Skip to content
Snippets Groups Projects
  1. Oct 14, 2015
    • Peter Rotich's avatar
      User Tickets · f4d79b1e
      Peter Rotich authored
      Include collaborated tickets
      Pagenate user and org tickets listing
      Add ability to export tickets
      f4d79b1e
  2. Oct 09, 2015
    • Jared Hancock's avatar
      forms: Avoid dropping the CDATA table · fddd2d12
      Jared Hancock authored
      MySql 5.6 and MariaDB 10 will return affected_rows == 0 if updating a row to
      its current values. Therefore, if an object is "edited", but none of the
      CDATA is modified, then the CDATA table might be dropped and rebuilt.
      fddd2d12
  3. Oct 03, 2015
    • Jared Hancock's avatar
      files: Only allow files uploaded in this session · 20537408
      Jared Hancock authored
      This fixes a security issue where, by crafting a special POST request to the
      client open.php page, an (unauthenticated) user could get a URL link to
      access to any attachment already uploaded in the system by guessing or
      brute-forcing the file's ID number.
      
      This patch addresses the issue by registering the uploaded file's ID in the
      current user's session. When processing the list of file ID's attached to
      the FileUploadField, the files must already have been attached to the field
      or have been newly attached in the current session.
      
      Fixes #2615
      
      References:
      "Security issue - Download attachments submitted by others"
      https://github.com/osTicket/osTicket-1.8/issues/2615
      20537408
    • Peter Rotich's avatar
      locks: Exclude expired locks via constrain · 6e507d4c
      Peter Rotich authored
      Fixes a bug where a lock icon is shown on tickets listing even when the lock
      in question is expired.
      6e507d4c
  4. Sep 29, 2015
  5. Sep 28, 2015
  6. Sep 26, 2015
  7. Sep 25, 2015
  8. Sep 22, 2015
Loading