Adjust bad SQL query that allowed contacts to see ticket subjects (bu…

…t not content) for other contacts
itflow-org · Apr 1, 2024 · bc8f79c · bc8f79c
1 parent 2f473c6
commit bc8f79c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/portal/ticket_view_all.php b/portal/ticket_view_all.php
@@ -13,8 +13,8 @@
 }
 
 // Ticket status from GET
-if (!isset($_GET['status'])) {
-    // If nothing is set, assume we only want to see open tickets
+if (!isset($_GET['status']) || ($_GET['status']) == 'Open') {
+    // Default to showing open
     $status = 'Open';
     $ticket_status_snippet = "ticket_closed_at IS NULL";
 } elseif (isset($_GET['status']) && ($_GET['status']) == 'Closed') {

diff --git a/portal/tickets.php b/portal/tickets.php
@@ -10,8 +10,8 @@
 
 
 // Ticket status from GET
-if (!isset($_GET['status'])) {
-    // If nothing is set, assume we only want to see open tickets
+if (!isset($_GET['status']) || ($_GET['status']) == 'Open') {
+    // Default to showing open
     $status = 'Open';
     $ticket_status_snippet = "ticket_closed_at IS NULL";
 } elseif (isset($_GET['status']) && ($_GET['status']) == 'Closed') {