From cb6103319ec499d2365b27e3bd86a04be47677e1 Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Sun, 1 May 2016 22:18:35 -0400
Subject: [PATCH] Secure ticket endpoint, add new properties to JSON

---
 api/admin/ticket/index.php             | 16 +++++----
 api/businesslogic/ticket_retriever.php | 46 ++++++++++++++++++--------
 api/dao/ticket_dao.php                 | 20 +++++++++--
 3 files changed, 59 insertions(+), 23 deletions(-)

diff --git a/api/admin/ticket/index.php b/api/admin/ticket/index.php
index f347af43..0875e908 100644
--- a/api/admin/ticket/index.php
+++ b/api/admin/ticket/index.php
@@ -32,7 +32,7 @@ $request_method = $_SERVER['REQUEST_METHOD'];
  * @apiSuccess {Integer} priority The ID of the priority the ticket is in
  * @apiSuccess {String} subject The subject of the ticket
  * @apiSuccess {String} message The original message of the ticket
- * @apiSuccess {String} dateCreated The date and time the ticket was submitted, in `YYYY-MM-DD hh:mm:ss`
+ * @apiSuccess {Date} dateCreated The date and time the ticket was submitted
  * @apiSuccess {Integer} articles The knowledgebase article IDs suggested when the user created the ticket
  * @apiSuccess {String} ip The IP address of the submitter
  * @apiSuccess {String} language The language the ticket was submitted in
@@ -41,7 +41,6 @@ $request_method = $_SERVER['REQUEST_METHOD'];
  * @apiSuccess {String} timeWorked The total time worked on the ticket, in `hh:mm:ss`
  * @apiSuccess {Boolean} archive `true` if the ticket is tagged<br>`false` otherwise
  * @apiSuccess {Boolean} locked `true` if the ticket is locked<br>`false` otherwise
- * @apiSuccess {Binary[]} attachments Array of attachments, in base-64 encoded binary
  * @apiSuccess {Integer[]} merged Array of merged ticket IDs
  * @apiSuccess {String} legacyAuditTrail HTML markup of the entire "Audit Trail" section
  * @apiSuccess {String} custom1-20 Custom fields 1-20's values.
@@ -52,6 +51,8 @@ $request_method = $_SERVER['REQUEST_METHOD'];
  * @apiSuccess {String} userAgent The user agent of the user who submitted the ticket
  * @apiSuccess {Integer} screenResolutionWidth The width of the screen resolution of the user who submitted the ticket
  * @apiSuccess {Integer} screenResolutionHeight The height of the screen resolution of the user who submitted the ticket
+ * @apiSuccess {Date} dueDate The ticket's due date, if there is one
+ * @apiSuccess {Boolean} overdueEmailSent Set to `true` if an overdue email has been sent.<br>`false` otherwise
  *
  * @apiSuccessExample {json} Success-Response:
  *     HTTP/1.1 200 OK
@@ -102,7 +103,9 @@ $request_method = $_SERVER['REQUEST_METHOD'];
  *           "html": false,
  *           "userAgent": null,
  *           "screenResolutionWidth": null,
- *           "screenResolutionHeight": null
+ *           "screenResolutionHeight": null,
+ *           "dueDate": "2016-01-01 00:00:00",
+ *           "overdueEmailSent": "true"
  *      }
  *
  * @apiError (noTokenProvided) 400 No `X-Auth-Token` was provided where it is required
@@ -110,17 +113,18 @@ $request_method = $_SERVER['REQUEST_METHOD'];
  */
 if ($request_method == 'GET') {
     $token = get_header('X-Auth-Token');
+    $user = NULL;
 
     try {
-        get_user_for_token($token, $hesk_settings);
+        $user = get_user_for_token($token, $hesk_settings);
     } catch (AccessException $e) {
         return http_response_code($e->getCode());
     }
 
     if (isset($_GET['id'])) {
-        $results = get_ticket_for_staff($hesk_settings, $_GET['id']);
+        $results = get_ticket_for_staff($hesk_settings, $user, $_GET['id']);
     } else {
-        $results = get_ticket_for_staff($hesk_settings);
+        $results = get_ticket_for_staff($hesk_settings, $user);
     }
 
     if ($results == NULL) {
diff --git a/api/businesslogic/ticket_retriever.php b/api/businesslogic/ticket_retriever.php
index b5165292..1f91da1e 100644
--- a/api/businesslogic/ticket_retriever.php
+++ b/api/businesslogic/ticket_retriever.php
@@ -1,8 +1,12 @@
 <?php
 require_once(API_PATH . 'dao/ticket_dao.php');
 
-function get_ticket_for_staff($hesk_settings, $id = NULL) {
-    $tickets = get_ticket_for_id($hesk_settings, $id);
+function get_ticket_for_staff($hesk_settings, $user, $id = NULL) {
+    $tickets = get_ticket_for_id($hesk_settings, $user, $id);
+
+    if ($tickets == NULL) {
+        return NULL;
+    }
 
     if ($id === NULL) {
         $original_tickets = $tickets;
@@ -10,10 +14,12 @@ function get_ticket_for_staff($hesk_settings, $id = NULL) {
         foreach ($original_tickets as $ticket) {
             $ticket = remove_common_properties($ticket);
             $ticket = convert_to_camel_case($ticket);
+            $ticket = handle_dates($ticket);
             $tickets[] = $ticket;
         }
     } else {
         $tickets = remove_common_properties($tickets);
+        $tickets = handle_dates($tickets);
         $tickets = convert_to_camel_case($tickets);
     }
 
@@ -36,27 +42,37 @@ function remove_common_properties($ticket) {
     return $ticket;
 }
 
+function handle_dates($ticket) {
+    $ticket['dt'] = hesk_date($ticket['dt'], true);
+
+    return $ticket;
+}
+
 function convert_to_camel_case($ticket) {
     if (isset($ticket['articles'])) {
         $ticket['suggestedArticles'] = $ticket['articles'];
         unset($ticket['articles']);
-        $ticket['legacyAuditTrail'] = $ticket['history'];
-        unset($ticket['history']);
-        $ticket['linkedTo'] = $ticket['parent'];
-        unset($ticket['parent']);
-        $ticket['timeWorked'] = $ticket['time_worked'];
-        unset($ticket['time_worked']);
-        $ticket['userAgent'] = $ticket['user_agent'];
-        unset($ticket['user_agent']);
-        $ticket['screenResolutionWidth'] = $ticket['screen_resolution_width'];
-        unset($ticket['screen_resolution_width']);
-        $ticket['screenResolutionHeight'] = $ticket['screen_resolution_height'];
-        unset($ticket['screen_resolution_height']);
     }
+    $ticket['legacyAuditTrail'] = $ticket['history'];
+    unset($ticket['history']);
+    $ticket['linkedTo'] = $ticket['parent'];
+    unset($ticket['parent']);
+    $ticket['timeWorked'] = $ticket['time_worked'];
+    unset($ticket['time_worked']);
+    $ticket['userAgent'] = $ticket['user_agent'];
+    unset($ticket['user_agent']);
+    $ticket['screenResolutionWidth'] = $ticket['screen_resolution_width'];
+    unset($ticket['screen_resolution_width']);
+    $ticket['screenResolutionHeight'] = $ticket['screen_resolution_height'];
+    unset($ticket['screen_resolution_height']);
     $ticket['trackingId'] = $ticket['trackid'];
     unset($ticket['trackid']);
     $ticket['dateCreated'] = $ticket['dt'];
     unset($ticket['dt']);
+    $ticket['dueDate'] = $ticket['due_date'];
+    unset($ticket['due_date']);
+    $ticket['overdueEmailSent'] = $ticket['overdue_email_sent'];
+
 
     return $ticket;
 }
@@ -83,6 +99,8 @@ function remove_staff_specific_properties($ticket) {
     unset($ticket['screen_resolution_width']);
     unset($ticket['screen_resolution_height']);
     unset($ticket['parent']);
+    unset($ticket['due_date']);
+    unset($ticket['overdue_email_sent']);
 
     return $ticket;
 }
\ No newline at end of file
diff --git a/api/dao/ticket_dao.php b/api/dao/ticket_dao.php
index 4047d2bf..fbf10fc3 100644
--- a/api/dao/ticket_dao.php
+++ b/api/dao/ticket_dao.php
@@ -1,9 +1,22 @@
 <?php
 
-function get_ticket_for_id($hesk_settings, $id = NULL) {
-    $sql = "SELECT * FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` ";
+function get_ticket_for_id($hesk_settings, $user, $id = NULL) {
+    $sql = "SELECT `tickets`.* FROM `" . hesk_dbEscape($hesk_settings['db_pfix']) . "tickets` AS `tickets` ";
+    $sql .= "INNER JOIN `" . hesk_dbEscape($hesk_settings['db_pfix']) . "users` AS `users` ON `users`.`id` = " . intval($user['id']) . " ";
+    $used_where_clause = false;
     if ($id != NULL) {
-        $sql .= "WHERE `id` = ".intval($id);
+        $used_where_clause = true;
+        $sql .= "WHERE `tickets`.`id` = " . intval($id);
+    }
+
+    if (!$user['isadmin']) {
+        $clause = $used_where_clause ? ' AND ' : ' WHERE ';
+        $used_where_clause = true;
+
+        $sql .= $clause . ' `category` IN (' . $user['categories'] . ')';
+        $sql .= " AND ((`heskprivileges` LIKE '%can_view_tickets%' AND `owner` = " . intval($user['id']) . ")";
+        $sql .= " OR (`heskprivileges` LIKE '%can_view_unassigned%' AND `owner` = 0)";
+        $sql .= " OR (`heskprivileges` LIKE '%can_view_ass_others%' AND `owner` <> " . intval($user['id']) . "))";
     }
 
     $response = hesk_dbQuery($sql);
@@ -32,6 +45,7 @@ function build_results($response) {
         $row['screen_resolution_width'] = convert_to_int($row['screen_resolution_width']);
         $row['owner'] = convert_to_int($row['owner']);
         $row['parent'] = convert_to_int($row['parent']);
+        $row['overdue_email_sent'] = $row['overdue_email_sent'] == true;
 
 
         $results[] = $row;