From 1338bb0167a4d0e0a84d58a1565b605228d57517 Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Sun, 20 Dec 2015 22:19:25 -0500
Subject: [PATCH] More work on attachments

---
 inc/attachments.inc.php                   | 16 ++++++++++++----
 inc/view_attachment_functions.inc.php     |  2 +-
 internal-api/ticket/upload-attachment.php | 16 ++++++++++++++++
 language/en/text.php                      |  2 +-
 4 files changed, 30 insertions(+), 6 deletions(-)
 create mode 100644 internal-api/ticket/upload-attachment.php

diff --git a/inc/attachments.inc.php b/inc/attachments.inc.php
index 001ec25b..4e3e68db 100644
--- a/inc/attachments.inc.php
+++ b/inc/attachments.inc.php
@@ -36,7 +36,7 @@ if (!defined('IN_SCRIPT')) {
 /***************************
  * Function hesk_uploadFiles()
  ***************************/
-function hesk_uploadFile($i, $isTicket = true)
+function hesk_uploadFile($i, $isTicket = true, $ajax = false)
 {
     global $hesk_settings, $hesklang, $trackingID, $hesk_error_buffer, $modsForHesk_settings;
 
@@ -68,10 +68,15 @@ function hesk_uploadFile($i, $isTicket = true)
         $tmp .= $useChars{mt_rand(0, 29)};
     }
 
-    if (defined('KB')) {
-        $file_name = substr(md5($tmp . $file_realname), 0, 200) . $ext;
+    if ($ajax) {
+        // Temporary attachments are, well, temporary. We can just use the real name since they'll be deleted afterwards.
+        $file_name = $file_realname;
     } else {
-        $file_name = substr($trackingID . '_' . md5($tmp . $file_realname), 0, 200) . $ext;
+        if (defined('KB')) {
+            $file_name = substr(md5($tmp . $file_realname), 0, 200) . $ext;
+        } else {
+            $file_name = substr($trackingID . '_' . md5($tmp . $file_realname), 0, 200) . $ext;
+        }
     }
 
     // Does the temporary file exist? If not, probably server-side configuration limits have been reached
@@ -88,6 +93,9 @@ function hesk_uploadFile($i, $isTicket = true)
     if (!$isTicket) {
         $directory = $modsForHesk_settings['kb_attach_dir'];
     }
+    if ($ajax) {
+        $directory = $modsForHesk_settings[''];
+    }
     if (!move_uploaded_file($_FILES['attachment']['tmp_name'][$i], dirname(dirname(__FILE__)) . '/' . $directory . '/' . $file_name)) {
         return hesk_fileError($hesklang['cannot_move_tmp']);
     }
diff --git a/inc/view_attachment_functions.inc.php b/inc/view_attachment_functions.inc.php
index 7bd1b0e8..59747845 100644
--- a/inc/view_attachment_functions.inc.php
+++ b/inc/view_attachment_functions.inc.php
@@ -211,7 +211,7 @@ function display_dropzone_field($url) {
     <script type=\"text/javascript\">
     Dropzone.options.filedrop = {
         paramName: 'file',
-        url: '".$url."',
+        url: ".json_encode($url).",
         parallelUploads: 1,
         uploadMultiple: false,
         maxFiles: 1,
diff --git a/internal-api/ticket/upload-attachment.php b/internal-api/ticket/upload-attachment.php
new file mode 100644
index 00000000..d817cce2
--- /dev/null
+++ b/internal-api/ticket/upload-attachment.php
@@ -0,0 +1,16 @@
+<?php
+define('IN_SCRIPT', 1);
+define('HESK_PATH', '../../');
+define('INTERNAL_API_PATH', '../../');
+require_once(HESK_PATH . 'hesk_settings.inc.php');
+require_once(HESK_PATH . 'inc/common.inc.php');
+require_once(INTERNAL_API_PATH . 'core/output.php');
+
+hesk_load_internal_api_database_functions();
+hesk_dbConnect();
+
+if (!empty($_FILES)) {
+
+}
+
+return http_response_code(400);
\ No newline at end of file
diff --git a/language/en/text.php b/language/en/text.php
index b2dfd5a5..b629b4be 100644
--- a/language/en/text.php
+++ b/language/en/text.php
@@ -32,7 +32,7 @@ $hesklang['warning_title_case'] = 'Warning';
 $hesklang['logs'] = 'Logs';
 $hesklang['view_message_log'] = 'View Message Log';
 $hesklang['can_view_logs'] = 'Can view message logs';
-$hesklang['attachment_viewer_message'] = 'Drag or click here to select your file for submission.';
+$hesklang['attachment_viewer_message'] = 'Drag or click here to select files to upload.';
 $hesklang['attachment_invalid_type_message'] = 'Sorry, but the file type you tried to upload is not allowed.';
 $hesklang['attachment_upload_error'] = 'An error occurred when trying to upload. Please try again later.';