From eff75b27b17b840ec7e74acac8bf43c4e370fc2b Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Thu, 9 Apr 2015 16:27:20 -0400
Subject: [PATCH] Fix a small bug with auto-close and only auto-close if staff
 is allowed to

---
 admin/index.php | 50 +++++++++++++++++++++++++------------------------
 1 file changed, 26 insertions(+), 24 deletions(-)

diff --git a/admin/index.php b/admin/index.php
index 0165d3ee..fefc2178 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -260,35 +260,37 @@ function do_login()
     	$revision = sprintf($hesklang['thist3'],hesk_date(),$hesklang['auto']);
         $dt  = date('Y-m-d H:i:s',time() - $hesk_settings['autoclose']*86400);
 
-        // Notify customer of closed ticket?
-        if ($hesk_settings['notify_closed'])
-        {
-            $closedStatusRs = hesk_dbQuery('SELECT `ID` FROM `'.hesk_dbEscape($hesk_settings['db_pfix']).'statuses` WHERE `IsDefaultStaffReplyStatus` = 1');
-            $closedStatus = hesk_dbFetchAssoc($closedStatusRs);
-            // Get list of tickets
-            $result = hesk_dbQuery("SELECT * FROM `".$hesk_settings['db_pfix']."tickets` WHERE `status` = ".$closedStatus['ID']." AND `lastchange` <= '".hesk_dbEscape($dt)."' ");
-            if (hesk_dbNumRows($result) > 0)
-            {
-                global $ticket;
 
-                // Load required functions?
-                if ( ! function_exists('hesk_notifyCustomer') )
-                {
-                    require(HESK_PATH . 'inc/email_functions.inc.php');
-                }
+        $closedStatusRs = hesk_dbQuery('SELECT `ID`, `Closable` FROM `'.hesk_dbEscape($hesk_settings['db_pfix']).'statuses` WHERE `IsDefaultStaffReplyStatus` = 1');
+        $closedStatus = hesk_dbFetchAssoc($closedStatusRs);
+        // Are we allowed to close tickets in this status?
+        if ($closedStatus['Closable'] == 'yes' || $closedStatus['Closable'] == 'sonly') {
+            // Notify customer of closed ticket?
+            if ($hesk_settings['notify_closed']) {
+                // Get list of tickets
+                $result = hesk_dbQuery("SELECT * FROM `" . $hesk_settings['db_pfix'] . "tickets` WHERE `status` = " . $closedStatus['ID'] . " AND `lastchange` <= '" . hesk_dbEscape($dt) . "' ");
+                if (hesk_dbNumRows($result) > 0) {
+                    global $ticket;
+
+                    // Load required functions?
+                    if (!function_exists('hesk_notifyCustomer')) {
+                        require(HESK_PATH . 'inc/email_functions.inc.php');
+                    }
 
-                while ($ticket = hesk_dbFetchAssoc($result))
-                {
-                    $ticket['dt'] = hesk_date($ticket['dt'], true);
-                    $ticket['lastchange'] = hesk_date($ticket['lastchange'], true);
-                    $ticket = hesk_ticketToPlain($ticket, 1, 0);
-                    hesk_notifyCustomer('ticket_closed');
+                    while ($ticket = hesk_dbFetchAssoc($result)) {
+                        $ticket['dt'] = hesk_date($ticket['dt'], true);
+                        $ticket['lastchange'] = hesk_date($ticket['lastchange'], true);
+                        $ticket = hesk_ticketToPlain($ticket, 1, 0);
+                        hesk_notifyCustomer('ticket_closed');
+                    }
                 }
             }
-        }
 
-        // Update ticket statuses and history in database
-        hesk_dbQuery("UPDATE `".$hesk_settings['db_pfix']."tickets` SET `status`='3', `closedat`=NOW(), `closedby`='-1', `history`=CONCAT(`history`,'".hesk_dbEscape($revision)."') WHERE `status` = '2' AND `lastchange` <= '".hesk_dbEscape($dt)."' ");
+            // Update ticket statuses and history in database if we're allowed to do so
+            $defaultCloseRs = hesk_dbQuery('SELECT `ID` FROM `'.hesk_dbEscape($hesk_settings['db_pfix']).'statuses` WHERE `IsStaffClosedOption` = 1');
+            $defaultCloseStatus = hesk_dbFetchAssoc($defaultCloseRs);
+            hesk_dbQuery("UPDATE `" . $hesk_settings['db_pfix'] . "tickets` SET `status`=".intval($defaultCloseStatus['ID']).", `closedat`=NOW(), `closedby`='-1', `history`=CONCAT(`history`,'" . hesk_dbEscape($revision) . "') WHERE `status` = '".$closedStatus['ID']."' AND `lastchange` <= '" . hesk_dbEscape($dt) . "' ");
+        }
     }
 
     /* Redirect to the destination page */