From a8f8310c63328140ad7dfaaa2a4c2c91aaa9fd1f Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Wed, 10 Aug 2016 23:31:55 -0400
Subject: [PATCH] Update common

---
 inc/common.inc.php | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/inc/common.inc.php b/inc/common.inc.php
index c8758e0e..2d84e024 100644
--- a/inc/common.inc.php
+++ b/inc/common.inc.php
@@ -1,7 +1,7 @@
 <?php
 /*******************************************************************************
  *  Title: Help Desk Software HESK
- *  Version: 2.6.7 from 18th April 2016
+ *  Version: 2.6.8 from 10th August 2016
  *  Author: Klemen Stirn
  *  Website: http://www.hesk.com
  ********************************************************************************
@@ -38,6 +38,7 @@ if (!defined('IN_SCRIPT')) {
 // Set correct Content-Type header
 if (!defined('NO_HTTP_HEADER')) {
     header('Content-Type: text/html; charset=utf-8');
+	header('X-Frame-Options: SAMEORIGIN');
 }
 
 // Set backslash options
@@ -461,17 +462,23 @@ function hesk_autoAssignTicket($ticket_category)
 } // END hesk_autoAssignTicket()
 
 
-function hesk_cleanID($field = 'track')
+function hesk_cleanID($field = 'track', $in=false)
 {
-    if ( isset($_SESSION[$field]) ) {
-        return substr(preg_replace('/[^A-Z0-9\-]/', '', strtoupper($_SESSION[$field])), 0, 12);
+	$id = '';
+	
+	if ($in !== false){
+		$id = $in;
+	} elseif (isset($_SESSION[$field])) {
+		$id = $_SESSION[$field];
     } elseif ( isset($_GET[$field]) && ! is_array($_GET[$field]) ) {
-        return substr(preg_replace('/[^A-Z0-9\-]/', '', strtoupper($_GET[$field])), 0, 12);
+        $id = $_GET[$field];
     } elseif (isset($_POST[$field]) && !is_array($_POST[$field])) {
-        return substr(preg_replace('/[^A-Z0-9\-]/', '', strtoupper($_POST[$field])), 0, 12);
+		$id = $_POST[$field];
     } else {
         return false;
     }
+	
+	return substr(preg_replace('/[^A-Z0-9\-]/', '', strtoupper($id)), 0, 12);
 
 } // END hesk_cleanID()