diff --git a/admin/admin_reply_ticket.php b/admin/admin_reply_ticket.php index 29a0d5c8..75d15d92 100644 --- a/admin/admin_reply_ticket.php +++ b/admin/admin_reply_ticket.php @@ -189,9 +189,9 @@ if ($hesk_settings['attachments']['use'] && !empty($attachments)) { // Add reply $html = $modsForHesk_settings['rich_text_for_tickets']; if ($submit_as_customer) { - hesk_dbQuery("INSERT INTO `" . hesk_dbEscape($hesk_settings['db_pfix']) . "replies` (`replyto`,`name`,`message`,`dt`,`attachments`,`html`) VALUES ('" . intval($replyto) . "','" . hesk_dbEscape(addslashes($ticket['name'])) . "','" . hesk_dbEscape($message . "

{$hesklang['creb']} {$_SESSION['name']}") . "','" . hesk_dbEscape(hesk_date()) . "','" . hesk_dbEscape($myattachments) . "', '" . $html . "')"); + hesk_dbQuery("INSERT INTO `" . hesk_dbEscape($hesk_settings['db_pfix']) . "replies` (`replyto`,`name`,`message`,`dt`,`attachments`,`html`) VALUES ('" . intval($replyto) . "','" . hesk_dbEscape(addslashes($ticket['name'])) . "','" . hesk_dbEscape($message . "

{$hesklang['creb']} {$_SESSION['name']}") . "', NOW(),'" . hesk_dbEscape($myattachments) . "', '" . $html . "')"); } else { - hesk_dbQuery("INSERT INTO `" . hesk_dbEscape($hesk_settings['db_pfix']) . "replies` (`replyto`,`name`,`message`,`dt`,`attachments`,`staffid`,`html`) VALUES ('" . intval($replyto) . "','" . hesk_dbEscape(addslashes($_SESSION['name'])) . "','" . hesk_dbEscape($message) . "','" . hesk_dbEscape(hesk_date()) . "','" . hesk_dbEscape($myattachments) . "','" . intval($_SESSION['id']) . "', '" . $html . "')"); + hesk_dbQuery("INSERT INTO `" . hesk_dbEscape($hesk_settings['db_pfix']) . "replies` (`replyto`,`name`,`message`,`dt`,`attachments`,`staffid`,`html`) VALUES ('" . intval($replyto) . "','" . hesk_dbEscape(addslashes($_SESSION['name'])) . "','" . hesk_dbEscape($message) . "', NOW(),'" . hesk_dbEscape($myattachments) . "','" . intval($_SESSION['id']) . "', '" . $html . "')"); } /* Track ticket status changes for history */ @@ -294,6 +294,15 @@ $sql .= $submit_as_customer ? "`lastreplier`='0', `replierid`='0' " : "`lastrepl if ($time_worked == '00:00:00') { $sql .= ", `lastchange` = NOW() "; } else { + $parts = explode(':', $ticket['time_worked']); + $seconds = ($parts[0] * 3600) + ($parts[1] * 60) + $parts[2]; + + $parts = explode(':', $time_worked); + $seconds += ($parts[0] * 3600) + ($parts[1] * 60) + $parts[2]; + + require(HESK_PATH . 'inc/reporting_functions.inc.php'); + $ticket['time_worked'] = hesk_SecondsToHHMMSS($seconds); + $sql .= ",`time_worked` = ADDTIME(`time_worked`,'" . hesk_dbEscape($time_worked) . "') "; } @@ -363,7 +372,9 @@ $info = array( 'dt' => hesk_date($ticket['dt'], true), 'lastchange' => hesk_date($ticket['lastchange'], true), 'id' => $ticket['id'], - 'language' => $ticket['language'] + 'language' => $ticket['language'], + 'time_worked' => $ticket['time_worked'], + 'last_reply_by' => ($submit_as_customer ? $ticket['name'] : $_SESSION['name']), ); // 2. Add custom fields to the array diff --git a/admin/admin_settings_save.php b/admin/admin_settings_save.php index 7113cd6f..ee1d8181 100644 --- a/admin/admin_settings_save.php +++ b/admin/admin_settings_save.php @@ -62,6 +62,7 @@ $set['noreply_mail'] = hesk_validateEmail(hesk_POST('s_noreply_mail'), $hesklang $set['noreply_name'] = hesk_input(hesk_POST('s_noreply_name')); $set['noreply_name'] = str_replace(array('\\"', '<', '>'), '', $set['noreply_name']); $set['noreply_name'] = trim(preg_replace('/\s{2,}/', ' ', $set['noreply_name'])); +$set['noreply_name'] = preg_replace("/\n|\r|\t|%0A|%0D|%08|%09/", '', $set['noreply_name']); /* --> Language settings */ $set['can_sel_lang'] = empty($_POST['s_can_sel_lang']) ? 0 : 1; diff --git a/admin/admin_ticket.php b/admin/admin_ticket.php index d17ee27b..150b54e6 100644 --- a/admin/admin_ticket.php +++ b/admin/admin_ticket.php @@ -423,13 +423,14 @@ if (isset($_POST['notemsg']) && hesk_token_check('POST')) { 'trackid' => $ticket['trackid'], 'status' => $ticket['status'], 'name' => $_SESSION['name'], - 'lastreplier' => $ticket['lastreplier'], 'subject' => $ticket['subject'], 'message' => stripslashes($msg), 'dt' => hesk_date($ticket['dt'], true), 'lastchange' => hesk_date($ticket['lastchange'], true), 'attachments' => $myattachments, 'id' => $ticket['id'], + 'time_worked' => $ticket['time_worked'], + 'last_reply_by' => $ticket['repliername'], ); // 2. Add custom fields to the array @@ -1561,7 +1562,7 @@ function hesk_getAdminButtons($category_id) function hesk_getAdminButtonsInTicket($reply = 0, $white = 1) { - global $hesk_settings, $hesklang, $ticket, $reply, $trackingID, $can_edit, $can_archive, $can_delete, $isManager; + global $hesk_settings, $hesklang, $ticket, $trackingID, $can_edit, $can_archive, $can_delete, $isManager; $options = $reply ? '' : '
'; @@ -1828,7 +1829,7 @@ function hesk_printTicketReplies() } // Re-sort them so they're in order by date - usort($combined_records, function ($a, $b) { + usort($combined_records, function ($a, $b) use (&$hesk_settings) { $a_date = null; $b_date = null; if ($a['SORT_TYPE'] == 'REPLY') { @@ -1844,12 +1845,14 @@ function hesk_printTicketReplies() } if ($a_date === $b_date && $a['SORT_TYPE'] != $b['SORT_TYPE']) { - if ($a['SORT_TYPE'] != $b['SORT_TYPE']) { - return $a['SORT_TYPE'] == 'REPLY' ? -1 : 1; + if ($hesk_settings['new_top']) { + return $a['SORT_TYPE'] == 'REPLY' ? 1 : -1; } + + return $a['SORT_TYPE'] == 'REPLY' ? -1 : 1; } - return $a_date - $b_date; + return $hesk_settings['new_top'] ? $b_date - $a_date : $a_date - $b_date; }); @@ -1934,7 +1937,7 @@ function mfh_print_reply($reply) { ?>
- +
diff --git a/admin/assign_owner.php b/admin/assign_owner.php index e875b2a5..e103e8aa 100755 --- a/admin/assign_owner.php +++ b/admin/assign_owner.php @@ -129,13 +129,14 @@ $info = array( 'trackid' => $ticket['trackid'], 'status' => $ticket['status'], 'name' => $ticket['name'], - 'lastreplier' => $ticket['lastreplier'], 'subject' => $ticket['subject'], 'message' => $ticket['message'], 'attachments' => $ticket['attachments'], 'dt' => hesk_date($ticket['dt'], true), 'lastchange' => hesk_date($ticket['lastchange'], true), 'id' => $ticket['id'], + 'time_worked' => $ticket['time_worked'], + 'last_reply_by' => hesk_getReplierName($ticket), ); // 2. Add custom fields to the array diff --git a/admin/edit_post.php b/admin/edit_post.php index a0bc7c55..8e14c90a 100644 --- a/admin/edit_post.php +++ b/admin/edit_post.php @@ -368,7 +368,7 @@ require_once(HESK_PATH . 'inc/show_admin_nav.inc.php');
-
@@ -380,7 +380,7 @@ require_once(HESK_PATH . 'inc/show_admin_nav.inc.php');
- ) diff --git a/admin/find_tickets.php b/admin/find_tickets.php index c9bcd812..350bb27b 100644 --- a/admin/find_tickets.php +++ b/admin/find_tickets.php @@ -145,21 +145,21 @@ LEFT(`message`, 400) AS `message`, $sql .= " ( `trackid` = '" . hesk_dbEscape($q) . "' OR `merged` LIKE '%#" . hesk_dbEscape($q) . "#%' ) "; break; case 'name': - $sql .= "`name` LIKE '%" . hesk_dbEscape($q) . "%' COLLATE '" . hesk_dbCollate() . "' "; + $sql .= "`name` LIKE '%".hesk_dbEscape( hesk_dbLike($q) )."%' COLLATE '" . hesk_dbCollate() . "' "; break; case 'email': $sql .= "`email` LIKE '%" . hesk_dbEscape($q) . "%' "; break; case 'subject': - $sql .= "`subject` LIKE '%" . hesk_dbEscape($q) . "%' COLLATE '" . hesk_dbCollate() . "' "; + $sql .= "`subject` LIKE '%".hesk_dbEscape( hesk_dbLike($q) )."%' COLLATE '" . hesk_dbCollate() . "' "; break; case 'message': - $sql .= " ( `message` LIKE '%" . hesk_dbEscape($q) . "%' COLLATE '" . hesk_dbCollate() . "' + $sql .= " ( `message` LIKE '%".hesk_dbEscape( hesk_dbLike($q) )."%' COLLATE '" . hesk_dbCollate() . "' OR `id` IN ( SELECT DISTINCT `replyto` FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "replies` - WHERE `message` LIKE '%" . hesk_dbEscape($q) . "%' COLLATE '" . hesk_dbCollate() . "' ) + WHERE `message` LIKE '%".hesk_dbEscape( hesk_dbLike($q) )."%' COLLATE '" . hesk_dbCollate() . "' ) ) "; break; @@ -170,7 +170,7 @@ LEFT(`message`, 400) AS `message`, $sql .= "`id` IN ( SELECT DISTINCT `ticket` FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "notes` - WHERE `message` LIKE '%" . hesk_dbEscape($q) . "%' COLLATE '" . hesk_dbCollate() . "' ) + WHERE `message` LIKE '%".hesk_dbEscape( hesk_dbLike($q) )."%' COLLATE '" . hesk_dbCollate() . "' ) "; break; default: @@ -220,6 +220,9 @@ LEFT(`message`, 400) AS `message`, $sql_count .= $sql; $sql = $sql_final . $sql; + // Strip extra slashes + $q = stripslashes($q); + /* Prepare variables used in search and forms */ require_once(HESK_PATH . 'inc/prepare_ticket_search.inc.php'); ?> diff --git a/admin/index.php b/admin/index.php index ba7c4b00..aec1e374 100644 --- a/admin/index.php +++ b/admin/index.php @@ -158,7 +158,7 @@ function do_login() exit(); } - $pass_enc = hesk_Pass2Hash($_SESSION['pass'] . strtolower($user) . $_SESSION['pass']); + $pass_enc = hesk_Pass2Hash($_SESSION['pass'].hesk_mb_strtolower($user).$_SESSION['pass']); /* Check if default password */ if ($_SESSION['pass'] == '499d74967b28a841c98bb4baaabaad699ff3c079') { @@ -330,7 +330,7 @@ function print_login() -