diff --git a/include/class.client.php b/include/class.client.php index 2af67879f6944db3526e4480c99e7eee06a2e08f..3e55929014452469378aece33cd35295dbaed194 100644 --- a/include/class.client.php +++ b/include/class.client.php @@ -149,6 +149,10 @@ abstract class TicketUser { return $this->_guest; } + function getUserId() { + return $this->user->getId(); + } + abstract function getTicketId(); abstract function getTicket(); } diff --git a/view.php b/view.php index 7e865d6a6bd3544ea3c3dbdd9f8aaafababf1839..2299043b0047d4007b3e535b898035b0935e8da5 100644 --- a/view.php +++ b/view.php @@ -16,14 +16,23 @@ **********************************************************************/ require_once('client.inc.php'); +$errors = array(); +// Check if the client is already signed in. Don't corrupt their session! +if ($_GET['auth'] + && $thisclient + && ($u = TicketUser::lookupByToken($_GET['auth'])) + && ($u->getUserId() == $thisclient->getId()) +) { + Http::redirect('tickets.php?id='.$u->getTicketId()); +} // Try autologin the user // Authenticated user can be of type ticket owner or collaborator -$errors = array(); -if (isset($_GET['auth']) || isset($_GET['t'])) +elseif (isset($_GET['auth']) || isset($_GET['t'])) { // TODO: Consider receiving an AccessDenied object $user = UserAuthenticationBackend::processSignOn($errors, false); +} -if ($user && $user->getTicketId()) +if (@$user && is_object($user) && $user->getTicketId()) Http::redirect('tickets.php?id='.$user->getTicketId()); $nav = new UserNav();