Skip to content

Commit 0c7d1e9

Browse files
EywekEywek
committed
Version 0.4.1 - Fix CSRF & JSON
1 parent f10d6f2 commit 0c7d1e9

11 files changed

Lines changed: 466 additions & 445 deletions

File tree

‎Config/routes.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
<?php
2-
Router::connect('/support', array('controller' => 'home', 'action' => 'index', 'plugin' => 'support'));
2+
Router::connect('/support', array('controller' => 'ticket', 'action' => 'index', 'plugin' => 'support'));

‎Controller/HomeController.php‎

Lines changed: 0 additions & 124 deletions
This file was deleted.

‎Controller/TicketController.php‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
<?php
2+
class TicketController extends AppController {
3+
4+
public function index() {
5+
$this->set('title_for_layout',"Support");
6+
7+
$this->layout = $this->Configuration->getKey('layout');
8+
9+
$this->loadModel('Support.Ticket');
10+
$tickets = $this->Ticket->find('all', array('order' => array('id' => 'desc')));
11+
12+
$this->loadModel('Support.ReplyTicket');
13+
$reply_tickets = $this->ReplyTicket->find('all');
14+
15+
$nbr_tickets = $this->Ticket->find('count');
16+
$nbr_tickets_resolved = $this->Ticket->find('count', array('conditions' => array('state' => 1)));
17+
$nbr_tickets_unresolved = $this->Ticket->find('count', array('conditions' => array('state' => 0)));
18+
19+
$this->set(compact('tickets', 'reply_tickets', 'nbr_tickets', 'nbr_tickets_resolved', 'nbr_tickets_unresolved'));
20+
}
21+
22+
public function ajax_delete() {
23+
$this->autoRender = false;
24+
if($this->request->is('ajax')) {
25+
26+
$this->loadModel('Support.Ticket');
27+
28+
$pseudo = $this->Ticket->find('first', array('conditions' => array('id' => $this->request->data['id'])));
29+
$pseudo = $pseudo['Ticket']['author'];
30+
31+
if($this->isConnected AND $this->User->isAdmin() OR $this->isConnected AND $this->User->getKey('pseudo') == $pseudo AND $this->Permissions->can('DELETE_HIS_TICKET') OR $this->Permissions->can('DELETE_ALL_TICKETS')) {
32+
$this->loadModel('Support.Ticket');
33+
34+
$this->Ticket->delete($this->request->data['id']);
35+
36+
$this->loadModel('Support.ReplyTicket');
37+
$this->ReplyTicket->deleteAll(array('ticket_id' => $this->request->data['id']));
38+
39+
echo 'true';
40+
41+
} else {
42+
throw new ForbiddenException();
43+
}
44+
} else {
45+
throw new NotFoundException();
46+
}
47+
}
48+
49+
public function ajax_reply_delete() {
50+
if($this->request->is('ajax')) {
51+
$this->autoRender = false;
52+
53+
if($this->isConnected AND $this->User->isAdmin()) {
54+
55+
$this->loadModel('Support.ReplyTicket');
56+
$this->ReplyTicket->delete($this->request->data['id']);
57+
58+
echo 'true';
59+
60+
} else {
61+
throw new ForbiddenException();
62+
}
63+
} else {
64+
throw new NotFoundException();
65+
}
66+
}
67+
68+
public function ajax_resolved() {
69+
if($this->request->is('ajax')) {
70+
$this->autoRender = false;
71+
72+
$this->loadModel('Support.Ticket');
73+
$pseudo = $this->Ticket->find('first', array('conditions' => array('id' => $this->request->data['id'])));
74+
$pseudo = $pseudo['Ticket']['author'];
75+
76+
if($this->isConnected AND $this->User->isAdmin() OR $this->isConnected AND $this->User->getKey('pseudo') == $pseudo AND $this->Permissions->can('RESOLVE_HIS_TICKET') OR $this->Permissions->can('RESOLVE_ALL_TICKETS')) {
77+
78+
$this->Ticket->read(null, $this->request->data['id']);
79+
$this->Ticket->set(array('state' => 1));
80+
$this->Ticket->save();
81+
82+
echo 'true';
83+
84+
} else {
85+
throw new ForbiddenException();
86+
}
87+
88+
} else {
89+
throw new NotFoundException();
90+
}
91+
}
92+
93+
public function ajax_reply() {
94+
if($this->request->is('ajax')) {
95+
$this->autoRender = false;
96+
97+
if(!empty($this->request->data['reply']) && !empty($this->request->data['id'])) {
98+
99+
$this->loadModel('Support.Ticket');
100+
$pseudo = $this->Ticket->find('first', array('conditions' => array('id' => $this->request->data['id'])));
101+
$pseudo = $pseudo['Ticket']['author'];
102+
103+
if($this->isConnected AND $this->User->isAdmin() OR $this->isConnected AND $this->User->getKey('pseudo') == $pseudo AND $this->Permissions->can('REPLY_TO_HIS_TICKETS') OR $this->Permissions->can('REPLY_TO_ALL_TICKETS')) {
104+
105+
$this->loadModel('Support.ReplyTicket');
106+
$this->ReplyTicket->create();
107+
$this->ReplyTicket->set(array('ticket_id' => $this->request->data['id'], 'reply' => $this->request->data['reply'], 'author' => $this->User->getKey('pseudo')));
108+
$this->ReplyTicket->save();
109+
110+
echo json_encode(array('statut' => true, 'msg' => ''));
111+
112+
} else {
113+
throw new ForbiddenException();
114+
}
115+
} else {
116+
echo json_encode(array('statut' => false, 'msg' => $this->Lang->get('ERROR__FILL_ALL_FIELDS')));
117+
}
118+
} else {
119+
throw new NotFoundException();
120+
}
121+
}
122+
123+
public function ajax_post() {
124+
if($this->request->is('ajax')) {
125+
$this->autoRender = false;
126+
127+
if(!empty($this->request->data['title']) AND !empty($this->request->data['content'])) {
128+
129+
if($this->isConnected AND $this->Permissions->can('POST_TICKET')) {
130+
131+
$data = array();
132+
133+
$data['author'] = $this->User->getKey('pseudo');
134+
$data['private'] = $this->request->data['private'];
135+
$data['title'] = before_display($this->request->data['title']);
136+
$data['content'] = before_display($this->request->data['content']);
137+
138+
$this->loadModel('Support.Ticket');
139+
$this->Ticket->create();
140+
$this->Ticket->set($data);
141+
$this->Ticket->save();
142+
143+
echo json_encode(array('statut' => true, 'msg' => '', 'id' => $this->Ticket->getLastInsertId()));
144+
145+
} else {
146+
throw new ForbiddenException();
147+
}
148+
} else {
149+
echo json_encode(array('statut' => false, 'msg' => $this->Lang->get('ERROR__FILL_ALL_FIELDS')));
150+
}
151+
} else {
152+
throw new NotFoundException();
153+
}
154+
}
155+
}

‎View/Home/ajax_delete.ctp‎

Whitespace-only changes.

‎View/Home/ajax_post.ctp‎

Whitespace-only changes.

‎View/Home/ajax_reply.ctp‎

Whitespace-only changes.

‎View/Home/ajax_reply_delete.ctp‎

Whitespace-only changes.

‎View/Home/ajax_resolved.ctp‎

Whitespace-only changes.

0 commit comments

Comments
 (0)