This adds a command-line module named `serve` which adds a module to run the
command-line built-in PHP server with a router file that will properly
handle the expected URL dispatchers for the pages/, api/, and apps/ magic
URLs.

Usage:

$ php manage.php serve --help

Add canned attachments to allowed files list when a canned response is used.

Add a global option to disable avatars on thread correspondence . Agent's
and user's profiles will still show an avatars.

Add a preference option to set the sort order of the thread entries in DESC or
ASC order.

 * System Default order is ASC
 * Auto-scroll is disabled when sort order is set to DESC.

Add preference to agent's profile to enable relative time use.

Support using global config table to store agent's preference.

Move setting from Setting > Tickets to Settings > Agents

Enable the ability to show the agent's full name or department's name on
responses/replies in addition to the emails address name. Email address of
the response would still be designated outgoing email address of the
Department to which the ticket is assigned or the system default outgoing
email address.

* Agents can set the default FROM Name in Profile > Preference.
* Private department's name won't be used regardless of the setting.
* Agent's name won't be used if identity masking is enabled.

Let textarea widgets parse and clean input based on configured text format.
Add cleanup routine to ThreadEntryBody
Clean response/note inputs

Filter assignees based on selected tickets department setting.

Make sure the references are valid for the email recipient.

Filter members based on department's assignment restriction when building a
list of assignees.

Implement auto focus and scroll when post reply or note action button is
clicked as well as tab highlight on error
Unpack tickets' mass action buttons - more options retired for now
Translate missed phases

Removed the span, it was unnecessary and gave the Internal Note button
a color to differentiate between Reply and Internal Note.

Moved buttons above with other action buttons and also into sticky
header. Removed titles of buttons and added tooltips. adjusted tooltip
z-index so it won’t be hidden behind dropdowns. added scroll to bottom
function to reply and internal note buttons.

Adds an additional location for the ticket response above the ticket
thread for a reverse order view of the ticket thread. Additionally the
reply/internal note button would be selected and the page would auto
scroll to the bottom.

ClaimForm extends AssignmentForm and hides assignees selection. Claimant is
still given the opportunity to log an optional internal note as to why
they're claiming the ticket in question.

Let the object have full control the list of possible assignees

Action to disable auto-autoresponse doesn't require  any config check.

Count by staff membership

Fix a bug where tickets assigned to ANY team and unassigned to an agent
showed up on My Tickets count.

Fix forms mixup bug that nulled users' name for existing users on CSV import. GUI update worked
as expected only because of the magic $_POST variable.

This is necessary to differentiate true system notes vs. notes made by a
deleted agent or collaborator.

getObject should be used instead.

Copy and paste hazard!

Consolidate and protect where ticket sources are defined
Only show IP address when if the ticket source is web. Otherwise, phone ticket created
by agents will have an IP of the agent showing.

Fulltext search is not ideal for user lookup. This pull request
makes the fulltext based search optional and disabled by default.

Add space when indexing user's custom data and emails.

Due to MySQL FULLTEXT min-word-lenn requirements (which various from
installation to installation), fulltext-based searches require at least two
characters.

Include collaborated tickets
Pagenate user and org tickets listing
Add ability to export tickets

If a new message alert bounced to a staff member and the postmaster sent
back a bounce notice, which was threaded, then the agent might receive
another new message alert, which would continue a bounce loop.

MySql 5.6 and MariaDB 10 will return affected_rows == 0 if updating a row to
its current values. Therefore, if an object is "edited", but none of the
CDATA is modified, then the CDATA table might be dropped and rebuilt.

Hi guys,

had this issue in my mind from before my vacation. Someone over in the forum had the issue that even though he checked "Assigned Agent / Team" the team never got notified. After some research and a closer look I guess Neil found out that he needed to check "Team Lead" and/or "Team members" to enable alerts for the team as well.

So in this case the wording "Assigned Agent / Team" is a bit misleading and I suggest to change it to just "Assigned Agent" or whatever  you prefer ;)

Just made this pull request, so that you don't need to search long and it's (hopefully) easier to understand which "Assigned Agent / Team" is meant since it's there several times at the alert settings page.

Cheers,
Michael

PS: Also I don't know why the first line appears as "removed" and "added" ... didn't change anything here, but anyway, line 126 is the important one ;)

This fixes a security issue where, by crafting a special POST request to the
client open.php page, an (unauthenticated) user could get a URL link to
access to any attachment already uploaded in the system by guessing or
brute-forcing the file's ID number.

This patch addresses the issue by registering the uploaded file's ID in the
current user's session. When processing the list of file ID's attached to
the FileUploadField, the files must already have been attached to the field
or have been newly attached in the current session.

Fixes #2615

References:
"Security issue - Download attachments submitted by others"
https://github.com/osTicket/osTicket-1.8/issues/2615