Add Release Notes for v1.18.4

Reviewed-By: JediKev <kevin@enhancesoft.com>

.gitignore

@@ -7,6 +7,8 @@ setup/cli/modules/importer
 .vagrant
 ._.DS_Store
 Vagrantfile
+# VS Code workspace files
+*.code-workspace
 
 # Staging directory used for packaging script
 stage

ISSUE_TEMPLATE.md

@@ -2,7 +2,7 @@
 
 * [ ] Can you reproduce the problem in a fresh installation of the "develop" branch?
 * [ ] Do you have any errors in the PHP error log, or javascript console?
-* [ ] Did you check the [osTicket forums](http://osticket.com/forum/categories)?
+* [ ] Did you check the [osTicket forums](https://forum.osticket.com/)?
 * [ ] Did you [perform a cursory search](https://github.com/osTicket/osTicket/issues) to see if your bug or enhancement is already reported?
 
 For more information on how to write a good [bug report](https://github.com/osTicket/osTicket/wiki/Github-Issues-Guidelines)
@@ -23,6 +23,6 @@ For more information on how to write a good [bug report](https://github.com/osTi
 
 ### Versions
 
-Admin panel -> Dashboard -> Information which also additionally gives you information about you server.
+Admin panel -> Dashboard -> Information which also additionally gives you information about your server.
 
 Also, please include the OS and what version of the OS you're running. As well as your browser and browser version.

README.md

@@ -1,6 +1,6 @@
 osTicket
 ========
-<a href="http://osticket.com"><img src="http://osticket.com/sites/default/files/osTicket.jpg"
+<a href="https://osticket.com"><img height="80px" width="80px" src="images/favicon.png"
 align="left" hspace="10" vspace="6"></a>
 
 **osTicket** is a widely-used open source support ticket system. It seamlessly
@@ -22,13 +22,14 @@ easy to setup and use. The best part is, it's completely free.
 Requirements
 ------------
   * HTTP server running Microsoft® IIS or Apache
-  * PHP version 5.4 or greater, 5.6 is recommended
+  * PHP version 8.2 - 8.4 (8.4 recommended)
   * mysqli extension for PHP
-  * MySQL database version 5.0 or greater
+  * MySQL database version 5.5 (or greater)
 
 ### Recommendations
-  * gd, gettext, imap, json, mbstring, and xml extensions for PHP
-  * APC module enabled and configured for PHP
+  * ctype, fileinfo, gd, gettext, iconv, imap, intl, json, mbstring,
+    Zend OPcache, phar, xml, xml-dom, and zip extensions for PHP
+  * APCu module enabled and configured for PHP
 
 Deployment
 ----------
@@ -58,40 +59,16 @@ Upgrading
 ---------
 osTicket supports upgrading from 1.6-rc1 and later versions. As with any
 upgrade, strongly consider a backup of your attachment files, database, and
-osTicket codebase before embarking on an upgrade.
-
-To trigger the update process, fetch the osTicket tarball from either
-the osTicket [github](http://github.com/osTicket/osTicket/releases) page
-or from the [osTicket website](http://osticket.com). Extract the tarball
-into the folder of your osTicket codebase. This can also be accomplished
-with the zip file, and a FTP client can of course be used to upload the new
-source code to your server.
-
-Any way you choose your adventure, when you have your codebase upgraded to
-osTicket-1.7, visit the /scp page of you ticketing system. The upgrader will
-be presented and will walk you through the rest of the process. (The couple
-clicks needed to go through the process are pretty boring to describe).
-
-### Upgrading from v1.6
-**WARNING**: If you are upgrading from osTicket 1.6, please ensure that all
-    your files in your upload folder are both readable and writable to your
-    http server software. Unreadable files will not be migrated to the
-    database during the upgrade and will be effectively lost.
-
-After upgrading, we recommend migrating your attachments to the database or
-to the new filesystem plugin. Use the `file` command-line applet to perform
-the migration.
-
-    php manage.php file migrate --backend=6 --to=D
-
-View the UPGRADING.txt file for other todo items to complete your upgrade.
+osTicket codebase before embarking on an upgrade. Please review our [Upgrade
+Guide](https://docs.osticket.com/en/latest/Getting%20Started/Upgrade%20and%20Migration.html)
+or the [UPGRADING.txt file](UPGRADING.txt) for upgrade instructions.
 
 Help
 ----
-Visit the [wiki](http://osticket.com/wiki/Home) or the
-[forum](http://osticket.com/forums/). And if you'd like professional help
+Visit the [Documentation](https://docs.osticket.com/) or the
+[forum](https://forum.osticket.com/). And if you'd like professional help
 managing your osTicket installation,
-[commercial support](http://osticket.com/support/) is available.
+[commercial support](https://osticket.com/support/) is available.
 
 Contributing
 ------------
@@ -101,18 +78,17 @@ the feature is published in your fork, send a pull request to begin the
 conversation of integrating your new feature into osTicket.
 
 ### Localization
-[![Crowdin](https://d322cqt584bo4o.cloudfront.net/osticket-official/localized.png)](http://i18n.osticket.com/project/osticket-official)
+[![Crowdin](https://badges.crowdin.net/osticket-official/localized.svg)](https://crowdin.com/project/osticket-official)
 
 The interface for osTicket is now completely translatable. Language packs
-are available on the [download page](http://osticket.com/download). If you
-do not see your language there, join the [Crowdin](http://i18n.osticket.com)
+are available on the [download page](https://osticket.com/download). If you
+do not see your language there, join the [Crowdin](https://crowdin.com/project/osticket-official)
 project and request to have your language added. Languages which reach 100%
 translated are are significantly reviewed will be made available on the
 osTicket download page.
 
-The software can also be translated in place in our [JIPT site]
-(http://jipt.i18n.osticket.com). Once you have a Crowdin account, login and
-translate the software in your browser!
+The software can also be translated in place in our [JIPT site](http://jipt.i18n.osticket.com).
+Once you have a Crowdin account, login and translate the software in your browser!
 
 Localizing strings in new code requires usage of a [few rules](setup/doc/i18n.md).
 
@@ -123,18 +99,19 @@ file for the gory details of the General Public License.
 
 osTicket is supported by several magical open source projects including:
 
-  * [Font-Awesome](http://fortawesome.github.com/Font-Awesome/)
-  * [HTMLawed](http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed)
-  * [jQuery dropdown](http://labs.abeautifulsite.net/jquery-dropdown/)
-  * [jsTimezoneDetect](http://pellepim.bitbucket.org/jstz/)
-  * [mPDF](http://www.mpdf1.com/)
-  * [PasswordHash](http://www.openwall.com/phpass/)
-  * [PEAR](http://pear.php.net/package/PEAR)
-  * [PEAR/Auth_SASL](http://pear.php.net/package/Auth_SASL)
-  * [PEAR/Mail](http://pear.php.net/package/mail)
-  * [PEAR/Net_SMTP](http://pear.php.net/package/Net_SMTP)
-  * [PEAR/Net_Socket](http://pear.php.net/package/Net_Socket)
-  * [PEAR/Serivces_JSON](http://pear.php.net/package/Services_JSON)
+  * [Font-Awesome](https://fontawesome.com/)
+  * [HTMLawed](https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed)
+  * [jQuery dropdown](https://labs.abeautifulsite.net/jquery-dropdown/) (Project Deleted)
+  * [jsTimezoneDetect](https://pellepim.bitbucket.org/jstz/)
+  * [laminas-mail](https://github.com/laminas/laminas-mail)
+  * [mPDF](https://github.com/mpdf/mpdf)
+  * [PasswordHash](https://www.openwall.com/phpass/)
+  * [PEAR](https://pear.php.net/package/PEAR)
+  * [PEAR/Auth_SASL](https://pear.php.net/package/Auth_SASL)
+  * [PEAR/Mail](https://pear.php.net/package/mail)
+  * [PEAR/Net_SMTP](https://pear.php.net/package/Net_SMTP)
+  * [PEAR/Net_Socket](https://pear.php.net/package/Net_Socket)
+  * [PEAR/Serivces_JSON](https://pear.php.net/package/Services_JSON)
   * [php-gettext](https://launchpad.net/php-gettext/)
-  * [phpseclib](http://phpseclib.sourceforge.net/)
-  * [Spyc](http://github.com/mustangostang/spyc)
+  * [phpseclib](https://phpseclib.sourceforge.net/)
+  * [Spyc](https://github.com/mustangostang/spyc)

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please send all POCs to security[at]osticket[dot]com.

UPGRADING.txt

@@ -1,5 +1,33 @@
-Welcome to osTicket 1.7
-=======================
+Upgrading osTicket
+==================
+osTicket supports upgrading from 1.6-rc1 and later versions. As with any
+upgrade, strongly consider a backup of your attachment files, database, and
+osTicket codebase before embarking on an upgrade.
+
+To trigger the update process, fetch the osTicket tarball from either
+the osTicket [GitHub](https://github.com/osTicket/osTicket/releases) page
+or from the [osTicket website](https://osticket.com/download). Extract the tarball
+into the folder of your osTicket codebase. This can also be accomplished
+with the zip file, and a FTP client can of course be used to upload the new
+source code to your server.
+
+Any way you choose your adventure, when you have your codebase upgraded,
+visit the /scp page of you ticketing system. The upgrader will
+be presented and will walk you through the rest of the process. (The couple
+clicks needed to go through the process are pretty boring to describe).
+
+### Upgrading from v1.6
+**WARNING**: If you are upgrading from osTicket 1.6, please ensure that all
+    your files in your upload folder are both readable and writable to your
+    http server software. Unreadable files will not be migrated to the
+    database during the upgrade and will be effectively lost.
+
+After upgrading, we recommend migrating your attachments to the database or
+to the new filesystem plugin. Use the `file` command-line applet to perform
+the migration.
+
+    php manage.php file migrate --backend=6 --to=D
+
 Some tasks are better left to a system administrator rather than a mindless
 upgrade script. These are those remaining things that we'd rather you take
 care of:

account.php

@@ -34,7 +34,7 @@ elseif ($thisclient) {
                 $user_form = $f;
                 $user_form->getField('email')->configure('disabled', true);
             }
-        }    
+        }
     }
     // Existing client (with an account) updating profile
     else {
@@ -57,15 +57,25 @@ elseif ($_POST) {
     if ($thisclient) {
         $user_form->getField('email')->configure('disabled', true);
         $user_form->getField('email')->value = $thisclient->getEmail();
+        $_POST['email'] = $thisclient->getEmail();
     }
 
-    if (!$user_form->isValid(function($f) { return !$f->isVisibleToUsers(); }))
+    if (!$user_form->isValid(function($f) { return $f->isVisibleToUsers(); }))
         $errors['err'] = __('Incomplete client information');
     elseif (!$_POST['backend'] && !$_POST['passwd1'])
         $errors['passwd1'] = __('New password is required');
     elseif (!$_POST['backend'] && $_POST['passwd2'] != $_POST['passwd1'])
         $errors['passwd1'] = __('Passwords do not match');
+    else {
+        try {
+            UserAccount::checkPassword($_POST['passwd1']);
+        } catch (BadPassword $ex) {
+             $errors['passwd1'] = $ex->getMessage();
+        }
+    }
 
+    if ($errors)
+        $errors['err'] = $errors['err'] ?: __('Unable to register account. See messages below');
     // XXX: The email will always be in use already if a guest is logged in
     // and is registering for an account. Instead,
     elseif (($addr = $user_form->getField('email')->getClean())
@@ -115,6 +125,8 @@ elseif ($_POST) {
             }
             break;
         }
+        // Rotate CSRF on successful POST
+        $ost->getCSRF()->rotate();
     }
 
     if ($errors && $user && $user != $thisclient)
@@ -124,4 +136,3 @@ elseif ($_POST) {
 include(CLIENTINC_DIR.'header.inc.php');
 include(CLIENTINC_DIR.$inc);
 include(CLIENTINC_DIR.'footer.inc.php');
-

ajax.php

@@ -40,12 +40,13 @@ $dispatcher = patterns('',
     url('^/form/', patterns('ajax.forms.php:DynamicFormsAjaxAPI',
         url_get('^help-topic/(?P<id>\d+)$', 'getClientFormsForHelpTopic'),
         url_post('^upload/(\d+)?$', 'upload'),
-        url_post('^upload/(\w+)?$', 'attach')
+        url_post('^upload/(\w+)?$', 'attach'),
+        url_post('^upload/(?P<object>ticket|task)/(\w+)$', 'attach')
     )),
     url('^/i18n/(?P<lang>[\w_]+)/', patterns('ajax.i18n.php:i18nAjaxAPI',
         url_get('(?P<tag>\w+)$', 'getLanguageFile')
     ))
 );
 Signal::send('ajax.client', $dispatcher);
-print $dispatcher->resolve($ost->get_path_info());
+print $dispatcher->resolve(Osticket::get_path_info());
 ?>

api/api.inc.php

@@ -15,10 +15,19 @@
 **********************************************************************/
 file_exists('../main.inc.php') or die('System Error');
 
-// Disable sessions for the API. API should be considered stateless and
-// shouldn't chew up database records to store sessions
-if (!defined('DISABLE_SESSION'))
-    define('DISABLE_SESSION', true);
+/*
+ * Why API_SESSION ??
+ * It indicates that the session is API - which session handler should handle as
+ * stateless for new sessions.
+ * Existing session continue to work as expected - this it's important for
+ * SSO authentication, which uses /api/auth/* endpoints. Such calls are not
+ * stateless.
+ *
+ */
+define('API_SESSION', true);
+
+// APICALL const.
+define('APICALL', true);
 
 require_once('../main.inc.php');
 require_once(INCLUDE_DIR.'class.http.php');

api/http.php

@@ -13,15 +13,9 @@
 
     vim: expandtab sw=4 ts=4 sts=4:
 **********************************************************************/
-// Use sessions — it's important for SSO authentication, which uses
-// /api/auth/ext
-define('DISABLE_SESSION', false);
-
 require 'api.inc.php';
-
 # Include the main api urls
 require_once INCLUDE_DIR."class.dispatcher.php";
-
 $dispatcher = patterns('',
         url_post("^/tickets\.(?P<format>xml|json|email)$", array('api.tickets.php:TicketApiController','create')),
         url('^/tasks/', patterns('',
@@ -29,8 +23,8 @@ $dispatcher = patterns('',
          ))
         );
 
+// Send api signal so backend can register endpoints
 Signal::send('api', $dispatcher);
-
 # Call the respective function
-print $dispatcher->resolve($ost->get_path_info());
+print $dispatcher->resolve(Osticket::get_path_info());
 ?>

api/pipe.php

@@ -18,10 +18,10 @@ ini_set('memory_limit', '256M'); //The concern here is having enough mem for ema
 @chdir(dirname(__FILE__).'/'); //Change dir.
 require('api.inc.php');
 
-//Only local piping supported via pipe.php
+// Only local piping supported via pipe.php
 if (!osTicket::is_cli())
     die(__('pipe.php only supports local piping - use http -> api/tickets.email'));
 
 require_once(INCLUDE_DIR.'api.tickets.php');
-PipeApiController::process();
+PipeApiController::process('cli');
 ?>

apps/dispatcher.php

@@ -28,4 +28,4 @@ require_once INCLUDE_DIR.'/class.dispatcher.php';
 $dispatcher = new Dispatcher();
 
 Signal::send('ajax.client', $dispatcher);
-print $dispatcher->resolve($ost->get_path_info());
+print $dispatcher->resolve(Osticket::get_path_info());

avatar.php

@@ -23,7 +23,7 @@ require_once INCLUDE_DIR . 'class.avatar.php';
 
 try {
     $ra = new RandomAvatar($_GET['mode']);
-    $avatar = $ra->makeAvatar($_GET['uid']);
+    $avatar = $ra->makeAvatar($_GET['uid'], $_GET['size']);
 
     Http::response(200, false, 'image/png', false);
     Http::cacheable($_GET['uid'], false, 86400);

bootstrap.php

@@ -21,9 +21,7 @@ class Bootstrap {
         session_cache_limiter('nocache');
 
         #Error reporting...Good idea to ENABLE error reporting to a file. i.e display_errors should be set to false
-        $error_reporting = E_ALL & ~E_NOTICE;
-        if (defined('E_STRICT')) # 5.4.0
-            $error_reporting &= ~E_STRICT;
+        $error_reporting = E_ALL & ~E_NOTICE & ~E_WARNING;
         if (defined('E_DEPRECATED')) # 5.3.0
             $error_reporting &= ~(E_DEPRECATED | E_USER_DEPRECATED);
         error_reporting($error_reporting); //Respect whatever is set in php.ini (sysadmin knows better??)
@@ -45,11 +43,29 @@ class Bootstrap {
         }
         date_default_timezone_set('UTC');
 
+        if (!function_exists('exif_imagetype')) {
+            function exif_imagetype ($filename) {
+                if ((list($width,$height,$type,) = getimagesize($filename)) !== false)
+                    return $type;
+
+                return false;
+            }
+        }
+
+        if (!function_exists('exif_imagetype')) {
+            function exif_imagetype ($filename) {
+                if ((list($width,$height,$type,) = getimagesize($filename)) !== false)
+                    return $type;
+
+                return false;
+            }
+        }
+
         if (!isset($_SERVER['REMOTE_ADDR']))
             $_SERVER['REMOTE_ADDR'] = '';
     }
 
-    function https() {
+    static function https() {
        return osTicket::is_https();
     }
 
@@ -92,6 +108,7 @@ class Bootstrap {
         define('THREAD_TABLE', $prefix.'thread');
         define('THREAD_ENTRY_TABLE', $prefix.'thread_entry');
         define('THREAD_ENTRY_EMAIL_TABLE', $prefix.'thread_entry_email');
+        define('THREAD_ENTRY_MERGE_TABLE', $prefix.'thread_entry_merge');
 
         define('LOCK_TABLE',$prefix.'lock');
 
@@ -124,6 +141,7 @@ class Bootstrap {
         define('SLA_TABLE', $prefix.'sla');
 
         define('EMAIL_TABLE',$prefix.'email');
+        define('EMAIL_ACCOUNT_TABLE', $prefix.'email_account');
         define('EMAIL_TEMPLATE_GRP_TABLE',$prefix.'email_template_group');
         define('EMAIL_TEMPLATE_TABLE',$prefix.'email_template');
 
@@ -132,6 +150,7 @@ class Bootstrap {
         define('FILTER_ACTION_TABLE', $prefix.'filter_action');
 
         define('PLUGIN_TABLE', $prefix.'plugin');
+        define('PLUGIN_INSTANCE_TABLE', $prefix.'plugin_instance');
         define('SEQUENCE_TABLE', $prefix.'sequence');
         define('TRANSLATION_TABLE', $prefix.'translation');
         define('QUEUE_TABLE', $prefix.'queue');
@@ -142,11 +161,14 @@ class Bootstrap {
         define('QUEUE_EXPORT_TABLE', $prefix.'queue_export');
         define('QUEUE_CONFIG_TABLE', $prefix.'queue_config');
 
+        define('SCHEDULE_TABLE', $prefix.'schedule');
+        define('SCHEDULE_ENTRY_TABLE', $prefix.'schedule_entry');
+
         define('API_KEY_TABLE',$prefix.'api_key');
         define('TIMEZONE_TABLE',$prefix.'timezone');
     }
 
-    function loadConfig() {
+    static function loadConfig() {
         #load config info
         $configfile='';
         if(file_exists(INCLUDE_DIR.'ost-config.php')) //NEW config file v 1.6 stable ++
@@ -176,7 +198,7 @@ class Bootstrap {
         define('SESSION_TTL', 86400); // Default 24 hours
     }
 
-    function connect() {
+    static function connect() {
         #Connect to the DB && get configuration from database
         $ferror=null;
         $options = array();
@@ -187,19 +209,29 @@ class Bootstrap {
                 'key' => DBSSLKEY
             );
 
-        if (!db_connect(DBHOST, DBUSER, DBPASS, $options)) {
-            $ferror=sprintf('Unable to connect to the database — %s',db_connect_error());
-        }elseif(!db_select_database(DBNAME)) {
-            $ferror=sprintf('Unknown or invalid database: %s',DBNAME);
+        $hosts = explode(',', DBHOST);
+        foreach ($hosts as $host) {
+            $ferror  = null;
+            try {
+                if (!db_connect($host, DBUSER, DBPASS, $options))
+                    $ferror = sprintf('Unable to connect to the database — %s', db_connect_error());
+                elseif (!db_select_database(DBNAME))
+                    $ferror = sprintf('Unknown or invalid database: %s', DBNAME);
+            } catch (mysqli_sql_exception $e) {
+                $ferror = sprintf('Database error — %s', $e->getMessage());
+            }
+            // break if no error
+            if (!$ferror) break;
         }
 
-        if($ferror) //Fatal error
+        if ($ferror) //Fatal error
             self::croak($ferror);
     }
 
-    function loadCode() {
+    static function loadCode() {
         #include required files
         require_once INCLUDE_DIR.'class.util.php';
+        include_once INCLUDE_DIR.'class.controller.php';
         require_once INCLUDE_DIR.'class.translation.php';
         require_once(INCLUDE_DIR.'class.signal.php');
         require(INCLUDE_DIR.'class.model.php');
@@ -210,14 +242,13 @@ class Bootstrap {
         require(INCLUDE_DIR.'class.crypto.php');
         require(INCLUDE_DIR.'class.page.php');
         require_once(INCLUDE_DIR.'class.format.php'); //format helpers
-        require_once(INCLUDE_DIR.'class.validator.php'); //Class to help with basic form input validation...please help improve it.
-        require(INCLUDE_DIR.'class.mailer.php');
+        require_once(INCLUDE_DIR.'class.validator.php');
         require_once INCLUDE_DIR.'mysqli.php';
         require_once INCLUDE_DIR.'class.i18n.php';
         require_once INCLUDE_DIR.'class.queue.php';
     }
 
-    function i18n_prep() {
+    static function i18n_prep() {
         ini_set('default_charset', 'utf-8');
         ini_set('output_encoding', 'utf-8');
 
@@ -295,15 +326,21 @@ class Bootstrap {
         if (extension_loaded('iconv'))
             iconv_set_encoding('internal_encoding', 'UTF-8');
 
+        if (intval(phpversion()) < 7) {
+            function random_int($a, $b) {
+                return rand($a, $b);
+            }
+        }
+
         function mb_str_wc($str) {
             return count(preg_split('~[^\p{L}\p{N}\'].+~u', trim($str)));
         }
     }
 
-    function croak($message) {
+    static function croak($message) {
         $msg = $message."\n\n".THISPAGE;
-        Mailer::sendmail(ADMIN_EMAIL, 'osTicket Fatal Error', $msg,
-            sprintf('"osTicket Alerts"<%s>', ADMIN_EMAIL));
+        osTicket\Mail\Mailer::sendmail(ADMIN_EMAIL, 'osTicket Fatal Error', $msg,
+            sprintf('"osTicket Alerts" <%s>', ADMIN_EMAIL));
         //Display generic error to the user
         Http::response(500, "<b>Fatal Error:</b> Contact system administrator.");
     }
@@ -329,9 +366,9 @@ define('CLI_DIR', INCLUDE_DIR.'cli/');
 /*############## Do NOT monkey with anything else beyond this point UNLESS you really know what you are doing ##############*/
 
 #Current version && schema signature (Changes from version to version)
-define('THIS_VERSION','1.8-git'); //Shown on admin panel
 define('GIT_VERSION','$git');
-define('MAJOR_VERSION', '1.10');
+define('MAJOR_VERSION', '1.18');
+define('THIS_VERSION', MAJOR_VERSION.'-git'); //Shown on admin panel
 //Path separator
 if(!defined('PATH_SEPARATOR')){
     if(strpos($_ENV['OS'],'Win')!==false || !strcasecmp(substr(PHP_OS, 0, 3),'WIN'))
@@ -356,7 +393,7 @@ if (!defined('ROOT_PATH') && ($rp = osTicket::get_root_path(dirname(__file__))))
 Bootstrap::init();
 
 #CURRENT EXECUTING SCRIPT.
-define('THISPAGE', Misc::currentURL());
+define('THISPAGE', Http::url());
 
 define('DEFAULT_MAX_FILE_UPLOADS', ini_get('max_file_uploads') ?: 5);
 define('DEFAULT_PRIORITY_ID', 1);

client.inc.php

@@ -22,6 +22,10 @@ require_once($thisdir.'main.inc.php');
 
 if(!defined('INCLUDE_DIR')) die('Fatal error');
 
+// Enforce ACL (if applicable)
+if (!Validator::check_acl('client'))
+    die(__('Access Denied'));
+
 /*Some more include defines specific to client only */
 define('CLIENTINC_DIR',INCLUDE_DIR.'client/');
 define('OSTCLIENTINC',TRUE);
@@ -63,8 +67,9 @@ if($thisclient && $thisclient->getId() && $thisclient->isValid()){
 }
 
 /******* CSRF Protectin *************/
-// Enforce CSRF protection for POSTS
-if ($_POST  && !$ost->checkCSRFToken()) {
+// Enforce CSRF protection for state-changing methods
+if (in_array($_SERVER['REQUEST_METHOD'], ['POST', 'PUT', 'PATCH', 'DELETE'])
+        && !$ost->checkCSRFToken()) {
     Http::redirect('index.php');
     //just incase redirect fails
     die('Action denied (400)!');
@@ -75,6 +80,8 @@ $ost->addExtraHeader('<meta name="csrf_token" content="'.$ost->getCSRFToken().'"
 
 /* Client specific defaults */
 define('PAGE_LIMIT', DEFAULT_PAGE_LIMIT);
+define('SESSION_MAXLIFE', $thisclient ? $thisclient->getMaxIdleTime() :
+        SESSION_TTL);
 
 require(INCLUDE_DIR.'class.nav.php');
 $nav = new UserNav($thisclient, 'home');

css/filedrop.css

@@ -69,9 +69,9 @@
   padding-left: 10px;
   float: right;
 }
-.redactor-box + .filedrop .dropzone,
-.redactor-box + div > .filedrop .dropzone,
-.redactor-box + div > .filedrop .files {
+.-redactor-container + .filedrop .dropzone,
+.-redactor-container .filedrop .dropzone,
+.-redactor-container .filedrop .files {
     border-top-width: 1px;
     border-top-left-radius: 0;
     border-top-right-radius: 0;

css/flags.css

@@ -30,10 +30,10 @@
 .flag.flag-bi {background-position: -112px -11px}
 .flag.flag-bj {background-position: -128px -11px}
 .flag.flag-bm {background-position: -144px -11px}
-.flag.flag-bn {background-position: -160px -11px}
+.flag.flag-bn {background-position: -32px -11px}
 .flag.flag-bo {background-position: -176px -11px}
 .flag.flag-br {background-position: -192px -11px}
-.flag.flag-bs {background-position: -208px -11px}
+.flag.flag-bs {background-position: 0px -11px}
 .flag.flag-bt {background-position: -224px -11px}
 .flag.flag-bv {background-position: -240px -11px}
 .flag.flag-bw {background-position: 0 -22px}
@@ -122,8 +122,9 @@
 .flag.flag-kg {background-position: -48px -77px}
 .flag.flag-kh {background-position: -64px -77px}
 .flag.flag-ki {background-position: -80px -77px}
-.flag.flag-km {background-position: -96px -77px}
+.flag.flag-km {background-position: -64px -77px}
 .flag.flag-kn {background-position: -112px -77px}
+.flag.flag-ko {background-position: -144px -77px}
 .flag.flag-kp {background-position: -128px -77px}
 .flag.flag-kr {background-position: -144px -77px}
 .flag.flag-kurdistan {background-position: -160px -77px}
@@ -186,7 +187,7 @@
 .flag.flag-pm {background-position: -48px -121px}
 .flag.flag-pn {background-position: -64px -121px}
 .flag.flag-pr {background-position: -80px -121px}
-.flag.flag-ps {background-position: -96px -121px}
+.flag.flag-ps {background-position: -48px 0px}
 .flag.flag-pt {background-position: -112px -121px}
 .flag.flag-pw {background-position: -128px -121px}
 .flag.flag-py {background-position: -144px -121px}
@@ -211,6 +212,7 @@
 .flag.flag-sn {background-position: -192px -132px}
 .flag.flag-so {background-position: -208px -132px}
 .flag.flag-somaliland {background-position: -224px -132px}
+.flag.flag-sq {background-position: -96px 0px}
 .flag.flag-sr {background-position: -240px -132px}
 .flag.flag-ss {background-position: 0 -143px}
 .flag.flag-st {background-position: -16px -143px}
@@ -244,7 +246,7 @@
 .flag.flag-vc {background-position: -208px -154px}
 .flag.flag-ve {background-position: -224px -154px}
 .flag.flag-vg {background-position: -240px -154px}
-.flag.flag-vi {background-position: 0 -165px}
+.flag.flag-vi {background-position: -16px -165px}
 .flag.flag-vn {background-position: -16px -165px}
 .flag.flag-vu {background-position: -32px -165px}
 .flag.flag-wales {background-position: -48px -165px}
@@ -256,3 +258,5 @@
 .flag.flag-zanzibar {background-position: -144px -165px}
 .flag.flag-zm {background-position: -160px -165px}
 .flag.flag-zw {background-position: -176px -165px}
+.flag.flag-fil {background-position: 0px -121px}
+.flag.flag-kk {background-position: -208px -77px}

css/jquery-ui-timepicker-addon.css

@@ -0,0 +1,30 @@
+.ui-timepicker-div .ui-widget-header { margin-bottom: 8px; }
+.ui-timepicker-div dl { text-align: left; }
+.ui-timepicker-div dl dt { float: left; clear:left; padding: 0 0 0 5px; }
+.ui-timepicker-div dl dd { margin: 0 10px 10px 40%; }
+.ui-timepicker-div td { font-size: 90%; }
+.ui-tpicker-grid-label { background: none; border: none; margin: 0; padding: 0; }
+.ui-timepicker-div .ui_tpicker_unit_hide{ display: none; }
+
+.ui-timepicker-div .ui_tpicker_time .ui_tpicker_time_input { background: none; color: inherit; border: none; outline: none; border-bottom: solid 1px #555; width: 95%; }
+.ui-timepicker-div .ui_tpicker_time .ui_tpicker_time_input:focus { border-bottom-color: #aaa; }
+
+.ui-timepicker-rtl{ direction: rtl; }
+.ui-timepicker-rtl dl { text-align: right; padding: 0 5px 0 0; }
+.ui-timepicker-rtl dl dt{ float: right; clear: right; }
+.ui-timepicker-rtl dl dd { margin: 0 40% 10px 10px; }
+
+/* Shortened version style */
+.ui-timepicker-div.ui-timepicker-oneLine { padding-right: 2px; }
+.ui-timepicker-div.ui-timepicker-oneLine .ui_tpicker_time, 
+.ui-timepicker-div.ui-timepicker-oneLine dt { display: none; }
+.ui-timepicker-div.ui-timepicker-oneLine .ui_tpicker_time_label { display: block; padding-top: 2px; }
+.ui-timepicker-div.ui-timepicker-oneLine dl { text-align: right; }
+.ui-timepicker-div.ui-timepicker-oneLine dl dd, 
+.ui-timepicker-div.ui-timepicker-oneLine dl dd > div { display:inline-block; margin:0; }
+.ui-timepicker-div.ui-timepicker-oneLine dl dd.ui_tpicker_minute:before,
+.ui-timepicker-div.ui-timepicker-oneLine dl dd.ui_tpicker_second:before { content:':'; display:inline-block; }
+.ui-timepicker-div.ui-timepicker-oneLine dl dd.ui_tpicker_millisec:before,
+.ui-timepicker-div.ui-timepicker-oneLine dl dd.ui_tpicker_microsec:before { content:'.'; display:inline-block; }
+.ui-timepicker-div.ui-timepicker-oneLine .ui_tpicker_unit_hide,
+.ui-timepicker-div.ui-timepicker-oneLine .ui_tpicker_unit_hide:before{ display: none; }

css/osticket.css

@@ -85,3 +85,9 @@ input.dp {
 .delete-draft:hover {
     background-color: #fc9f41 !important;
 }
+
+.notice_bar { margin: 0; padding: 5px 10px 5px 36px; height: 16px; line-height: 16px; border: 1px solid #0a0; background: url('../assets/default/images/icons/ok.png') 10px 50% no-repeat #e0ffe0; }
+
+.warning_bar { margin: 0; padding: 5px 10px 5px 36px; height: 16px; line-height: 16px; border: 1px solid #f26522; background: url('../assets/default/images/icons/alert.png') 10px 50% no-repeat #ffffdd; }
+
+.error_bar { margin: 0; padding: 5px 10px 5px 36px; height: 16px; line-height: 16px; border: 1px solid #a00; background: url('../assets/default/images/icons/error.png') 10px 50% no-repeat #fff0f0; }

css/thread.css

@@ -22,6 +22,8 @@
 .thread-body section,
 .thread-body summary {
   display: block;
+  margin: 0;
+  margin-bottom: 1em;
 }
 .thread-body {
   font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;

file.php

@@ -45,9 +45,8 @@ if ($cfg->isAuthRequiredForFiles()
         ) {
 
     // Try and determine if an agent is viewing the page / file
-    if (strpos($_SERVER['HTTP_REFERRER'], ROOT_PATH .  'scp/') !== false) {
-        $_SESSION['_staff']['auth']['dest'] =
-            '/' . ltrim($_SERVER['REQUEST_URI'], '/');
+    if (strpos($_SERVER['HTTP_REFERER'], ROOT_PATH .  'scp/') !== false) {
+        $_SESSION['_staff']['auth']['dest'] = Http::refresh_url();
         Http::redirect(ROOT_PATH.'scp/login.php');
     } else {
         require 'secure.inc.php';
@@ -59,7 +58,7 @@ if ($cfg->isAuthRequiredForFiles()
 // and the user has access to the parent ticket!!
 if ($file->verifySignature($_GET['signature'], $_GET['expires'])) {
     try {
-        if (($s = @$_GET['s']) && strpos($file->getType(), 'image/') === 0)
+        if (($s = @$_GET['s']) && $file->isInlineSafeImage())
             return $file->display($s);
 
         // Download the file..
@@ -68,7 +67,8 @@ if ($file->verifySignature($_GET['signature'], $_GET['expires'])) {
         $file->download($filename, $disposition, @$_GET['expires']);
     }
     catch (Exception $ex) {
-        Http::response(500, 'Unable to find that file: '.$ex->getMessage());
+        $ost->logError(__('File download error'), $ex->getMessage());
+        Http::response(500, __('Unable to retrieve the requested file'));
     }
 }
 // else

include/JSON.php

@@ -152,7 +152,7 @@ class Services_JSON
             return mb_convert_encoding($utf16, 'UTF-8', 'UTF-16');
         }
 
-        $bytes = (ord($utf16{0}) << 8) | ord($utf16{1});
+        $bytes = (ord($utf16[0]) << 8) | ord($utf16[1]);
 
         switch(true) {
             case ((0x7F & $bytes) == $bytes):
@@ -205,17 +205,17 @@ class Services_JSON
             case 2:
                 // return a UTF-16 character from a 2-byte UTF-8 char
                 // see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-                return chr(0x07 & (ord($utf8{0}) >> 2))
-                     . chr((0xC0 & (ord($utf8{0}) << 6))
-                         | (0x3F & ord($utf8{1})));
+                return chr(0x07 & (ord($utf8[0]) >> 2))
+                     . chr((0xC0 & (ord($utf8[0]) << 6))
+                         | (0x3F & ord($utf8[1])));
 
             case 3:
                 // return a UTF-16 character from a 3-byte UTF-8 char
                 // see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-                return chr((0xF0 & (ord($utf8{0}) << 4))
-                         | (0x0F & (ord($utf8{1}) >> 2)))
-                     . chr((0xC0 & (ord($utf8{1}) << 6))
-                         | (0x7F & ord($utf8{2})));
+                return chr((0xF0 & (ord($utf8[0]) << 4))
+                         | (0x0F & (ord($utf8[1]) >> 2)))
+                     . chr((0xC0 & (ord($utf8[1]) << 6))
+                         | (0x7F & ord($utf8[2])));
         }
 
         // ignoring UTF-32 for now, sorry
@@ -260,7 +260,7 @@ class Services_JSON
                 */
                 for ($c = 0; $c < $strlen_var; ++$c) {
 
-                    $ord_var_c = ord($var{$c});
+                    $ord_var_c = ord($var[$c]);
 
                     switch (true) {
                         case $ord_var_c == 0x08:
@@ -283,18 +283,18 @@ class Services_JSON
                         case $ord_var_c == 0x2F:
                         case $ord_var_c == 0x5C:
                             // double quote, slash, slosh
-                            $ascii .= '\\'.$var{$c};
+                            $ascii .= '\\'.$var[$c];
                             break;
 
                         case (($ord_var_c >= 0x20) && ($ord_var_c <= 0x7F)):
                             // characters U-00000000 - U-0000007F (same as ASCII)
-                            $ascii .= $var{$c};
+                            $ascii .= $var[$c];
                             break;
 
                         case (($ord_var_c & 0xE0) == 0xC0):
                             // characters U-00000080 - U-000007FF, mask 110XXXXX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-                            $char = pack('C*', $ord_var_c, ord($var{$c + 1}));
+                            $char = pack('C*', $ord_var_c, ord($var[$c + 1]));
                             $c += 1;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -304,8 +304,8 @@ class Services_JSON
                             // characters U-00000800 - U-0000FFFF, mask 1110XXXX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]));
                             $c += 2;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -315,9 +315,9 @@ class Services_JSON
                             // characters U-00010000 - U-001FFFFF, mask 11110XXX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}),
-                                         ord($var{$c + 3}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]),
+                                         ord($var[$c + 3]));
                             $c += 3;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -327,10 +327,10 @@ class Services_JSON
                             // characters U-00200000 - U-03FFFFFF, mask 111110XX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}),
-                                         ord($var{$c + 3}),
-                                         ord($var{$c + 4}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]),
+                                         ord($var[$c + 3]),
+                                         ord($var[$c + 4]));
                             $c += 4;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -340,11 +340,11 @@ class Services_JSON
                             // characters U-04000000 - U-7FFFFFFF, mask 1111110X
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}),
-                                         ord($var{$c + 3}),
-                                         ord($var{$c + 4}),
-                                         ord($var{$c + 5}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]),
+                                         ord($var[$c + 3]),
+                                         ord($var[$c + 4]),
+                                         ord($var[$c + 5]));
                             $c += 5;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -519,7 +519,7 @@ class Services_JSON
                     for ($c = 0; $c < $strlen_chrs; ++$c) {
 
                         $substr_chrs_c_2 = substr($chrs, $c, 2);
-                        $ord_chrs_c = ord($chrs{$c});
+                        $ord_chrs_c = ord($chrs[$c]);
 
                         switch (true) {
                             case $substr_chrs_c_2 == '\b':
@@ -549,7 +549,7 @@ class Services_JSON
                             case $substr_chrs_c_2 == '\\/':
                                 if (($delim == '"' && $substr_chrs_c_2 != '\\\'') ||
                                    ($delim == "'" && $substr_chrs_c_2 != '\\"')) {
-                                    $utf8 .= $chrs{++$c};
+                                    $utf8 .= $chrs[++$c];
                                 }
                                 break;
 
@@ -562,7 +562,7 @@ class Services_JSON
                                 break;
 
                             case ($ord_chrs_c >= 0x20) && ($ord_chrs_c <= 0x7F):
-                                $utf8 .= $chrs{$c};
+                                $utf8 .= $chrs[$c];
                                 break;
 
                             case ($ord_chrs_c & 0xE0) == 0xC0:
@@ -609,7 +609,7 @@ class Services_JSON
                 } elseif (preg_match('/^\[.*\]$/s', $str) || preg_match('/^\{.*\}$/s', $str)) {
                     // array, or object notation
 
-                    if ($str{0} == '[') {
+                    if ($str[0] == '[') {
                         $stk = array(SERVICES_JSON_IN_ARR);
                         $arr = array();
                     } else {
@@ -648,12 +648,12 @@ class Services_JSON
                         $top = end($stk);
                         $substr_chrs_c_2 = substr($chrs, $c, 2);
 
-                        if (($c == $strlen_chrs) || (($chrs{$c} == ',') && ($top['what'] == SERVICES_JSON_SLICE))) {
+                        if (($c == $strlen_chrs) || (($chrs[$c] == ',') && ($top['what'] == SERVICES_JSON_SLICE))) {
                             // found a comma that is not inside a string, array, etc.,
                             // OR we've reached the end of the character list
                             $slice = substr($chrs, $top['where'], ($c - $top['where']));
                             array_push($stk, array('what' => SERVICES_JSON_SLICE, 'where' => ($c + 1), 'delim' => false));
-                            //print("Found split at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found split at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
                             if (reset($stk) == SERVICES_JSON_IN_ARR) {
                                 // we are in an array, so just push an element onto the stack
@@ -690,48 +690,48 @@ class Services_JSON
 
                             }
 
-                        } elseif ((($chrs{$c} == '"') || ($chrs{$c} == "'")) && ($top['what'] != SERVICES_JSON_IN_STR)) {
+                        } elseif ((($chrs[$c] == '"') || ($chrs[$c] == "'")) && ($top['what'] != SERVICES_JSON_IN_STR)) {
                             // found a quote, and we are not inside a string
-                            array_push($stk, array('what' => SERVICES_JSON_IN_STR, 'where' => $c, 'delim' => $chrs{$c}));
-                            //print("Found start of string at {$c}\n");
+                            array_push($stk, array('what' => SERVICES_JSON_IN_STR, 'where' => $c, 'delim' => $chrs[$c]));
+                            //print("Found start of string at [$c]\n");
 
-                        } elseif (($chrs{$c} == $top['delim']) &&
+                        } elseif (($chrs[$c] == $top['delim']) &&
                                  ($top['what'] == SERVICES_JSON_IN_STR) &&
                                  ((strlen(substr($chrs, 0, $c)) - strlen(rtrim(substr($chrs, 0, $c), '\\'))) % 2 != 1)) {
                             // found a quote, we're in a string, and it's not escaped
                             // we know that it's not escaped becase there is _not_ an
                             // odd number of backslashes at the end of the string so far
                             array_pop($stk);
-                            //print("Found end of string at {$c}: ".substr($chrs, $top['where'], (1 + 1 + $c - $top['where']))."\n");
+                            //print("Found end of string at [$c]: ".substr($chrs, $top['where'], (1 + 1 + $c - $top['where']))."\n");
 
-                        } elseif (($chrs{$c} == '[') &&
+                        } elseif (($chrs[$c] == '[') &&
                                  in_array($top['what'], array(SERVICES_JSON_SLICE, SERVICES_JSON_IN_ARR, SERVICES_JSON_IN_OBJ))) {
                             // found a left-bracket, and we are in an array, object, or slice
                             array_push($stk, array('what' => SERVICES_JSON_IN_ARR, 'where' => $c, 'delim' => false));
-                            //print("Found start of array at {$c}\n");
+                            //print("Found start of array at [$c]\n");
 
-                        } elseif (($chrs{$c} == ']') && ($top['what'] == SERVICES_JSON_IN_ARR)) {
+                        } elseif (($chrs[$c] == ']') && ($top['what'] == SERVICES_JSON_IN_ARR)) {
                             // found a right-bracket, and we're in an array
                             array_pop($stk);
-                            //print("Found end of array at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found end of array at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
-                        } elseif (($chrs{$c} == '{') &&
+                        } elseif (($chrs[$c] == '{') &&
                                  in_array($top['what'], array(SERVICES_JSON_SLICE, SERVICES_JSON_IN_ARR, SERVICES_JSON_IN_OBJ))) {
                             // found a left-brace, and we are in an array, object, or slice
                             array_push($stk, array('what' => SERVICES_JSON_IN_OBJ, 'where' => $c, 'delim' => false));
-                            //print("Found start of object at {$c}\n");
+                            //print("Found start of object at [$c]\n");
 
-                        } elseif (($chrs{$c} == '}') && ($top['what'] == SERVICES_JSON_IN_OBJ)) {
+                        } elseif (($chrs[$c] == '}') && ($top['what'] == SERVICES_JSON_IN_OBJ)) {
                             // found a right-brace, and we're in an object
                             array_pop($stk);
-                            //print("Found end of object at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found end of object at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
                         } elseif (($substr_chrs_c_2 == '/*') &&
                                  in_array($top['what'], array(SERVICES_JSON_SLICE, SERVICES_JSON_IN_ARR, SERVICES_JSON_IN_OBJ))) {
                             // found a comment start, and we are in an array, object, or slice
                             array_push($stk, array('what' => SERVICES_JSON_IN_CMT, 'where' => $c, 'delim' => false));
                             $c++;
-                            //print("Found start of comment at {$c}\n");
+                            //print("Found start of comment at [$c]\n");
 
                         } elseif (($substr_chrs_c_2 == '*/') && ($top['what'] == SERVICES_JSON_IN_CMT)) {
                             // found a comment end, and we're in one now
@@ -741,7 +741,7 @@ class Services_JSON
                             for ($i = $top['where']; $i <= $c; ++$i)
                                 $chrs = substr_replace($chrs, ' ', $i, 1);
 
-                            //print("Found end of comment at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found end of comment at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
                         }
 
@@ -762,7 +762,7 @@ class Services_JSON
     /**
      * @todo Ultimately, this should just call PEAR::isError()
      */
-    function isError($data, $code = null)
+    static function isError($data, $code = null)
     {
         if (class_exists('pear')) {
             return PEAR::isError($data, $code);

include/Spyc.php

@@ -146,7 +146,7 @@ class Spyc {
      * @return array
      * @param string $input Path of YAML file or string containing YAML
      */
-  function YAMLLoad($input) {
+  static function YAMLLoad($input) {
     $Spyc = new Spyc;
     return $Spyc->__load($input);
   }

include/ajax.admin.php

@@ -48,7 +48,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Department");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -95,7 +95,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Team");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -139,7 +139,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Role");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add-role.tmpl.php';
     }
@@ -186,7 +186,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Agent");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -225,10 +225,12 @@ class AdminAjaxAPI extends AjaxController {
             Http::response(403, 'Access denied');
 
         $sort = new QueueSort();
+        $errors = array();
         if ($_POST) {
+            $_POST['root'] = $root;
             $data_form = $sort->getDataConfigForm($_POST);
             if ($data_form->isValid()) {
-                $sort->update($data_form->getClean() + $_POST, $root);
+                $sort->update($data_form->getClean() + $_POST, $errors);
                 if ($sort->save())
                     Http::response(201, $this->encode(array(
                         'id' => $sort->getId(),
@@ -237,6 +239,9 @@ class AdminAjaxAPI extends AjaxController {
             }
         }
 
+        if (!$data_form)
+            $data_form = $sort->getDataConfigForm();
+
         include STAFFINC_DIR . 'templates/queue-sorting-add.tmpl.php';
 
     }

include/ajax.config.php

@@ -28,7 +28,7 @@ class ConfigAjaxAPI extends AjaxController {
         list($sl, $locale) = explode('_', $lang);
 
         $rtl = false;
-        foreach (Internationalization::availableLanguages() as $info) {
+        foreach (Internationalization::getConfiguredSystemLanguages() as $info) {
             if (isset($info['direction']))
                 $rtl = true;
         }
@@ -40,7 +40,7 @@ class ConfigAjaxAPI extends AjaxController {
         $config=array(
               'lock_time'       => $cfg->getTicketLockMode() == Lock::MODE_DISABLED ? 0 : ($cfg->getLockTime()*60),
               'html_thread'     => (bool) $cfg->isRichTextEnabled(),
-              'date_format'     => $cfg->getDateFormat(true),
+              'date_format'     => Format::dtfmt_php2js($cfg->getDateFormat(true)),
               'lang'            => $lang,
               'short_lang'      => $sl,
               'has_rtl'         => $rtl,
@@ -49,6 +49,8 @@ class ConfigAjaxAPI extends AjaxController {
               'primary_language' => Internationalization::rfc1766($primary),
               'secondary_languages' => $cfg->getSecondaryLanguages(),
               'page_size'       => $thisstaff->getPageLimit() ?: PAGE_LIMIT,
+              'path'            => ROOT_PATH,
+              'editor_spacing' => $thisstaff->editorSpacing(),
         );
         return $this->json_encode($config);
     }
@@ -72,6 +74,7 @@ class ConfigAjaxAPI extends AjaxController {
             'has_rtl'         => $rtl,
             'primary_language' => Internationalization::rfc1766($cfg->getPrimaryLanguage()),
             'secondary_languages' => $cfg->getSecondaryLanguages(),
+            'path'            => ROOT_PATH,
         );
 
         $config = $this->json_encode($config);

include/ajax.content.php

@@ -19,7 +19,12 @@ require_once INCLUDE_DIR.'class.ajax.php';
 
 class ContentAjaxAPI extends AjaxController {
 
-    function log($id) {
+    function syslog($id) {
+        global $thisstaff;
+
+        // Ensure there is a Staff and that they are an Administrator
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
 
         if($id && ($log=Log::lookup($id))) {
             $content=sprintf('<div
@@ -27,7 +32,7 @@ class ContentAjaxAPI extends AjaxController {
                     style="white-space:pre-line;">%s</p>
                     <hr><strong>%s:</strong> <em>%s</em> <strong>%s:</strong> <em>%s</em></div>',
                     $log->getTitle(),
-                    Format::display(str_replace(',',', ',$log->getText())),
+                    Format::display(str_replace(',',', ',Format::htmlchars($log->getText()))),
                     __('Log Date'),
                     Format::daydatetime($log->getCreateDate()),
                     __('IP Address'),
@@ -142,8 +147,8 @@ class ContentAjaxAPI extends AjaxController {
     function manageContent($id, $lang=false) {
         global $thisstaff, $cfg;
 
-        if (!$thisstaff)
-            Http::response(403, 'Login Required');
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
 
         $content = Page::lookup($id, $lang);
 
@@ -168,8 +173,8 @@ class ContentAjaxAPI extends AjaxController {
     function manageNamedContent($type, $lang=false) {
         global $thisstaff, $cfg;
 
-        if (!$thisstaff)
-            Http::response(403, 'Login Required');
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
 
         $langs = $cfg->getSecondaryLanguages();
 
@@ -180,10 +185,10 @@ class ContentAjaxAPI extends AjaxController {
     }
 
     function updateContent($id) {
-        global $thisstaff;
+        global $thisstaff, $cfg;
 
-        if (!$thisstaff)
-            Http::response(403, 'Login Required');
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
         elseif (!($content = Page::lookup($id)))
             Http::response(404, 'No such content');
 
@@ -201,6 +206,7 @@ class ContentAjaxAPI extends AjaxController {
         }
         if (!$errors['err'])
             $errors['err'] = __('Correct any errors below and try again.');
+        $langs = Internationalization::getConfiguredSystemLanguages();
         $info = $_POST;
         $errors = Format::htmlchars($errors);
         include STAFFINC_DIR . 'templates/content-manage.tmpl.php';

include/ajax.draft.php

@@ -3,10 +3,11 @@
 if(!defined('INCLUDE_DIR')) die('!');
 
 require_once(INCLUDE_DIR.'class.draft.php');
+require_once(INCLUDE_DIR.'class.file.php');
 
 class DraftAjaxAPI extends AjaxController {
 
-    function _createDraft($vars) {
+    static function _createDraft($vars) {
         if (false === ($vars['body'] = self::_findDraftBody($_POST)))
             return JsonDataEncoder::encode(array(
                 'error' => __("Draft body not found in request"),
@@ -16,24 +17,26 @@ class DraftAjaxAPI extends AjaxController {
         if (!($draft = Draft::create($vars)) || !$draft->save())
             Http::response(500, 'Unable to create draft');
 
+        header('Content-Type: application/json; charset=UTF-8');
         echo JsonDataEncoder::encode(array(
             'draft_id' => $draft->getId(),
         ));
     }
 
-    function _getDraft($draft) {
+    static function _getDraft($draft) {
         if (!$draft || !$draft instanceof Draft)
             Http::response(205, "Draft not found. Create one first");
 
         $body = Format::viewableImages($draft->getBody());
 
+        header('Content-Type: application/json; charset=UTF-8');
         echo JsonDataEncoder::encode(array(
             'body' => $body,
             'draft_id' => $draft->getId(),
         ));
     }
 
-    function _updateDraft($draft) {
+    static function _updateDraft($draft) {
         if (false === ($body = self::_findDraftBody($_POST)))
             return JsonDataEncoder::encode(array(
                 'error' => array(
@@ -48,94 +51,96 @@ class DraftAjaxAPI extends AjaxController {
         echo "{}";
     }
 
-    function _uploadInlineImage($draft) {
+    static function _uploadInlineImage($draft) {
         global $cfg;
 
-        if (!isset($_POST['data']) && !isset($_FILES['file']))
+        if (!isset($_FILES['file']))
             Http::response(422, "File not included properly");
 
         # Fixup for expected multiple attachments
-        if (isset($_FILES['file'])) {
-            foreach ($_FILES['file'] as $k=>$v)
-                $_FILES['image'][$k] = array($v);
-            unset($_FILES['file']);
+        $file = AttachmentFile::format($_FILES['file']);
 
-            $file = AttachmentFile::format($_FILES['image']);
-            # Allow for data-uri uploaded files
-            $fp = fopen($file[0]['tmp_name'], 'rb');
-            if (fread($fp, 5) == 'data:') {
-                $data = 'data:';
-                while ($block = fread($fp, 8192))
-                  $data .= $block;
-                $file[0] = Format::parseRfc2397($data);
-                list(,$ext) = explode('/', $file[0]['type'], 2);
-                $file[0] += array(
-                    'name' => Misc::randCode(8).'.'.$ext,
-                    'size' => strlen($file[0]['data']),
-                );
-            }
-            fclose($fp);
-
-            # TODO: Detect unacceptable attachment extension
-            # TODO: Verify content-type and check file-content to ensure image
-            $type = $file[0]['type'];
-            if (strpos($file[0]['type'], 'image/') !== 0)
-                return Http::response(403,
-                    JsonDataEncoder::encode(array(
-                        'error' => 'File type is not allowed',
-                    ))
-                );
-
-            # TODO: Verify file size is acceptable
-            if ($file[0]['size'] > $cfg->getMaxFileSize())
-                return Http::response(403,
-                    JsonDataEncoder::encode(array(
-                        'error' => 'File is too large',
-                    ))
-                );
-
-            // Paste uploads in Chrome will have a name of 'blob'
-            if ($file[0]['name'] == 'blob')
-                $file[0]['name'] = 'screenshot-'.Misc::randCode(4);
-
-            $ids = $draft->attachments->upload($file);
-
-            if (!$ids) {
-                if ($file[0]['error']) {
-                    return Http::response(403,
-                        JsonDataEncoder::encode(array(
-                            'error' => $file[0]['error'],
-                        ))
-                    );
-                }
-                else
-                    return Http::response(500, 'Unable to attach image');
-            }
-
-            $id = (is_array($ids)) ? $ids[0] : $ids;
-        }
-        else {
-            $type = explode('/', $_POST['contentType']);
-            $info = array(
-                'data' => base64_decode($_POST['data']),
-                'name' => Misc::randCode(10).'.'.$type[1],
-                // TODO: Ensure _POST['contentType']
-                'type' => $_POST['contentType'],
+        // Allow one file at a time.
+        if (count($file) > 1)
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'Send one file at a time',
+                ))
+            );
+
+        # Allow for data-uri uploaded files
+        $fp = fopen($file[0]['tmp_name'], 'rb');
+        if (fread($fp, 5) == 'data:') {
+            $data = 'data:';
+            while ($block = fread($fp, 8192))
+              $data .= $block;
+            $file[0] = Format::parseRfc2397($data);
+            list(,$ext) = explode('/', $file[0]['type'], 2);
+            $file[0] += array(
+                'name' => Misc::randCode(8).'.'.$ext,
+                'size' => strlen($file[0]['data']),
             );
-            // TODO: Detect unacceptable filetype
-            // TODO: Verify content-type and check file-content to ensure image
-            $id = $draft->attachments->save($info);
         }
+        fclose($fp);
+
+        // Check file type to ensure image
+        $type = $file[0]['type'];
+        if (!AttachmentFile::isInlineSafeImageType($file[0]['type']))
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'File type is not allowed',
+                ))
+            );
+
+        // Check if file is truly an image
+        if (!FileUploadField::isValidFile($file[0]))
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'File is not valid',
+                ))
+            );
+
+        // Verify file size is acceptable
+        if ($file[0]['size'] > $cfg->getMaxFileSize())
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'File is too large',
+                ))
+            );
+
+        // Paste uploads in Chrome will have a name of 'blob'
+        if ($file[0]['name'] == 'blob')
+            $file[0]['name'] = 'screenshot-'.Misc::randCode(4);
+
+        $ids = $draft->attachments->upload($file);
+
+        if (!$ids) {
+            if ($file[0]['error']) {
+                return Http::response(403,
+                    JsonDataEncoder::encode(array(
+                        'error' => $file[0]['error'],
+                    ))
+                );
+
+            }
+            else
+                return Http::response(500, 'Unable to attach image');
+        }
+
+        $id = (is_array($ids)) ? $ids[0] : $ids;
         if (!($f = AttachmentFile::lookup($id)))
             return Http::response(500, 'Unable to attach image');
 
+        header('Content-Type: application/json; charset=UTF-8');
         echo JsonDataEncoder::encode(array(
+            Format::sanitize($f->getName()) => array(
             'content_id' => 'cid:'.$f->getKey(),
+            'id' => $f->getKey(),
             // Return draft_id to connect the auto draft creation
             'draft_id' => $draft->getId(),
-            'filelink' => $f->getDownloadUrl(
+            'url' => $f->getDownloadUrl(
                 ['type' => 'D', 'deposition' => 'inline']),
-        ));
+        )));
     }
 
     // Client interface for drafts =======================================
@@ -238,6 +243,7 @@ class DraftAjaxAPI extends AjaxController {
 
         $draft = Draft::create(array(
             'namespace' => $namespace,
+            'body' => ''
         ));
         if (!$draft->save())
             Http::response(500, 'Unable to create draft');
@@ -308,7 +314,8 @@ class DraftAjaxAPI extends AjaxController {
             Http::response(403, "Login required for image upload");
 
         $draft = Draft::create(array(
-            'namespace' => $namespace
+            'namespace' => $namespace,
+            'body' => ''
         ));
         if (!$draft->save())
             Http::response(500, 'Unable to create draft');
@@ -335,43 +342,49 @@ class DraftAjaxAPI extends AjaxController {
         if (!$thisstaff)
             Http::response(403, "Login required for file queries");
 
+        $search = Q::any([
+            Q::all([
+                'attachments__type__in' => array('C', 'F', 'T', 'P'),
+                'attachments__inline' => 1,
+            ]),
+            'ft' => 'L',
+        ]);
+
         if (isset($_GET['threadId']) && is_numeric($_GET['threadId'])
             && ($thread = Thread::lookup($_GET['threadId']))
             && ($object = $thread->getObject())
             && ($thisstaff->canAccess($object))
         ) {
-            $union = ' UNION SELECT f.id, a.id as aid, a.`type`, a.`name` FROM '.THREAD_TABLE.' t
-                JOIN '.THREAD_ENTRY_TABLE.' th ON (th.thread_id = t.id)
-                JOIN '.ATTACHMENT_TABLE.' a ON (a.object_id = th.id AND a.`type` = \'H\')
-                JOIN '.FILE_TABLE.' f ON (a.file_id = f.id)
-                WHERE a.`inline` = 1 AND t.id='.db_input($_GET['threadId']);
+            $search->add(Q::all([
+                'attachments__thread_entry__thread_id' => $_GET['threadId'],
+                'attachments__inline' => 1,
+            ]));
         }
 
-        $sql = 'SELECT distinct f.id, a.id as aid, COALESCE(a.type, f.ft), a.`name` FROM '.FILE_TABLE
-            .' f LEFT JOIN '.ATTACHMENT_TABLE.' a ON (a.file_id = f.id)
-            WHERE ((a.`type` IN (\'C\', \'F\', \'T\', \'P\') AND a.`inline` = 1) OR f.ft = \'L\')'
-                .' AND f.`type` LIKE \'image/%\'';
-        if (!($res = db_query($sql.$union)))
-            Http::response(500, 'Unable to lookup files');
+        $images = AttachmentFile::objects()->filter([
+                $search,
+                'type__startswith' => 'image/',
+            ])->distinct('id');
 
         $files = array();
-        while (list($id, $aid, $type, $name) = db_fetch_row($res)) {
-            if (!($f = AttachmentFile::lookup((int) $id)))
+        foreach ($images as $f) {
+            if (!$f->isInlineSafeImage())
                 continue;
 
-            $url = $f->getDownloadUrl(['id' => $aid]);
+            $url = $f->getDownloadUrl();
             $files[] = array(
                 // Don't send special sizing for thread items 'cause they
                 // should be cached already by the client
-                'thumb'=>$url.($type != 'H' ? '&s=128' : ''),
-                'image'=>$url,
-                'title'=>$name ?: $f->getName(),
+                'thumb' => $url.($f->type != 'H' ? '&s=128' : ''),
+                'url' => $url,
+                'title' => $f->getName(),
             );
         }
+        header('Content-Type: application/json; charset=UTF-8');
         echo JsonDataEncoder::encode($files);
     }
 
-    function _findDraftBody($vars) {
+    static function _findDraftBody($vars) {
         if (isset($vars['name'])) {
             $parts = array();
             // Support nested `name`, like trans[lang]
@@ -383,8 +396,15 @@ class DraftAjaxAPI extends AjaxController {
                 return $focus;
             }
         }
+
+        // Get ThreadEntry field name.
+        $tform = TicketForm::objects()->one()->getForm();
+        $tfield = $tform->getField('message')->getFormName();
+        // Get Task Description field name.
+        $aform = TaskForm::objects()->one()->getForm();
+        $afield = $aform->getField('description')->getFormName();
         $field_list = array('response', 'note', 'answer', 'body',
-             'message', 'issue', 'description');
+             $tfield, 'issue', $afield);
         foreach ($field_list as $field) {
             if (isset($vars[$field])) {
                 return $vars[$field];

include/ajax.email.php

@@ -0,0 +1,59 @@
+<?php
+require_once INCLUDE_DIR . 'class.email.php';
+class EmailAjaxAPI extends AjaxController {
+    function access() {
+        global $thisstaff;
+        if (!$thisstaff || !$thisstaff->isAdmin())
+             Http::response(403, 'Access Denied');
+        return true;
+    }
+
+    function stashFormData($id) {
+        if (!($email=Email::lookup($id)))
+            Http::response(404, 'Unknown Email');
+        $email->stashFormData($_POST ?: []);
+        Http::response(201, 'Form Stashed Maybe!');
+    }
+
+    function configureAuth($id, $type, $auth) {
+        if (!($email=Email::lookup($id)))
+            Http::response(404, 'Unknown Email');
+        if (!($account=$email->getAuthAccount($type)))
+            Http::response(404, 'Unknown Authentication Type');
+        if (!($form=$account->getAuthConfigForm($auth, $_POST ?: null)))
+             Http::response(404, 'Unknown Authentication Provider');
+        $info = $errors = [];
+        if ($_POST && $account->saveAuth($auth, $form, $errors)) {
+            if ($account->isOAuthAuth()
+                    && $account->shouldAuthorize()) {
+                 Http::response(201, JsonDataEncoder::encode([
+                             'redirect' => sprintf('emails.php?id=%d&do=autho&bk=%s',
+                                 $email->getId(), $account->getBkId())]),
+                         'application/json');
+            } else {
+                Http::response(201, __('Successfully Updated Credentials.'));
+            }
+        }
+        // Passible types are basic or oauth2
+        list($authtype, $provider) = explode(':', $auth);
+        $template = sprintf('email-%sauth.tmpl.php', $authtype);
+        include INCLUDE_DIR . "staff/templates/$template";
+    }
+
+    /*
+     * Delete the OAuth2 token
+     */
+    function deleteToken($id, $type) {
+        // Check to make sure the email exists
+        if (!($email=Email::lookup($id)))
+            Http::response(404, 'Unknown Email');
+        // Get the authentication account
+        if (!($account=$email->getAuthAccount($type)))
+            Http::response(404, 'Unknown Authentication Type');
+        // Destory the account config which will delete the token
+        if ($account->destroyConfig())
+            Http::response(201, __('Token Deleted Successfully.'));
+        // Couldn't delete the Token
+        Http::response(404, 'Unable to delete token.');
+    }
+}

include/ajax.export.php

@@ -0,0 +1,28 @@
+<?php
+require_once INCLUDE_DIR . 'class.export.php';
+
+class ExportAjaxAPI extends AjaxController {
+
+    function check($id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Agent login is required');
+        elseif (!($exporter=Exporter::load($id)) || !$exporter->isAvailable())
+            Http::response(404, 'No such export');
+
+        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+            if ($exporter->isReady())
+                Http::response(201, $this->json_encode([
+                            'status' => 'ready',
+                            'href' => sprintf('export.php?id=%s',
+                                $exporter->getId()),
+                            'filename' => $exporter->getFilename()]));
+            else // Export is not ready... checkback in a few
+                Http::response(200, $this->json_encode([
+                        'status' => 'notready']));
+        }
+
+        include STAFFINC_DIR . 'templates/export.tmpl.php';
+    }
+}

include/ajax.forms.php

@@ -29,8 +29,9 @@ class DynamicFormsAjaxAPI extends AjaxController {
         }
 
         foreach ($topic->getForms() as $form) {
-            if (!$form->hasAnyVisibleFields())
+            if ($form->isDeleted() || !$form->hasAnyVisibleFields())
                 continue;
+
             ob_start();
             $form->getForm($_SESSION[':form-data'])->render(array(
                 'staff' => !$client,
@@ -78,7 +79,7 @@ class DynamicFormsAjaxAPI extends AjaxController {
         $preserve = $field->flags & $p_mask;
 
         // Set admin-configured flag states
-        $flags = array_reduce($_POST['flags'],
+        $flags = array_reduce($_POST['flags'] ?: array(),
             function($a, $b) { return $a | $b; }, 0);
         $field->flags = $flags | $preserve;
 
@@ -151,6 +152,8 @@ class DynamicFormsAjaxAPI extends AjaxController {
     function saveListItem($list_id, $item_id) {
         global $thisstaff;
 
+        $errors = array();
+
         if (!$thisstaff)
             Http::response(403, 'Login required');
 
@@ -179,7 +182,7 @@ class DynamicFormsAjaxAPI extends AjaxController {
                     'name' =>   $basic['name'],
                     'value' =>  $basic['value'],
                     'abbrev' =>  $basic['extra'],
-                ]);
+                ], $errors);
             }
         }
 
@@ -380,19 +383,30 @@ class DynamicFormsAjaxAPI extends AjaxController {
         if (!$impl instanceof FileUploadField)
             Http::response(400, 'Upload to a non file-field');
 
+        header('Content-Type: application/json; charset=UTF-8');
         return JsonDataEncoder::encode(
             array('id'=>$impl->ajaxUpload())
         );
     }
 
-    function attach() {
+    function attach($object=null) {
         global $thisstaff;
 
+        $filter = array('type__contains'=>'thread');
+        // Determine if for Ticket/Task/Custom
+        if ($object && is_string($object)) {
+            if ($object == 'ticket')
+                $filter['form_id'] = TicketForm::objects()->one()->id;
+            elseif ($object == 'task')
+                $filter['form_id'] = TaskForm::objects()->one()->id;
+        }
         $config = DynamicFormField::objects()
-            ->filter(array('type__contains'=>'thread'))
+            ->filter($filter)
+            ->order_by('id')
             ->first()->getConfiguration();
         $field = new FileUploadField();
         $field->_config = $config;
+        header('Content-Type: application/json; charset=UTF-8');
         return JsonDataEncoder::encode(
             array('id'=>$field->ajaxUpload($thisstaff ? true : false))
         );

include/ajax.i18n.php

@@ -49,6 +49,7 @@ class i18nAjaxAPI extends AjaxController {
         $json = JsonDataEncoder::encode($phrases) ?: '{}';
         //Http::cacheable(md5($json), $lm);
 
+        header('Content-Type: application/json; charset=UTF-8');
         return $json;
     }
 
@@ -73,7 +74,7 @@ class i18nAjaxAPI extends AjaxController {
                 }
                 else {
                     // Avoid XSS injection
-                    $p->text = trim(Format::striptags($phrase));
+                    $p->text = trim(Format::sanitize($phrase));
                     $p->agent_id = $thisstaff->getId();
                 }
             }
@@ -124,6 +125,7 @@ class i18nAjaxAPI extends AjaxController {
         $json = JsonDataEncoder::encode($langs);
         Http::cacheable(md5($json), $cfg->lastModified());
 
+        header('Content-Type: application/json; charset=UTF-8');
         return $json;
     }
 
@@ -142,6 +144,7 @@ class i18nAjaxAPI extends AjaxController {
         $json = JsonDataEncoder::encode($langs);
         Http::cacheable(md5($json), $cfg->lastModified());
 
+        header('Content-Type: application/json; charset=UTF-8');
         return $json;
     }
 }

include/ajax.kbase.php

@@ -85,7 +85,7 @@ class KbaseAjaxAPI extends AjaxController {
 
         $title = __("Manage FAQ Access");
         $verb = __('Update');
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }

include/ajax.note.php

@@ -13,6 +13,9 @@ class NoteAjaxAPI extends AjaxController {
             Http::response(403, "Login required");
         elseif (!($note = QuickNote::lookup($id)))
             Http::response(205, "Note not found");
+        elseif (($note->staff_id !== $thisstaff->getId())
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
 
         Http::response(200, $note->display());
     }
@@ -24,6 +27,9 @@ class NoteAjaxAPI extends AjaxController {
             Http::response(403, "Login required");
         elseif (!($note = QuickNote::lookup($id)))
             Http::response(205, "Note not found");
+        elseif (($note->staff_id !== $thisstaff->getId())
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
         elseif (!isset($_POST['note']) || !$_POST['note'])
             Http::response(422, "Send `note` parameter");
 
@@ -41,6 +47,9 @@ class NoteAjaxAPI extends AjaxController {
             Http::response(403, "Login required");
         elseif (!($note = QuickNote::lookup($id)))
             Http::response(205, "Note not found");
+        elseif (($note->staff_id !== $thisstaff->getId())
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
         elseif (!$note->delete())
             Http::response(500, "Unable to remove note");
 
@@ -52,6 +61,9 @@ class NoteAjaxAPI extends AjaxController {
 
         if (!$thisstaff)
             Http::response(403, "Login required");
+        elseif (!in_array(substr($ext_id, 0, 1), ['O', 'U'])
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
         elseif (!isset($_POST['note']) || !$_POST['note'])
             Http::response(422, "Send `note` parameter");
 

include/ajax.orgs.php

@@ -17,6 +17,7 @@ if(!defined('INCLUDE_DIR')) die('403');
 
 require_once INCLUDE_DIR . 'class.organization.php';
 include_once(INCLUDE_DIR.'class.ticket.php');
+require_once INCLUDE_DIR.'ajax.tickets.php';
 
 class OrgsAjaxAPI extends AjaxController {
 
@@ -24,12 +25,12 @@ class OrgsAjaxAPI extends AjaxController {
 
         if(!isset($_REQUEST['q'])) {
             Http::response(400, 'Query argument is required');
-        } 
-        
+        }
+
         if (!$_REQUEST['q'])
             return $this->json_encode(array());
 
-        $q = $_REQUEST['q'];
+        $q = Format::sanitize($_REQUEST['q']);
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
 
         if (strlen(Format::searchable($q)) < 3)
@@ -54,7 +55,7 @@ class OrgsAjaxAPI extends AjaxController {
         foreach ($orgs as $O) {
             list($id, $name) = $O;
             $matched[] = array('name' => Format::htmlchars($name), 'info' => $name,
-                'id' => $id, '/bin/true' => $_REQUEST['q']);
+                'id' => $id, '/bin/true' => Format::htmlchars($q));
         }
 
         return $this->json_encode(array_values($matched));
@@ -92,7 +93,10 @@ class OrgsAjaxAPI extends AjaxController {
             Http::response(404, 'Unknown organization');
 
         $errors = array();
-        if($org->update($_POST, $errors))
+        if ($profile) {
+            if ($org->updateProfile($_POST, $errors))
+                Http::response(201, $org->to_json(), 'application/json');
+        } elseif ($org->update($_POST, $errors))
              Http::response(201, $org->to_json(), 'application/json');
 
         $forms = $org->getForms();
@@ -329,5 +333,29 @@ class OrgsAjaxAPI extends AjaxController {
 
         Http::response(201, 'Successfully managed');
     }
+
+    function exportTickets($id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Agent login is required');
+        elseif (!$id)
+            Http::response(403, __('Organization ID Required'));
+
+        $org = Organization::lookup($id);
+        if (!$org)
+            Http::response(403, __('Organization Not Found'));
+
+        $queue = $org->getTicketsQueue();
+
+        if ($_POST) {
+            $api = new TicketsAjaxAPI();
+            return $api->queueExport($queue);
+        }
+
+        $info = array('action' => "#orgs/$id/tickets/export");
+
+        include STAFFINC_DIR . 'templates/queue-export.tmpl.php';
+    }
 }
 ?>

include/ajax.plugins.php

@@ -0,0 +1,62 @@
+<?php
+require_once(INCLUDE_DIR . 'class.plugin.php');
+
+class PluginsAjaxAPI extends AjaxController {
+
+    /*
+     * Protect all routines in this controller
+     */
+    function access() {
+        global $thisstaff;
+        if (!$thisstaff || !$thisstaff->isAdmin())
+             Http::response(403, 'Access Denied');
+
+        return true;
+    }
+
+    // helper func to look up plugin & instance
+    private function lookup($plugin_id, $instance_id=0) {
+        if (!($plugin = PluginManager::lookup( (int) $plugin_id)))
+            Http::response(404, 'No such plugin');
+
+        if ($instance_id && !($instance = $plugin->getInstance( (int) $instance_id)))
+            Http::response(404, 'No such plugin instance');
+
+        return [$plugin, $instance];
+    }
+
+    function getInstances($plugin_id) {
+        list($plugin,)= $this->lookup($plugin_id);
+        $pjax_container = '#items';
+        include(STAFFINC_DIR . 'templates/plugin-instances.tmpl.php');
+    }
+
+    function updateInstance($plugin_id, $instance_id) {
+        list($plugin, $instance) = $this->lookup($plugin_id, $instance_id);
+        $errors = array();
+        if ($_POST && $instance->update($_POST, $errors))
+            Http::response(201, $this->encode([
+                'redirect' => sprintf('plugins.php?id=%d#instances',
+                    $plugin->getId())
+            ]));
+        $form = $instance->getForm();
+        $action = "#plugins/{$plugin->getId()}/instances/{$instance->getId()}/update";
+        include STAFFINC_DIR . 'templates/plugin-instance-modal.tmpl.php';
+    }
+
+    function addInstance($plugin_id) {
+        list($plugin,) = $this->lookup($plugin_id);
+        $errors = array();
+        if ($_POST  && ($instance=$plugin->addInstance($_POST, $errors)))
+            Http::response(201, $this->encode([
+                'redirect' => sprintf('plugins.php?id=%d#instances',
+                    $plugin->getId())
+            ]));
+        // This should return cached form with errors (if any)
+        $form = $plugin->getConfigForm();
+        // Set action
+        $action = "#plugins/{$plugin->getId()}/instances/add";
+        include(STAFFINC_DIR . 'templates/plugin-instance-modal.tmpl.php');
+    }
+}
+?>

include/ajax.schedule.php

@@ -0,0 +1,130 @@
+<?php
+require_once(INCLUDE_DIR . 'class.schedule.php');
+
+class ScheduleAjaxAPI extends AjaxController {
+
+    function add($sid=0) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Login required');
+        if ($sid && !($schedule = Schedule::lookup($sid)))
+            Http::response(404, 'No such schedule');
+        elseif ($_POST['sid'])
+            $schedule =  Schedule::lookup($_POST['sid']);
+
+        $action = '#schedule/add';
+        $errors = array();
+        $form = Schedule::basicForm($_POST ?: ($schedule ? array(
+                        'type' => $schedule->getType(),
+                        'timezone' => $schedule->timezone,
+                        'description' => 'Copy of '.$schedule->getName()
+                        ) : null));
+        if ($_POST && $form->isValid()) {
+            $data = $form->getClean();
+            if (Schedule::getIdByName($data['name'])) {
+                $form->getField('name')->addError(
+                        __('Name already in use'));
+            } elseif ($schedule  &&  strcasecmp($schedule->getType(),
+                        $data['type'])) {
+                $errors['sid'] = sprintf(
+                        __('Type must be of %s to clone this Schedule'),
+                        $schedule->getTypeDesc());
+            } else {
+                $vars = array_intersect_key($data, array_flip(['name',
+                            'timezone', 'description']));
+                $s = Schedule::create($vars);
+                $s->setFlag(Schedule::FLAG_BIZHRS, ($data['type'] ==
+                            'bizhrs'));
+                if ($s->save()) {
+                    if ($schedule) $s->cloneEntries($schedule);
+                    Http::response(201, $s->getId());
+                }
+            }
+        }
+
+        include STAFFINC_DIR.'templates/schedule-add.tmpl.php';
+    }
+
+    function cloneSchedule($id) {
+        return $this->add($id);
+    }
+
+    function addEntry($id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Login required');
+        elseif (!($schedule = Schedule::lookup($id)))
+            Http::response(404, 'No such schedule');
+
+        $form = $schedule->getEntryForm($_POST ?: null);
+        $errors = array();
+        if ($_POST && $form->isValid()) {
+            if (($entry = $schedule->addEntry($form, $errors)))
+                Http::response(201, $entry->getId());
+
+            foreach ($errors as $k => $error) {
+                if (($f=$form->getField($k)))
+                    $f->addError($error);
+            }
+
+        }
+
+        include STAFFINC_DIR . 'templates/schedule-entry.tmpl.php';
+    }
+
+    function updateEntry($sid, $id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+             Http::response(403, 'Login required');
+        if (!($entry = ScheduleEntry::lookup($id))
+                || !($schedule=$entry->getSchedule())
+                || $schedule->getId() != $sid)
+            Http::response(404, 'Unknown Entry');
+        $form = $entry->getForm($_POST ?: null);
+        $errors = array();
+        if ($_POST && $entry->update($form, $errors))
+            Http::response(201, $entry->getId());
+
+        foreach ($errors as $k => $error) {
+            if (($f=$form->getField($k)))
+                $f->addError($error);
+        }
+
+        include STAFFINC_DIR . 'templates/schedule-entry.tmpl.php';
+    }
+
+
+    function diagnostic($id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+             Http::response(403, 'Login required');
+        elseif (!($schedule = BusinessHoursSchedule::lookup($id)))
+            Http::response(404, 'No such schedule');
+
+        $form = $schedule->getDiagnosticForm($_POST ?: null);
+        if ($_POST) $form->isValid();
+        include STAFFINC_DIR . 'templates/schedule-diagnostic.tmpl.php';
+    }
+
+    function deleteEntries($id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+             Http::response(403, 'Login required');
+        if (!($schedule = Schedule::lookup($id)))
+            Http::response(404, 'Unknown Schedule');
+
+        $count = 0;
+        if (isset($_POST['ids']) && is_array($_POST['ids']))
+            $count = $schedule->entries
+                ->filter(array('id__in' => array_values($_POST['ids'])))
+                ->delete();
+
+        Http::response(200, $this->encode(array('success' => $count)));
+    }
+}
+?>

include/ajax.search.php

@@ -31,7 +31,7 @@ class SearchAjaxAPI extends AjaxController {
         $search = new AdhocSearch(array(
             'root' => 'T',
             'staff_id' => $thisstaff->getId(),
-            'parent_id' => @$_GET['parent_id'] ?: 0,
+            'parent_id' => (int) @$_GET['parent_id'] ?: 0,
         ));
         if ($search->parent_id) {
             $search->flags |= SavedSearch::FLAG_INHERIT_COLUMNS;
@@ -125,8 +125,9 @@ class SearchAjaxAPI extends AjaxController {
             // the recent search list
             if (isset($_SESSION[$key])) {
                 reset($_SESSION[$key]);
-                while (count($keep) < 5) {
-                    list($k, $v) = each($_SESSION[$key]);
+                for ($i = 0; $i < 5; $i++) {
+                    $k = key($_SESSION[$key]);
+                    $v = current($_SESSION[$key]);
                     if (!$k)
                         break;
                     $keep[$k] = $v;
@@ -167,7 +168,7 @@ class SearchAjaxAPI extends AjaxController {
                     'title' => __('Add Queue'),
                     'root' => 'T',
                     'staff_id' => $thisstaff->getId(),
-                    'parent_id' =>  $_GET['pid'],
+                    'parent_id' => (int) $_GET['pid'],
                     ));
         $this->_tryAgain($search);
     }
@@ -187,11 +188,16 @@ class SearchAjaxAPI extends AjaxController {
                         'root' => 'T',
                         'staff_id' => $thisstaff->getId()
                         ));
+            $new = true;
         }
 
         if (false === $this->_saveSearch($search))
             return;
 
+        //store saved search count when it is created
+        if ($new)
+            $search->counts($thisstaff, false);
+
         $info = array(
                 'msg' => sprintf('%s %s %s',
                     __('Search'),
@@ -202,6 +208,7 @@ class SearchAjaxAPI extends AjaxController {
     }
 
     function _saveSearch(SavedSearch $search) {
+        $_POST['queue-name'] = Format::htmlchars($_POST['queue-name']);
 
         // Validate the form.
         $form = $search->getForm($_POST);
@@ -259,8 +266,8 @@ class SearchAjaxAPI extends AjaxController {
             Http::response(404, 'No such queue sort');
         }
 
+        $data_form = $sort->getDataConfigForm($_POST ?: false);
         if ($_POST) {
-            $data_form = $sort->getDataConfigForm($_POST);
             if ($data_form->isValid()) {
                 $sort->update($data_form->getClean() + $_POST);
                 if ($sort->save())
@@ -344,17 +351,16 @@ class SearchAjaxAPI extends AjaxController {
     function addCondition() {
         global $thisstaff;
 
-        if (!$thisstaff) {
+        if (!$thisstaff)
             Http::response(403, 'Agent login is required');
-        }
         elseif (!isset($_GET['field']) || !isset($_GET['id'])
-            || !isset($_GET['object_id'])
-        ) {
+                || !isset($_GET['object_id']))
             Http::response(400, '`field`, `id`, and `object_id` parameters required');
-        }
-        elseif (!is_numeric($_GET['object_id'])) {
+        elseif (!is_numeric($_GET['object_id']))
             Http::response(400, '`object_id` should be an integer');
-        }
+        elseif (!is_numeric($_GET['id']))
+            Http::response(400, '`id` should be an integer');
+
         $fields = SavedSearch::getSearchableFields('Ticket');
         if (!isset($fields[$_GET['field']])) {
             Http::response(400, sprintf('%s: No such searchable field'),
@@ -380,8 +386,8 @@ class SearchAjaxAPI extends AjaxController {
             Http::response(400, '`prop` and `condition` parameters required');
         }
 
-        $prop = $_GET['prop'];
-        $id = $_GET['condition'];
+        $prop = Format::htmlchars($_GET['prop']);
+        $id = Format::htmlchars($_GET['condition']);
         include STAFFINC_DIR . 'templates/queue-column-condition-prop.tmpl.php';
     }
 

include/ajax.staff.php

@@ -35,12 +35,15 @@ class StaffAjaxAPI extends AjaxController {
 
       if ($_POST && $form->isValid()) {
           $clean = $form->getClean();
-          if ($id == 0) {
-              // Stash in the session later when creating the user
-              $_SESSION['new-agent-passwd'] = $clean;
-              Http::response(201, 'Carry on');
-          }
           try {
+              // Validate password
+              if (!$clean['welcome_email'])
+                  Staff::checkPassword($clean['passwd1'], null);
+              if ($id == 0) {
+                  // Stash in the session later when creating the user
+                  $_SESSION['new-agent-passwd'] = $clean;
+                  Http::response(201, 'Carry on');
+              }
               if ($clean['welcome_email']) {
                   $staff->sendResetEmail();
               }
@@ -53,8 +56,8 @@ class StaffAjaxAPI extends AjaxController {
                   Http::response(201, 'Successfully updated');
           }
           catch (BadPassword $ex) {
-              $passwd1 = $form->getField('passwd1');
-              $passwd1->addError($ex->getMessage());
+              if ($passwd1 = $form->getField('passwd1'))
+                  $passwd1->addError($ex->getMessage());
           }
           catch (PasswordUpdateFailed $ex) {
               $errors['err'] = __('Password update failed:').' '.$ex->getMessage();
@@ -63,7 +66,7 @@ class StaffAjaxAPI extends AjaxController {
 
       $title = __("Set Agent Password");
       $verb = $id == 0 ? __('Set') : __('Update');
-      $path = ltrim($ost->get_path_info(), '/');
+      $path = ltrim(Osticket::get_path_info(), '/');
 
       include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
   }
@@ -105,8 +108,8 @@ class StaffAjaxAPI extends AjaxController {
                     }
                 }
                 catch (BadPassword $ex) {
-                    $passwd1 = $form->getField('passwd1');
-                    $passwd1->addError($ex->getMessage());
+                    if ($passwd1 = $form->getField('passwd1'))
+                        $passwd1->addError($ex->getMessage());
                 }
                 catch (PasswordUpdateFailed $ex) {
                     $errors['err'] = __('Password update failed:').' '.$ex->getMessage();
@@ -116,7 +119,7 @@ class StaffAjaxAPI extends AjaxController {
 
         $title = __("Change Password");
         $verb = __('Update');
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -145,7 +148,7 @@ class StaffAjaxAPI extends AjaxController {
         $form = new ResetAgentPermissionsForm($_POST);
 
         if (@is_array($_GET['ids'])) {
-            $perms = new RolePermission();
+            $perms = new RolePermission(null);
             $selected = Staff::objects()->filter(array('staff_id__in' => $_GET['ids']));
             foreach ($selected as $staff)
                 // XXX: This maybe should be intersection rather than union
@@ -160,7 +163,7 @@ class StaffAjaxAPI extends AjaxController {
 
         $title = __("Reset Agent Permissions");
         $verb = __("Continue");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/reset-agent-permissions.tmpl.php';
     }
@@ -202,7 +205,7 @@ class StaffAjaxAPI extends AjaxController {
 
         $title = __("Change Primary Department");
         $verb = __("Continue");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -229,4 +232,91 @@ class StaffAjaxAPI extends AjaxController {
             'code' => $code,
           ));
     }
+
+    function configure2FA($staffId, $id=0) {
+        global $thisstaff;
+        if (!$thisstaff)
+            Http::response(403, 'Agent login required');
+        if ($staffId != $thisstaff->getId())
+            Http::response(403, 'Access denied');
+        if ($id && !($auth= Staff2FABackend::lookup($id)))
+            Http::response(404, 'Unknown 2FA');
+
+        $staff = $thisstaff;
+        $info = array();
+        if ($auth) {
+            // Simple state machine to manage settings and verification
+            $state = @$_POST['state'] ?: 'validate';
+            switch ($state) {
+                case 'verify':
+                    try {
+                        $form = $auth->getInputForm($_POST);
+                        if ($_POST && $form
+                                && $form->isValid()
+                                && $auth->validate($form, $staff)) {
+                            // Mark the settings as verified
+                            if (($config = $staff->get2FAConfig($auth->getId()))) {
+                                $config['verified'] = time();
+                                $staff->updateConfig(array(
+                                            $auth->getId() => JsonDataEncoder::encode($config)));
+                            }
+                            // We're done here
+                            $auth = null;
+                            $info['notice'] = __('Setup completed successfully');
+                        } else {
+                            $info['error'] = __('Unable to verify the token - try again!');
+                        }
+                    } catch (ExpiredOTP $ex) {
+                        // giving up cleanly
+                        $info['error'] = $ex->getMessage();
+                        $auth = null;
+                    }
+                    break;
+                case 'validate':
+                default:
+                    $config = $staff->get2FAConfig($auth->getId());
+                    $vars = $_POST ?: $config['config'] ?: array('email' => $staff->getEmail());
+                    $form = $auth->getSetupForm($vars);
+                    if ($_POST && $form && $form->isValid()) {
+                        if ($config['config'] && $config['config']['external2fa'])
+                            $external2fa = true;
+
+                        // Save the setting based on setup form
+                        $clean = $form->getClean();
+                        if (!$external2fa) {
+                            $config = ['config' => $clean, 'verified' => 0];
+                            $staff->updateConfig(array(
+                                        $auth->getId() => JsonDataEncoder::encode($config)));
+                        }
+
+                        // Send verification token to the user
+                        if ($token=$auth->send($staff)) {
+                            // Transition to verify state
+                            $form =  $auth->getInputForm($vars);
+                            $state = 'verify';
+                            $info['notice'] = __('Token sent to you!');
+                        } else {
+                            // Generic error TODO: better wording
+                            $info['error'] = __('Error sending Token - double check entry');
+                        }
+                    }
+            }
+        }
+
+        include STAFFINC_DIR . 'templates/2fas.tmpl.php';
+    }
+
+    function reset2fA($staffId) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Agent login required');
+        if (!$thisstaff->isAdmin())
+            Http::response(403, 'Access denied');
+
+        $default_2fa = ConfigItem::getConfigsByNamespace('staff.'.$staffId, 'default_2fa');
+
+        if ($default_2fa)
+            $default_2fa->delete();
+    }
 }

include/ajax.tasks.php

@@ -59,10 +59,17 @@ class TasksAjaxAPI extends AjaxController {
     }
 
     function triggerThreadAction($task_id, $thread_id, $action) {
+        global $thisstaff;
+
+        if (!($task = Task::lookup($task_id))
+                || !$task->checkStaffPerm($thisstaff))
+            Http::response(404, 'No such task thread entry');
+
         $thread = ThreadEntry::lookup($thread_id);
         if (!$thread)
             Http::response(404, 'No such task thread entry');
-        if ($thread->getThread()->getObjectId() != $task_id)
+        if ($thread->getThread()->getObjectType() != 'A'
+                || $thread->getThread()->getObjectId() != $task_id)
             Http::response(404, 'No such task thread entry');
 
         $valid = false;
@@ -110,10 +117,11 @@ class TasksAjaxAPI extends AjaxController {
                 $vars['default_formdata'] = $form->getClean();
                 $vars['internal_formdata'] = $iform->getClean();
                 $desc = $form->getField('description');
+                $vars['description'] = $desc->getClean();
                 if ($desc
                         && $desc->isAttachmentsEnabled()
                         && ($attachments=$desc->getWidget()->getAttachments()))
-                    $vars['files'] = $attachments->getFiles();
+                            $vars['files'] = $attachments->getFiles();
                 $vars['staffId'] = $thisstaff->getId();
                 $vars['poster'] = $thisstaff;
                 $vars['ip_address'] = $_SERVER['REMOTE_ADDR'];
@@ -211,6 +219,82 @@ class TasksAjaxAPI extends AjaxController {
         include STAFFINC_DIR . 'templates/task-edit.tmpl.php';
     }
 
+    function editField($tid, $fid) {
+        global $thisstaff;
+
+        if (!($task=Task::lookup($tid)))
+            Http::response(404, __('No such task'));
+        elseif (!$task->checkStaffPerm($thisstaff, Task::PERM_EDIT))
+            Http::response(403, __('Permission denied'));
+        elseif (!($field=$task->getField($fid)))
+            Http::response(404, __('No such field'));
+        $errors = array();
+        $info = array(
+                ':title' => sprintf(__('Task #%s: %s %s'),
+                  $task->getNumber(),
+                  __('Update'),
+                  $field->getLabel()
+                  ),
+              ':action' => sprintf('#tasks/%d/field/%s/edit',
+                  $task->getId(), $field->getId())
+              );
+
+        $form = $field->getEditForm($_POST);
+        if ($_POST && $form->isValid()) {
+
+            if ($task->updateField($form, $errors)) {
+                $msg = sprintf(
+                      __('%s successfully'),
+                      sprintf(
+                          __('%s updated'),
+                          __($field->getLabel())
+                          )
+                      );
+
+                switch (true) {
+                    case $field instanceof DateTime:
+                    case $field instanceof DatetimeField:
+                        $clean = Format::datetime((string) $field->getClean());
+                        break;
+                    case $field instanceof FileUploadField:
+                        $field->save();
+                        $answer =  $field->getAnswer();
+                        $clean = $answer->display() ?: '—' . __('Empty') .  '—';
+                        break;
+                    case $field instanceof DepartmentField:
+                        $clean = (string) Dept::lookup($field->getClean());
+                        break;
+                    case $field instanceof TextareaField:
+                        $clean =  (string) $field->getClean();
+                        $clean = Format::striptags($clean) ? $clean : '—' . __('Empty') .  '—';
+                        if (strlen($clean) > 200)
+                             $clean = Format::truncate($clean, 200);
+                        break;
+                    case $field instanceof BooleanField:
+                        $clean = $field->getClean();
+                        $clean = $field->toString($clean);
+                        break;
+                    default:
+                        $clean =  $field->getClean();
+                        $clean = is_array($clean) ? implode(',', $clean) :
+                            (string) $clean;
+                        if (strlen($clean) > 200)
+                             $clean = Format::truncate($clean, 200);
+                }
+
+                $clean = is_array($clean) ? $clean[0] : $clean;
+                Http::response(201, $this->json_encode(['value' =>
+                            $clean ?: '—' . __('Empty') .  '—',
+                            'id' => $fid, 'msg' => $msg]));
+            }
+
+            $form->addErrors($errors);
+            $info['error'] = $errors['err'] ?: __('Unable to update field');
+        }
+
+        include STAFFINC_DIR . 'templates/field-edit.tmpl.php';
+    }
+
     function massProcess($action, $w=null)  {
         global $thisstaff, $cfg;
 
@@ -228,7 +312,7 @@ class TasksAjaxAPI extends AjaxController {
                     'verbed' => __('deleted'),
                     ),
                 'reopen' => array(
-                    'verbed' => __('reopen'),
+                    'verbed' => __('reopened'),
                     ),
                 'close' => array(
                     'verbed' => __('closed'),
@@ -374,9 +458,10 @@ class TasksAjaxAPI extends AjaxController {
         case 'transfer':
             $inc = 'transfer.tmpl.php';
             $info[':action'] = '#tasks/mass/transfer';
-            $info[':title'] = sprintf('Transfer %s',
+            $info[':title'] = sprintf(__('Transfer %s'),
                     _N('selected task', 'selected tasks', $count));
             $form = TransferForm::instantiate($_POST);
+            $form->hideDisabled();
             if ($_POST && $form->isValid()) {
                 foreach ($_POST['tids'] as $tid) {
                     if (($t=Task::lookup($tid))
@@ -402,7 +487,7 @@ class TasksAjaxAPI extends AjaxController {
             $inc = 'task-status.tmpl.php';
             $info[':action'] = "#tasks/mass/$action";
             $info['status'] = $info['status'] ?: 'closed';
-            $perm = $action = '';
+            $perm = '';
             switch ($info['status']) {
             case 'open':
                 // If an agent can create a task then they're allowed to
@@ -561,6 +646,8 @@ class TasksAjaxAPI extends AjaxController {
                 );
 
         $form = $task->getTransferForm($_POST);
+        $form->hideDisabled();
+
         if ($_POST && $form->isValid()) {
             if ($task->transfer($form, $errors)) {
                 $_SESSION['::sysmsgs']['msg'] = sprintf(
@@ -618,7 +705,11 @@ class TasksAjaxAPI extends AjaxController {
                             __('Task'),
                             $form->getAssignee())
                         );
-                Http::response(201, $task->getId());
+
+                $assignee =  $task->isAssigned() ? Format::htmlchars(implode('/', $task->getAssignees())) :
+                                            '<span class="faded">&mdash; '.__('Unassigned').' &mdash;';
+                Http::response(201, $this->json_encode(['value' =>
+                    $assignee, 'id' => 'assign', 'msg' => $_SESSION['::sysmsgs']['msg']]));
             }
 
             $form->addErrors($errors);

include/ajax.thread.php

@@ -56,7 +56,7 @@ class ThreadAjaxAPI extends AjaxController {
     }
 
 
-    function addRemoteCollaborator($tid, $bk, $id) {
+    function addRemoteCollaborator($tid, $type, $bk, $id) {
         global $thisstaff;
 
         if (!($thread=Thread::lookup($tid))
@@ -74,7 +74,7 @@ class ThreadAjaxAPI extends AjaxController {
         if (!$user_info)
             $info['error'] = __('Unable to find user in directory');
 
-        return self::_addcollaborator($thread, null, $form, 'addcc', $info);
+        return self::_addcollaborator($thread, null, $form, $type, $info);
     }
 
     //Collaborators utils
@@ -83,6 +83,7 @@ class ThreadAjaxAPI extends AjaxController {
 
         if (!($thread=Thread::lookup($tid))
                 || !($object=$thread->getObject())
+                || !is_subclass_of($object, 'Threadable')
                 || !$object->checkStaffPerm($thisstaff))
             Http::response(404, __('No such thread'));
 
@@ -100,20 +101,14 @@ class ThreadAjaxAPI extends AjaxController {
             $user = User::fromForm($form);
         }
 
-        $errors = $info = array();
-        if ($user) {
-            // FIXME: Refuse to add ticket owner??
-            if (($c=$thread->addCollaborator($user,
-                            array(), $errors))) {
-                $info = array('msg' => sprintf(__('%s added as a collaborator'),
-                            Format::htmlchars($c->getName())));
-                $c->setCc();
-                $c->save();
-                return self::_collaborators($thread, $info);
-            }
+        $errors = $info = $vars = array();
+        if ($user && ($c=$object->addCollaborator($user, $vars, $errors))) {
+            $info = array('msg' => sprintf(__('%s added as a collaborator'),
+                        Format::htmlchars($c->getName())));
+            return self::_collaborators($thread, $info);
         }
 
-        if($errors && $errors['err']) {
+        if ($errors && $errors['err']) {
             $info +=array('error' => $errors['err']);
         } else {
             $info +=array('error' =>__('Unable to add collaborator.').' '.__('Internal error occurred'));
@@ -178,7 +173,7 @@ class ThreadAjaxAPI extends AjaxController {
         return self::_addcollaborator($thread);
     }
 
-    function previewCollaborators($tid) {
+    function previewCollaborators($tid, $manage=true) {
         global $thisstaff;
 
         if (!($thread=Thread::lookup($tid))
@@ -194,7 +189,7 @@ class ThreadAjaxAPI extends AjaxController {
         return $resp;
     }
 
-    function _addcollaborator($thread, $user=null, $form=null, $type=null, $info=array()) {
+    static function _addcollaborator($thread, $user=null, $form=null, $type=null, $info=array()) {
         global $thisstaff;
 
         $info += array(
@@ -222,20 +217,7 @@ class ThreadAjaxAPI extends AjaxController {
             Http::response(404, 'No such thread');
 
         $errors = $info = array();
-        if ($thread->updateCollaborators($_POST, $errors))
-            $users = array();
-            foreach ($thread->getCollaborators() as $c)
-                $users[] = array('id' => $c->getUserId(),
-                        'name' => $c->getName(),
-                        'email' => $c->getEmail());
-
-            Http::response(201, $this->json_encode(array(
-                            'id' => $thread->getId(),
-                            'users' => $users,
-                            'text' => sprintf('(%d)',
-                                $thread->getNumCollaborators())
-                            )
-                        ));
+        $thread->updateCollaborators($_POST, $errors);
 
         if($errors && $errors['err'])
             $info +=array('error' => $errors['err']);
@@ -245,7 +227,7 @@ class ThreadAjaxAPI extends AjaxController {
 
 
 
-    function _collaborator($collaborator, $form=null, $info=array()) {
+    static function _collaborator($collaborator, $form=null, $info=array()) {
         global $thisstaff;
 
         $info += array('action' => sprintf('#thread/%d/collaborators/%d',
@@ -261,7 +243,7 @@ class ThreadAjaxAPI extends AjaxController {
         return $resp;
     }
 
-    function _collaborators($thread, $info=array()) {
+    static function _collaborators($thread, $info=array()) {
 
         ob_start();
         include(STAFFINC_DIR . 'templates/collaborators.tmpl.php');

include/ajax.tickets.php

@@ -23,7 +23,7 @@ include_once INCLUDE_DIR . 'class.thread_actions.php';
 
 class TicketsAjaxAPI extends AjaxController {
 
-    function lookup() {
+    function lookup($wildcard=false) {
         global $thisstaff;
 
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
@@ -35,12 +35,16 @@ class TicketsAjaxAPI extends AjaxController {
         $visibility = $thisstaff->getTicketsVisibility();
         $hits = Ticket::objects()
             ->filter($visibility)
-            ->values('user__default_email__address')
+            ->values('user__default_email__address', 'cdata__subject', 'user__name', 'ticket_id', 'thread__id', 'flags')
             ->annotate(array(
                 'number' => new SqlCode('null'),
                 'tickets' => SqlAggregate::COUNT('ticket_id', true),
+                'tasks' => SqlAggregate::COUNT('tasks__id', true),
+                'collaborators' => SqlAggregate::COUNT('thread__collaborators__id', true),
+                'entries' => SqlAggregate::COUNT('thread__entries__id', true),
             ))
             ->order_by(SqlAggregate::SUM(new SqlCode('Z1.relevance')), QuerySet::DESC)
+            ->distinct('user__default_email__address')
             ->limit($limit);
 
         $q = $_REQUEST['q'];
@@ -49,32 +53,37 @@ class TicketsAjaxAPI extends AjaxController {
             return $this->encode(array());
 
         global $ost;
-        $hits = $ost->searcher->find($q, $hits, false);
+        $hits = $ost->searcher->find($q, $hits, false, ['boolean' => $wildcard]);
 
-        if (preg_match('/\d{2,}[^*]/', $q, $T = array())) {
-            $hits = Ticket::objects()
-                ->values('user__default_email__address', 'number')
-                ->annotate(array(
-                    'tickets' => new SqlCode('1'),
-                ))
-                ->filter($visibility)
-                ->filter(array('number__startswith' => $q))
-                ->order_by('number')
-                ->limit($limit)
-                ->union($hits);
+        $T = array();
+        if (preg_match('/\d{2,}[^*]/', $q, $T)) {
+            $hits = $this->lookupByNumber($limit, $visibility, $hits);
         }
-        elseif (!count($hits) && preg_match('`\w$`u', $q)) {
+        elseif (preg_match('/(.*@.{2,})|(.{2,}@.*)/', $q, $T)) {
+            $hits = $this->lookupByEmail($limit, $visibility, $hits);
+        }
+        elseif (!$wildcard && !count($hits) && preg_match('`^[a-zA-Z0-9]+$`u', $q)) {
             // Do wild-card fulltext search
             $_REQUEST['q'] = $q.'*';
-            return $this->lookup();
+            return $this->lookup(true);
         }
 
+        // TODO: Why not aggregate based on relationship?
         foreach ($hits as $T) {
             $email = $T['user__default_email__address'];
             $count = $T['tickets'];
             if ($T['number']) {
                 $tickets[$T['number']] = array('id'=>$T['number'], 'value'=>$T['number'],
+                    'ticket_id'=>$T['ticket_id'],
                     'info'=>"{$T['number']} — {$email}",
+                    'subject'=>$T['cdata__subject'],
+                    'user'=>$T['user__name'],
+                    'tasks'=>$T['tasks'],
+                    'thread_id'=>$T['thread__id'],
+                    'collaborators'=>$T['collaborators'],
+                    'entries'=>$T['entries'],
+                    'mergeType'=>Ticket::getMergeTypeByFlag($T['flags']),
+                    'children'=>count(Ticket::getChildTickets($T['ticket_id'])) > 0 ? true : false,
                     'matches'=>$_REQUEST['q']);
             }
             else {
@@ -87,6 +96,102 @@ class TicketsAjaxAPI extends AjaxController {
         return $this->json_encode($tickets);
     }
 
+    function lookupByNumber($limit=false, $visibility=false, $matches=false) {
+        global $thisstaff;
+
+        if (!$limit)
+            $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
+
+        $tickets=array();
+        // Bail out of query is empty
+        if (!$_REQUEST['q'])
+            return $this->json_encode($tickets);
+
+        $q = trim($_REQUEST['q']);
+
+        if (!$visibility)
+            $visibility = $thisstaff->getTicketsVisibility();
+
+        $hits = Ticket::objects()
+            ->values('user__default_email__address', 'cdata__subject', 'user__name', 'ticket_id', 'thread__id', 'flags', 'number')
+            ->annotate(array(
+                'tickets' => new SqlCode('1'),
+                'tasks' => SqlAggregate::COUNT('tasks__id', true),
+                'collaborators' => SqlAggregate::COUNT('thread__collaborators__id', true),
+                'entries' => SqlAggregate::COUNT('thread__entries__id', true),
+            ))
+            ->filter($visibility)
+            ->filter(array('number__startswith' => $q))
+            ->order_by('number')
+            ->limit($limit);
+
+        if ($matches && is_a($matches, 'QuerySet'))
+            return $hits->union($matches);
+
+        foreach ($hits as $T) {
+            $email = $T['user__default_email__address'];
+            $tickets[$T['number']] = array('id'=>$T['number'], 'value'=>$T['number'],
+                'ticket_id'=>$T['ticket_id'],
+                'info'=>"{$T['number']} — {$email}",
+                'subject'=>$T['cdata__subject'],
+                'user'=>$T['user__name'],
+                'tasks'=>$T['tasks'],
+                'thread_id'=>$T['thread__id'],
+                'collaborators'=>$T['collaborators'],
+                'entries'=>$T['entries'],
+                'mergeType'=>Ticket::getMergeTypeByFlag($T['flags']),
+                'children'=>count(Ticket::getChildTickets($T['ticket_id'])) > 0 ? true : false,
+                'matches'=>$_REQUEST['q']);
+        }
+        $tickets = array_values($tickets);
+
+        return $this->json_encode($tickets);
+    }
+
+    function lookupByEmail($limit=false, $visibility=false, $matches=false) {
+        global $thisstaff;
+
+        if (!$limit)
+            $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
+
+        $tickets=array();
+        // Bail out of query is empty
+        if (!$_REQUEST['q'])
+            return $this->json_encode($tickets);
+
+        $q = trim($_REQUEST['q']);
+
+        if (!$visibility)
+            $visibility = $thisstaff->getTicketsVisibility();
+
+        $hits = Ticket::objects()
+            ->values('user__default_email__address', 'cdata__subject', 'user__name', 'ticket_id', 'thread__id', 'flags')
+            ->annotate(array(
+                'number' => new SqlCode('null'),
+                'tickets' => SqlAggregate::COUNT('ticket_id', true),
+                'tasks' => SqlAggregate::COUNT('tasks__id', true),
+                'collaborators' => SqlAggregate::COUNT('thread__collaborators__id', true),
+                'entries' => SqlAggregate::COUNT('thread__entries__id', true),
+            ))
+            ->filter($visibility)
+            ->filter(array('user__default_email__address__contains' => $q))
+            ->order_by('user__default_email__address')
+            ->limit($limit);
+
+        if ($matches && is_a($matches, 'QuerySet'))
+            return $hits->union($matches);
+
+        foreach ($hits as $T) {
+            $count = $T['tickets'];
+            $email = $T['user__default_email__address'];
+            $tickets[$email] = array('email'=>$email, 'value'=>$email,
+                'info'=>"$email ($count)", 'matches'=>$_REQUEST['q']);
+        }
+        $tickets = array_values($tickets);
+
+        return $this->json_encode($tickets);
+    }
+
     function acquireLock($tid) {
         global $cfg, $thisstaff;
 
@@ -261,7 +366,7 @@ class TicketsAjaxAPI extends AjaxController {
         return self::_userlookup($user, null, $info);
     }
 
-    function _userlookup($user, $form, $info) {
+    static function _userlookup($user, $form, $info) {
         global $thisstaff;
 
         ob_start();
@@ -329,6 +434,89 @@ class TicketsAjaxAPI extends AjaxController {
         Http::response(201, 'Successfully managed');
     }
 
+    function mergeTickets($ticket_id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, "Login required");
+        elseif (!($ticket = Ticket::lookup($ticket_id)))
+            Http::response(404, "No such ticket");
+        elseif (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_EDIT))
+            Http::response(403, "Access Denied");
+
+        //retrieve the parent and child tickets
+        $parent = Ticket::objects()
+            ->filter(array('ticket_id'=>$ticket_id))
+            ->values_flat('ticket_id', 'number', 'ticket_pid', 'sort', 'thread__id', 'user_id', 'cdata__subject', 'user__name', 'flags')
+            ->annotate(array('tasks' => SqlAggregate::COUNT('tasks__id', true),
+                             'collaborators' => SqlAggregate::COUNT('thread__collaborators__id', true),
+                             'entries' => SqlAggregate::COUNT('thread__entries__id', true),));
+        $tickets =  Ticket::getChildTickets($ticket_id);
+        $tickets = $parent->union($tickets);
+
+        //fix sort of tickets
+        $sql = sprintf('SELECT * FROM (%s) a ORDER BY sort', $tickets->getQuery());
+        $res = db_query($sql);
+        $tickets = db_assoc_array($res);
+        $info = array('action' => '#tickets/'.$ticket->getId().'/merge');
+
+        return self::_updateMerge($ticket, $tickets, $info);
+    }
+
+    function updateMerge($ticket_id) {
+        global $thisstaff;
+
+        $info = array();
+        $errors = array();
+
+        if ($_POST['dtids']) {
+            foreach($_POST['dtids'] as $key => $value) {
+                if (is_numeric($key) && $ticket = Ticket::lookup($value))
+                    $ticket->unlink();
+            }
+            Http::response(201, 'Successfully managed');
+        } elseif ($_POST['tids']) {
+            if ($parent = Ticket::merge($_POST))
+                Http::response(201, 'Successfully managed');
+            else
+                Http::response(404, 'Unable to manage ticket');
+        }
+
+        $parentModel = Ticket::objects()
+            ->filter(array('ticket_id'=>$ticket_id))
+            ->values_flat('ticket_id', 'number', 'ticket_pid', 'sort', 'thread__id', 'user_id', 'cdata__subject', 'user__name', 'flags')
+            ->annotate(array('tasks' => SqlAggregate::COUNT('tasks__id', true),
+                             'collaborators' => SqlAggregate::COUNT('thread__collaborators__id', true),
+                             'entries' => SqlAggregate::COUNT('thread__entries__id', true),));
+
+        if ($parent->getMergeType() == 'visual') {
+            $tickets = Ticket::getChildTickets($ticket_id);
+            $tickets = $parentModel->union($tickets);
+        } else
+            $tickets = $parentModel;
+
+        return self::_updateMerge($parent, $tickets, $info);
+    }
+
+    static private function _updateMerge($ticket, $tickets, $info) {
+        include(STAFFINC_DIR . 'templates/merge-tickets.tmpl.php');
+    }
+
+    function previewMerge($tid) {
+        global $thisstaff;
+
+        if (!($ticket=Ticket::lookup($tid))
+                || !$ticket->checkStaffPerm($thisstaff))
+            Http::response(404, 'No such ticket');
+
+        ob_start();
+        include STAFFINC_DIR . 'templates/merge-preview.tmpl.php';
+        $resp = ob_get_contents();
+        ob_end_clean();
+
+        return $resp;
+    }
+
     function cannedResponse($tid, $cid, $format='text') {
         global $thisstaff, $cfg;
 
@@ -358,7 +546,7 @@ class TicketsAjaxAPI extends AjaxController {
             $format.='.plain';
 
         $varReplacer = function (&$var) use($ticket) {
-            return $ticket->replaceVars($var);
+            return $ticket->replaceVars($var, array('recipient' => $ticket->getOwner()));
         };
 
         include_once(INCLUDE_DIR.'class.canned.php');
@@ -400,7 +588,6 @@ class TicketsAjaxAPI extends AjaxController {
                         );
                 Http::response(201, $ticket->getId());
             }
-
             $form->addErrors($errors);
             $info['error'] = $errors['err'] ?: __('Unable to transfer ticket');
         }
@@ -410,105 +597,101 @@ class TicketsAjaxAPI extends AjaxController {
         include STAFFINC_DIR . 'templates/transfer.tmpl.php';
     }
 
-
-  function referrals($tid) {
-
+    function referrals($tid) {
       return $this->refer($tid);
-
-  }
-
-function refer($tid, $target=null) {
-    global $thisstaff;
-
-    if (!($ticket=Ticket::lookup($tid)))
-        Http::response(404, __('No such ticket'));
-
-    if (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_ASSIGN)
-            || !($form = $ticket->getReferralForm($_POST,
-                    array('target' => $target))))
-        Http::response(403, __('Permission denied'));
-
-    $errors = array();
-    $info = array(
-            ':title' => sprintf(__('Ticket #%s: %s'),
-                $ticket->getNumber(),
-                __('Refer')
-                ),
-            ':action' => sprintf('#tickets/%d/refer%s',
-                $ticket->getId(),
-                ($target  ? "/$target": '')),
-            );
-
-    if ($_POST) {
-
-        switch ($_POST['do']) {
-        case 'refer':
-            if ($form->isValid() && $ticket->refer($form, $errors)) {
-                $clean = $form->getClean();
-                if ($clean['comments'])
-                    $ticket->logNote('Referral', $clean['comments'], $thisstaff);
-                $_SESSION['::sysmsgs']['msg'] = sprintf(
-                        __('%s successfully'),
-                        sprintf(
-                            __('%s referred to %s'),
-                            sprintf(__('Ticket #%s'),
-                                 sprintf('<a href="tickets.php?id=%d"><b>%s</b></a>',
-                                     $ticket->getId(),
-                                     $ticket->getNumber()))
-                            ,
-                            $form->getReferee())
-                        );
-                Http::response(201, $ticket->getId());
-            }
-
-            $form->addErrors($errors);
-            $info['error'] = $errors['err'] ?: __('Unable to refer ticket');
-            break;
-        case 'manage':
-            $remove = array();
-            if (is_array($_POST['referrals'])) {
-                $remove = array();
-                foreach ($_POST['referrals'] as $k => $v)
-                    if ($v[0] == '-')
-                        $remove[] = substr($v, 1);
-                if (count($remove)) {
-                    $num = $ticket->thread->referrals
-                        ->filter(array('id__in' => $remove))
-                        ->delete();
-                    if ($num) {
-                        $info['msg'] = sprintf(
-                                __('%s successfully'),
-                                sprintf(__('Removed %d referrals'),
-                                    $num
-                                    )
-                                );
-                    }
-                    //TODO: log removal
-                }
-            }
-            break;
-        default:
-             $errors['err'] = __('Unknown Action');
-        }
     }
 
-    $thread = $ticket->getThread();
-    include STAFFINC_DIR . 'templates/refer.tmpl.php';
-}
-  function editField($tid, $fid) {
-      global $thisstaff;
+    function refer($tid, $target=null) {
+        global $thisstaff;
 
-      if (!($ticket=Ticket::lookup($tid)))
-          Http::response(404, __('No such ticket'));
+        if (!($ticket=Ticket::lookup($tid)))
+            Http::response(404, __('No such ticket'));
 
-      if (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_EDIT))
-          Http::response(403, __('Permission denied'));
-      elseif (!($field=$ticket->getField($fid)))
-          Http::response(404, __('No such field'));
+        if (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_ASSIGN)
+                || !($form = $ticket->getReferralForm($_POST,
+                        array('target' => $target))))
+            Http::response(403, __('Permission denied'));
 
-      $errors = array();
-      $info = array(
-              ':title' => sprintf(__('Ticket #%s: %s %s'),
+        $errors = array();
+        $info = array(
+                ':title' => sprintf(__('Ticket #%s: %s'),
+                    $ticket->getNumber(),
+                    __('Refer')
+                    ),
+                ':action' => sprintf('#tickets/%d/refer%s',
+                    $ticket->getId(),
+                    ($target  ? "/$target": '')),
+                );
+
+        if ($_POST) {
+            switch ($_POST['do']) {
+                case 'refer':
+                    if ($form->isValid() && $ticket->refer($form, $errors)) {
+                        $clean = $form->getClean();
+                        if ($clean['comments'])
+                            $ticket->logNote('Referral', $clean['comments'], $thisstaff);
+                        $_SESSION['::sysmsgs']['msg'] = sprintf(
+                                __('%s successfully'),
+                                sprintf(
+                                    __('%s referred to %s'),
+                                    sprintf(__('Ticket #%s'),
+                                         sprintf('<a href="tickets.php?id=%d"><b>%s</b></a>',
+                                             $ticket->getId(),
+                                             $ticket->getNumber()))
+                                    ,
+                                    $form->getReferee())
+                                );
+                        Http::response(201, $ticket->getId());
+                    }
+
+                    $form->addErrors($errors);
+                    $info['error'] = $errors['err'] ?: __('Unable to refer ticket');
+                    break;
+                case 'manage':
+                    $remove = array();
+                    if (is_array($_POST['referrals'])) {
+                        $remove = array();
+                        foreach ($_POST['referrals'] as $k => $v)
+                            if ($v[0] == '-')
+                                $remove[] = substr($v, 1);
+                        if (count($remove)) {
+                            $num = $ticket->getThread()->referrals
+                                ->filter(array('id__in' => $remove))
+                                ->delete();
+                            if ($num) {
+                                $info['msg'] = sprintf(
+                                        __('%s successfully'),
+                                        sprintf(__('Removed %d referrals'),
+                                            $num
+                                            )
+                                        );
+                            }
+                            //TODO: log removal
+                        }
+                    }
+                    break;
+                default:
+                     $errors['err'] = __('Unknown Action');
+            }
+        }
+
+        $thread = $ticket->getThread();
+        include STAFFINC_DIR . 'templates/refer.tmpl.php';
+    }
+
+    function editField($tid, $fid) {
+        global $cfg, $thisstaff;
+
+        if (!($ticket=Ticket::lookup($tid)))
+            Http::response(404, __('No such ticket'));
+        elseif (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_EDIT))
+            Http::response(403, __('Permission denied'));
+        elseif (!($field=$ticket->getField($fid)))
+            Http::response(404, __('No such field'));
+
+        $errors = array();
+        $info = array(
+                ':title' => sprintf(__('Ticket #%s: %s %s'),
                   $ticket->getNumber(),
                   __('Update'),
                   $field->getLabel()
@@ -517,10 +700,11 @@ function refer($tid, $target=null) {
                   $ticket->getId(), $field->getId())
               );
 
-      $form = $field->getEditForm($_POST);
-      if ($_POST && $form->isValid()) {
+        $form = $field->getEditForm($_POST);
+        if ($_POST && $form->isValid()) {
+
             if ($ticket->updateField($form, $errors)) {
-              $_SESSION['::sysmsgs']['msg'] = sprintf(
+                $msg = sprintf(
                       __('%s successfully'),
                       sprintf(
                           __('%s updated'),
@@ -528,16 +712,91 @@ function refer($tid, $target=null) {
                           )
                       );
 
-              if ($field instanceof FileUploadField)
-                  $field->save();
-              Http::response(201, $field->getClean());
-          }
-          $form->addErrors($errors);
-          $info['error'] = $errors['err'] ?: __('Unable to update field');
-      }
+                switch (true) {
+                    case $field instanceof DateTime:
+                    case $field instanceof DatetimeField:
+                        $clean = Format::datetime((string) $field->getClean());
+                        break;
+                    case $field instanceof FileUploadField:
+                        $field->save();
+                        $answer =  $field->getAnswer();
+                        $clean = $answer->display() ?: '&mdash;' . __('Empty') .  '&mdash;';
+                        break;
+                    case $field instanceof DepartmentField:
+                        $clean = (string) Dept::lookup($field->getClean());
+                        break;
+                    case $field instanceof TextareaField:
+                        $clean =  (string) $field->getClean();
+                        $clean = Format::striptags($clean) ?: '&mdash;' . __('Empty') .  '&mdash;';
+                        if (strlen($clean) > 200)
+                             $clean = Format::truncate(Format::striptags($clean), 200);
+                        break;
+                    case $field instanceof BooleanField:
+                        $clean = $field->toString($field->getClean());
+                        break;
+                    default:
+                        $clean =  $field->getClean();
+                        $clean = is_array($clean) ? implode(',', $clean) :
+                            (string) $clean;
+                }
 
-      include STAFFINC_DIR . 'templates/field-edit.tmpl.php';
-  }
+                // Set basic response data
+                $response = array(
+                    'value' => $clean ?: '&mdash;' . __('Empty') .  '&mdash;',
+                    'id' => $fid, 'msg' => $msg
+                );
+
+                // If we require HT to close, the ticket is open, the staff has permission
+                // to close, and we set a HT - ensure we provide all available statuses
+                if ($cfg->requireTopicToClose() && $ticket->isOpen()
+                        && $ticket->checkStaffPerm($thisstaff, Ticket::PERM_CLOSE)
+                        && ($field instanceof TopicField) && $clean) {
+                    $statuses = array();
+                    foreach (TicketStatusList::getStatuses(
+                            array('states' => array('closed'))) as $s) {
+                        if (!$s->isEnabled()) continue;
+                        $statuses[$s->getId()] = $s->getName();
+                    }
+                    if (!is_null($statuses))
+                        $response['statuses'] = $statuses;
+                }
+
+                $clean = is_array($clean) ? $clean[0] : $clean;
+                Http::response(201, $this->json_encode($response));
+            }
+
+            $form->addErrors($errors);
+            $info['error'] = $errors['err'] ?: __('Unable to update field');
+        }
+
+        include STAFFINC_DIR . 'templates/field-edit.tmpl.php';
+    }
+
+    function viewField($tid, $fid) {
+        global $cfg, $thisstaff;
+
+        if (!($ticket=Ticket::lookup($tid)))
+            Http::response(404, __('No such ticket'));
+        elseif (!$ticket->checkStaffPerm($thisstaff))
+            Http::response(403, __('Permission denied'));
+        elseif (!($field=$ticket->getField($fid)))
+            Http::response(404, __('No such field'));
+
+        $errors = array();
+        $info = array(
+                ':title' => sprintf(__('Ticket #%s: %s %s'),
+                  $ticket->getNumber(),
+                  __('View'),
+                  $field->getLabel()
+                  ),
+              ':action' => sprintf('#tickets/%d/field/%s/edit',
+                  $ticket->getId(), $field->getId())
+              );
+
+        $form = $field->getEditForm();
+
+        include STAFFINC_DIR . 'templates/field-view.tmpl.php';
+    }
 
     function assign($tid, $target=null) {
         global $thisstaff;
@@ -579,14 +838,18 @@ function refer($tid, $target=null) {
 
         if ($_POST && $form->isValid()) {
             if ($ticket->assign($form, $errors)) {
-                $_SESSION['::sysmsgs']['msg'] = sprintf(
+                $msg = sprintf(
                         __('%s successfully'),
                         sprintf(
                             __('%s assigned to %s'),
                             __('Ticket'),
                             $form->getAssignee())
                         );
-                Http::response(201, $ticket->getId());
+
+                $assignee =  $ticket->isAssigned() ? Format::htmlchars(implode('/', $ticket->getAssignees())) :
+                                            '<span class="faded">&mdash; '.__('Unassigned').' &mdash;';
+                Http::response(201, $this->json_encode(['value' =>
+                    $assignee, 'id' => 'assign', 'msg' => $msg]));
             }
 
             $form->addErrors($errors);
@@ -728,6 +991,12 @@ function refer($tid, $target=null) {
                 'refer' => array(
                     'verbed' => __('referred'),
                     ),
+                'merge' => array(
+                    'verbed' => __('merged'),
+                    ),
+                'link' => array(
+                    'verbed' => __('linked'),
+                    ),
                 'claim' => array(
                     'verbed' => __('assigned'),
                     ),
@@ -758,6 +1027,89 @@ function refer($tid, $target=null) {
             $count  =  $_REQUEST['count'];
         }
         switch ($action) {
+        case 'merge':
+        case 'link':
+            $inc = 'merge-tickets.tmpl.php';
+            $ticketIds = $_GET ? explode(',', $_GET['tids']) : explode(',', $_POST['tids']);
+            $tickets = array();
+            $title = strpos($_SERVER['PATH_INFO'], 'link') !== false ? 'link' : 'merge';
+            $eventName = ($title && $title == 'link') ? 'linked' : 'merged';
+            $permission = ($title && $title == 'link') ? (Ticket::PERM_LINK) : (Ticket::PERM_MERGE);
+            $hasPermission = array();
+            $parent = false;
+
+            $tickets = Ticket::objects()
+                ->filter(array('ticket_id__in'=>$ticketIds))
+                ->values_flat('ticket_id', 'flags', 'dept_id', 'ticket_pid');
+            foreach ($tickets as $ticket) {
+                list($ticket_id, $flags, $dept_id, $ticket_pid) = $ticket;
+                $mergeType = Ticket::getMergeTypeByFlag($flags);
+                $isParent = Ticket::isParentStatic($flags);
+                $role = $thisstaff->getRole($dept_id);
+                $hasPermission[] = $role->hasPerm($permission);
+
+                if (!$ticket)
+                    continue;
+                elseif (!$parent && $isParent && $mergeType != 'visual') {
+                    $parent = $ticket;
+                    $parentMergeType = $mergeType;
+                }
+
+                if ($mergeType != 'visual' && $title == 'link')
+                    $info['error'] = sprintf(
+                            __('One or more Tickets selected is part of a merge. Merged Tickets cannot be %s.'),
+                            __($eventName)
+                            );
+
+                if ($parent && ($isParent && $mergeType != 'visual') && $parent[0] != $ticket_id)
+                    $info['error'] = sprintf(
+                            __('More than one Parent Ticket selected. %1$s cannot be %2$s.'),
+                            _N('The selected Ticket', 'The selected Tickets', $count),
+                            __($eventName)
+                            );
+
+                if ($ticket_pid && $mergeType != 'visual' && $title == 'merge')
+                    $info['error'] = sprintf(
+                            __('One or more Tickets selected is a merged child. %1$s cannot be %2$s.'),
+                            _N('The selected Ticket', 'The selected Tickets', $count),
+                            __($eventName)
+                            );
+            }
+            //move parent ticket to top of list
+            if (count($ticketIds) > 1) {
+                $ticketIdsSorted = $ticketIds;
+                if ($parent && $parentMergeType != 'visual') {
+                    foreach ($ticketIdsSorted as $key => $value) {
+                        if ($value == $parent[0]) {
+                            unset($ticketIdsSorted[$key]);
+                            array_unshift($ticketIdsSorted, $value);
+                            array_unshift($ticketIdsSorted, new SqlField('ticket_id'));
+                        }
+                    }
+                }
+
+                $expr = call_user_func_array(array('SqlFunction', 'FIELD'), $ticketIdsSorted);
+            }
+            $tickets = Ticket::objects()
+                 ->filter(array('ticket_id__in'=>$ticketIds))
+                 ->values_flat('ticket_id', 'number', 'ticket_pid', 'sort', 'thread__id',
+                               'user_id', 'cdata__subject', 'user__name', 'flags')
+                 ->annotate(array('tasks' => SqlAggregate::COUNT('tasks__id', true),
+                                  'collaborators' => SqlAggregate::COUNT('thread__collaborators__id'),
+                                  'entries' => SqlAggregate::COUNT('thread__entries__id'),))
+                 ->order_by($expr ?: 'sort');
+            $ticket = Ticket::lookup($parent[0] ?: $ticket[0]);
+
+            // Generic permission check.
+            if (in_array(false, $hasPermission) && !$ticket->getThread()->isReferred()) {
+                $info['error'] = sprintf(
+                        __('You do not have permission to %1$s %2$s'),
+                        __($title),
+                        _N('the selected Ticket', 'the selected Tickets', $count));
+                $info = array_merge($info, Format::htmlchars($_POST));
+            } else
+                $info['action'] = sprintf('#tickets/%s/merge', $ticket->getId());
+            break;
         case 'claim':
             $w = 'me';
         case 'assign':
@@ -784,13 +1136,8 @@ function refer($tid, $target=null) {
 
                         $depts = $tickets->values_flat('dept_id');
                     }
-                    $members = Staff::objects()
-                        ->distinct('staff_id')
-                        ->filter(array(
-                                    'onvacation' => 0,
-                                    'isactive' => 1,
-                                    )
-                                );
+                    //agents in depts $thisstaff can access
+                    $members = $thisstaff->getDeptAgents(array('available' => true));
 
                     if ($depts) {
                         $all_agent_depts = Dept::objects()->filter(
@@ -867,6 +1214,9 @@ function refer($tid, $target=null) {
                 $f->configure('prompt', $prompt);
 
             if ($_POST && $form->isValid()) {
+                // we need to clear this relation so we can create a fresh
+                // query that will get roles for all depts this agent can access
+                unset($thisstaff->ht['dept_access']);
                 foreach ($_POST['tids'] as $tid) {
                     if (($t=Ticket::lookup($tid))
                             // Make sure the agent is allowed to
@@ -889,9 +1239,10 @@ function refer($tid, $target=null) {
         case 'transfer':
             $inc = 'transfer.tmpl.php';
             $info[':action'] = '#tickets/mass/transfer';
-            $info[':title'] = sprintf('Transfer %s',
+            $info[':title'] = sprintf(__('Transfer %s'),
                     _N('selected ticket', 'selected tickets', $count));
             $form = TransferForm::instantiate($_POST);
+            $form->hideDisabled();
             if ($_POST && $form->isValid()) {
                 foreach ($_POST['tids'] as $tid) {
                     if (($t=Ticket::lookup($tid))
@@ -1098,23 +1449,45 @@ function refer($tid, $target=null) {
         $state = strtolower($status->getState());
 
         if (!$errors && $ticket->setStatus($status, $_REQUEST['comments'], $errors)) {
+            $failures = array();
+            // Set children statuses (if applicable)
+            if ($_REQUEST['children']) {
+                $children = $ticket->getChildren();
 
-            if ($state == 'deleted') {
-                $msg = sprintf('%s %s',
-                        sprintf(__('Ticket #%s'), $ticket->getNumber()),
-                        __('deleted sucessfully')
-                        );
-            } elseif ($state != 'open') {
-                 $msg = sprintf(__('%s status changed to %s'),
-                         sprintf(__('Ticket #%s'), $ticket->getNumber()),
-                         $status->getName());
-            } else {
-                $msg = sprintf(
-                        __('%s status changed to %s'),
-                        __('Ticket'),
-                        $status->getName());
+                foreach ($children as $cid) {
+                    $child = Ticket::lookup($cid[0]);
+                    if (!$child->setStatus($status, '', $errors))
+                        $failures[$cid[0]] = $child->getNumber();
+                }
             }
 
+            if (!$failures) {
+                if ($state == 'deleted') {
+                    $msg = sprintf('%s %s',
+                            sprintf(__('Ticket #%s'), $ticket->getNumber()),
+                            __('deleted sucessfully')
+                            );
+                } elseif ($state != 'open') {
+                     $msg = sprintf(__('%s status changed to %s'),
+                             sprintf(__('Ticket #%s'), $ticket->getNumber()),
+                             $status->getName());
+                } else {
+                    $msg = sprintf(
+                            __('%s status changed to %s'),
+                            __('Ticket'),
+                            $status->getName());
+                }
+            } else {
+                $tickets = array();
+                foreach ($failures as $id=>$num) {
+                    $tickets[] = sprintf('<a href="tickets.php?id=%d"><b>#%s</b></a>',
+                                    $id,
+                                    $num);
+                }
+                $info['warn'] = sprintf(__('Error updating ticket status for %s'),
+                                 ($tickets) ? implode(', ', $tickets) : __('child tickets')
+                                 );
+            }
             $_SESSION['::sysmsgs']['msg'] = $msg;
 
             Http::response(201, 'Successfully processed');
@@ -1273,7 +1646,7 @@ function refer($tid, $target=null) {
         if (!($ticket=Ticket::lookup($tid)))
             Http::response(404, __('No such ticket'));
 
-        if (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_REPLY) && !$thisstaff->isManager())
+        if (!$ticket->checkStaffPerm($thisstaff, Ticket::PERM_MARKANSWERED) && !$thisstaff->isManager($ticket->getDept()))
             Http::response(403, __('Permission denied'));
 
         $errors = array();
@@ -1331,10 +1704,17 @@ function refer($tid, $target=null) {
     }
 
     function triggerThreadAction($ticket_id, $thread_id, $action) {
+        global $thisstaff;
+
+        if (!($ticket = Ticket::lookup($ticket_id))
+                || !$ticket->checkStaffPerm($thisstaff))
+            Http::response(404, 'No such ticket thread entry');
+
         $thread = ThreadEntry::lookup($thread_id);
         if (!$thread)
             Http::response(404, 'No such ticket thread entry');
-        if ($thread->getThread()->getObjectId() != $ticket_id)
+        if ($thread->getThread()->getObjectType() != 'T'
+                || $thread->getThread()->getObjectId() != $ticket_id)
             Http::response(404, 'No such ticket thread entry');
 
         $valid = false;
@@ -1351,7 +1731,7 @@ function refer($tid, $target=null) {
         $thread->triggerAction($action);
     }
 
-    private function _changeSelectedTicketsStatus($state, $info=array(), $errors=array()) {
+    private static function _changeSelectedTicketsStatus($state, $info=array(), $errors=array()) {
 
         $count = $_REQUEST['count'] ?:
             ($_REQUEST['tids'] ?  count($_REQUEST['tids']) : 0);
@@ -1383,7 +1763,7 @@ function refer($tid, $target=null) {
         return self::_changeStatus($state, $info, $errors);
     }
 
-    private function _changeTicketStatus($ticket, $state, $info=array(), $errors=array()) {
+    private static function _changeTicketStatus($ticket, $state, $info=array(), $errors=array()) {
 
         $verb = TicketStateField::getVerb($state);
 
@@ -1413,10 +1793,13 @@ function refer($tid, $target=null) {
         $info['status_id'] = $info['status_id'] ?: $ticket->getStatusId();
         $info['comments'] = Format::htmlchars($_REQUEST['comments']);
 
+        // Has Children?
+        $info['children'] = count($ticket->getChildren());
+
         return self::_changeStatus($state, $info, $errors);
     }
 
-    private function _changeStatus($state, $info=array(), $errors=array()) {
+    private static function _changeStatus($state, $info=array(), $errors=array()) {
 
         if ($info && isset($info['errors']))
             $errors = array_merge($errors, $info['errors']);
@@ -1437,6 +1820,16 @@ function refer($tid, $target=null) {
          include STAFFINC_DIR . 'ticket-tasks.inc.php';
     }
 
+    function relations($tid) {
+        global $thisstaff;
+
+        if (!($ticket=Ticket::lookup($tid))
+                || !$ticket->checkStaffPerm($thisstaff))
+            Http::response(404, 'Unknown ticket');
+
+         include STAFFINC_DIR . 'ticket-relations.inc.php';
+    }
+
     function addTask($tid, $vars=array()) {
         global $thisstaff;
 
@@ -1456,7 +1849,7 @@ function refer($tid, $target=null) {
                 && ($f=$iform->getField('duedate'))) {
             $f->configure('max', Misc::db2gmtime($ticket->getEstDueDate()));
         }
-        $vars = array_merge($_SESSION[':form-data'], $vars);
+        $vars = array_merge($_SESSION[':form-data'] ?: array(), $vars);
 
         if ($_POST) {
             Draft::deleteForNamespace(
@@ -1479,6 +1872,7 @@ function refer($tid, $target=null) {
                 $vars['default_formdata'] = $form->getClean();
                 $vars['internal_formdata'] = $iform->getClean();
                 $desc = $form->getField('description');
+                $vars['description'] = $desc->getClean();
                 if ($desc
                         && $desc->isAttachmentsEnabled()
                         && ($attachments=$desc->getWidget()->getAttachments()))
@@ -1592,7 +1986,7 @@ function refer($tid, $target=null) {
                     // Clear attachment list
                     $reply_attachments_form->setSource(array());
                     $reply_attachments_form->getField('attachments')->reset();
-                    Draft::deleteForNamespace('task.reply.'.$task->getId(),
+                    Draft::deleteForNamespace('task.response.'.$task->getId(),
                             $thisstaff->getId());
                 } else {
                     if (!$errors['err'])
@@ -1616,22 +2010,63 @@ function refer($tid, $target=null) {
         else
             $queue = AdhocSearch::load($id);
 
+       if (!$queue)
+           Http::response(404, 'Unknown Queue');
+
+        return $this->queueExport($queue);
+    }
+
+    function queueExport(CustomQueue $queue) {
+        global $thisstaff;
+
         if (!$thisstaff)
             Http::response(403, 'Agent login is required');
         elseif (!$queue || !$queue->checkAccess($thisstaff))
             Http::response(404, 'No such saved queue');
 
+        $errors = array();
         if ($_POST && is_array($_POST['fields'])) {
             // Cache export preferences
             $id = $queue->getId();
             $_SESSION['Export:Q'.$id]['fields'] = $_POST['fields'];
             $_SESSION['Export:Q'.$id]['filename'] = $_POST['filename'];
-            $_SESSION['Export:Q'.$id]['delimiter'] = $_POST['delimiter'];
-
+            $_SESSION['Export:Q'.$id]['delimiter'] = $_POST['csv-delimiter'];
+            // Save fields selection if requested
             if ($queue->isSaved() && isset($_POST['save-changes']))
                $queue->updateExports(array_flip($_POST['fields']));
 
-            Http::response(201, 'Export Ready');
+            // Filename of the report
+            if (isset($_POST['filename'])
+                    && ($parts = pathinfo($_POST['filename']))) {
+                $filename = $_POST['filename'];
+                if (strcasecmp($parts['extension'], 'csv'))
+                      $filename ="$filename.csv";
+            } else {
+                $filename = sprintf('%s Tickets-%s.csv',
+                        $queue->getName(),
+                        date('Ymd'));
+            }
+
+            try {
+                $interval = 5;
+                $options = ['filename' => $filename,
+                    'interval' => $interval, 'delimiter' => $_POST['csv-delimiter']];
+                // Create desired exporter
+                $exporter = new CsvExporter($options);
+                // Acknowledge the export
+                $exporter->ack();
+                // Phew... now we're free to do the export
+                // Ask the queue to export to the exporter
+                $queue->export($exporter);
+                $exporter->finalize();
+                // Email the export if it exists
+                $exporter->email($thisstaff);
+                // Delete the file.
+                @$exporter->delete();
+                exit;
+            } catch (Exception $ex) {
+                $errors['err'] = __('Unable to prepare the export');
+            }
         }
 
         include STAFFINC_DIR . 'templates/queue-export.tmpl.php';

include/ajax.users.php

@@ -19,6 +19,7 @@ if(!defined('INCLUDE_DIR')) die('403');
 
 include_once(INCLUDE_DIR.'class.ticket.php');
 require_once INCLUDE_DIR.'class.note.php';
+require_once INCLUDE_DIR.'ajax.tickets.php';
 
 class UsersAjaxAPI extends AjaxController {
 
@@ -33,7 +34,7 @@ class UsersAjaxAPI extends AjaxController {
         if (!$_REQUEST['q'])
             return $this->json_encode($matches);
 
-        $q = $_REQUEST['q'];
+        $q = Format::sanitize($_REQUEST['q']);
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
         $users=array();
         $emails=array();
@@ -73,16 +74,18 @@ class UsersAjaxAPI extends AjaxController {
                     return $this->search($type, $fulltext);
                 }
             } else {
-                $filter = Q::any(array(
-                    'emails__address__contains' => $q,
-                    'name__contains' => $q,
-                    'org__name__contains' => $q,
-                    'account__username__contains' => $q,
-                ));
-                if (UserForm::getInstance()->getField('phone'))
-                    $filter->add(array('cdata__phone__contains' => $q));
-
-                $users->filter($filter);
+                $base = clone $users;
+                $users->filter(array('name__contains' => $q));
+                $users->union($base->copy()->filter(array(
+                                'org__name__contains' => $q)), false);
+                $users->union($base->copy()->filter(array(
+                                'emails__address__contains' => $q)),  false);
+                $users->union($base->copy()->filter(array(
+                                'account__username__contains' => $q)), false);
+                if (UserForm::getInstance()->getField('phone')) {
+                      $users->union($base->copy()->filter(array(
+                                'cdata__phone__contains' => $q)), false);
+                }
             }
 
             // Omit already-imported remote users
@@ -104,7 +107,7 @@ class UsersAjaxAPI extends AjaxController {
                 }
                 $name = Format::htmlchars(new UsersName($name));
                 $matches[] = array('email'=>$email, 'name'=>$name, 'info'=>"$email - $name",
-                    "id" => $id, "/bin/true" => $_REQUEST['q']);
+                    "id" => $id, "/bin/true" => $q);
             }
             usort($matches, function($a, $b) { return strcmp($a['name'], $b['name']); });
         }
@@ -118,7 +121,12 @@ class UsersAjaxAPI extends AjaxController {
 
         if(!$thisstaff)
             Http::response(403, 'Login Required');
-        elseif(!($user = User::lookup($id)))
+
+        if (!$thisstaff->hasPerm(User::PERM_DIRECTORY)
+                && !$thisstaff->hasPerm(User::PERM_EDIT))
+            Http::response(403, 'Permission Denied');
+
+        if(!($user = User::lookup($id)))
             Http::response(404, 'Unknown user');
 
         $info = array(
@@ -137,7 +145,6 @@ class UsersAjaxAPI extends AjaxController {
 
     }
 
-
     function editUser($id) {
         global $thisstaff;
 
@@ -167,6 +174,10 @@ class UsersAjaxAPI extends AjaxController {
             Http::response(404, 'Unknown user');
 
         $errors = array();
+        $form = UserForm::getUserForm()->getForm($_POST);
+        if (!is_string($form->getField('name')->getValue()))
+            Http::response(404, 'Invalid Data');
+
         if ($user->updateInfo($_POST, $errors, true) && !$errors)
              Http::response(201, $user->to_json(),  'application/json');
 
@@ -174,7 +185,7 @@ class UsersAjaxAPI extends AjaxController {
         include(STAFFINC_DIR . 'templates/user.tmpl.php');
     }
 
-    function register($id) {
+    static function register($id) {
         global $thisstaff;
 
         if (!$thisstaff)
@@ -269,6 +280,14 @@ class UsersAjaxAPI extends AjaxController {
     }
 
     function getUser($id=false) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Login Required');
+
+        if (!$thisstaff->hasPerm(User::PERM_DIRECTORY)
+                && !$thisstaff->hasPerm(User::PERM_EDIT))
+            Http::response(403, 'Permission Denied');
 
         if(($user=User::lookup(($id) ? $id : $_REQUEST['id'])))
            Http::response(201, $user->to_json(), 'application/json');
@@ -282,7 +301,7 @@ class UsersAjaxAPI extends AjaxController {
         return self::addUser();
     }
 
-    function addUser() {
+    static function addUser() {
         global $thisstaff;
 
         $info = array();
@@ -296,6 +315,8 @@ class UsersAjaxAPI extends AjaxController {
 
             $info['title'] = __('Add New User');
             $form = UserForm::getUserForm()->getForm($_POST);
+            if (!is_string($form->getField('name')->getValue()))
+                Http::response(404, 'Invalid Data');
             if (($user = User::fromForm($form)))
                 Http::response(201, $user->to_json(), 'application/json');
 
@@ -315,7 +336,7 @@ class UsersAjaxAPI extends AjaxController {
         elseif (!$bk || !$id)
             Http::response(422, 'Backend and user id required');
         elseif (!($backend = AuthenticationBackend::getSearchDirectoryBackend($bk))
-                || !($user_info = $backend->lookup($id)))
+                || !($user_info = $backend->lookup(html_entity_decode($id))))
             Http::response(404, 'User not found');
 
         $form = UserForm::getUserForm()->getForm($user_info);
@@ -414,6 +435,8 @@ class UsersAjaxAPI extends AjaxController {
             Http::response(403, 'Login Required');
         elseif (!($user = User::lookup($id)))
             Http::response(404, 'Unknown user');
+        elseif (!$thisstaff->hasPerm(User::PERM_EDIT))
+            Http::response(403, 'Access Denied');
 
         $info = array();
         $info['title'] = sprintf(__('Organization for %s'),
@@ -426,6 +449,9 @@ class UsersAjaxAPI extends AjaxController {
                 if (!($org = Organization::lookup($_POST['orgid'])))
                     $info['error'] = __('Unknown organization selected');
             } else { //Creating new org.
+                if (!$thisstaff->hasPerm(Organization::PERM_CREATE))
+                    Http::response(403, 'Permission Denied');
+
                 $form = OrganizationForm::getDefaultForm()->getForm($_POST);
                 if (!($org = Organization::fromForm($form)))
                     $info['error'] = __('Unable to create organization.')
@@ -513,5 +539,28 @@ class UsersAjaxAPI extends AjaxController {
         Http::response(201, 'Successfully managed');
     }
 
+    function exportTickets($id) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Agent login is required');
+        elseif (!$id)
+            Http::response(403, __('User ID Required'));
+
+        $user = User::lookup($id);
+        if (!$user)
+            Http::response(403, __('User Not Found'));
+
+        $queue = $user->getTicketsQueue();
+
+        if ($_POST) {
+            $api = new TicketsAjaxAPI();
+            return $api->queueExport($queue);
+        }
+
+        $info = array('action' => "#users/$id/tickets/export");
+
+        include STAFFINC_DIR . 'templates/queue-export.tmpl.php';
+    }
 }
 ?>

include/api.cron.php

@@ -3,40 +3,45 @@
 include_once INCLUDE_DIR.'class.cron.php';
 
 class CronApiController extends ApiController {
-
     function execute() {
 
-        if(!($key=$this->requireApiKey()) || !$key->canExecuteCron())
+        if (!($key=$this->requireApiKey()) || !$key->canExecuteCron())
             return $this->exerr(401, __('API key not authorized'));
 
         $this->run();
     }
 
-    /* private */
-    function run() {
-        global $ost;
-
+    protected function run() {
         Cron::run();
-       
-        $ost->logDebug(__('Cron Job'),__('Cron job executed').' ['.$_SERVER['REMOTE_ADDR'].']');
+        // TODO: Add elapsed time to the debug log
+        $this->debug(__('Cron Job'),
+                sprintf('%s [%s]', __('Cron job executed'), $this->getRemoteAddr()));
         $this->response(200,'Completed');
     }
 }
 
 class LocalCronApiController extends CronApiController {
 
-    function response($code, $resp) {
+    public function isCli() {
+        return true;
+    }
 
-        if($code == 200) //Success - exit silently.
+    protected function getRemoteAddr() {
+        // Local Cron doesn't have IP Addr set
+        return 'CLI';
+    }
+
+    public function response($code, $response) {
+
+        if ($code == 200) //Success - exit silently.
             exit(0);
-        
-        //On error echo the response (error)
-        echo $resp;
+
+        echo $response;
         exit(1);
     }
-        
-    function call() {
-        $cron = new LocalCronApiController();
+
+    static function call() {
+        $cron = new LocalCronApiController('cli');
         $cron->run();
     }
 }

include/api.tickets.php

@@ -15,7 +15,12 @@ class TicketApiController extends ApiController {
                 array("name", "type", "data", "encoding", "size")
             ),
             "message", "ip", "priorityId",
-            "system_emails", "thread_entry_recipients"
+            "system_emails" => array(
+                "*" => "*"
+            ),
+            "thread_entry_recipients" => array (
+                "*" => array("to", "cc")
+            )
         );
         # Fetch dynamic form field names for the given help topic and add
         # the names to the supported request structure
@@ -38,15 +43,22 @@ class TicketApiController extends ApiController {
             foreach ($form->getFields() as $field)
                 $supported[] = $field->get('name');
 
-        if(!strcasecmp($format, 'email')) {
-            $supported = array_merge($supported, array('header', 'mid',
-                'emailId', 'to-email-id', 'ticketId', 'reply-to', 'reply-to-name',
-                'in-reply-to', 'references', 'thread-type', 'system_emails',
-                'mailflags' => array('bounce', 'auto-reply', 'spam', 'viral'),
-                'recipients' => array('*' => array('name', 'email', 'source'))
-                ));
-
-            $supported['attachments']['*'][] = 'cid';
+        switch ($format) {
+            case 'email':
+                $supported = array_merge($supported, [
+                    'header', 'mid', 'emailId', 'to-email-id', 'ticketId', 'reply-to',
+                    'reply-to-name', 'in-reply-to', 'references', 'thread-type', 'system_emails',
+                    'mailflags' => ['bounce', 'auto-reply', 'spam', 'viral'],
+                    'recipients' => ['*' => ['name', 'email', 'source']]
+                ]);
+                $supported['attachments']['*'][] = 'cid';
+                break;
+            case 'json':
+            case 'xml':
+                $supported = array_merge($supported, [
+                    'duedate', 'slaId', 'staffId'
+                ]);
+                break;
         }
 
         return $supported;
@@ -73,7 +85,7 @@ class TicketApiController extends ApiController {
             $data['attachments'] = array();
 
         //Validate attachments: Do error checking... soft fail - set the error and pass on the request.
-        if ($data['attachments'] && is_array($data['attachments'])) {
+        if (isset($data['attachments']) && is_array($data['attachments'])) {
             foreach($data['attachments'] as &$file) {
                 if ($file['encoding'] && !strcasecmp($file['encoding'], 'base64')) {
                     if(!($file['data'] = base64_decode($file['data'], true)))
@@ -86,7 +98,9 @@ class TicketApiController extends ApiController {
                     $file['id'] = $F->getId();
                 }
                 catch (FileUploadError $ex) {
-                    $file['error'] = $file['name'] . ': ' . $ex->getMessage();
+                    $name = $file['name'];
+                    $file = array();
+                    $file['error'] = Format::htmlchars($name) . ': ' . $ex->getMessage();
                 }
             }
             unset($file);
@@ -98,61 +112,84 @@ class TicketApiController extends ApiController {
 
     function create($format) {
 
-        if(!($key=$this->requireApiKey()) || !$key->canCreateTickets())
+        if (!($key=$this->requireApiKey()) || !$key->canCreateTickets())
             return $this->exerr(401, __('API key not authorized'));
 
         $ticket = null;
-        if(!strcasecmp($format, 'email')) {
-            # Handle remote piped emails - could be a reply...etc.
-            $ticket = $this->processEmail();
+        if (!strcasecmp($format, 'email')) {
+            // Process remotely piped emails - could be a reply...etc.
+            $ticket = $this->processEmailRequest();
         } else {
-            # Parse request body
+            // Get and Parse request body data for the format
             $ticket = $this->createTicket($this->getRequest($format));
         }
 
-        if(!$ticket)
-            return $this->exerr(500, __("Unable to create new ticket: unknown error"));
 
-        $this->response(201, $ticket->getNumber());
+
+        if ($ticket)
+            $this->response(201, $ticket->getNumber());
+        else
+            $this->exerr(500, _S("unknown error"));
+
     }
 
     /* private helper functions */
 
-    function createTicket($data) {
+    function createTicket($data, $source = 'API') {
 
         # Pull off some meta-data
         $alert       = (bool) (isset($data['alert'])       ? $data['alert']       : true);
         $autorespond = (bool) (isset($data['autorespond']) ? $data['autorespond'] : true);
 
-        # Assign default value to source if not defined, or defined as NULL
-        $data['source'] = isset($data['source']) ? $data['source'] : 'API';
+        // Assign default value to source if not defined, or defined as NULL
+        $data['source'] ??= $source;
 
-        # Create the ticket with the data (attempt to anyway)
+        // Create the ticket with the data (attempt to anyway)
         $errors = array();
+        if (($ticket = Ticket::create($data, $errors, $data['source'],
+                        $autorespond, $alert)) &&  !$errors)
+            return $ticket;
 
-        $ticket = Ticket::create($data, $errors, $data['source'], $autorespond, $alert);
-        # Return errors (?)
+        // Ticket create failed Bigly - got errors?
+        $title = null;
+        // Got errors?
         if (count($errors)) {
-            if(isset($errors['errno']) && $errors['errno'] == 403)
-                return $this->exerr(403, __('Ticket denied'));
-            else
-                return $this->exerr(
-                        400,
-                        __("Unable to create new ticket: validation errors").":\n"
-                        .Format::array_implode(": ", "\n", $errors)
-                        );
-        } elseif (!$ticket) {
-            return $this->exerr(500, __("Unable to create new ticket: unknown error"));
+            // Ticket denied? Say so loudly so it can standout from generic
+            // validation errors
+            if (isset($errors['errno']) && $errors['errno'] == 403) {
+                $title = _S('Ticket denied');
+                $error = sprintf("%s: %s\n\n%s",
+                        $title, $data['email'], $errors['err']);
+            } else {
+                // unpack the errors
+                $error = Format::array_implode("\n", "\n", $errors);
+            }
+        } else {
+            // unknown reason - default
+            $error = _S('unknown error');
         }
 
-        return $ticket;
+        $error = sprintf('%s :%s',
+                _S('Unable to create new ticket'), $error);
+        return $this->exerr($errors['errno'] ?: 500, $error, $title);
     }
 
-    function processEmail($data=false) {
+    function processEmailRequest() {
+        return $this->processEmail();
+    }
 
-        if (!$data)
-            $data = $this->getEmailRequest();
+    function processEmail($data=false, array $defaults = []) {
 
+        try {
+            if (!$data)
+                $data = $this->getEmailRequest();
+            elseif (!is_array($data))
+                $data = $this->parseEmail($data);
+        } catch (Exception $ex)  {
+            throw new EmailParseError($ex->getMessage());
+        }
+
+        $data = array_merge($defaults, $data);
         $seen = false;
         if (($entry = ThreadEntry::lookupByEmailHeaders($data, $seen))
             && ($message = $entry->postEmail($data))
@@ -176,18 +213,34 @@ class TicketApiController extends ApiController {
         // All emails which do not appear to be part of an existing thread
         // will always create new "Tickets". All other objects will need to
         // be created via the web interface or the API
-        return $this->createTicket($data);
+        try {
+            return $this->createTicket($data, 'Email');
+        } catch (TicketApiError $err) {
+            // Check if the ticket was denied by a filter or banlist
+            if ($err->isDenied() && $data['mid']) {
+                // We need to log the Message-Id (mid) so we don't
+                // process the same email again in subsequent fetches
+                $entry = new ThreadEntry();
+                $entry->logEmailHeaders(0, $data['mid']);
+                // throw TicketDenied exception so the caller can handle it
+                // accordingly
+                throw new TicketDenied($err->getMessage());
+            } else {
+                // otherwise rethrow this bad baby as it is!
+                throw $err;
+            }
+        }
     }
-
 }
 
 //Local email piping controller - no API key required!
 class PipeApiController extends TicketApiController {
 
-    //Overwrite grandparent's (ApiController) response method.
+    // Overwrite grandparent's (ApiController) response method.
     function response($code, $resp) {
 
-        //Use postfix exit codes - instead of HTTP
+        // It's important to use postfix exit codes for local piping instead
+        // of HTTP's so the piping script can process them accordingly
         switch($code) {
             case 201: //Success
                 $exitcode = 0;
@@ -212,19 +265,33 @@ class PipeApiController extends TicketApiController {
             default: //Temp (unknown) failure - retry
                 $exitcode = 75;
         }
-
-        //echo "$code ($exitcode):$resp";
         //We're simply exiting - MTA will take care of the rest based on exit code!
         exit($exitcode);
     }
 
-    function  process() {
-        $pipe = new PipeApiController();
-        if(($ticket=$pipe->processEmail()))
-           return $pipe->response(201, $ticket->getNumber());
+    static function process($sapi=null) {
+        $pipe = new PipeApiController($sapi);
+        if (($ticket=$pipe->processEmail()))
+           return $pipe->response(201,
+                   is_object($ticket) ? $ticket->getNumber() : $ticket);
 
         return $pipe->exerr(416, __('Request failed - retry again!'));
     }
+
+    static function local() {
+        return self::process('cli');
+    }
 }
 
+class TicketApiError extends Exception {
+
+    // Check if exception is because of denial
+    public function isDenied() {
+        return ($this->getCode() === 403);
+    }
+}
+
+class TicketDenied extends Exception {}
+class EmailParseError extends Exception {}
+
 ?>

include/class.2fa.php

@@ -0,0 +1,263 @@
+<?php
+
+/**
+ * TwoFactorAuthentication backend
+ *
+ * Provides the basis of abstracting 2fa backends
+
+ * The authentication backend should define a validate() method which
+ * receives a user and OPT.
+ */
+abstract class TwoFactorAuthenticationBackend extends ServiceRegistry {
+    // Global registry
+    static protected $registry = array();
+    // Grace period in minutes before OTP is expired and user logged out
+    // It's hardcoded to 6 minutes here but downstream backends can make it
+    // configurable
+    protected $timeout = 6;
+
+    // Maximum number of validation attempts before the user is logged out
+    // It's hardcoded to 3 attempts here but downstream backends can make it
+    // configurable
+    protected $maxstrikes = 3;
+
+    // Base properties
+    static $id;
+    static $name;
+    static $desc;
+
+    // Forms
+    private $_setupform;
+    private $_inputform;
+
+
+    // Send OTP to user specified and stash it
+    abstract function send($user);
+    // validate OTP provided by user
+    abstract function validate($form, $user);
+
+    function getDescription() {
+        return __(static::$desc);
+    }
+
+    function getTimeout() {
+        return $this->timeout;
+    }
+
+    function getMaxStrikes() {
+        return $this->maxstrikes;
+    }
+
+    protected function getSetupOptions() {
+        return array();
+    }
+
+    protected function getInputOptions() {
+        return array();
+    }
+
+    // stash OTP info in the session
+    protected function store($otp) {
+       $store =  &$_SESSION['_2fa'][$this->getId()];
+       $store = ['otp' => $otp, 'time' => time(), 'strikes' => 0];
+       return $store;
+    }
+
+    // Validate OPT
+    // On strict mode check strikes and timeout
+    protected function _validate($otp, $strict=true) {
+        $store = &$_SESSION['_2fa'][$this->getId()];
+        // Track and check the attempts
+        $store['strikes'] += 1;
+        if ($strict && $store['strikes'] > $this->getMaxStrikes())
+            throw new ExpiredOTP(__('Too many attempts'));
+
+        // Check timeout - if expired throw an exception.
+        if ($strict
+                && ($timeout=$this->getTimeout())
+                && ($store['time']+($timeout*60)) < time())
+            throw new ExpiredOTP(__('Expired OTP'));
+
+        // Check the OTP
+        return (!strcmp($store['otp'], $otp));
+    }
+
+    // Called on a successfull validation for house keeping e.g clear 2fa
+    // flags
+    protected function onValidate($user) {
+         $user->clear2FA();
+    }
+
+    // Get a form the user uses to setup 2fa
+    function getSetupForm($data=null) {
+        if (!$this->_setupForm) {
+            $this->_setupForm = new SimpleForm($this->getSetupOptions(), $data);
+        }
+        return $this->_setupForm;
+    }
+
+    // Get a form the user uses to input OTP
+    function getInputForm($data=null) {
+        if (!$this->_inputForm) {
+            $this->_inputForm = new SimpleForm($this->getInputOptions(), $data);
+        }
+        return $this->_inputForm;
+    }
+
+    static function register($class) {
+        if (is_string($class) && class_exists($class))
+            $class = new $class();
+
+        if (!is_object($class)
+                || !($class instanceof TwoFactorAuthenticationBackend))
+            return false;
+
+        static::$registry[$class->getBkId()] = $class;
+    }
+
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::getRegistry());
+    }
+
+    static function getBackend($id) {
+
+        if ($id
+                && ($backends = static::allRegistered())
+                && isset($backends[$id]))
+            return $backends[$id];
+    }
+
+    static function lookup($id) {
+        return static::getBackend($id);
+    }
+}
+
+class ExpiredOTP extends Exception {}
+
+/*
+ * user type container classes to aid in registry segmentation
+ *
+ */
+abstract class Staff2FABackend extends TwoFactorAuthenticationBackend {
+    static protected $registry = array();
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::allRegistered());
+    }
+    abstract function send($user);
+    abstract function validate($form, $user);
+}
+
+abstract class User2FABackend extends TwoFactorAuthenticationBackend {
+    static protected $registry = array();
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::allRegistered());
+    }
+    abstract function send($user);
+    abstract function validate($form, $user);
+}
+
+/*
+ * Email2FABackend
+ *
+ * Email based two factor authentication.
+ *
+ * This is the default 2FA that works out of the box once users configure
+ * it.
+ *
+ */
+
+class Email2FABackend extends TwoFactorAuthenticationBackend {
+    static $id = "2fa-email";
+    static $name = /* @trans */ 'Email';
+    static $desc = /* @trans */ 'Verification codes are sent by email';
+
+    protected function getSetupOptions() {
+        return array(
+            'email' => new TextboxField(array(
+                'id'=>2, 'label'=>__('Email Address'), 'required'=>true, 'default'=>'',
+                'validator'=>'email', 'hint'=>__('Valid email address'),
+                'configuration'=>array('size'=>40, 'length'=>40),
+            )),
+        );
+    }
+
+    protected function getInputOptions() {
+        return array(
+            'token' => new TextboxField(array(
+                'id'=>1, 'label'=>__('Verification Code'), 'required'=>true, 'default'=>'',
+                'validator'=>'number',
+                'hint'=>__('Please enter the code you were sent'),
+                'configuration'=>array(
+                    'size'=>40, 'length'=>40,
+                    'autocomplete' => 'one-time-code',
+                    'inputmode' => 'numeric',
+                    'pattern' => '[0-9]*',
+                    'validator-error' => __('Invalid Code format'),
+                    ),
+            )),
+        );
+    }
+
+    function validate($form, $user) {
+        // Make sure form is valid and token exists
+        if (!($form->isValid()
+                    && ($clean=$form->getClean())
+                    && $clean['token']))
+            return false;
+
+        // upstream validation might throw an exception due to expired token
+        // or too many attempts (timeout). It's the responsibility of the
+        // caller to catch and handle such exceptions.
+        if (!$this->_validate($clean['token']))
+            return false;
+
+        // Validator doesn't do house cleaning - it's our responsibility
+        $this->onValidate($user);
+        return true;
+    }
+
+    function send($user) {
+        global $ost, $cfg;
+
+        // Get backend configuration for this user
+        if (!$cfg || !($info = $user->get2FAConfig($this->getId())))
+            return false;
+
+        // Email to send the OTP via
+        if (!($email = $cfg->getAlertEmail() ?: $cfg->getDefaultEmail()))
+            return false;
+
+        // Generate OTP
+        $otp = Misc::randNumber(6);
+        // Stash it in the session
+        $this->store($otp);
+
+        $template = 'email2fa-staff';
+        $content = Page::lookupByType($template);
+
+        if (!$content)
+           return new BaseError(/* @trans */ 'Unable to retrieve two factor authentication email template');
+
+        $vars = array(
+           'url' => $ost->getConfig()->getBaseUrl(),
+           'otp' => $otp,
+           'staff' => $user,
+           'recipient' => $user,
+       );
+
+       $lang = $user->lang ?: $user->getExtraAttr('browser_lang');
+       $msg = $ost->replaceTemplateVariables(array(
+           'subj' => $content->getLocalName($lang),
+           'body' => $content->getLocalBody($lang),
+       ), $vars);
+
+        $email->send($user->getEmail(), Format::striptags($msg['subj']),
+           $msg['body']);
+
+        // MD5 here is not meant to be secure here - just done to avoid plain leaks
+        return md5($otp);
+    }
+}
+// Register email2fa for both agents and users (parent class)
+TwoFactorAuthenticationBackend::register('Email2FABackend');
+?>

include/class.ajax.php

@@ -25,12 +25,18 @@ require_once (INCLUDE_DIR.'class.api.php');
  * consistency.
  */
 class AjaxController extends ApiController {
+
     function staffOnly() {
         global $thisstaff;
-        if(!$thisstaff || !$thisstaff->isValid()) {
-            Http::response(401,sprintf(__('Access Denied. IP %s'),$_SERVER['REMOTE_ADDR']));
+
+        if (!$thisstaff || !$thisstaff->isValid()) {
+            $this->exerr(401, sprintf('%s (%s)',
+                        __('Access Denied'), $_SERVER['REMOTE_ADDR']));
         }
+
+        return true;
     }
+
     /**
      * Convert a PHP array into a JSON-encoded string
      */
@@ -43,6 +49,6 @@ class AjaxController extends ApiController {
     }
 
     function get($var, $default=null) {
-        return (isset($_GET[$var])) ? $_GET[$var] : $default;
+        return $_GET[$var] ?: $default;
     }
 }

include/class.api.php

@@ -13,6 +13,8 @@
 
     vim: expandtab sw=4 ts=4 sts=4:
 **********************************************************************/
+include_once INCLUDE_DIR.'class.controller.php';
+
 class API {
 
     var $id;
@@ -91,15 +93,15 @@ class API {
     }
 
     /** Static functions **/
-    function add($vars, &$errors) {
+    static function add($vars, &$errors) {
         return API::save(0, $vars, $errors);
     }
 
-    function validate($key, $ip) {
+    static function validate($key, $ip) {
         return ($key && $ip && self::getIdByKey($key, $ip));
     }
 
-    function getIdByKey($key, $ip='') {
+    static function getIdByKey($key, $ip='') {
 
         $sql='SELECT id FROM '.API_KEY_TABLE.' WHERE apikey='.db_input($key);
         if($ip)
@@ -111,15 +113,15 @@ class API {
         return $id;
     }
 
-    function lookupByKey($key, $ip='') {
+    static function lookupByKey($key, $ip='') {
         return self::lookup(self::getIdByKey($key, $ip));
     }
 
-    function lookup($id) {
+    static function lookup($id) {
         return ($id && is_numeric($id) && ($k= new API($id)) && $k->getId()==$id)?$k:null;
     }
 
-    function save($id, $vars, &$errors) {
+    static function save($id, $vars, &$errors) {
 
         if(!$id && (!$vars['ipaddr'] || !Validator::is_ip($vars['ipaddr'])))
             $errors['ipaddr'] = __('Valid IP is required');
@@ -144,7 +146,7 @@ class API {
             $sql='INSERT INTO '.API_KEY_TABLE.' SET '.$sql
                 .',created=NOW() '
                 .',ipaddr='.db_input($vars['ipaddr'])
-                .',apikey='.db_input(strtoupper(md5(time().$vars['ipaddr'].md5(Misc::randCode(16)))));
+                .',apikey='.db_input(strtoupper(Misc::randCode(48, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')));
 
             if(db_query($sql) && ($id=db_insert_id()))
                 return $id;
@@ -165,28 +167,51 @@ class API {
  * API request.
  */
 
-class ApiController {
+class ApiController extends Controller {
 
-    var $apikey;
+    private $sapi;
+    private $key;
+
+    public function __construct($sapi = null) {
+        // Set API Interface the request is coming from
+        $this->sapi = $sapi ?: (osTicket::is_cli() ? 'cli' : 'http');
+    }
+
+    public function isCli() {
+        return (strcasecmp($this->sapi, 'cli') === 0);
+    }
+
+    private function getInputStream() {
+        return $this->isCli() ? 'php://stdin' : 'php://input';
+    }
+
+    protected function getRemoteAddr() {
+       return $_SERVER['REMOTE_ADDR'];
+    }
+
+    protected function getApiKey() {
+        return $_SERVER['HTTP_X_API_KEY'];
+    }
 
     function requireApiKey() {
-        # Validate the API key -- required to be sent via the X-API-Key
-        # header
-
-        if(!($key=$this->getApiKey()))
+        // Require a valid API key sent as X-API-Key HTTP header
+        // see getApiKey method.
+        if (!($key=$this->getKey()))
             return $this->exerr(401, __('Valid API key required'));
-        elseif (!$key->isActive() || $key->getIPAddr()!=$_SERVER['REMOTE_ADDR'])
+        elseif (!$key->isActive() || $key->getIPAddr() != $this->getRemoteAddr())
             return $this->exerr(401, __('API key not found/active or source IP not authorized'));
 
         return $key;
     }
 
-    function getApiKey() {
+    function getKey() {
+        // Lookup record using sent API Key && IP Addr
+        if (!$this->key
+                && ($key=$this->getApiKey())
+                && ($ip=$this->getRemoteAddr()))
+            $this->key = API::lookupByKey($key, $ip);
 
-        if (!$this->apikey && isset($_SERVER['HTTP_X_API_KEY']) && isset($_SERVER['REMOTE_ADDR']))
-            $this->apikey = API::lookupByKey($_SERVER['HTTP_X_API_KEY'], $_SERVER['REMOTE_ADDR']);
-
-        return $this->apikey;
+        return $this->key;
     }
 
     /**
@@ -194,20 +219,28 @@ class ApiController {
      * hashtable. For JSON formats, this is mostly a noop, the conversion
      * work will be done for XML requests
      */
-    function getRequest($format) {
-        global $ost;
-
-        $input = osTicket::is_cli()?'php://stdin':'php://input';
-
+    function getRequest($format, $validate=true) {
+        $input = $this->getInputStream();
         if (!($stream = @fopen($input, 'r')))
-            $this->exerr(400, __("Unable to read request body"));
+            $this->exerr(400, sprintf('%s (%s)',
+                        __("Unable to read request body"), $input));
 
+        return $this->parseRequest($stream, $format, $validate);
+    }
+
+    function getEmailRequest() {
+        if (!($data=$this->getRequest('email', false)))
+            $this->exerr(400, __("Unable to read email request"));
+
+        return $data;
+    }
+
+    function parseRequest($stream, $format, $validate=true) {
         $parser = null;
         switch(strtolower($format)) {
             case 'xml':
                 if (!function_exists('xml_parser_create'))
-                    $this->exerr(501, __('XML extension not supported'));
-
+                    return $this->exerr(501, __('XML extension not supported'));
                 $parser = new ApiXmlDataParser();
                 break;
             case 'json':
@@ -217,23 +250,24 @@ class ApiController {
                 $parser = new ApiEmailDataParser();
                 break;
             default:
-                $this->exerr(415, __('Unsupported data format'));
+                return $this->exerr(415, __('Unsupported data format'));
         }
 
-        if (!($data = $parser->parse($stream)))
+        if (!($data = $parser->parse($stream)) || !is_array($data)) {
             $this->exerr(400, $parser->lastError());
+        }
 
         //Validate structure of the request.
-        $this->validate($data, $format, false);
+        if ($validate && $data)
+            $this->validate($data, $format, false);
 
         return $data;
     }
 
-    function getEmailRequest() {
-        return $this->getRequest('email');
+    function parseEmail($content) {
+        return $this->parseRequest($content, 'email', false);
     }
 
-
     /**
      * Structure to validate the request against -- must be overridden to be
      * useful
@@ -257,14 +291,11 @@ class ApiController {
             } elseif (in_array($key, $structure)) {
                 continue;
             }
-            if ($strict)
-                return $this->exerr(400, sprintf(__("%s: Unexpected data received in API request"), "$prefix$key"));
-            else
-                $ost->logWarning(__('API Unexpected Data'),
-                    sprintf(__("%s: Unexpected data received in API request"), "$prefix$key"),
-                    false);
-        }
 
+            $error = sprintf(__("%s: Unexpected data received in API request"),
+                    "$prefix$key");
+            $this->onError(400, $error, __('Unexpected Data'), !$strict);
+        }
         return true;
     }
 
@@ -280,37 +311,66 @@ class ApiController {
                 $strict);
     }
 
+    protected function debug($subj, $msg) {
+        return $this->log($subj, $msg, LOG_DEBUG);
+    }
+
+    protected function logError($subj, $msg, $fatal=false) {
+        // If error is not fatal then log it as a warning
+        return $this->log($subj, $msg, $fatal ? LOG_ERR : LOG_WARN);
+    }
+
+    protected function log($title, $msg, $level = LOG_WARN) {
+        global $ost;
+        switch ($level) {
+            case LOG_WARN:
+            case LOG_ERR:
+                // We are disabling email alerts on API errors / warnings
+                // due to potential abuse or loops that might cause email DOS
+                $ost->log($level, $title, $msg, false);
+                break;
+            case  LOG_DEBUG:
+            default:
+                $ost->logDebug($title, $msg);
+        }
+        return true;
+    }
+
     /**
      * API error & logging and response!
      *
+     * final - don not override downstream.
      */
+    final public function onError($code, $error, $title = null,
+            $logOnly = false) {
 
-    /* If possible - DO NOT - overwrite the method downstream */
-    function exerr($code, $error='') {
-        global $ost;
-
-        if($error && is_array($error))
+        // Unpack the errors to string if error is an array
+        if ($error && is_array($error))
             $error = Format::array_implode(": ", "\n", $error);
 
-        //Log the error as a warning - include api key if available.
+        // Log the error
         $msg = $error;
-        if($_SERVER['HTTP_X_API_KEY'])
-            $msg.="\n*[".$_SERVER['HTTP_X_API_KEY']."]*\n";
-        $ost->logWarning(__('API Error')." ($code)", $msg, false);
+        // TODO: Only include API Key when in debug mode to avoid
+        // potentialialy leaking a valid key in system logs
+        if (($key=$this->getApiKey()))
+            $msg .= sprintf("\n[%s]\n", Format::shroud($key, 8, 16));
 
-        if (PHP_SAPI == 'cli') {
-            fwrite(STDERR, "({$code}) $error\n");
-        }
-        else {
-            $this->response($code, $error); //Responder should exit...
-        }
-        return false;
-    }
+        $title = sprintf('%s (%s)', $title ?: __('API Error'), $code);
+        $this->logError($title, $msg, $logOnly);
 
-    //Default response method - can be overwritten in subclasses.
-    function response($code, $resp) {
-        Http::response($code, $resp);
-        exit();
+        // If the error is not deemed fatal then simply return
+        if ($logOnly)
+            return;
+
+        // If the API Interface is CLI then throw a TicketApiError exception
+        // so the caller can handle the error gracefully.
+        // Note that we set the error code as well
+        if ($this->isCli())
+            throw new TicketApiError($error, $code);
+
+        // Respond and exit since HTTP endpoint requests
+        // are considered stateless
+        $this->response($code, $error);
     }
 }
 
@@ -327,8 +387,8 @@ class ApiXmlDataParser extends XmlDataParser {
     function fixup($current) {
         global $cfg;
 
-		if($current['ticket'])
-			$current = $current['ticket'];
+        if (isset($current['ticket']))
+            $current = $current['ticket'];
 
         if (!is_array($current))
             return $current;
@@ -381,10 +441,10 @@ class ApiXmlDataParser extends XmlDataParser {
 
 include_once "class.json.php";
 class ApiJsonDataParser extends JsonDataParser {
-    function parse($stream, $tidy=false) {
-        return $this->fixup(parent::parse($stream));
+    static function parse($stream, $tidy=false) {
+        return self::fixup(parent::parse($stream));
     }
-    function fixup($current) {
+    static function fixup($current) {
         if (!is_array($current))
             return $current;
         foreach ($current as $key=>&$value) {
@@ -396,7 +456,7 @@ class ApiJsonDataParser extends JsonDataParser {
                 $value = (bool)$value;
             } elseif ($key == "message") {
                 // Allow message specified in RFC 2397 format
-                $data = Format::parseRfc2397($value, 'utf-8');
+                $data = Format::strip_emoticons(Format::parseRfc2397($value, 'utf-8'));
 
                 if (isset($data['type']) && $data['type'] == 'text/html')
                     $value = new HtmlThreadEntryBody($data['data']);
@@ -434,17 +494,17 @@ class ApiEmailDataParser extends EmailDataParser {
     function fixup($data) {
         global $cfg;
 
-        if(!$data) return $data;
+        if (!$data) return $data;
 
         $data['source'] = 'Email';
 
-        if(!$data['subject'])
+        if (!$data['subject'])
             $data['subject'] = '[No Subject]';
 
-        if(!$data['emailId'])
+        if (!$data['emailId'])
             $data['emailId'] = $cfg->getDefaultEmailId();
 
-        if(!$cfg->useEmailPriority())
+        if( !$cfg->useEmailPriority())
             unset($data['priorityId']);
 
         return $data;

include/class.app.php

@@ -28,7 +28,7 @@ class Application {
             array('desc'=>$desc, 'href'=>$href));
     }
 
-    function getStaffApps() {
+    static function getStaffApps() {
         return self::$staff_apps;
     }
 
@@ -37,7 +37,7 @@ class Application {
             array('desc'=>$desc, 'href'=>$href));
     }
 
-    function getClientApps() {
+    static function getClientApps() {
         return self::$client_apps;
     }
 
@@ -46,7 +46,7 @@ class Application {
             array('desc'=>$desc, 'href'=>$href));
     }
 
-    function getAdminApps() {
+    static function getAdminApps() {
         return self::$admin_apps;
     }
 }

include/class.attachment.php

@@ -105,7 +105,7 @@ extends InstrumentedList {
 
     function getId() { return $this->key['object_id']; }
     function getType() { return $this->key['type']; }
-
+    function getMimeType() { return $this->getType(); }
     /**
      * Drop attachments whose file_id values are not in the included list,
      * additionally, add new files whose IDs are in the list provided.
@@ -120,10 +120,11 @@ extends InstrumentedList {
         }
         $attachments = array();
         // Format $new for upload() with new name
-        foreach ($ids as $id=>$name) {
+        foreach ($ids as $id=>$value) {
+            if (is_array($value)) list('id' => $id, 'name' => $value) = $value;
             $attachments[] = array(
                     'id' => $id,
-                    'name' => $name
+                    'name' => $value
                 );
         }
         // Everything remaining in $attachments is truly new
@@ -148,7 +149,15 @@ extends InstrumentedList {
 
             $_inline = isset($file['inline']) ? $file['inline'] : $inline;
 
-            $att = $this->add(new Attachment(array(
+            // Check if Attachment exists
+            if ($F && $this->key)
+                $existing = Attachment::objects()->filter(array(
+                    'file__key' => $F->key,
+                    'object_id' => $this->key['object_id'],
+                    'type' => $this->key['type']
+                ))->first();
+
+            $att = $this->add(isset($existing) ? $existing : new Attachment(array(
                 'file_id' => $fileId,
                 'inline' => $_inline ? 1 : 0,
             )));
@@ -183,7 +192,7 @@ extends InstrumentedList {
     function getInlines($lang=false) { return $this->_getList(false, true, $lang); }
     function getSeparates($lang=false) { return $this->_getList(true, false, $lang); }
     function getAll($lang=false) { return $this->_getList(true, true, $lang); }
-    function count($lang=false) { return count($this->getSeparates($lang)); }
+    function count($lang=false): int { return count($this->getSeparates($lang)); }
 
     function _getList($separates=false, $inlines=false, $lang=false) {
         $base = $this;

include/class.auth.php

@@ -1,16 +1,23 @@
 <?php
 
+require_once(INCLUDE_DIR.'class.2fa.php');
+
 interface AuthenticatedUser {
-/* PHP 5.3 < 5.3.8 will crash with some abstract inheritance issue
- * ------------------------------------------------------------
     // Get basic information
     function getId();
     function getUsername();
     function getUserType();
 
+
+    // Get password reset timestamp
+    function getPasswdResetTimestamp();
+
     //Backend used to authenticate the user
     function getAuthBackend();
 
+    // Get 2FA Backend
+    function get2FABackend();
+
     //Authentication key
     function setAuthKey($key);
 
@@ -22,7 +29,6 @@ interface AuthenticatedUser {
     // Signal method to allow performing extra things when a user is logged
     // into the sysem
     function onLogin($bk);
- */
 }
 
 abstract class BaseAuthenticatedUser
@@ -35,9 +41,17 @@ implements AuthenticatedUser {
     abstract function getUsername();
     abstract function getUserType();
 
+    // Get password reset timestamp
+    function getPasswdResetTimestamp() {
+        return null;
+    }
+
     //Backend used to authenticate the user
     abstract function getAuthBackend();
 
+    // Get 2FA Backend
+    abstract function get2FABackend();
+
     //Authentication key
     function setAuthKey($key) {
         $this->authkey = $key;
@@ -120,7 +134,7 @@ class ClientCreateRequest {
     function attemptAutoRegister() {
         global $cfg;
 
-        if (!$cfg)
+        if (!$cfg || $cfg->isClientRegistrationMode(['disabled']))
             return false;
 
         // Attempt to automatically register
@@ -132,7 +146,7 @@ class ClientCreateRequest {
         );
         if ($bk->supportsInteractiveAuthentication())
             // User can only be authenticated against this backend
-            $defaults['backend'] = $bk::$id;
+            $defaults['backend'] = $bk->getBkId();
         if ($this_form->isValid(function($f) { return !$f->isVisibleToUsers(); })
                 && ($U = User::fromVars($this_form->getClean()))
                 && ($acct = ClientAccount::createForUser($U, $defaults))
@@ -145,6 +159,78 @@ class ClientCreateRequest {
     }
 }
 
+
+/**
+ * Authorization backend
+ *
+ * Abstract service registry to provide authorization backends.
+ */
+abstract class OAuth2Backend extends ServiceRegistry {
+    static $name;
+    static $id;
+    protected  $config;
+
+    static function register($bk) {
+        if (is_string($bk) && class_exists($bk))
+            $bk = new $bk();
+
+        if (!is_object($bk)
+                || !($bk instanceof OAuth2Backend))
+            return false;
+
+        static::$registry[$bk->getBkId()] = $bk;
+    }
+
+    static function allRegistered() {
+        return self::getRegistry();
+    }
+
+    static function getBackend($id) {
+        if ($id && ($registry = static::allRegistered())
+                && isset($registry[$id]))
+            return $registry[$id];
+    }
+}
+
+abstract class OAuth2AuthorizationBackend  extends OAuth2Backend {
+    static protected $registry = array();
+
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::allRegistered());
+    }
+
+    static function getBackend($id) {
+        if (($bk=parent::getBackend($id)))
+            return $bk;
+
+        // Overloaded backend load.
+        list($auth, $a, $i) = self::parseId($id);
+        if ($auth && ($bk=parent::getBackend($auth)))
+            return $bk;
+    }
+
+    static function parseId($id) {
+        return  preg_split('/(?(?<=oauth2):(?!\w+)|:)/', $id);
+    }
+
+    abstract function getConfigForm($configId);
+    abstract function triggerEmailAuth($id);
+    abstract function callback($resp, $ref);
+}
+
+abstract class OAuth2AuthenticationBackend  extends OAuth2Backend {
+    static protected $registry = array();
+
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::allRegistered());
+    }
+
+    static function getBackend($id) {
+        if (($bk=parent::getBackend($id)))
+            return $bk;
+    }
+}
+
 /**
  * Authentication backend
  *
@@ -160,41 +246,61 @@ class ClientCreateRequest {
  * receives a username and optional password. If the authentication
  * succeeds, an instance deriving from <User> should be returned.
  */
-abstract class AuthenticationBackend {
-    static protected $registry = array();
+abstract class AuthenticationBackend extends ServiceRegistry {
     static $name;
     static $id;
+    protected  $config;
 
+    static function register($bk) {
+        if (is_string($bk) && class_exists($bk))
+            $bk = new $bk();
 
-    /* static */
-    static function register($class) {
-        if (is_string($class) && class_exists($class))
-            $class = new $class();
-
-        if (!is_object($class)
-                || !($class instanceof AuthenticationBackend))
+        if (!is_object($bk)
+                || !($bk instanceof AuthenticationBackend))
             return false;
 
-        return static::_register($class);
-    }
-
-    static function _register($class) {
-        // XXX: Raise error if $class::id is already in the registry
-        static::$registry[$class::$id] = $class;
+        static::$registry[$bk->getBkId()] = $bk;
     }
 
     static function allRegistered() {
-        return static::$registry;
+        return self::getRegistry();
+    }
+
+    static function getInteractive() {
+        $backends = [];
+        foreach (static::allRegistered() as $bk)
+            if ($bk->isInteractive())
+                $backends[] = $bk;
+        return $backends;
+    }
+
+    static function getExternal() {
+        $backends = [];
+        foreach (static::allRegistered() as $bk)
+            if ($bk->isExternal())
+                $backends[] = $bk;
+        return $backends;
     }
 
     static function getBackend($id) {
-
         if ($id
                 && ($backends = static::allRegistered())
                 && isset($backends[$id]))
             return $backends[$id];
     }
 
+    static function lookupBackend($id, $class=null) {
+        // Lookup both registries
+        if (!($bk = StaffAuthenticationBackend::getBackend($id)))
+            $bk = UserAuthenticationBackend::getBackend($id);
+
+        // See if specific type is requesred.
+        if ($class && !($bk instanceof $class))
+            return null;
+
+        return $bk;
+    }
+
     static function getSearchDirectoryBackend($id) {
 
         if ($id
@@ -224,7 +330,7 @@ abstract class AuthenticationBackend {
         foreach (static::allRegistered() as $bk) {
             if ($backends //Allowed backends
                     && $bk->supportsInteractiveAuthentication()
-                    && !in_array($bk::$id, $backends))
+                    && !in_array($bk->getBkId(), $backends))
                 // User cannot be authenticated against this backend
                 continue;
 
@@ -266,7 +372,7 @@ abstract class AuthenticationBackend {
      * $forcedAuth - indicate if authentication is required.
      *
      */
-    function processSignOn(&$errors, $forcedAuth=true) {
+    static function processSignOn(&$errors, $forcedAuth=true) {
 
         foreach (static::allRegistered() as $bk) {
             // All backends are queried here, even if they don't support
@@ -307,13 +413,13 @@ abstract class AuthenticationBackend {
         $backends = array();
         foreach (StaffAuthenticationBackend::allRegistered() as $bk)
             if ($bk instanceof AuthDirectorySearch)
-                $backends[$bk::$id] = $bk;
+                $backends[$bk->getBkId()] = $bk;
 
         foreach (UserAuthenticationBackend::allRegistered() as $bk)
             if ($bk instanceof AuthDirectorySearch)
-                $backends[$bk::$id] = $bk;
+                $backends[$bk->getBkId()] = $bk;
 
-        return array_unique($backends);
+        return array_unique($backends, SORT_REGULAR);
     }
 
     static function searchUsers($query) {
@@ -324,13 +430,6 @@ abstract class AuthenticationBackend {
         return $users;
     }
 
-    /**
-     * Fetches the friendly name of the backend
-     */
-    function getName() {
-        return static::$name;
-    }
-
     /**
      * Indicates if the backed supports authentication. Useful if the
      * backend is used for logging or lockout only
@@ -339,6 +438,21 @@ abstract class AuthenticationBackend {
         return true;
     }
 
+    /**
+     * Alias for supportsInteractiveAuthentication()
+     *
+     */
+    function isInteractive() {
+        return $this->supportsInteractiveAuthentication();
+    }
+
+    /**
+     * Indicates of the backend is External Authentication
+     */
+    function isExternal() {
+        return ($this instanceof ExternalAuthentication);
+    }
+
     /**
      * Indicates if the backend supports changing a user's password. This
      * would be done in two fashions. Either the currently-logged in user
@@ -350,6 +464,15 @@ abstract class AuthenticationBackend {
         return false;
     }
 
+
+    /**
+     * Get supported password policies for the backend.
+     *
+     */
+    function getPasswordPolicies($user=null) {
+        return PasswordPolicy::allActivePolicies();
+    }
+
     /**
      * Request the backend to update the password for a user. This method is
      * the main entry for password updates so that password policies can be
@@ -361,7 +484,9 @@ abstract class AuthenticationBackend {
      * PasswordUpdateFailed — if backend failed to update the password
      */
     function setPassword($user, $password, $current=false) {
-        PasswordPolicy::checkPassword($password, $current);
+        foreach ($this->getPasswordPolicies($user) as $P)
+            $P->onSet($password, $current);
+
         $rv = $this->syncPassword($user, $password);
         if ($rv) {
             $info = array('password' => $password, 'current' => $current);
@@ -370,6 +495,17 @@ abstract class AuthenticationBackend {
         return $rv;
     }
 
+    /*
+     * Request the backend to check the policies for a just logged
+     * in user.
+     * Throws: BadPassword & ExpiredPassword - for password related failures
+     */
+    function checkPolicies($user, $password) {
+        // Password policies
+        foreach ($this->getPasswordPolicies($user) as $P)
+            $P->onLogin($user, $password);
+    }
+
     /**
      * Request the backend to update the user's password with the password
      * given. This method should only be used if the backend advertises
@@ -401,7 +537,7 @@ abstract class AuthenticationBackend {
     abstract function authenticate($username, $password);
     abstract function login($user, $bk);
     abstract static function getUser(); //Validates  authenticated users.
-    abstract function getAllowedBackends($userid);
+    abstract static function getAllowedBackends($userid);
     abstract protected function getAuthKey($user);
     abstract static function signOut($user);
 }
@@ -424,6 +560,13 @@ interface ExternalAuthentication {
      */
     function renderExternalLink();
 
+    /**
+     * Function: getServiceName
+     *
+     * Called to get the service name displayed on login page.
+     */
+     function getServiceName();
+
     /**
      * Function: triggerAuth
      *
@@ -435,26 +578,33 @@ interface ExternalAuthentication {
 }
 
 abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
-
-    static private $_registry = array();
-
-    static function _register($class) {
-        static::$_registry[$class::$id] = $class;
-    }
+    static protected $registry = array();
 
     static function allRegistered() {
-        return array_merge(self::$_registry, parent::allRegistered());
+        return array_merge(self::$registry, parent::allRegistered());
     }
 
-    function isBackendAllowed($staff, $bk) {
+    static function isBackendAllowed($staff, $bk) {
 
         if (!($backends=self::getAllowedBackends($staff->getId())))
             return true;  //No restrictions
 
-        return in_array($bk::$id, array_map('strtolower', $backends));
+        return in_array($bk->getBkId(), array_map('strtolower', $backends));
     }
 
-    function getAllowedBackends($userid) {
+    function getPasswordPolicies($user=null) {
+        global $cfg;
+        $policies = PasswordPolicy::allActivePolicies();
+        if ($cfg && ($policy = $cfg->getStaffPasswordPolicy())) {
+            foreach ($policies as $P)
+                if ($policy == $P->getBkId())
+                    return array($P);
+        }
+
+        return $policies;
+    }
+
+    static function getAllowedBackends($userid) {
 
         $backends =array();
         //XXX: Only one backend can be specified at the moment.
@@ -488,24 +638,38 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
             sprintf(_S("%s logged in [%s], via %s"), $staff->getUserName(),
                 $_SERVER['REMOTE_ADDR'], get_class($bk))); //Debug.
 
-        // Tag the authkey.
-        $authkey = $bk::$id.':'.$authkey;
+        $agent = Staff::lookup($staff->getId());
+        $type = array('type' => 'login');
+        Signal::send('person.login', $agent, $type);
 
+        // Check if the agent has 2fa enabled
+        $auth2fa = null;
+        if (($_2fa = $staff->get2FABackend())
+                && ($token=$_2fa->send($staff))) {
+            $auth2fa = sprintf('%s:%s:%s',
+                    $_2fa->getId(), md5($token.$staff->getId()), time());
+        }
+
+        // Tag the authkey.
+        $authkey = $bk->getBkId().':'.$authkey;
         // Now set session crap and lets roll baby!
         $authsession = &$_SESSION['_auth']['staff'];
-
         $authsession = array(); //clear.
         $authsession['id'] = $staff->getId();
         $authsession['key'] =  $authkey;
-
+        $authsession['2fa'] =  $auth2fa;
+        // Set TIME_BOMB to regenerate the session 10 seconds after login
+        $_SESSION['TIME_BOMB'] = time() + 10;
+        // Set session token
+        $staff->setSessionToken();
+        // Set Auth Key
         $staff->setAuthKey($authkey);
-        $staff->refreshSession(true); //set the hash.
-
         Signal::send('auth.login.succeeded', $staff);
 
         if ($bk->supportsInteractiveAuthentication())
             $staff->cancelResetTokens();
 
+
         // Update last-used language, login time, etc
         $staff->onLogin($bk);
 
@@ -528,6 +692,9 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
                     $staff->getUserName(),
                     $_SERVER['REMOTE_ADDR'])); //Debug.
 
+        $agent = Staff::lookup($staff->getId());
+        $type = array('type' => 'logout');
+        Signal::send('person.logout', $agent, $type);
         Signal::send('auth.logout', $staff);
     }
 
@@ -543,6 +710,7 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
         if (!($bk=static::getBackend($id)) //get the backend
                 || !($staff = $bk->validate($auth)) //Get AuthicatedUser
                 || !($staff instanceof Staff)
+                || !$staff->isActive()
                 || $staff->getId() != $_SESSION['_auth']['staff']['id'] // check ID
         )
             return null;
@@ -567,7 +735,9 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
 
     protected function validate($authkey) {
 
-        if (($staff = StaffSession::lookup($authkey)) && $staff->getId())
+        if (($staff = StaffSession::lookup($authkey))
+            && $staff->getId()
+            && $staff->isActive())
             return $staff;
     }
 }
@@ -580,19 +750,28 @@ abstract class ExternalStaffAuthenticationBackend
     static $sign_in_image_url = false;
     static $service_name = "External";
 
-    function renderExternalLink() { ?>
-        <a class="external-sign-in" title="Sign in with <?php echo static::$service_name; ?>"
-                href="login.php?do=ext&amp;bk=<?php echo urlencode(static::$id); ?>">
+    function getServiceName() {
+        return __(static::$service_name);
+    }
+
+    function renderExternalLink() {
+        $service = sprintf('%s %s',
+                __('Sign in with'),
+                $this->getServiceName());
+        ?>
+        <a class="external-sign-in" title="<?php echo $service; ?>"
+                href="login.php?do=ext&amp;bk=<?php echo
+                urlencode($this->getBkId()); ?>">
 <?php if (static::$sign_in_image_url) { ?>
         <img class="sign-in-image" src="<?php echo static::$sign_in_image_url;
-            ?>" alt="Sign in with <?php echo static::$service_name; ?>"/>
+            ?>" alt="<?php echo $service; ?>"/>
 <?php } else { ?>
             <div class="external-auth-box">
             <span class="external-auth-icon">
                 <i class="icon-<?php echo static::$fa_icon; ?> icon-large icon-fixed-with"></i>
             </span>
             <span class="external-auth-name">
-                Sign in with <?php echo static::$service_name; ?>
+               <?php echo $service; ?>
             </span>
             </div>
 <?php } ?>
@@ -600,15 +779,17 @@ abstract class ExternalStaffAuthenticationBackend
     }
 
     function triggerAuth() {
+        $_SESSION['ext:bk:id'] = $this->getBkId();
+        // For legacy plugins prior to v1.17
         $_SESSION['ext:bk:class'] = get_class($this);
     }
 }
 Signal::connect('api', function($dispatcher) {
     $dispatcher->append(
         url('^/auth/ext$', function() {
-            if ($class = $_SESSION['ext:bk:class']) {
-                $bk = StaffAuthenticationBackend::getBackend($class::$id)
-                    ?: UserAuthenticationBackend::getBackend($class::$id);
+            if ($id = $_SESSION['ext:bk:id']) {
+                $bk = StaffAuthenticationBackend::getBackend($id)
+                    ?: UserAuthenticationBackend::getBackend($id);
                 if ($bk instanceof ExternalAuthentication)
                     $bk->triggerAuth();
             }
@@ -617,18 +798,25 @@ Signal::connect('api', function($dispatcher) {
 });
 
 abstract class UserAuthenticationBackend  extends AuthenticationBackend {
-
-    static private $_registry = array();
-
-    static function _register($class) {
-        static::$_registry[$class::$id] = $class;
-    }
+    static protected $registry = array();
 
     static function allRegistered() {
-        return array_merge(self::$_registry, parent::allRegistered());
+        return array_merge(self::$registry, parent::allRegistered());
     }
 
-    function getAllowedBackends($userid) {
+    function getPasswordPolicies($user=null) {
+        global $cfg;
+        $policies = PasswordPolicy::allActivePolicies();
+        if ($cfg && ($policy = $cfg->getClientPasswordPolicy())) {
+            foreach ($policies as $P)
+                if ($policy == $P->getId())
+                    return array($P);
+        }
+
+        return $policies;
+    }
+
+    static function getAllowedBackends($userid) {
         $backends = array();
         $sql = 'SELECT A1.backend FROM '.USER_ACCOUNT_TABLE
               .' A1 INNER JOIN '.USER_EMAIL_TABLE.' A2 ON (A2.user_id = A1.user_id)'
@@ -649,7 +837,7 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
         global $ost;
 
         if (!$user || !$bk
-                || !$bk::$id //Must have ID
+                || !$bk->getBkId() //Must have ID
                 || !($authkey = $bk->getAuthKey($user)))
             return false;
 
@@ -664,19 +852,24 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
 
         // Tag the user and associated ticket in the SESSION
         $this->setAuthKey($user, $bk, $authkey);
-
+        // Set Session Token
+        $user->setSessionToken();
         //The backend used decides the format of the auth key.
         // XXX: encrypt to hide the bk??
         $user->setAuthKey($authkey);
-
-        $user->refreshSession(true); //set the hash.
-
         //Log login info...
         $msg=sprintf(_S('%1$s (%2$s) logged in [%3$s]'
                 /* Tokens are <username>, <id>, and <ip> */),
                 $user->getUserName(), $user->getId(), $_SERVER['REMOTE_ADDR']);
         $ost->logDebug(_S('User login'), $msg);
 
+        $u = $user->getSessionUser()->getUser();
+        $type = array('type' => 'login');
+        Signal::send('person.login', $u, $type);
+
+        // Set TIME_BOMB to regenerate the session 10 seconds after login
+        $_SESSION['TIME_BOMB'] = time() + 10;
+
         if ($bk->supportsInteractiveAuthentication() && ($acct=$user->getAccount()))
             $acct->cancelResetTokens();
 
@@ -690,7 +883,7 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
         $authkey = $key ?: $bk->getAuthKey($user);
 
         //Tag the authkey.
-        $authkey = $bk::$id.':'.$authkey;
+        $authkey = $bk->getBkId().':'.$authkey;
 
         //Set the session goodies
         $authsession = &$_SESSION['_auth']['user'];
@@ -712,6 +905,10 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
         $ost->logDebug(_S('User logout'),
             sprintf(_S("%s logged out [%s]" /* Tokens are <username> and <ip> */),
                 $user->getUserName(), $_SERVER['REMOTE_ADDR']));
+
+        $u = $user->getSessionUser()->getUser();
+        $type = array('type' => 'logout');
+        Signal::send('person.logout', $u, $type);
     }
 
     protected function getAuthKey($user) {
@@ -733,6 +930,9 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
                 )
             return null;
 
+        if (($account=$user->getAccount()) && !$account->isActive())
+            return null;
+
         $user->setAuthKey($_SESSION['_auth']['user']['key']);
 
         return $user;
@@ -741,7 +941,9 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
     protected function validate($userid) {
         if (!($user = User::lookup($userid)))
             return false;
-        elseif (!$user->getAccount())
+        elseif (!($account=$user->getAccount()))
+            return false;
+        elseif (!$account->isActive())
             return false;
 
         return new ClientSession(new EndUser($user));
@@ -756,19 +958,29 @@ abstract class ExternalUserAuthenticationBackend
     static $sign_in_image_url = false;
     static $service_name = "External";
 
-    function renderExternalLink() { ?>
-        <a class="external-sign-in" title="<?php echo sprintf(__('Sign in with %s'), __(static::$service_name)); ?>"
-                href="login.php?do=ext&amp;bk=<?php echo urlencode(static::$id); ?>">
+    function getServiceName() {
+        return __(static::$service_name);
+    }
+
+    function renderExternalLink() {
+        $service = sprintf('%s %s',
+                __('Sign in with'),
+                $this->getServiceName());
+
+        ?>
+        <a class="external-sign-in" title="<?php echo $service; ?>"
+                href="login.php?do=ext&amp;bk=<?php echo
+                urlencode($this->getBkId()); ?>">
 <?php if (static::$sign_in_image_url) { ?>
         <img class="sign-in-image" src="<?php echo static::$sign_in_image_url;
-            ?>" alt="<?php echo sprintf(__('Sign in with %s'), __(static::$service_name)); ?>"/>
+            ?>" alt="<?php echo $service; ?>"/>
 <?php } else { ?>
             <div class="external-auth-box">
             <span class="external-auth-icon">
                 <i class="icon-<?php echo static::$fa_icon; ?> icon-large icon-fixed-with"></i>
             </span>
             <span class="external-auth-name">
-                <?php echo sprintf(__('Sign in with %s'), __(static::$service_name)); ?>
+                <?php echo $service; ?>
             </span>
             </div>
 <?php } ?>
@@ -776,6 +988,8 @@ abstract class ExternalUserAuthenticationBackend
     }
 
     function triggerAuth() {
+        $_SESSION['ext:bk:id'] = $this->getBkId();
+        // Legacy for plugins prior to v1.17
         $_SESSION['ext:bk:class'] = get_class($this);
     }
 }
@@ -821,7 +1035,7 @@ abstract class AuthStrikeBackend extends AuthenticationBackend {
         return false;
     }
 
-    function getAllowedBackends($userid) {
+    static function getAllowedBackends($userid) {
         return array();
     }
 
@@ -838,22 +1052,23 @@ abstract class AuthStrikeBackend extends AuthenticationBackend {
 
     }
 
-    abstract function authStrike($credentials);
-    abstract function authTimeout();
+    abstract static function authStrike($credentials);
+    abstract static function authTimeout();
 }
 
 /*
  * Backend to monitor staff's failed login attempts
  */
 class StaffAuthStrikeBackend extends  AuthStrikeBackend {
+    static $id = "authstrike.staff";
 
-    function authTimeout() {
+    static function authTimeout() {
         global $ost;
 
         $cfg = $ost->getConfig();
 
         $authsession = &$_SESSION['_auth']['staff'];
-        if (!$authsession['laststrike'])
+        if (!isset($authsession['laststrike']))
             return;
 
         //Veto login due to excessive login attempts.
@@ -868,7 +1083,7 @@ class StaffAuthStrikeBackend extends  AuthStrikeBackend {
         $authsession['strikes']=0;
     }
 
-    function authstrike($credentials) {
+    static function authstrike($credentials) {
         global $ost;
 
         $cfg = $ost->getConfig();
@@ -890,6 +1105,13 @@ class StaffAuthStrikeBackend extends  AuthStrikeBackend {
             $admin_alert = ($cfg->alertONLoginError() == 1) ? TRUE : FALSE;
             $ost->logWarning(sprintf(_S('Excessive login attempts (%s)'),$username),
                     $alert, $admin_alert);
+
+              if ($username) {
+                $agent = Staff::lookup($username);
+                $type = array('type' => 'login', 'msg' => sprintf('Excessive login attempts (%s)', $authsession['strikes']));
+                Signal::send('person.login', $agent, $type);
+              }
+
             return new AccessDenied(__('Forgot your login info? Contact Admin.'));
         //Log every other third failed login attempt as a warning.
         } elseif($authsession['strikes']%3==0) {
@@ -908,8 +1130,9 @@ StaffAuthenticationBackend::register('StaffAuthStrikeBackend');
  * Backend to monitor user's failed login attempts
  */
 class UserAuthStrikeBackend extends  AuthStrikeBackend {
+    static $id = "authstrike.user";
 
-    function authTimeout() {
+    static function authTimeout() {
         global $ost;
 
         $cfg = $ost->getConfig();
@@ -930,7 +1153,7 @@ class UserAuthStrikeBackend extends  AuthStrikeBackend {
         $authsession['strikes']=0;
     }
 
-    function authstrike($credentials) {
+    static function authstrike($credentials) {
         global $ost;
 
         $cfg = $ost->getConfig();
@@ -950,6 +1173,21 @@ class UserAuthStrikeBackend extends  AuthStrikeBackend {
                     _S('Attempts').": {$authsession['strikes']}";
             $admin_alert = ($cfg->alertONLoginError() == 1 ? TRUE : FALSE);
             $ost->logError(_S('Excessive login attempts (user)'), $alert, $admin_alert);
+
+            if ($username) {
+              $account = UserAccount::lookupByUsername($username);
+              $id = UserEmailModel::getIdByEmail($username);
+              if ($account)
+                  $user = User::lookup($account->user_id);
+              elseif ($id)
+                $user = User::lookup($id);
+
+              if ($user) {
+                $type = array('type' => 'login', 'msg' => sprintf('Excessive login attempts (%s)', $authsession['strikes']));
+                Signal::send('person.login', $user, $type);
+              }
+            }
+
             return new AccessDenied(__('Access denied'));
         } elseif($authsession['strikes']%3==0) { //Log every third failed login attempt as a warning.
             $alert=_S('Username').": {$username}\n".
@@ -964,21 +1202,18 @@ class UserAuthStrikeBackend extends  AuthStrikeBackend {
 UserAuthenticationBackend::register('UserAuthStrikeBackend');
 
 
-class osTicketAuthentication extends StaffAuthenticationBackend {
+class osTicketStaffAuthentication extends StaffAuthenticationBackend {
     static $name = "Local Authentication";
     static $id = "local";
 
     function authenticate($username, $password) {
         if (($user = StaffSession::lookup($username)) && $user->getId() &&
                 $user->check_passwd($password)) {
-
-            //update last login && password reset stuff.
-            $sql='UPDATE '.STAFF_TABLE.' SET lastlogin=NOW() ';
-            if($user->isPasswdResetDue() && !$user->isAdmin())
-                $sql.=',change_passwd=1';
-            $sql.=' WHERE staff_id='.db_input($user->getId());
-            db_query($sql);
-
+            try {
+                $this->checkPolicies($user, $password);
+            } catch (BadPassword | ExpiredPassword $ex) {
+                $user->change_passwd = 1;
+            }
             return $user;
         }
     }
@@ -991,8 +1226,12 @@ class osTicketAuthentication extends StaffAuthenticationBackend {
         $staff->passwd = Passwd::hash($password);
     }
 
+    static function checkPassword($new, $current) {
+        PasswordPolicy::checkPassword($new, $current, new self());
+    }
+
 }
-StaffAuthenticationBackend::register('osTicketAuthentication');
+StaffAuthenticationBackend::register('osTicketStaffAuthentication');
 
 class PasswordResetTokenBackend extends StaffAuthenticationBackend {
     static $id = "pwreset.staff";
@@ -1016,7 +1255,7 @@ class PasswordResetTokenBackend extends StaffAuthenticationBackend {
                 || $id != $staff->getId())
             $errors['msg'] = __('Invalid reset token');
         elseif (!($ts = $_config->lastModified($_POST['token']))
-                && ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
+                || ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
             $errors['msg'] = __('Invalid reset token');
         elseif (!$staff->forcePasswdRest())
             $errors['msg'] = __('Unable to reset password');
@@ -1063,7 +1302,8 @@ class AuthTokenAuthentication extends UserAuthenticationBackend {
             if (($ticket = Ticket::lookupByNumber($_GET['t'], $_GET['e']))
                     // Using old ticket auth code algo - hardcoded here because it
                     // will be removed in ticket class in the upcoming rewrite
-                    && !strcasecmp($_GET['a'], md5($ticket->getId() .  strtolower($_GET['e']) . SECRET_SALT))
+                    && strcasecmp((string) $_GET['a'], md5($ticket->getId()
+                            .  strtolower($_GET['e']) . SECRET_SALT)) === 0
                     && ($owner = $ticket->getOwner()))
                 $user = new ClientSession($owner);
         }
@@ -1208,11 +1448,15 @@ class osTicketClientAuthentication extends UserAuthenticationBackend {
         if (($client = new ClientSession(new EndUser($acct->getUser())))
                 && !$client->getId())
             return false;
-        elseif (!$acct->checkPassword($password))
+        elseif (!$acct->check_passwd($password))
             return false;
         else
             return $client;
     }
+
+    static function checkPassword($new, $current) {
+        PasswordPolicy::checkPassword($new, $current, new self());
+    }
 }
 UserAuthenticationBackend::register('osTicketClientAuthentication');
 
@@ -1238,7 +1482,7 @@ class ClientPasswordResetTokenBackend extends UserAuthenticationBackend {
                 || $id != 'c'.$client->getId())
             $errors['msg'] = __('Invalid reset token');
         elseif (!($ts = $_config->lastModified($_POST['token']))
-                && ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
+                || ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
             $errors['msg'] = __('Invalid reset token');
         elseif (!$acct->forcePasswdReset())
             $errors['msg'] = __('Unable to reset password');
@@ -1284,26 +1528,40 @@ UserAuthenticationBackend::register('ClientAcctConfirmationTokenBackend');
 // ----- Password Policy --------------------------------------
 
 class BadPassword extends Exception {}
+class ExpiredPassword extends Exception {}
 class PasswordUpdateFailed extends Exception {}
 
-abstract class PasswordPolicy {
-    static protected $registry = array();
+abstract class PasswordPolicy extends ServiceRegistry {
+    static $id;
+    static $name;
 
     /**
      * Check a password and throw BadPassword with a meaningful message if
      * the password cannot be accepted.
      */
-    abstract function processPassword($new, $current);
+    abstract function onset($new, $current);
 
-    static function checkPassword($new, $current) {
-        foreach (static::allActivePolicies() as $P) {
-            $P->processPassword($new, $current);
-        }
+    /*
+     * Called on login to enforce policies & check for expired passwords
+     */
+    abstract function onLogin($user, $password);
+
+    /*
+     * Check a password aganist all available policies
+     */
+    static function checkPassword($new, $current, $bk=null) {
+        if ($bk && is_a($bk, 'AuthenticationBackend'))
+            $policies = $bk->getPasswordPolicies();
+        else
+            $policies = self::allActivePolicies();
+
+        foreach ($policies as $P)
+            $P->onSet($new, $current);
     }
 
     static function allActivePolicies() {
         $policies = array();
-        foreach (static::$registry as $P) {
+        foreach (array_reverse(self::getRegistry()) as $P) {
             if (is_string($P) && class_exists($P))
                 $P = new $P();
             if ($P instanceof PasswordPolicy)
@@ -1312,10 +1570,6 @@ abstract class PasswordPolicy {
         return $policies;
     }
 
-    static function register($policy) {
-        static::$registry[] = $policy;
-    }
-
     static function cleanSessions($model, $user=null) {
         $criteria = array();
 
@@ -1328,7 +1582,7 @@ abstract class PasswordPolicy {
                         Q::not(array('session_id' => $user->session->session_id)));
                 break;
             case ($model instanceof User):
-                $regexp = '_auth\|.*"user";[a-z]+:[0-9]+:{[a-z]+:[0-9]+:"id";[a-z]+:'.$model->getId();
+                $regexp = '_auth\|.*"user";[a-z]+:[0-9]+:\{[a-z]+:[0-9]+:"id";[a-z]+:'.$model->getId();
                 $criteria['user_id'] = 0;
                 $criteria['session_data__regex'] = $regexp;
 
@@ -1340,17 +1594,41 @@ abstract class PasswordPolicy {
                 return false;
         }
 
-        return SessionData::objects()->filter($criteria)->delete();
+        return DatabaseSessionRecord::objects()->filter($criteria)->delete();
     }
 }
 Signal::connect('auth.clean', array('PasswordPolicy', 'cleanSessions'));
 
+/*
+ * Basic default password policy that ships with osTicket.
+ * 
+ */
 class osTicketPasswordPolicy
 extends PasswordPolicy {
-    function processPassword($passwd, $current) {
-        if (strlen($passwd) < 6) {
+    static $id = "basic";
+    static $name = /* @trans */ "Default Basic Policy";
+
+    function onLogin($user, $password) {
+        global $cfg;
+
+        // Check for possible password expiration
+        // Check is only here for legacy reasons - password management
+        // policies are now done via plugins.
+        if ($cfg && $user
+                && ($period=$cfg->getPasswdResetPeriod())
+                && ($time=$user->getPasswdResetTimestamp())
+                && $time < time()-($period*2629800))
+            throw new ExpiredPassword(__('Expired password'));
+    }
+
+    function onSet($passwd, $current) {
+        $pwdlen = strlen($passwd);
+        if ($pwdlen < 6) {
             throw new BadPassword(
                 __('Password must be at least 6 characters'));
+        } elseif ($pwdlen > 128) {
+            throw new BadPassword(
+                sprintf('%s - %s', __('Password is too long'), __('maximum of 128 characters allowed')));
         }
         // XXX: Changing case is technicall changing the password
         if (0 === strcasecmp($passwd, $current)) {

include/class.avatar.php

@@ -52,7 +52,7 @@ abstract class AvatarSource {
             $this->mode = $mode;
     }
 
-    function getName() {
+    static function getName() {
         return __(static::$name);
     }
 
@@ -107,12 +107,17 @@ class LocalAvatar
 extends Avatar {
     var $mode;
     var $code;
+    var $size;
 
     function __construct($user, $mode) {
         parent::__construct($user);
         $this->mode = $mode;
     }
 
+    function setSize($size) {
+        $this->size = $size;
+    }
+
     function getUrl($size) {
         $code = $this->code;
         if (!$code && method_exists($this->user, 'getExtraAttr'))
@@ -124,8 +129,12 @@ extends Avatar {
             // Generate a random string of 0-6 chars for the avatar signature
             $uid = md5(strtolower($this->user->getEmail()));
 
-        return ROOT_PATH . 'avatar.php?'.Http::build_query(array('uid'=>$uid,
-            'mode' => $this->mode));
+        $args = array('uid'=>$uid, 'mode' => $this->mode);
+
+        if ($this->size)
+            $args['size'] = $this->size;
+
+        return ROOT_PATH . 'avatar.php?' . Http::build_query($args);
     }
 
     function toggle() {
@@ -152,7 +161,7 @@ class RandomAvatar {
         $this->mode = $mode;
     }
 
-    function makeAvatar($uid) {
+    function makeAvatar($uid, $size=null) {
         $sprite = self::$sprites[$this->mode];
         if (!$sprite || !is_readable(ROOT_DIR . $sprite['file']) || !extension_loaded('gd'))
             Http::redirect(ROOT_PATH.'images/mystery-oscar.png');
@@ -172,6 +181,11 @@ class RandomAvatar {
             imagecopy($avatar, $source, 0, 0, $idx*$grid, $i*$grid, $grid, $grid);
         }
 
+        // Resize the avatar (if applicable)
+        if ($size) {
+            $avatar = imagescale($avatar, $size, $size);
+        }
+
         return $avatar;
     }
 }

include/class.banlist.php

@@ -17,11 +17,11 @@
 require_once "class.filter.php";
 class Banlist {
 
-    function add($email,$submitter='') {
+    static function add($email,$submitter='') {
         return self::getSystemBanList()->addRule('email','equal',$email);
     }
 
-    function remove($email) {
+    static function remove($email) {
         return self::getSystemBanList()->removeRule('email','equal',$email);
     }
 
@@ -52,11 +52,11 @@ class Banlist {
         return false;
     }
 
-    function includes($email) {
+    static function includes($email) {
         return self::getSystemBanList()->containsRule('email','equal',$email);
     }
 
-    function ensureSystemBanList() {
+    static function ensureSystemBanList() {
 
         if (!($id=Filter::getByName('SYSTEM BAN LIST')))
             $id=self::createSystemBanList();
@@ -64,7 +64,7 @@ class Banlist {
         return $id;
     }
 
-    function createSystemBanList() {
+    static function createSystemBanList() {
         # XXX: Filter::create should return the ID!!!
         $errors=array();
         return Filter::create(array(
@@ -80,8 +80,8 @@ class Banlist {
         ), $errors);
     }
 
-    function getSystemBanList() {
-        return new Filter(self::ensureSystemBanList());
+    static function getSystemBanList() {
+        return self::ensureSystemBanList();
     }
 
     static function getFilter() {

include/class.base32.php

@@ -20,7 +20,7 @@ class Base32 {
      * to double performance
      */
 
-    function encode($inString)
+    static function encode($inString)
     {
         $outString = "";
         $compBits = "";
@@ -68,7 +68,7 @@ class Base32 {
      *
      */
 
-    function decode($inString) {
+    static function decode($inString) {
         /* declaration */
         $deCompBits = '';
         $outString = '';

include/class.businesshours.php

@@ -0,0 +1,195 @@
+<?php
+/*********************************************************************
+    class.businesshours.php
+
+    Peter Rotich <peter@osticket.com>
+    Copyright (c)  2019 osTicket
+    http://www.osticket.com
+
+    Released under the GNU General Public License WITHOUT ANY WARRANTY.
+    See LICENSE.TXT for details.
+
+    vim: expandtab sw=4 ts=4 sts=4:
+**********************************************************************/
+
+include_once INCLUDE_DIR.'class.schedule.php';
+
+/*
+ * BusinessHours utility class
+ *
+ */
+class BusinessHours {
+
+    // Schedule
+    protected $schedule;
+
+    // Options
+    protected $options;
+
+    // Occurrence buckets
+    protected $workhours;
+    protected $holidays;
+
+    // Timeline log
+    protected $timeline;
+
+
+    function __construct(BusinessHoursSchedule $schedule,
+            $options=array()) {
+
+        $this->schedule = $schedule;
+        $this->options = $options;
+    }
+
+    function __onload() {
+        $this->workhours = array();
+        $this->holidays = array();
+        $this->timeline = array();
+    }
+
+    public function getSchedule() {
+        return $this->schedule;
+    }
+
+    // Intitialize occurrenses buckets
+    private function initOccurrences(Datetime $date, $grace_period_hrs=72) {
+
+        $dt = clone $date;
+        // Start from next day if current date is already processed
+        if (isset($this->workhours[$dt->format('Y-m-d')]))
+            $dt->modify('+1 day');
+
+        // Apply grace period
+        $period =  clone $dt;
+        $period->modify("+$grace_period_hrs hour");
+
+        // Reset occurrense buckets
+        $this->workhours = $this->holidays = array();
+        // Init workhours
+        foreach ($this->getSchedule()->getEntries() as $entry)
+            $this->workhours += $entry->getOccurrences($dt,
+                    $period->format('Y-m-d'));
+        ksort($this->workhours);
+        // Init holidays taking into account end date of the workhours in
+        // the current scope.
+        $enddate = array_pop(array_keys($this->workhours));
+        foreach ($this->getSchedule()->getHolidaysSchedules() as $schedule) {
+            foreach ($schedule->getEntries() as $entry)
+                $this->holidays += $entry->getOccurrences($dt, $enddate);
+        }
+        ksort($this->holidays);
+
+        // Return number of work hours occurrences
+        return count($this->workhours);
+    }
+
+    // Add requesed Working Hours to a given date in accordance to schedule
+    public function addWorkingHours(Datetime $date, $hours, &$auditlog=array()) {
+
+        // We ain't doing shit without hours
+        if (!$hours || !is_numeric($hours))
+            return $date;
+
+        // If the schedule has no entries then return false - indicating an
+        // error to the caller
+        if (!$this->getSchedule()->getNumEntries())
+            return false;
+
+        // Set timezone to schedule's one
+        $date->setTimezone($this->getSchedule()->getDatetimeZone());
+        $this->timeline(sprintf('*** Add %d Working Hours to %s ***',
+                 $hours, $date->format('Y-m-d H:i:s')));
+        $seconds = $hours*3600; // Requested hours in seconds
+        $_seconds = 0; // Bucker to collect working hours in seconds
+        while ($_seconds < $seconds) {
+            // Initialize occurrences of schedule entries from this date.
+            if (!$this->initOccurrences($date))
+                break;
+            // Loop thro' business hours while accounting for requested
+            // working hours
+            foreach ($this->workhours as $d => $e) {
+                $partial = false;
+                // Handle edge case where we're starting with a date that
+                // might or not be within Schedule Entry hours.
+                if ($d == $date->format('Y-m-d')) {
+                    // If it's after hours then continue to the next working
+                    // day
+                    if ($e->isAfterHours($date))
+                        continue;
+
+                    // If we're already into the day then we need to do
+                    // partial / remaining hours
+                    if (!$e->isBeforeHours($date))
+                        $partial = true;
+
+                } elseif (strtotime("$d ".$e->getEndsTime()) <
+                           $date->getTimestamp()) {
+                    // Entry is out of scope
+                    continue;
+                }
+
+                // Handle holidays - if within scope of current work day
+                $leadtime =0;
+                if (($holiday=$this->holidays[$d])) {
+                    $this->timeline(sprintf('%s -> Skip %f Holiday Hours from %s [%s]',
+                            $d,
+                            $holiday->getHours(),
+                            $holiday->getSchedule()->getName(),
+                            $holiday->getDesc()));
+
+                    //Move the date to end of the day of the holiday
+                    $date->modify("$d ".$holiday->getEndsTime());
+                    // If the holiday is a full day then assume the day is a goner
+                    if ($holiday->isFullDay()) continue;
+                    $partial = true;
+                    // See if we need to recover any time prior to start of
+                    // holiday e.g if the day starts at 8am but the  holiday
+                    // starts at 10am. Not typical but I foresee people
+                    // using holiday concept to account for lunch hours.
+                    $hstarts = strtotime($holiday->getStartsTime());
+                    $dstarts = strtotime($e->getStartsTime());
+                    if ($hstarts > $dstarts)
+                        $leadtime = $hstarts-$dstarts;
+                }
+
+                // Add time to the bucket.
+                $time = $partial ? ($e->diffTime($date) + $leadtime) : $e->diff();
+                $_seconds += $time;
+                // Advance the date to end of this business day
+                $date->modify("$d ".$e->getEndsTime());
+                $this->timeline(sprintf('%s -> Apply %f Working Hours from %s
+                        - %s (%d)',
+                        $d, $time/3600, $e->getName(),
+                        $date->format('Y-m-d H:i:s'),
+                         ($_seconds/3600)));
+                // Back track if the quota is met and break out of the loop.
+                if ($_seconds > $seconds) {
+                    // TODO: Guard aganist backtracking to non working
+                    // hours.
+                    $time = intval(round(($_seconds-$seconds)));
+                    $interval = new DateInterval('PT'.$time.'S');
+                    $date->sub($interval);
+                    $this->timeline(sprintf('%s -> Backtrack %f Hours  %s (%s)',
+                            $d, ($time)/3600,
+                            $date->format('Y-m-d H:i:s'), ($seconds/3600)));
+                    break;
+                }
+            }
+        }
+        $this->timeline(sprintf('*** Final Datetime  %s ***',
+                $date->format('Y-m-d H:i:s')));
+
+        return $date;
+    }
+
+    // Log of the timeline for audit purposes
+    private function timeline($log) {
+        $this->timeline[] = $log;
+    }
+
+    public function getTimeline() {
+        return $this->timeline;
+    }
+}
+
+?>

include/class.canned.php

@@ -203,6 +203,9 @@ extends VerySimpleModel {
         if (!parent::delete())
             return false;
 
+        $type = array('type' => 'deleted');
+        Signal::send('object.deleted', $this, $type);
+
         $this->attachments->deleteAll();
 
         return true;
@@ -226,11 +229,22 @@ extends VerySimpleModel {
     }
 
     static function getCannedResponses($deptId=0, $explicit=false) {
+        global $thisstaff;
+
         $canned = static::objects()
             ->filter(array('isenabled' => true))
             ->order_by('title')
             ->values_flat('canned_id', 'title');
 
+        if ($thisstaff) {
+            $staffDepts = array();
+
+            $staffDepts = $thisstaff->getDepts();
+            $staffDepts[] = 0;
+
+            $canned->filter(array('dept_id__in' => $staffDepts));
+        }
+
         if ($deptId) {
             $depts = array($deptId);
             if (!$explicit)
@@ -247,7 +261,7 @@ extends VerySimpleModel {
         return $responses;
     }
 
-    function responsesByDeptId($deptId, $explicit=false) {
+    static function responsesByDeptId($deptId, $explicit=false) {
         return self::getCannedResponses($deptId, $explicit);
     }
 
@@ -297,6 +311,12 @@ extends VerySimpleModel {
 
         return true;
     }
+
+    function staffCanAccess($staff) {
+        if (!$staff instanceof Staff)
+            return false;
+        return (!$this->dept || (($role = $staff->getRole($this->dept)) && $role->hasPerm(Canned::PERM_MANAGE)));
+    }
 }
 RolePermission::register( /* @trans */ 'Knowledgebase', Canned::getPermissions());
 

include/class.category.php

@@ -211,11 +211,13 @@ class Category extends VerySimpleModel {
     function delete() {
         try {
             parent::delete();
-            $this->faqs->expunge();
         }
         catch (OrmException $e) {
             return false;
         }
+        $type = array('type' => 'deleted');
+        Signal::send('object.deleted', $this, $type);
+
         return true;
     }
 

include/class.charset.php

@@ -29,7 +29,8 @@ class Charset {
         // ks_c_5601-1987: Korean alias for cp949
         case preg_match('`^ks_c_5601-1987`i', $charset):
             return 'cp949';
-        case preg_match('`^iso-?(\S+)$`i', $charset, $match):
+        // Remove trailing junk from ISO charset
+        case preg_match('`^iso-?(\S+[^i])(-i)?$`i', $charset, $match):
             return "ISO-".$match[1];
         // GBK superceded gb2312 and is backward compatible
         case preg_match('`^gb2312`i', $charset):
@@ -73,7 +74,7 @@ class Charset {
     }
 
     //Wrapper for utf-8 transcoding.
-    function utf8($text, $charset=null) {
+    static function utf8($text, $charset=null) {
         return self::transcode($text, $charset, self::UTF8);
     }
 }

include/class.client.php

@@ -53,34 +53,36 @@ implements EmailContact, ITicketUser, TemplateVariable {
     }
 
     function getVar($tag) {
-        global $cfg;
-
         switch (strtolower($tag)) {
         case 'ticket_link':
-            $qstr = array();
-            if ($cfg && $cfg->isAuthTokenEnabled()
-                    && ($ticket=$this->getTicket())) {
-                      if (!$ticket->getThread()->getNumCollaborators()) {
-                          $qstr['auth'] = $ticket->getAuthToken($this);
-                          return sprintf('%s/view.php?%s',
-                               $cfg->getBaseUrl(),
-                               Http::build_query($qstr, false)
-                               );
-                      }
-                      else {
-                          return sprintf('%s/tickets.php?id=%s',
-                               $cfg->getBaseUrl(),
-                               $ticket->getId()
-                               );
-                      }
-                    }
-
-
-
+            $ticket = $this->getTicket();
+            return $this->getTicketLink(($ticket &&
+                        !$ticket->getNumCollaborators()));
             break;
         }
     }
 
+    function getTicketLink($authtoken=true) {
+        global $cfg;
+
+        $ticket = $this->getTicket();
+        if ($authtoken
+                && $ticket
+                && $cfg->isAuthTokenEnabled()) {
+            $qstr = array();
+            $qstr['auth'] = $ticket->getAuthToken($this);
+            return sprintf('%s/view.php?%s',
+                        $cfg->getBaseUrl(),
+                        Http::build_query($qstr, false)
+                        );
+        }
+
+        return sprintf('%s/view.php?id=%s',
+                $cfg->getBaseUrl(),
+                $ticket ? $ticket->getId() : 0
+                );
+    }
+
     function getId() { return ($this->user) ? $this->user->getId() : null; }
     function getEmail() { return ($this->user) ? $this->user->getEmail() : null; }
     function getName() {
@@ -149,6 +151,19 @@ implements EmailContact, ITicketUser, TemplateVariable {
         return $this->user->getId();
     }
 
+    function getEmailAddress() {
+        $emailaddr =  (string) $this->getEmail();
+        if (($name=$this->getName()))
+            $emailaddr = sprintf('"%s" <%s>',
+                    (string) $name,
+                    $emailaddr);
+        return $emailaddr;
+    }
+
+    function __toString() {
+        return $this->getEmailAddress();
+    }
+
     abstract function getTicketId();
     abstract function getTicket();
 }
@@ -245,6 +260,11 @@ class EndUser extends BaseAuthenticatedUser {
         return UserAuthenticationBackend::getBackend($authkey);
     }
 
+    function get2FABackend() {
+        //TODO: support 2FA on client portal
+        return null;
+    }
+
     function getTicketStats() {
         if (!isset($this->_stats))
             $this->_stats = $this->getStats();
@@ -316,6 +336,13 @@ class EndUser extends BaseAuthenticatedUser {
         return $this->_account;
     }
 
+    function getUser() {
+        if ($this->user === false)
+            $this->user = User::lookup($this->getId());
+
+        return $this->user;
+    }
+
     function getLanguage($flags=false) {
         if ($acct = $this->getAccount())
             return $acct->getLanguage($flags);
@@ -372,7 +399,7 @@ class EndUser extends BaseAuthenticatedUser {
 
 class ClientAccount extends UserAccount {
 
-    function checkPassword($password, $autoupdate=true) {
+    function check_passwd($password, $autoupdate=true) {
 
         /*bcrypt based password match*/
         if(Passwd::cmp($password, $this->get('passwd')))
@@ -393,7 +420,7 @@ class ClientAccount extends UserAccount {
     }
 
     function hasCurrentPassword($password) {
-        return $this->checkPassword($password, false);
+        return $this->check_passwd($password, false);
     }
 
     function cancelResetTokens() {
@@ -422,32 +449,37 @@ class ClientAccount extends UserAccount {
             return parent::update($vars, $errors);
 
         $rtoken = $_SESSION['_client']['reset-token'];
-        if ($vars['passwd1'] || $vars['passwd2'] || $vars['cpasswd'] || $rtoken) {
+
+
+		if ($rtoken) {
+			$_config = new Config('pwreset');
+			if ($_config->get($rtoken) != 'c'.$this->getUserId())
+				$errors['err'] =
+					__('Invalid reset token. Logout and try again');
+			elseif (!($ts = $_config->lastModified($rtoken))
+					&& ($cfg->getPwResetWindow() < (time() - strtotime($ts))))
+				$errors['err'] =
+					__('Invalid reset token. Logout and try again');
+		} elseif ($vars['passwd1'] || $vars['passwd2'] || $vars['cpasswd']) {
 
             if (!$vars['passwd1'])
                 $errors['passwd1']=__('New password is required');
-            elseif ($vars['passwd1'] && strlen($vars['passwd1'])<6)
-                $errors['passwd1']=__('Password must be at least 6 characters');
             elseif ($vars['passwd1'] && strcmp($vars['passwd1'], $vars['passwd2']))
                 $errors['passwd2']=__('Passwords do not match');
-
-            if ($rtoken) {
-                $_config = new Config('pwreset');
-                if ($_config->get($rtoken) != 'c'.$this->getUserId())
-                    $errors['err'] =
-                        __('Invalid reset token. Logout and try again');
-                elseif (!($ts = $_config->lastModified($rtoken))
-                        && ($cfg->getPwResetWindow() < (time() - strtotime($ts))))
-                    $errors['err'] =
-                        __('Invalid reset token. Logout and try again');
-            }
             elseif ($this->get('passwd')) {
                 if (!$vars['cpasswd'])
                     $errors['cpasswd']=__('Current password is required');
                 elseif (!$this->hasCurrentPassword($vars['cpasswd']))
                     $errors['cpasswd']=__('Invalid current password!');
-                elseif (!strcasecmp($vars['passwd1'], $vars['cpasswd']))
-                    $errors['passwd1']=__('New password MUST be different from the current password!');
+            }
+
+            // Check password policies
+			if (!$errors) {
+                try {
+                    UserAccount::checkPassword($vars['passwd1'], @$vars['cpasswd']);
+                } catch (BadPassword $ex) {
+                    $errors['passwd1'] = $ex->getMessage();
+                }
             }
         }
 
@@ -465,7 +497,7 @@ class ClientAccount extends UserAccount {
         if ($vars['backend']) {
             $this->set('backend', $vars['backend']);
             if ($vars['username'])
-                $this->set('username', $vars['username']);
+                $this->set('username', Format::sanitize($vars['username']));
         }
 
         if ($vars['passwd1']) {

include/class.collaborator.php

@@ -37,12 +37,8 @@ implements EmailContact, ITicketUser {
     const FLAG_ACTIVE = 0x0001;
     const FLAG_CC = 0x0002;
 
-    function __toString() {
-        return Format::htmlchars($this->toString());
-    }
-    function toString() {
-        return sprintf('"%s" <%s>', $this->getName(), $this->getEmail());
-    }
+    var $active;
+
 
     function getId() {
         return $this->id;
@@ -61,7 +57,7 @@ implements EmailContact, ITicketUser {
     }
 
     function getTicketId() {
-        if ($this->thread->object_type == ObjectModel::OBJECT_TYPE_TICKET)
+        if ($this->thread && $this->thread->object_type == ObjectModel::OBJECT_TYPE_TICKET)
             return $this->thread->object_id;
     }
 
@@ -79,6 +75,16 @@ implements EmailContact, ITicketUser {
     function getEmail() {
         return $this->user->getEmail();
     }
+
+    function getEmailAddress() {
+        $emailaddr =  (string) $this->getEmail();
+        if (($name=$this->getName()))
+            $emailaddr = sprintf('"%s" <%s>',
+                    (string) $name,
+                    $emailaddr);
+        return $emailaddr;
+    }
+
     function getName() {
         return $this->user->getName();
     }
@@ -133,6 +139,10 @@ implements EmailContact, ITicketUser {
         return $this->user_id;
     }
 
+    function __toString() {
+        return Format::htmlchars($this->getEmailAddress());
+    }
+
     function hasFlag($flag) {
         return ($this->get('flags', 0) & $flag) != 0;
     }
@@ -144,8 +154,8 @@ implements EmailContact, ITicketUser {
             $this->flags &= ~$flag;
     }
 
-    public function setCc() {
-      $this->setFlag(Collaborator::FLAG_ACTIVE, true);
+    public function setCc($active=true) {
+      $this->setFlag(Collaborator::FLAG_ACTIVE, $active);
       $this->setFlag(Collaborator::FLAG_CC, true);
       $this->save();
     }

include/class.config.php

@@ -31,14 +31,13 @@ class Config {
     var $defaults = array();                # List of default values
 
     function __construct($section=null, $defaults=array()) {
+        if ($defaults)
+            $this->defaults = $defaults;
         if ($section)
             $this->section = $section;
-
         if ($this->section === null)
             return false;
 
-        if ($defaults)
-            $this->defaults = $defaults;
 
         if (isset($_SESSION['cfg:'.$this->section]))
             $this->session = &$_SESSION['cfg:'.$this->section];
@@ -62,6 +61,10 @@ class Config {
         return $info;
     }
 
+    function toArray() {
+        return $this->getInfo();
+    }
+
     function get($key, $default=null) {
         if (isset($this->session) && isset($this->session[$key]))
             return $this->session[$key];
@@ -74,7 +77,12 @@ class Config {
     }
 
     function exists($key) {
-        return $this->get($key, null) ? true : false;
+        if ((isset($this->session) && array_key_exists($key, $this->session))
+                || array_key_exists($key, $this->config)
+                || array_key_exists($key, $this->defaults))
+            return true;
+
+        return false;
     }
 
     function set($key, $value) {
@@ -116,7 +124,14 @@ class Config {
             return $this->create($key, $value);
 
         $item = $this->config[$key];
+        $before = $item->value;
         $item->value = $value;
+
+        if ($before != $item->value) {
+            $type = array('type' => 'edited', 'key' => $item->ht['key']);
+            Signal::send('object.edited', $item, $type);
+        }
+
         return $item->save();
     }
 
@@ -179,6 +194,25 @@ extends VerySimpleModel {
                 'updated__lt' => SqlFunction::NOW()->minus(SqlInterval::SECOND($period)),
             ))->delete();
     }
+
+
+    static function getConfigsByNamespace(?string $namespace, $key, $value=false) {
+      
+        $filter = array();
+
+         $filter['key'] = $key;
+
+         if ($namespace)
+            $filter['namespace'] = $namespace;
+
+         if ($value)
+            $filter['value'] = $value;
+
+         $token = ConfigItem::objects()
+            ->filter($filter);
+
+         return $namespace ? $token[0] : $token;
+    }
 }
 
 class OsticketConfig extends Config {
@@ -187,6 +221,7 @@ class OsticketConfig extends Config {
 
     var $defaultDept;   //Default Department
     var $defaultSLA;   //Default SLA
+    var $defaultSchedule; // Default Schedule
     var $defaultEmail;  //Default Email
     var $alertEmail;  //Alert Email
     var $defaultSMTPEmail; //Default  SMTP Email
@@ -200,7 +235,9 @@ class OsticketConfig extends Config {
         'agent_name_format' =>  'full', # First Last
         'client_name_format' => 'original', # As entered
         'auto_claim_tickets'=>  true,
+        'auto_refer_closed' => true,
         'collaborator_ticket_visibility' =>  true,
+        'disable_agent_collabs' => false,
         'require_topic_to_close' =>  false,
         'system_language' =>    'en_US',
         'default_storage_bk' => 'D',
@@ -219,6 +256,8 @@ class OsticketConfig extends Config {
         'ticket_lock' => 2, // Lock on activity
         'max_open_tickets' => 0,
         'files_req_auth' => 1,
+        'force_https' => '',
+        'allow_external_images' => 0,
     );
 
     function __construct($section=null) {
@@ -334,14 +373,38 @@ class OsticketConfig extends Config {
     }
 
     /* Date & Time Formats */
-    function getTimeFormat() {
+    function getTimeFormat($propogate=false) {
+        global $cfg;
+
         if ($this->get('date_formats') == 'custom')
             return $this->get('time_format');
+
+        if ($propogate) {
+            $format = 'h:i a'; // Default
+            if (class_exists('IntlDateFormatter')) {
+                $formatter = new IntlDateFormatter(
+                    Internationalization::getCurrentLocale(),
+                    IntlDateFormatter::NONE,
+                    IntlDateFormatter::SHORT,
+                    $this->getTimezone(),
+                    IntlDateFormatter::GREGORIAN
+                );
+                $format = $formatter->getPattern();
+            }
+            // Check if we're forcing 24 hrs format
+            if ($cfg && $cfg->isForce24HourTime() && $format)
+                $format = trim(str_replace(array('a', 'h'), array('', 'H'),
+                            $format));
+            return $format;
+        }
+
         return '';
     }
+
     function isForce24HourTime() {
         return $this->get('date_formats') == '24';
     }
+
     /**
      * getDateFormat
      *
@@ -368,10 +431,8 @@ class OsticketConfig extends Config {
                 );
                 return $formatter->getPattern();
             }
-            else {
-                // Use a standard
-                return 'y-M-d';
-            }
+            // Use a standard
+            return 'y-M-d';
         }
         return '';
     }
@@ -379,6 +440,11 @@ class OsticketConfig extends Config {
     function getDateTimeFormat() {
         if ($this->get('date_formats') == 'custom')
             return $this->get('datetime_format');
+
+        if (class_exists('IntlDateFormatter'))
+            return sprintf('%s %s', $this->getDateFormat(true),
+                    $this->getTimeFormat(true));
+
         return '';
     }
 
@@ -412,14 +478,59 @@ class OsticketConfig extends Config {
         return $this->get('overdue_grace_period');
     }
 
+    // This is here for legacy reasons - default osTicket Password Policy
+    // uses it, if previously set.
     function getPasswdResetPeriod() {
         return $this->get('passwd_reset_period');
     }
 
+
+    function getStaffPasswordPolicy() {
+        return $this->get('agent_passwd_policy');
+    }
+
+    function getClientPasswordPolicy() {
+        return $this->get('client_passwd_policy');
+    }
+
+    function require2FAForAgents() {
+         return $this->get('require_agent_2fa');
+    }
+
     function isRichTextEnabled() {
         return $this->get('enable_richtext');
     }
 
+    function getAllowIframes() {
+        return str_replace(array(', ', ','), array(' ', ' '), $this->get('allow_iframes')) ?: "'self'";
+    }
+
+    function getIframeWhitelist() {
+        $whitelist = array_filter(explode(',', str_replace(' ', '', $this->get('embedded_domain_whitelist'))));
+
+        return !empty($whitelist) ? $whitelist : null;
+    }
+
+    function getACL() {
+        if (!($acl = $this->get('acl')))
+            return null;
+
+        return explode(',', str_replace(' ', '', $acl));
+    }
+
+    function getACLBackendOpts() {
+        return array(
+            0 => __('Disabled'),
+            1 => __('All'),
+            2 => __('Client Portal'),
+            3 => __('Staff Panel')
+        );
+    }
+
+    function getACLBackend() {
+        return $this->get('acl_backend') ?: 0;
+    }
+
     function isAvatarsEnabled() {
         return $this->get('enable_avatars');
     }
@@ -533,6 +644,18 @@ class OsticketConfig extends Config {
         return $this->defaultSLA;
     }
 
+    function getDefaultScheduleId() {
+        return $this->get('schedule_id');
+    }
+
+    function getDefaultSchedule() {
+        if (!isset($this->defaultSchedule) && $this->getDefaultScheduleId())
+            $this->defaultSchedule = BusinessHoursSchedule::lookup(
+                    $this->getDefaultScheduleId());
+
+        return $this->defaultSchedule;
+    }
+
     function getAlertEmailId() {
         return $this->get('alert_email_id');
     }
@@ -546,12 +669,15 @@ class OsticketConfig extends Config {
         return $this->alertEmail;
     }
 
-    function getDefaultSMTPEmail() {
+    function getDefaultSmtpAccount() {
+        if (!$this->defaultSmtpAccount && $this->get('default_smtp_id'))
+            $this->defaultSmtpAccount = SmtpAccount::lookup($this->get('default_smtp_id'));
 
-        if(!$this->defaultSMTPEmail && $this->get('default_smtp_id'))
-            $this->defaultSMTPEmail = Email::lookup($this->get('default_smtp_id'));
+        return $this->defaultSmtpAccount;
+    }
 
-        return $this->defaultSMTPEmail;
+    function getDefaultMTA() {
+        return $this->getDefaultSmtpAccount();
     }
 
     function getDefaultPriorityId() {
@@ -577,6 +703,10 @@ class OsticketConfig extends Config {
         return $this->get('help_topic_sort_mode');
     }
 
+    function forceHttps() {
+        return $this->get('force_https') == 'on';
+    }
+
     function setTopicSortMode($mode) {
         $modes = static::allTopicSortModes();
         if (!isset($modes[$mode]))
@@ -707,6 +837,13 @@ class OsticketConfig extends Config {
         return $this->get('client_registration');
     }
 
+    function isClientRegistrationMode($modes) {
+        if (!is_array($modes))
+            $modes = array($modes);
+
+        return in_array($this->getClientRegistrationMode(), $modes);
+    }
+
     function isClientEmailVerificationRequired() {
         return $this->get('client_verify_email');
     }
@@ -928,16 +1065,28 @@ class OsticketConfig extends Config {
         return $this->get('auto_claim_tickets');
     }
 
+    function autoReferTicketsOnClose() {
+         return $this->get('auto_refer_closed');
+    }
+
     function collaboratorTicketsVisibility() {
         return $this->get('collaborator_ticket_visibility');
     }
 
+    function disableAgentCollaborators() {
+        return $this->get('disable_agent_collabs');
+    }
+
     function requireTopicToClose() {
         return $this->get('require_topic_to_close');
     }
 
+    function allowExternalImages() {
+        return ($this->get('allow_external_images'));
+    }
+
     function getDefaultTicketQueueId() {
-        return $this->get('default_ticket_queue');
+        return $this->get('default_ticket_queue', 1);
     }
 
     function hideStaffName() {
@@ -1120,6 +1269,9 @@ class OsticketConfig extends Config {
         $f['helpdesk_title']=array('type'=>'string',   'required'=>1, 'error'=>__('Helpdesk title is required'));
         $f['default_dept_id']=array('type'=>'int',   'required'=>1, 'error'=>__('Default Department is required'));
         $f['autolock_minutes']=array('type'=>'int',   'required'=>1, 'error'=>__('Enter lock time in minutes'));
+        $f['allow_iframes']=array('type'=>'cs-url',   'required'=>0, 'error'=>__('Enter comma separated list of urls'));
+        $f['embedded_domain_whitelist']=array('type'=>'cs-domain',   'required'=>0, 'error'=>__('Enter comma separated list of domains'));
+        $f['acl']=array('type'=>'ipaddr',   'required'=>0, 'error'=>__('Enter comma separated list of IP addresses'));
         //Date & Time Options
         $f['time_format']=array('type'=>'string',   'required'=>1, 'error'=>__('Time format is required'));
         $f['date_format']=array('type'=>'string',   'required'=>1, 'error'=>__('Date format is required'));
@@ -1130,6 +1282,18 @@ class OsticketConfig extends Config {
 
         $vars = Format::htmlchars($vars, true);
 
+        // ACL Checks
+        if ($vars['acl']) {
+            // Check if Admin's IP is in the list, if not, return error
+            // to avoid locking self out
+            if (!in_array($vars['acl_backend'], array(0,2))) {
+                $acl = explode(',', str_replace(' ', '', $vars['acl']));
+                if (!in_array(osTicket::get_client_ip(), $acl))
+                    $errors['acl'] = __('Cowardly refusing to lock out active administrator');
+            }
+        } elseif ((int) $vars['acl_backend'] !== 0)
+            $errors['acl'] = __('IP address required when selecting panel');
+
         // Make sure the selected backend is valid
         $storagebk = null;
         if (isset($vars['default_storage_bk'])) {
@@ -1161,6 +1325,7 @@ class OsticketConfig extends Config {
             'helpdesk_title'=>$vars['helpdesk_title'],
             'helpdesk_url'=>$vars['helpdesk_url'],
             'default_dept_id'=>$vars['default_dept_id'],
+            'force_https'=>$vars['force_https'] ? 'on' : '',
             'max_page_size'=>$vars['max_page_size'],
             'log_level'=>$vars['log_level'],
             'log_graceperiod'=>$vars['log_graceperiod'],
@@ -1170,6 +1335,7 @@ class OsticketConfig extends Config {
             'daydatetime_format'=>$vars['daydatetime_format'],
             'date_formats'=>$vars['date_formats'],
             'default_timezone'=>$vars['default_timezone'],
+            'schedule_id' => $vars['schedule_id'],
             'default_locale'=>$vars['default_locale'],
             'system_language'=>$vars['system_language'],
             'secondary_langs'=>$secondary_langs,
@@ -1178,6 +1344,10 @@ class OsticketConfig extends Config {
             'enable_avatars' => isset($vars['enable_avatars']) ? 1 : 0,
             'enable_richtext' => isset($vars['enable_richtext']) ? 1 : 0,
             'files_req_auth' => isset($vars['files_req_auth']) ? 1 : 0,
+            'allow_iframes' => Format::sanitize($vars['allow_iframes']),
+            'embedded_domain_whitelist' => Format::sanitize($vars['embedded_domain_whitelist']),
+            'acl' => Format::sanitize($vars['acl']),
+            'acl_backend' => Format::sanitize((int) $vars['acl_backend']) ?: 0,
         ));
     }
 
@@ -1196,16 +1366,18 @@ class OsticketConfig extends Config {
             return false;
 
         return $this->updateAll(array(
-            'passwd_reset_period'=>$vars['passwd_reset_period'],
+            'agent_passwd_policy'=>$vars['agent_passwd_policy'],
             'staff_max_logins'=>$vars['staff_max_logins'],
             'staff_login_timeout'=>$vars['staff_login_timeout'],
             'staff_session_timeout'=>$vars['staff_session_timeout'],
             'staff_ip_binding'=>isset($vars['staff_ip_binding'])?1:0,
             'allow_pw_reset'=>isset($vars['allow_pw_reset'])?1:0,
             'pw_reset_window'=>$vars['pw_reset_window'],
+            'require_agent_2fa'=> isset($vars['require_agent_2fa']) ? 1 : 0,
             'agent_name_format'=>$vars['agent_name_format'],
             'hide_staff_name'=>isset($vars['hide_staff_name']) ? 1 : 0,
             'agent_avatar'=>$vars['agent_avatar'],
+            'disable_agent_collabs'=>isset($vars['disable_agent_collabs'])?1:0,
         ));
     }
 
@@ -1222,6 +1394,7 @@ class OsticketConfig extends Config {
             return false;
 
         return $this->updateAll(array(
+            'client_passwd_policy'=>$vars['client_passwd_policy'],
             'client_max_logins'=>$vars['client_max_logins'],
             'client_login_timeout'=>$vars['client_login_timeout'],
             'client_session_timeout'=>$vars['client_session_timeout'],
@@ -1289,12 +1462,14 @@ class OsticketConfig extends Config {
             'max_open_tickets'=>$vars['max_open_tickets'],
             'enable_captcha'=>isset($vars['enable_captcha'])?1:0,
             'auto_claim_tickets'=>isset($vars['auto_claim_tickets'])?1:0,
+            'auto_refer_closed' => isset($vars['auto_refer_closed']) ? 1 : 0,
             'collaborator_ticket_visibility'=>isset($vars['collaborator_ticket_visibility'])?1:0,
             'require_topic_to_close'=>isset($vars['require_topic_to_close'])?1:0,
             'show_related_tickets'=>isset($vars['show_related_tickets'])?1:0,
             'allow_client_updates'=>isset($vars['allow_client_updates'])?1:0,
             'ticket_lock' => $vars['ticket_lock'],
             'default_ticket_queue'=>$vars['default_ticket_queue'],
+            'allow_external_images'=>isset($vars['allow_external_images'])?1:0,
         ));
     }
 
@@ -1525,11 +1700,6 @@ class OsticketConfig extends Config {
 
 
     function updateKBSettings($vars, &$errors) {
-
-        if ($vars['restrict_kb'] && !$this->isClientRegistrationEnabled())
-            $errors['restrict_kb'] =
-                __('The knowledge base cannot be restricted unless client registration is enabled');
-
         if ($errors) return false;
 
         return $this->updateAll(array(
@@ -1621,7 +1791,7 @@ class OsticketConfig extends Config {
     }
 
     //Used to detect version prior to 1.7 (useful during upgrade)
-    /* static */ function getDBVersion() {
+    static function getDBVersion() {
         $sql='SELECT `ostversion` FROM '.TABLE_PREFIX.'config '
             .'WHERE id=1';
         return db_result(db_query($sql));

include/class.controller.php

@@ -0,0 +1,44 @@
+<?php
+/*********************************************************************
+    class.controller.php
+
+    Peter Rotich
+    Copyright (c)  osTicket
+    http://www.osticket.com
+
+    Released under the GNU General Public License WITHOUT ANY WARRANTY.
+    See LICENSE.TXT for details.
+
+    vim: expandtab sw=4 ts=4 sts=4:
+**********************************************************************/
+abstract class Controller {
+    /*
+     * access
+     *
+     * This routine can be defined downstream to check if user has
+     * permission to call routines in the controller.
+     *
+     */
+    function access() {
+        return true;
+    }
+
+    // Wrapper for onFatalError
+    public function exerr($code, $error='') {
+        return $this->onFatalError($code, $error);
+    }
+
+    public function onFatalError($code, $error) {
+        $this->onError($code, $error);
+        // On error should exit but we're making doubly sure
+        $this->response($code, $error);
+        exit();
+    }
+
+    protected function response($code, $response) {
+        Http::response($code, $response);
+        exit();
+    }
+
+    abstract function onError($code, $error, $title=null, $logOnly=false);
+}

include/class.cron.php

@@ -20,12 +20,12 @@ require_once INCLUDE_DIR.'class.signal.php';
 
 class Cron {
 
-    function MailFetcher() {
-        require_once(INCLUDE_DIR.'class.mailfetch.php');
-        MailFetcher::run(); //Fetch mail..frequency is limited by email account setting.
+    static function MailFetcher() {
+        require_once(INCLUDE_DIR.'class.email.php');
+        osTicket\Mail\Fetcher::run(); //Fetch mail..frequency is limited by email account setting.
     }
 
-    function TicketMonitor() {
+    static function TicketMonitor() {
         require_once(INCLUDE_DIR.'class.ticket.php');
         Ticket::checkOverdue(); //Make stale tickets overdue
         // Cleanup any expired locks
@@ -34,34 +34,34 @@ class Cron {
 
     }
 
-    function PurgeLogs() {
+    static function PurgeLogs() {
         global $ost;
         // Once a day on a 5-minute cron
         if (rand(1,300) == 42)
             if($ost) $ost->purgeLogs();
     }
 
-    function PurgeDrafts() {
+    static function PurgeDrafts() {
         require_once(INCLUDE_DIR.'class.draft.php');
         Draft::cleanup();
     }
 
-    function CleanOrphanedFiles() {
+    static function CleanOrphanedFiles() {
         require_once(INCLUDE_DIR.'class.file.php');
         AttachmentFile::deleteOrphans();
     }
 
-    function CleanExpiredSessions() {
+    static function CleanExpiredSessions() {
         require_once(INCLUDE_DIR.'class.ostsession.php');
-        DbSessionBackend::cleanup();
+        osTicketSession::cleanup();
     }
 
-    function CleanPwResets() {
+    static function CleanPwResets() {
         require_once(INCLUDE_DIR.'class.config.php');
         ConfigItem::cleanPwResets();
     }
 
-    function MaybeOptimizeTables() {
+    static function MaybeOptimizeTables() {
         // Once a week on a 5-minute cron
         $chance = rand(1,2000);
         switch ($chance) {
@@ -102,7 +102,7 @@ class Cron {
         }
     }
 
-    function run(){ //called by outside cron NOT autocron
+    static function run(){ //called by outside cron NOT autocron
         global $ost;
         if (!$ost || $ost->isUpgradePending())
             return;

include/class.crypto.php

@@ -104,7 +104,7 @@ class Crypto {
 
         list(, $crypt, $ciphertext) = explode('$', $ciphertext, 3);
         //Get crypto....  based on crypt tag.
-        if(!$crypt || !($crypto=Crypto::get($crypt)) || !$crypto->exists())
+        if(!$crypt || !($crypto=Crypto::get($crypt)))
             return false;
 
         $crypto->setKeys($key, $skey);
@@ -221,8 +221,7 @@ class Crypto {
  * decrypt() which will perform the respective operations on the text
  * subjects using a specific library.
  */
-/* abstract */
-class CryptoAlgo {
+abstract class CryptoAlgo {
 
     var $master_key;
     var $sub_key;
@@ -300,8 +299,7 @@ class CryptoAlgo {
      * available and supported. This method is abstract and should be
      * defined in extension classes.
      */
-    /* abstract */
-    function exists() { return false; }
+    abstract static function exists();
 
 
 }
@@ -341,7 +339,7 @@ Class CryptoMcrypt extends CryptoAlgo {
        return ($c
                && $c['name']
                && $c['mode']
-               && $this->exists()
+               && self::exists()
                && mcrypt_module_open($c['name'], '', $c['mode'], '')
                );
     }
@@ -357,7 +355,7 @@ Class CryptoMcrypt extends CryptoAlgo {
      */
     function encrypt($text, $cid=0) {
 
-        if(!$this->exists()
+        if(!self::exists()
                 || !$text
                 || !($cipher=$this->getCipher($cid))
                 || !$cipher['cid'])
@@ -394,7 +392,7 @@ Class CryptoMcrypt extends CryptoAlgo {
      */
     function decrypt($ciphertext) {
 
-         if(!$this->exists()
+         if(!self::exists()
                  || !$ciphertext
                  || $ciphertext[0] != '$'
                  )
@@ -431,7 +429,7 @@ Class CryptoMcrypt extends CryptoAlgo {
          return $plaintext;
     }
 
-    function exists() {
+    static function exists() {
         return (extension_loaded('mcrypt')
                 && function_exists('mcrypt_module_open'));
     }
@@ -473,7 +471,7 @@ class CryptoOpenSSL extends CryptoAlgo {
 
         return ($c
                 && $c['method']
-                && $this->exists()
+                && self::exists()
                 && openssl_cipher_iv_length($c['method'])
                 );
     }
@@ -489,7 +487,7 @@ class CryptoOpenSSL extends CryptoAlgo {
      */
     function encrypt($text, $cid=0) {
 
-        if(!$this->exists()
+        if(!self::exists()
                 || !$text
                 || !($cipher=$this->getCipher($cid)))
             return false;
@@ -517,7 +515,7 @@ class CryptoOpenSSL extends CryptoAlgo {
     function decrypt($ciphertext) {
 
 
-        if(!$this->exists() || !$ciphertext || $ciphertext[0] != '$')
+        if(!self::exists() || !$ciphertext || $ciphertext[0] != '$')
             return false;
 
         list(, $cid, $ciphertext) = explode('$', $ciphertext, 3);
@@ -539,7 +537,7 @@ class CryptoOpenSSL extends CryptoAlgo {
         return $plaintext;
     }
 
-    function exists() {
+    static function exists() {
         return  (extension_loaded('openssl') && function_exists('openssl_cipher_iv_length'));
     }
 }
@@ -595,7 +593,7 @@ class CryptoPHPSecLib extends CryptoAlgo {
 
     function encrypt($text, $cid=0) {
 
-        if(!$this->exists()
+        if(!self::exists()
                 || !$text
                 || !($cipher=$this->getCipher($cid))
                 || !($crypto=$this->getCrypto($cipher['cid']))
@@ -612,7 +610,7 @@ class CryptoPHPSecLib extends CryptoAlgo {
 
     function decrypt($ciphertext) {
 
-        if(!$this->exists() || !$ciphertext || $ciphertext[0] != '$')
+        if(!self::exists() || !$ciphertext || $ciphertext[0] != '$')
             return false;
 
         list(, $cid, $ciphertext) = explode('$', $ciphertext, 3);
@@ -634,7 +632,7 @@ class CryptoPHPSecLib extends CryptoAlgo {
         return $crypto->decrypt($ciphertext);
     }
 
-    function exists() {
+    static function exists() {
         return  class_exists('Crypt_AES');
     }
 }

include/class.csrf.php

@@ -60,7 +60,7 @@ Class CSRF {
 
     function getToken() {
 
-        if (!$this->csrf['token'] || $this->isExpired()) {
+        if ((!is_array($this->csrf) || !$this->csrf['token']) || $this->isExpired()) {
             $this->rotate();
         } else {
             //Reset the timer

include/class.dept.php

@@ -14,6 +14,7 @@
     vim: expandtab sw=4 ts=4 sts=4:
 **********************************************************************/
 require_once INCLUDE_DIR . 'class.search.php';
+require_once INCLUDE_DIR.'class.role.php';
 
 class Dept extends VerySimpleModel
 implements TemplateVariable, Searchable {
@@ -31,7 +32,7 @@ implements TemplateVariable, Searchable {
                 'null' => true,
              ),
             'sla' => array(
-                'constraint' => array('sla_id' => 'SLA.sla_id'),
+                'constraint' => array('sla_id' => 'SLA.id'),
                 'null' => true,
             ),
             'manager' => array(
@@ -58,6 +59,8 @@ implements TemplateVariable, Searchable {
     var $_groupids;
     var $config;
 
+    var $schedule;
+
     var $template;
     var $autorespEmail;
 
@@ -65,12 +68,24 @@ implements TemplateVariable, Searchable {
     const DISPLAY_DISABLED = 2;
     const ALERTS_DEPT_AND_EXTENDED = 1;
     const ALERTS_DEPT_ONLY = 0;
+    const ALERTS_ADMIN_ONLY = 3;
 
     const FLAG_ASSIGN_MEMBERS_ONLY = 0x0001;
     const FLAG_DISABLE_AUTO_CLAIM  = 0x0002;
     const FLAG_ACTIVE = 0x0004;
     const FLAG_ARCHIVED = 0x0008;
     const FLAG_ASSIGN_PRIMARY_ONLY = 0x0010;
+    const FLAG_DISABLE_REOPEN_AUTO_ASSIGN = 0x0020;
+
+    const PERM_DEPT = 'visibility.departments';
+
+    static protected $perms = array(
+        self::PERM_DEPT => array(
+            'title' => /* @trans */ 'Department',
+            'desc'  => /* @trans */ 'Ability to see all Departments',
+            'primary' => true,
+        ),
+    );
 
     function asVar() {
         return $this->getName();
@@ -165,28 +180,6 @@ implements TemplateVariable, Searchable {
         return !!($this->flags & self::FLAG_ACTIVE);
     }
 
-    function clearInactiveDept($dept_id) {
-      global $cfg;
-
-      $topics = Topic::objects()->filter(array('dept_id'=>$dept_id))->values_flat('topic_id');
-      if ($topics) {
-        foreach ($topics as $topic_id) {
-          $topic = Topic::lookup($topic_id[0]);
-          $topic->dept_id = $cfg->getDefaultDeptId();
-          $topic->save();
-        }
-      }
-
-      $emails = Email::objects()->filter(array('dept_id'=>$dept_id))->values_flat('email_id');
-      if ($emails) {
-        foreach ($emails as $email_id) {
-          $email = Email::lookup($email_id[0]);
-          $email->dept_id = $cfg->getDefaultDeptId();
-          $email->save();
-        }
-      }
-    }
-
     function getEmailId() {
         return $this->email_id;
     }
@@ -282,26 +275,29 @@ implements TemplateVariable, Searchable {
     }
 
     // Get eligible members only
-    function getAssignees() {
+    function getAssignees($criteria=array()) {
+        if (!$this->assignPrimaryOnly() && !$this->assignMembersOnly()) {
+            // this is for if all agents is set - assignment is not restricted
+            // based on department membership.
+            $members =  Staff::objects()->filter(array(
+                'onvacation' => 0,
+                'isactive' => 1,
+            ));
+        } else {
+            //this gets just the members of the dept including extended access
+            $members = clone $this->getAvailableMembers();
 
-      //this is for if all members is set
-      if (!$this->assignPrimaryOnly() && !$this->assignMembersOnly()) {
-        $members =  Staff::objects()->filter(array(
-            'onvacation' => 0,
-            'isactive' => 1,
-        ));
+            //Restrict to the primary members only
+            if ($this->assignPrimaryOnly())
+                $members->filter(array('dept_id' => $this->getId()));
+        }
 
+        // Restrict agents based on visibility of the assigner
+        if (($staff=$criteria['staff']))
+            $members = $staff->applyDeptVisibility($members);
+
+        // Sort based on set name format
         return Staff::nsort($members);
-      }
-
-      //this gets just the members of the dept
-      $members = clone $this->getAvailableMembers();
-
-      //this gets just the primary members of the dept
-      if ($this->assignPrimaryOnly())
-        $members->filter(array('dept_id' => $this->getId()));
-
-      return Staff::nsort($members);
     }
 
     function getMembersForAlerts() {
@@ -326,6 +322,10 @@ implements TemplateVariable, Searchable {
         return $rv;
     }
 
+    function getNumMembersForAlerts() {
+        return count($this->getMembersForAlerts());
+    }
+
     function getSLAId() {
         return $this->sla_id;
     }
@@ -334,6 +334,18 @@ implements TemplateVariable, Searchable {
         return $this->sla;
     }
 
+    function getScheduleId() {
+        return $this->schedule_id;
+    }
+
+    function getSchedule() {
+        if (!isset($this->schedule) && $this->getScheduleId())
+            $this->schedule = BusinessHoursSchedule::lookup(
+                        $this->getScheduleId());
+
+        return $this->schedule;
+    }
+
     function getTemplateId() {
          return $this->tpl_id;
     }
@@ -460,6 +472,10 @@ implements TemplateVariable, Searchable {
         return $this->flags & self::FLAG_DISABLE_AUTO_CLAIM;
     }
 
+    function disableReopenAutoAssign() {
+        return $this->flags & self::FLAG_DISABLE_REOPEN_AUTO_ASSIGN;
+    }
+
     function isGroupMembershipEnabled() {
         return $this->group_membership;
     }
@@ -473,7 +489,7 @@ implements TemplateVariable, Searchable {
         $ht['disable_auto_claim'] =  $this->disableAutoClaim();
         $ht['status'] = $this->getStatus();
         $ht['assignment_flag'] = $this->getAssignmentFlag();
-
+        $ht['disable_reopen_auto_assign'] =  $this->disableReopenAutoAssign();
         return $ht;
     }
 
@@ -495,6 +511,9 @@ implements TemplateVariable, Searchable {
 
         $id = $this->getId();
         if (parent::delete()) {
+            $type = array('type' => 'deleted');
+            Signal::send('object.deleted', $this, $type);
+
             // DO SOME HOUSE CLEANING
             //Move tickets to default Dept. TODO: Move one ticket at a time and send alerts + log notes.
             Ticket::objects()
@@ -514,22 +533,11 @@ implements TemplateVariable, Searchable {
             // Clear any settings using dept to default back to system default
             Topic::objects()
                 ->filter(array('dept_id' => $id))
-                ->delete();
+                ->update(array('dept_id' => 0));
+
             Email::objects()
                 ->filter(array('dept_id' => $id))
-                ->delete();
-
-            foreach(FilterAction::objects()
-                ->filter(array('type' => FA_RouteDepartment::$type)) as $fa
-            ) {
-                $config = $fa->getConfiguration();
-                if ($config && $config['dept_id'] == $id) {
-                    $config['dept_id'] = 0;
-                    // FIXME: Move this code into FilterAction class
-                    $fa->set('configuration', JsonDataEncoder::encode($config));
-                    $fa->save();
-                }
-            }
+                ->update(array('dept_id' => 0));
 
             // Delete extended access entries
             StaffDeptAccess::objects()
@@ -586,7 +594,17 @@ implements TemplateVariable, Searchable {
             $this->flags &= ~$flag;
     }
 
-    function export($dept, $criteria=null, $filename='') {
+    function hasFlag($flag) {
+        return ($this->get('flags', 0) & $flag) != 0;
+    }
+
+    function flagChanged($flag, $var) {
+        if (($this->hasFlag($flag) && !$var) ||
+            (!$this->hasFlag($flag) && $var))
+                return true;
+    }
+
+    static function export($dept, $criteria=null, $filename='') {
         include_once(INCLUDE_DIR.'class.error.php');
         $members = $dept->getMembers();
 
@@ -607,12 +625,21 @@ implements TemplateVariable, Searchable {
         return $row ? $row[0] : 0;
     }
 
-    function getNameById($id) {
+    static function getEmailIdById($id) {
+        $row = static::objects()
+            ->filter(array('id' => $id))
+            ->values_flat('email_id')
+            ->first();
+
+        return $row ? $row[0] : 0;
+    }
+
+    static function getNameById($id) {
         $names = Dept::getDepartments();
         return $names[$id];
     }
 
-    function getDefaultDeptName() {
+    static function getDefaultDeptName() {
         global $cfg;
 
         return ($cfg
@@ -629,7 +656,11 @@ implements TemplateVariable, Searchable {
             // XXX: This will upset the static $depts array
             $depts = array();
             $query = self::objects();
-            if (isset($criteria['publiconly']))
+            if (isset($criteria['publiconly']) && $criteria['publiconly'])
+                $query->filter(array(
+                             'ispublic' => ($criteria['publiconly'] ? 1 : 0)));
+
+            if (isset($criteria['activeonly']) && $criteria['activeonly'])
                 $query->filter(array(
                             'flags__hasbit' => Dept::FLAG_ACTIVE));
 
@@ -713,6 +744,15 @@ implements TemplateVariable, Searchable {
         return $depts;
     }
 
+    static function getActiveDepartments() {
+        $depts =null;
+
+        if (!$depts)
+            $depts = self::getDepartments(array('activeonly'=>true));
+
+        return $depts;
+    }
+
     static function create($vars=false, &$errors=array()) {
         $dept = new static($vars);
         $dept->created = SqlFunction::NOW();
@@ -758,8 +798,12 @@ implements TemplateVariable, Searchable {
             $errors['pid'] = __('Department selection is required');
 
         $dept = Dept::lookup($vars['pid']);
-        if($dept && !$dept->isActive())
-          $errors['dept_id'] = sprintf(__('%s selected must be active'), __('Parent Department'));
+        if ($dept) {
+          if (!$dept->isActive())
+            $errors['dept_id'] = sprintf(__('%s selected must be active'), __('Parent Department'));
+          elseif (strpos($dept->getFullPath(), '/'.$this->getId().'/') !== false)
+            $errors['pid'] = sprintf(__('%s cannot contain the current %s'), __('Parent Department'), __('Department'));
+        }
 
         if ($vars['sla_id'] && !SLA::lookup($vars['sla_id']))
             $errors['sla_id'] = __('Invalid SLA');
@@ -789,11 +833,34 @@ implements TemplateVariable, Searchable {
         if ($errors)
             return false;
 
+        $vars['disable_auto_claim'] = isset($vars['disable_auto_claim']) ? 1 : 0;
+        if ($this->getId()) {
+            //flags
+            $disableAutoClaim = $this->flagChanged(self::FLAG_DISABLE_AUTO_CLAIM, $vars['disable_auto_claim']);
+            $disableAutoAssign = $this->flagChanged(self::FLAG_DISABLE_REOPEN_AUTO_ASSIGN, $vars['disable_reopen_auto_assign']);
+            $ticketAssignment = ($this->getAssignmentFlag() != $vars['assignment_flag']);
+            foreach ($vars as $key => $value) {
+                if ($key == 'status' && $this->getStatus() && strtolower($this->getStatus()) != $value) {
+                    $type = array('type' => 'edited', 'status' => ucfirst($value));
+                    Signal::send('object.edited', $this, $type);
+                } elseif ((isset($this->$key) && ($this->$key != $value) && $key != 'members') ||
+                         ($disableAutoClaim && $key == 'disable_auto_claim') ||
+                          $ticketAssignment && $key == 'assignment_flag' ||
+                          $disableAutoAssign && $key == 'disable_reopen_auto_assign') {
+                    $type = array('type' => 'edited', 'key' => $key);
+                    Signal::send('object.edited', $this, $type);
+                }
+            }
+        }
+        if ($vars['disable_auto_claim'] !== 1)
+            unset($vars['disable_auto_claim']);
+
         $this->pid = $vars['pid'] ?: null;
         $this->ispublic = isset($vars['ispublic']) ? (int) $vars['ispublic'] : 0;
         $this->email_id = isset($vars['email_id']) ? (int) $vars['email_id'] : 0;
         $this->tpl_id = isset($vars['tpl_id']) ? (int) $vars['tpl_id'] : 0;
         $this->sla_id = isset($vars['sla_id']) ? (int) $vars['sla_id'] : 0;
+        $this->schedule_id = isset($vars['schedule_id']) ? (int) $vars['schedule_id'] : 0;
         $this->autoresp_email_id = isset($vars['autoresp_email_id']) ? (int) $vars['autoresp_email_id'] : 0;
         $this->manager_id = $vars['manager_id'] ?: 0;
         $this->name = Format::striptags($vars['name']);
@@ -805,12 +872,16 @@ implements TemplateVariable, Searchable {
 
         $this->setFlag(self::FLAG_ASSIGN_MEMBERS_ONLY, isset($vars['assign_members_only']));
         $this->setFlag(self::FLAG_DISABLE_AUTO_CLAIM, isset($vars['disable_auto_claim']));
+        $this->setFlag(self::FLAG_DISABLE_REOPEN_AUTO_ASSIGN, isset($vars['disable_reopen_auto_assign']));
 
         $filter_actions = FilterAction::objects()->filter(array('type' => 'dept', 'configuration' => '{"dept_id":'. $this->getId().'}'));
         if ($filter_actions && $vars['status'] == 'active')
-          FilterAction::setFilterFlag($filter_actions, 'dept', false);
+          FilterAction::setFilterFlags($filter_actions, 'Filter::FLAG_INACTIVE_DEPT', false);
         else
-          FilterAction::setFilterFlag($filter_actions, 'dept', true);
+          FilterAction::setFilterFlags($filter_actions, 'Filter::FLAG_INACTIVE_DEPT', true);
+
+        if ($cfg && ($this->getId() == $cfg->getDefaultDeptId()))
+            $vars['status'] = 'active';
 
         switch ($vars['status']) {
           case 'active':
@@ -828,8 +899,6 @@ implements TemplateVariable, Searchable {
             $this->setFlag(self::FLAG_ARCHIVED, true);
         }
 
-        $this->setFlag(self::FLAG_DISABLE_AUTO_CLAIM, isset($vars['disable_auto_claim']));
-
         switch ($vars['assignment_flag']) {
           case 'all':
             $this->setFlag(self::FLAG_ASSIGN_MEMBERS_ONLY, false);
@@ -872,7 +941,8 @@ implements TemplateVariable, Searchable {
       $dropped = array();
       foreach ($this->extended as $DA)
           $dropped[$DA->staff_id] = 1;
-      while (list(, list($staff_id, $role_id, $alerts)) = each($access)) {
+      foreach ($access as $acc) {
+          list ($staff_id, $role_id, $alerts) = $acc;
           unset($dropped[$staff_id]);
           if (!$role_id || !Role::lookup($role_id))
               $errors['members'][$staff_id] = __('Select a valid role');
@@ -894,6 +964,8 @@ implements TemplateVariable, Searchable {
                   'staff_id' => $staff_id, 'role_id' => $role_id
               ));
               $this->extended->add($da);
+              $type = array('type' => 'edited', 'key' => 'Staff Added');
+              Signal::send('object.edited', $this, $type);
           }
           else {
               $da->role_id = $role_id;
@@ -906,6 +978,8 @@ implements TemplateVariable, Searchable {
           return false;
 
       if ($dropped) {
+          $type = array('type' => 'edited', 'key' => 'Staff Removed');
+          Signal::send('object.edited', $this, $type);
           $this->extended->saveAll();
           $this->extended
               ->filter(array('staff_id__in' => array_keys($dropped)))
@@ -918,7 +992,12 @@ implements TemplateVariable, Searchable {
 
       return true;
     }
+
+    static function getPermissions() {
+        return self::$perms;
+    }
 }
+RolePermission::register(/* @trans */ 'Miscellaneous', Dept::getPermissions());
 
 class DepartmentQuickAddForm
 extends Form {

include/class.dispatcher.php

@@ -29,10 +29,14 @@ class Dispatcher {
     function resolve($url, $args=null) {
         if ($this->file) { $this->lazy_load(); }
         # Support HTTP method emulation with the _method GET argument
-        if (isset($_GET['_method'])) {
-            $_SERVER['REQUEST_METHOD'] = strtoupper($_GET['_method']);
-            unset($_GET['_method']);
+        if ($_SERVER['REQUEST_METHOD'] == 'POST'
+                && isset($_POST['_method'])
+                && in_array(strtoupper($_POST['_method']), array('PUT', 'PATCH', 'DELETE'))) {
+            $_SERVER['REQUEST_METHOD'] = strtoupper($_POST['_method']);
+            unset($_POST['_method']);
         }
+        // Decode URL for accurate matching
+        $url = urldecode($url);
         foreach ($this->urls as $matcher) {
             if ($matcher->matches($url)) {
                 return $matcher->dispatch($url, $args);
@@ -105,7 +109,7 @@ class UrlMatcher {
         $f = array_filter(array_keys($this->matches), 'is_numeric');
         $this->matches = array_intersect_key($this->matches, array_flip($f));
 
-        if (@get_class($this->func) == "Dispatcher") {
+        if (is_object($this->func) && (@get_class($this->func) == "Dispatcher")) {
             # Trim the leading match off the $url and call the
             # sub-dispatcher. This will be the case for lines in the URL
             # file like
@@ -136,7 +140,13 @@ class UrlMatcher {
         if ($class) {
             # Create instance of the class, which is the first item,
             # then call the method which is the second item
-            $func = array(new $class, $func);
+            $class = new $class;
+            # Check access at the controller level
+            if (!$class->access())
+                 Http::response(403,  __('Access Denied!!!'));
+            # Create callable function, class is the first item,
+            # then call the method is the second item
+            $func = array($class, $func);
         }
 
         if (!is_callable($func))
@@ -160,7 +170,7 @@ class UrlMatcher {
 
         if (strpos($class, ":")) {
             list($file, $class) = explode(":", $class, 2);
-            include $file;
+            include_once $file;
         }
         return array($class, $func);
     }

include/class.draft.php

@@ -65,16 +65,14 @@ class Draft extends VerySimpleModel {
             $draft_body = $draft->getBody();
         }
         $attrs[] = sprintf('data-draft-original="%s"',
-            Format::htmlchars(Format::viewableImages($original)));
+            Format::viewableImages($original, [], true));
 
-        return array(Format::htmlchars(Format::viewableImages($draft_body)),
+        return array(Format::viewableImages($draft_body, [], true),
             implode(' ', $attrs));
     }
 
-    function getAttachmentIds($body=false) {
+    static function getAttachmentIds($body=false) {
         $attachments = array();
-        if (!$body)
-            $body = $this->getBody();
         $body = Format::localizeInlineImages($body);
         $matches = array();
         if (preg_match_all('/"cid:([\\w.-]{32})"/', $body, $matches)) {
@@ -83,6 +81,7 @@ class Draft extends VerySimpleModel {
             foreach ($files as $F) {
                 $attachments[] = array(
                     'id' => $F->getId(),
+                    'name' => $F->getName(),
                     'inline' => true
                 );
             }

include/class.dynamic_forms.php

@@ -121,14 +121,23 @@ class DynamicForm extends VerySimpleModel {
         $fields = $this->getFields();
         $form = new SimpleForm($fields, $source, array(
             'title' => $this->getLocal('title'),
-            'instructions' => $this->getLocal('instructions'),
+            'instructions' => Format::htmldecode($this->getLocal('instructions')),
             'id' => $this->getId(),
+            'type' => $this->type ?: null,
         ));
         return $form;
     }
 
+    function hasFlag($flag) {
+        return (isset($this->flags) && ($this->flags & $flag) != 0);
+    }
+
+    function isDeleted() {
+        return $this->hasFlag(self::FLAG_DELETED);
+    }
+
     function isDeletable() {
-        return $this->flags & self::FLAG_DELETABLE;
+        return $this->hasFlag(self::FLAG_DELETABLE);
     }
 
     function setFlag($flag) {
@@ -185,7 +194,7 @@ class DynamicForm extends VerySimpleModel {
     function save($refetch=false) {
         if (count($this->dirty))
             $this->set('updated', new SqlFunction('NOW'));
-        if ($rv = parent::save($refetch | $this->dirty))
+        if ($rv = parent::save($refetch || $this->dirty))
             return $this->saveTranslations();
         return $rv;
     }
@@ -197,6 +206,8 @@ class DynamicForm extends VerySimpleModel {
 
         // Soft Delete: Mark the form as deleted.
         $this->setFlag(self::FLAG_DELETED);
+        $type = array('type' => 'deleted');
+        Signal::send('object.deleted', $this, $type);
         return $this->save();
     }
 
@@ -280,14 +291,51 @@ class DynamicForm extends VerySimpleModel {
         return true;
     }
 
-    static function ensureDynamicDataView() {
+    static function getNewInstance() {
+        return static::objects()
+                ->one()
+                ->instanciate();
+    }
+
+    static function rebuildDynamicDataViews() {
+        // Flush the object cache
+        ModelInstanceManager::flushCache();
+        return self::ensureDynamicDataViews(true, true);
+    }
+
+    // ensure cdata tables exists
+    static function ensureDynamicDataViews($build=true, $force=false) {
+        $forms = ['TicketForm', 'TaskForm', 'UserForm', 'OrganizationForm'];
+        foreach ($forms as $form) {
+            if ($force && $build)
+                $form::dropDynamicDataView(false);
+            $form::ensureDynamicDataView($build);
+        }
+    }
+
+    static function ensureCdataTables($obj, $data) {
+        // Only perfrom check on real cron call, not autocrons triggered on
+        // agents activity.
+        if ($data['autocron'] === false)
+            self::ensureDynamicDataViews(true);
+    }
+
+    static function ensureDynamicDataView($build=false, $croak=true) {
 
         if (!($cdata=static::$cdata) || !$cdata['table'])
             return false;
 
         $sql = 'SHOW TABLES LIKE \''.$cdata['table'].'\'';
-        if (!db_num_rows(db_query($sql)))
-            return static::buildDynamicDataView($cdata);
+        // Return true if the cdata table exists
+        if (db_num_rows(db_query($sql)))
+            return true;
+
+        if (!$build && $croak)
+            die(sprintf('%s. %s.',
+                        __('Missing CDATA table'),
+                        __('Get technical support')));
+
+        return $build ? static::buildDynamicDataView($cdata) : false;
     }
 
     static function buildDynamicDataView($cdata) {
@@ -297,8 +345,17 @@ class DynamicForm extends VerySimpleModel {
         db_query($sql);
     }
 
-    static function dropDynamicDataView($table) {
-        db_query('DROP TABLE IF EXISTS `'.$table.'`');
+    static function dropDynamicDataView($rebuild=true) {
+
+        if (!($cdata=static::$cdata) || !$cdata['table'])
+            return false;
+
+        $sql = 'DROP TABLE IF EXISTS `'.$cdata['table'].'`';
+        if (!db_query($sql))
+            return false;
+
+        return  $rebuild ?  static::ensureDynamicDataView($rebuild, false) :
+            true;
     }
 
     static function updateDynamicDataView($answer, $data) {
@@ -329,8 +386,7 @@ class DynamicForm extends VerySimpleModel {
                     $cdata['object_id'],
                     db_input($answer->getEntry()->get('object_id')))
             .' ON DUPLICATE KEY UPDATE '.$fields;
-        if (!db_query($sql))
-            return self::dropDynamicDataView($cdata['table']);
+        db_query($sql);
     }
 
     static function updateDynamicFormEntryAnswer($answer, $data) {
@@ -358,13 +414,13 @@ class DynamicForm extends VerySimpleModel {
 
         switch ($field->form->get('type')) {
         case 'T':
-            return TicketForm::dropDynamicDataView(TicketForm::$cdata['table']);
+            return TicketForm::dropDynamicDataView();
         case 'A':
-            return TaskForm::dropDynamicDataView(TaskForm::$cdata['table']);
+            return TaskForm::dropDynamicDataView();
         case 'U':
-            return UserForm::dropDynamicDataView(UserForm::$cdata['table']);
+            return UserForm::dropDynamicDataView();
         case 'O':
-            return OrganizationForm::dropDynamicDataView(OrganizationForm::$cdata['table']);
+            return OrganizationForm::dropDynamicDataView();
         }
 
     }
@@ -383,7 +439,7 @@ class DynamicForm extends VerySimpleModel {
     // @see http://code.google.com/p/flexviews/
     static function getDynamicDataViewFields($exclude) {
         $fields = array();
-        foreach (static::getInstance()->getFields() as $f) {
+        foreach (static::getNewInstance()->getFields() as $f) {
             if ($exclude && in_array($f->get('name'), $exclude))
                 continue;
 
@@ -437,13 +493,7 @@ class UserForm extends DynamicForm {
 
     static function getInstance() {
         if (!isset(static::$instance))
-            static::$instance = static::getUserForm()->instanciate();
-        return static::$instance;
-    }
-
-    static function getNewInstance() {
-        $o = static::objects()->one();
-        static::$instance = $o->instanciate();
+            static::$instance = self::getNewInstance();
         return static::$instance;
     }
 }
@@ -479,16 +529,9 @@ class TicketForm extends DynamicForm {
 
     static function getInstance() {
         if (!isset(static::$instance))
-            self::getNewInstance();
+            static::$instance = self::getNewInstance();
         return static::$instance;
     }
-
-    static function getNewInstance() {
-        $o = static::objects()->one();
-        static::$instance = $o->instanciate();
-        return static::$instance;
-    }
-
 }
 // Add fields from the standard ticket form to the ticket filterable fields
 Filter::addSupportedMatches(/* @trans */ 'Ticket Data', function() {
@@ -529,6 +572,9 @@ Signal::connect('model.updated',
     function($o, $d) { return isset($d['dirty'])
         && (isset($d['dirty']['name']) || isset($d['dirty']['type'])); });
 
+// Check to make sure cdata tables exists
+Signal::connect('cron', array('DynamicForm', 'ensureCdataTables'));
+
 Filter::addSupportedMatches(/* trans */ 'Custom Forms', function() {
     $matches = array();
     foreach (DynamicForm::objects()->filter(array('type'=>'G')) as $form) {
@@ -657,7 +703,7 @@ class DynamicFormField extends VerySimpleModel {
         // See if field impl. need to save or override anything
         $config = $this->getImpl()->to_config($config);
         $this->set('configuration', JsonDataEncoder::encode($config));
-        $this->set('hint', Format::sanitize($vars['hint']));
+        $this->set('hint', Format::sanitize($vars['hint']) ?: NULL);
 
         return true;
     }
@@ -748,7 +794,7 @@ class DynamicFormField extends VerySimpleModel {
      * flags which should be set on the new field to implement the
      * requirement / visibility mode.
      */
-    function allRequirementModes() {
+    static function allRequirementModes() {
         return array(
             'a' => array('desc' => __('Optional'),
                 'flags' => self::FLAG_CLIENT_VIEW | self::FLAG_AGENT_VIEW
@@ -868,7 +914,7 @@ class DynamicFormField extends VerySimpleModel {
                 /* `variable` is used for automation. Internally it's called `name` */
                 ), "name");
         }
-        if (preg_match('/[.{}\'"`; ]/u', $this->get('name')))
+        if ($this->get('name') && !preg_match('/^(?!\d)([[:alnum:]]|_)+$/u', $this->get('name')))
             $this->addError(__(
                 'Invalid character in variable name. Please use letters and numbers only.'
             ), 'name');
@@ -988,6 +1034,10 @@ class DynamicFormEntry extends VerySimpleModel {
         return $this->form->getInstructions();
     }
 
+    function getNotice() {
+        return  $this->form->getNotice();
+    }
+
     function getDynamicForm() {
         return $this->form;
     }
@@ -1008,6 +1058,7 @@ class DynamicFormEntry extends VerySimpleModel {
                 'title' => $this->getTitle(),
                 'instructions' => $this->getInstructions(),
                 'id' => $this->form_id,
+                'type' => $this->getDynamicForm()->type ?: null,
                 );
             $this->_form = new CustomForm($fields, $source, $options);
         }
@@ -1151,7 +1202,7 @@ class DynamicFormEntry extends VerySimpleModel {
         return $vars;
     }
 
-    function forTicket($ticket_id, $force=false) {
+    static function forTicket($ticket_id, $force=false) {
         static $entries = array();
         if (!isset($entries[$ticket_id]) || $force) {
             $stuff = DynamicFormEntry::objects()
@@ -1163,6 +1214,23 @@ class DynamicFormEntry extends VerySimpleModel {
         }
         return $entries[$ticket_id];
     }
+
+    static function forTask($id, $force=false) {
+        static $entries = array();
+        if (!isset($entries[$id]) || $force) {
+            $stuff = DynamicFormEntry::objects()->filter(array(
+                        'object_id' => $id,
+                        'object_type' => ObjectModel::OBJECT_TYPE_TASK
+                        ));
+            // If forced, don't cache the result
+            if ($force)
+                return $stuff;
+
+            $entries[$id] = &$stuff;
+        }
+        return $entries[$id];
+    }
+
     function setTicketId($ticket_id) {
         $this->object_type = 'T';
         $this->object_id = $ticket_id;
@@ -1177,14 +1245,13 @@ class DynamicFormEntry extends VerySimpleModel {
         $this->object_id = $object_id;
     }
 
-    function forObject($object_id, $object_type) {
+    static function forObject($object_id, $object_type) {
         return DynamicFormEntry::objects()
             ->filter(array('object_id'=>$object_id, 'object_type'=>$object_type));
     }
 
     function render($options=array()) {
-        if (is_array($options))
-            $options += array('staff' => true);
+        $options += array('staff' => true);
         return $this->getForm()->render($options);
     }
 
@@ -1194,11 +1261,10 @@ class DynamicFormEntry extends VerySimpleModel {
             $field = $a->getField();
             if (!$field->hasData() || $field->isPresentationOnly())
                 continue;
-            $after = $field->to_database($field->getClean());
-            $before = $field->to_database($a->getValue());
-            if ($before == $after)
+            $changes = $field->getChanges();
+            if (!$changes)
                 continue;
-            $fields[$field->get('id')] = array($before, $after);
+            $fields[$field->get('id')] = $changes;
         }
         return $fields;
     }
@@ -1282,7 +1348,18 @@ class DynamicFormEntry extends VerySimpleModel {
 
             try {
                 $field->setForm($this);
-                $val = $field->to_database($field->getClean());
+                //for form entry values of file upload fields, we want to save the value as
+                //json with the file id(s) and file name(s) of each file stored in the field
+                //so that they display correctly within tasks/tickets
+                if (get_class($field) == 'FileUploadField') {
+                    //use getChanges if getClean returns an empty array
+                    $fieldClean = $field->getClean() ?: $field->getChanges();
+                    if (is_array($fieldClean) && $fieldClean[0])
+                        $fieldClean = is_string($fieldClean[0]) ? json_decode($fieldClean[0], true) : $fieldClean[0];
+                } else
+                    $fieldClean = $field->getClean();
+
+                $val = $field->to_database($fieldClean);
             }
             catch (FieldUnchanged $e) {
                 // Don't update the answer.
@@ -1516,7 +1593,7 @@ class SelectionField extends FormField {
         $selection = array();
 
         if ($value && !is_array($value))
-            $value = array($value);
+            $value = JsonDataParser::parse($value) ?: array($value);
 
         if ($value && is_array($value)) {
             foreach ($value as $k=>$v) {
@@ -1556,6 +1633,7 @@ class SelectionField extends FormField {
             $values = array();
             $choices = $this->getChoices();
             foreach (explode(',', $value) as $V) {
+                $V = trim($V);
                 if (isset($choices[$V]))
                     $values[$V] = $choices[$V];
             }
@@ -1656,6 +1734,7 @@ class SelectionField extends FormField {
                         ?: __('Unknown or invalid input');
                 }
             } elseif ($config['typeahead']
+                    && $entry
                     && ($entered = $this->getWidget()->getEnteredValue())
                     && !in_array($entered, $entry)
                     && $entered != $entry) {
@@ -1731,7 +1810,7 @@ class SelectionField extends FormField {
         return $config;
     }
 
-    function getChoices($verbose=false) {
+    function getChoices($verbose=false, $options=array()) {
         if (!$this->_choices || $verbose) {
             $choices = array();
             foreach ($this->getList()->getItems() as $i)
@@ -1797,7 +1876,8 @@ class SelectionField extends FormField {
             // Add in the properties for all selected list items in sub
             // labeled by their field id
             foreach ($v as $id=>$L) {
-                if (!($li = DynamicListItem::lookup($id)))
+                if (!($li = DynamicListItem::lookup($id))
+                      || !$li->getListId())
                     continue;
                 foreach ($li->getFilterData() as $prop=>$value) {
                     if (!isset($data[$prop]))
@@ -1838,7 +1918,7 @@ class SelectionField extends FormField {
         $name = $name ?: $this->get('name');
         $val = $value;
         if ($value && is_array($value))
-            $val = '"?'.implode('("|,|$)|"?', array_keys($value)).'("|,|$)';
+            $val = '"?(?<![0-9])'.implode('("|,|$)|"?(?<![0-9])', array_keys($value)).'("|,|$)';
         switch ($method) {
         case '!includes':
             return Q::not(array("{$name}__regex" => $val));

include/class.error.php

@@ -25,12 +25,15 @@ class BaseError extends Exception {
         global $ost;
 
         parent::__construct(__($message));
-        $message = str_replace(ROOT_DIR, '(root)/', _S($message));
 
-        if ($ost && $ost->getConfig()->getLogLevel() == 3)
-            $message .= "\n\n" . $this->getBacktrace();
+        if ($ost) {
+            $message = str_replace(ROOT_DIR, '(root)/', _S($message));
 
-        $ost->logError($this->getTitle(), $message, static::$sendAlert);
+            if ($ost->getConfig()->getLogLevel() == 3)
+                $message .= "\n\n" . $this->getBacktrace();
+
+            $ost->logError($this->getTitle(), $message, static::$sendAlert);
+        }
     }
 
     function getTitle() {

include/class.export.php

@@ -30,7 +30,7 @@ class Export {
             'json' => 'JsonResultsExporter'
         );
         $exp = new $exporters[$how]($sql, $headers, $options);
-        return $exp->dump();
+        return $exp->dump($options['tmp'] ? true : false);
     }
 
     # XXX: Think about facilitated exporting. For instance, we might have a
@@ -259,7 +259,7 @@ class Export {
 
         // Filename or stream to export agents to
         $filename = $filename ?: sprintf('Agents-%s.csv',
-                strftime('%Y%m%d'));
+                date('Ymd'));
         Http::download($filename, "text/$how");
         $depts = Dept::getDepartments(null, true, Dept::DISPLAY_DISABLED);
         echo self::dumpQuery($agents, array(
@@ -296,7 +296,7 @@ static function departmentMembers($dept, $agents, $filename='', $how='csv') {
 
     // Filename or stream to export depts' agents to
     $filename = $filename ?: sprintf('%s-%s.csv', $dept->getName(),
-            strftime('%Y%m%d'));
+            date('Ymd'));
     Http::download($filename, "text/$how");
     echo self::dumpQuery($agents, array(
                 '::getName'  =>  'Name',
@@ -321,8 +321,313 @@ static function departmentMembers($dept, $agents, $filename='', $how='csv') {
             );
     exit;
   }
+
+  static function audits($type, ?string $filename, ?string $tableInfo, ?string $object, ?string $how='csv', ?bool $show_viewed=true, ?array $data=array(), CsvExporter $exporter) {
+      $headings = array('Description', 'Timestamp', 'IP');
+      switch ($type) {
+          case 'audit':
+              $sql = AuditEntry::objects()->filter(array('object_type'=>$data['type']));
+              if ($data['state'] && $data['state'] != 'All') {
+                  $eventId = Event::getIdByName(strtolower($data['state']));
+                  $sql = $sql->filter(array('event_id'=>$eventId));
+              }
+              if ($data['startDate'] && $data['endDate'])
+                  $sql = $sql->filter(array('timestamp__range' =>
+                                      array('"'.$data['startDate'].'"', '"'.$data['endDate'].'"', true)));
+
+              $sql = $sql->order_by('-timestamp');
+              $tableInfo = $sql;
+              break;
+          case 'user':
+              $sql = AuditEntry::objects()->filter(array('user_id'=>$object))->order_by('-timestamp');
+              break;
+          case 'staff':
+              $sql = AuditEntry::objects()->filter(array('staff_id'=>$object))->order_by('-timestamp');
+              break;
+          case 'ticket':
+              $sql = AuditEntry::objects()->filter(array('object_id'=>$object, 'object_type'=>'T'))->order_by('-timestamp');
+              break;
+      }
+      if (!$show_viewed)
+          $sql = $sql->filter(Q::not(array('event_id'=>Event::getIdByName('viewed'))))->order_by('-timestamp');
+
+      $exporter->write($headings);
+      $row = array();
+      foreach ($sql as $key => $value) {
+        if (is_object($value)) {
+            $description = AuditEntry::getDescription($value, true);
+            $value = $value->ht;
+        }
+        $row[0] = $description;
+        $row[1] = Format::datetime($value['timestamp']);
+        $row[2] = $value['ip'];
+        $exporter->write($row);
+      }
+    }
 }
 
+
+/*
+ * Exporter Interface
+ *
+ */
+abstract class  Exporter {
+
+    protected $id;   // Export ID (random code)
+    protected $fp;   // stream: file pointer for $file
+    protected $file; // File name / path for the export
+
+    protected $fileObj;  // FileObject class
+
+    protected $options;
+
+    abstract function write($data);
+    abstract function init();
+
+    function __construct($options=array()) {
+        $this->id = $options['id'] ?: self::generateId();
+        if (isset($options['file']))
+            $this->file = $options['file'];
+        $this->options = $options;
+        $this->open();
+    }
+
+    function isAvailable() {
+        return file_exists($this->getFile());
+    }
+
+    function isReady() {
+        return ($this->isAvailable() && $this->lock());
+    }
+
+    private function open($mode='a+') {
+        if ($this->fp)
+            return $this->fp;
+
+        try {
+            if (($file=$this->getFile())) {
+                if (!($this->fp=fopen($file, $mode)))
+                    throw new Exception();
+            } else {
+                // We don't have a file create one in temp directory
+                $prefix = Format::filename(Misc::randCode(6));
+                if (!($temp=tempnam(sys_get_temp_dir(), $prefix))
+                        || !($this->fp=fopen($temp, $mode))
+                        || !($meta=stream_get_meta_data($this->fp))) {
+                    throw new Exception();
+                }
+                // get filename from mera
+                $this->file = $meta['uri'];
+                $this->init();
+            }
+        } catch(Exception $ex) {
+            @fclose($this->fp);
+            @unlink($temp);
+            throw new Exception();
+        }
+
+        return $this->fp;
+    }
+
+    // Close / unlock the file.
+    function close() {
+        @fclose($this->fp);
+    }
+
+    function delete() {
+        @unlink($this->getFile());
+    }
+
+    function getId() {
+        return $this->id;
+    }
+
+    function getStream() {
+        return $this->fp;
+    }
+
+    function getFile() {
+        return $this->file;
+    }
+
+    function getFilename() {
+        return $this->options['filename'] ?: 'Export';
+    }
+
+    function getFileType() {
+        return mime_content_type($this->getFile());
+    }
+
+    function getFileSize() {
+        return filesize($this->getFile());
+    }
+
+    function getFileObject() {
+        if (!isset($this->fileObj)) {
+            $this->fileObj = new FileObject($this->getFile());
+            // Set the real filename
+            $this->fileObj->setFilename($this->getFilename());
+            // Set mime type
+            $this->fileObj->setMimeType($this->getFileType());
+        }
+
+        return $this->fileObj;
+    }
+
+    function getOptions() {
+        return $this->options;
+    }
+
+    // Check interval in seconds
+    function getInterval() {
+        return @$this->options['interval'] ?: 5;
+    }
+
+    function lock() {
+        return $this->fp ? flock($this->fp, LOCK_EX | LOCK_NB) : false;
+    }
+
+    function unlock() {
+        fflush($this->fp);
+        flock($this->fp, LOCK_UN);
+    }
+
+    // Acknowledge the export and close the session
+    // This is important when the export would be taking a long time or when
+    // it's being emailed out in the background
+    function ack() {
+        // Register the export in the session
+        self::register($this);
+        // Flush response / return export id and check interval
+        Http::flush(201, json_encode(['eid' =>
+                    $this->getId(), 'interval' => $this->getInterval()]));
+        // Phew... now we're free to do the export
+        session_write_close(); // Release session for other requests
+        ignore_user_abort(1);  // Leave us alone bro!
+        @set_time_limit(0);    // Useless when safe_mode is on
+        // Ask the queue to export to the exporter
+    }
+
+    // Finilize the export - unlock the file and close the ponter
+    function finalize($delay=true) {
+        $this->unlock();
+        $this->close();
+        // Sleep 3 times the interval to allow time for file download
+        if ($delay) sleep($this->getInterval()*3);
+    }
+
+    function download($filename=false, $delete=true) {
+        $this->close();
+        $filename = $filename ?: $this->getFilename();
+        Http::download($filename, 'application/octet-stream', null, 'attachment');
+        header('Content-Length: '.$this->getFileSize());
+        readfile($this->getFile());
+        //  Delete the file if requsted
+        if ($delete) @$this->delete();
+        exit;
+    }
+
+    function email(Staff $staff) {
+        global $cfg;
+
+        if (!file_exists($this->getFile())
+                || !($file=$this->getFileObject())
+                || !($email=$cfg->getDefaultEmail()))
+            return false;
+
+        $mailer = new osTicket\Mail\Mailer($email);
+        $mailer->addFileObject($file);
+        $subject = __("Export");
+        $body = __("Attached is file containing the export you asked us to send you!");
+        return $mailer->send(array($staff), $subject, $body);
+    }
+
+    // Generate an alphanumeric url safe id/code
+    static function generateId($len=6) {
+        $id = substr(str_replace('%', '', urlencode(Misc::randCode($len))),
+                0, $len);
+        if (isset($_SESSION['Exports'][$id]))
+            return self::generateId($len);
+
+        return $id;
+    }
+
+    static function register($exporter, $extra=array()) {
+        if (!$exporter instanceof Exporter)
+            return false;
+
+        $_SESSION['Exports'][$exporter->getId()] = $exporter->getOptions() + array(
+                 'file' => $exporter->getFile(),
+                 'class' => get_class($exporter)) + $extra ?: $extra;
+    }
+
+    static function load($id) {
+        if (!isset($_SESSION['Exports'][$id])
+                || !file_exists($_SESSION['Exports'][$id]['file']))
+            return null;
+
+        try {
+            $info = $_SESSION['Exports'][$id];
+            $class = $info['class'];
+            $exporter = new $class(array('id' => $id) + $info);
+        } catch (Exception $ex) {
+            return null;
+        }
+
+        return $exporter;
+    }
+}
+
+/*
+ * CsvExporter - expects an open file
+ */
+class CsvExporter extends Exporter {
+    protected $mimetype = 'text/csv';
+
+    function __construct($options=array()) {
+        try {
+            parent::__construct($options);
+        } catch (Exception $ex) {
+            throw new Exception();
+        }
+    }
+
+    function init() {
+        $this->lock();
+        // Output a UTF-8 BOM (byte order mark)
+        fputs($this->fp, chr(0xEF) . chr(0xBB) . chr(0xBF));
+    }
+
+    function getFileType() {
+        return $this->mimetype;
+    }
+
+    function getDelimiter() {
+        if (isset($this->options['delimiter'])
+                && $this->options['delimiter'])
+            return $this->options['delimiter'];
+        return Internationalization::getCSVDelimiter();
+    }
+
+    function escape($data) {
+        return $data;
+        // Escape formula, commands etc.
+        return array_map(function($v) {
+                if (preg_match('/^[=\-+@].*/', $v))
+                    return "'".$v;
+                return $v;
+                }, $data);
+    }
+
+    function write($data) {
+        fputcsv($this->fp, $this->escape($data), $this->getDelimiter(), "\"", "");
+    }
+
+}
+
+/*
+ * Given SQL query export results based on subclass.
+ */
 class ResultSetExporter {
     var $output;
 
@@ -375,7 +680,7 @@ class ResultSetExporter {
                 }
             }
             // Evalutate :: function call on target current
-            if ($func && (method_exists($current, $func) || method_exists($current, '__call'))) {
+            if (($current && $func) && (method_exists($current, $func) || method_exists($current, '__call'))) {
                 $current = $current->{$func}();
             }
 
@@ -413,32 +718,36 @@ class CsvResultsExporter extends ResultSetExporter {
         return Internationalization::getCSVDelimiter();
     }
 
-    function dump() {
-
+    function dump($tmp=false) {
         if (!$this->output)
              $this->output = fopen('php://output', 'w');
 
-
         $delimiter = $this->getDelimiter();
         // Output a UTF-8 BOM (byte order mark)
         fputs($this->output, chr(0xEF) . chr(0xBB) . chr(0xBF));
-        fputcsv($this->output, $this->getHeaders(), $delimiter);
+        fputcsv($this->output, $this->getHeaders(), $delimiter, "\"", "");
         while ($row=$this->next())
-            fputcsv($this->output, $row, $delimiter);
+            fputcsv($this->output, array_map(
+                function($v){
+                    if (preg_match('/^[=\-+@].*/', $v))
+                        return "'".$v;
+                    return $v;
+                }, $row),
+            $delimiter, "\"", "");
 
-        fclose($this->output);
+        if (!$tmp)
+            fclose($this->output);
     }
 }
 
 class JsonResultsExporter extends ResultSetExporter {
     function dump() {
         require_once(INCLUDE_DIR.'class.json.php');
-        $exp = new JsonDataEncoder();
         $rows = array();
         while ($row=$this->nextArray()) {
             $rows[] = $row;
         }
-        echo $exp->encode($rows);
+        echo JsonDataEncoder::encode($rows);
     }
 }
 
@@ -454,15 +763,16 @@ class DatabaseExporter {
     var $stream;
     var $options;
     var $tables = array(CONFIG_TABLE, SYSLOG_TABLE, FILE_TABLE,
-        FILE_CHUNK_TABLE, STAFF_TABLE, DEPT_TABLE, TOPIC_TABLE, GROUP_TABLE,
+        FILE_CHUNK_TABLE, STAFF_TABLE, DEPT_TABLE, TOPIC_TABLE,
         STAFF_DEPT_TABLE, TEAM_TABLE, TEAM_MEMBER_TABLE, FAQ_TABLE,
         FAQ_TOPIC_TABLE, FAQ_CATEGORY_TABLE, DRAFT_TABLE,
         CANNED_TABLE, TICKET_TABLE, ATTACHMENT_TABLE,
         THREAD_TABLE, THREAD_ENTRY_TABLE, THREAD_ENTRY_EMAIL_TABLE,
-        LOCK_TABLE, THREAD_EVENT_TABLE, TICKET_PRIORITY_TABLE,
-        EMAIL_TABLE, EMAIL_TEMPLATE_TABLE, EMAIL_TEMPLATE_GRP_TABLE,
+        THREAD_ENTRY_MERGE_TABLE, LOCK_TABLE, THREAD_EVENT_TABLE,
+        TICKET_PRIORITY_TABLE, EMAIL_TABLE, EMAIL_TEMPLATE_TABLE,
+        EMAIL_TEMPLATE_GRP_TABLE,
         FILTER_TABLE, FILTER_RULE_TABLE, SLA_TABLE, API_KEY_TABLE,
-        TIMEZONE_TABLE, SESSION_TABLE, PAGE_TABLE,
+        SESSION_TABLE, PAGE_TABLE,
         FORM_SEC_TABLE, FORM_FIELD_TABLE, LIST_TABLE, LIST_ITEM_TABLE,
         FORM_ENTRY_TABLE, FORM_ANSWER_TABLE, USER_TABLE, USER_EMAIL_TABLE,
         PLUGIN_TABLE, THREAD_COLLABORATOR_TABLE, TRANSLATION_TABLE,
@@ -555,3 +865,126 @@ class DatabaseExporter {
         $this->write_block(array('end-table'));
     }
 }
+
+class TicketZipExporter {
+    var $ticket;
+    var $tmpfiles;
+
+    function __construct(Ticket $ticket) {
+        $this->ticket = $ticket;
+        $this->tmpfiles = array();
+    }
+
+    function addTicket($ticket, $zip, $prefix, $notes=true, $psize=null) {
+        require_once(INCLUDE_DIR.'class.pdf.php');
+
+        $pdf_file = $this->tmpfiles[] = tempnam(sys_get_temp_dir(), 'zip');
+        $pdf = new Ticket2PDF($ticket, $psize, $notes);
+        $pdf->output($pdf_file, 'F');
+
+        $zip->addFile($pdf_file, "{$ticket->getNumber()}.pdf");
+
+        // Include all the (non-inline) attachments
+        // XXX: Handle attachments with duplicate filenames between entry posts
+        $attachments = Attachment::objects()
+            ->filter([
+                'thread_entry__thread' => $ticket->getThread(),
+                'inline' => 0
+            ])
+            ->order_by('thread_entry__created')
+            ->select_related('file');
+
+        foreach ($attachments as $att) {
+            $zip->addFromString("{$prefix}/{$att->getFilename()}",
+                $att->getFile()->getData());
+        }
+
+        // Include custom fields attachments
+        foreach (DynamicFormEntry::forTicket($ticket->getId()) as $form) {
+            $answers = $form->getAnswers()->filter(
+                    array('field__type' => 'files'));
+            foreach ($answers as $answer) {
+                $field = $answer->getField();
+                foreach ($field->getAttachments() as $a)
+                    $zip->addFromString("{$prefix}/{$a->getFilename()}",
+                            $a->getFile()->getData());
+            }
+        }
+    }
+
+    function addTask($task, $zip, $prefix, $notes=true, $psize=null) {
+        require_once(INCLUDE_DIR.'class.pdf.php');
+
+        $pdf_file = $this->tmpfiles[] = tempnam(sys_get_temp_dir(), 'zip');
+        $pdf = new Task2PDF($task, ['psize' => $psize]);
+        $pdf->output($pdf_file, 'F');
+
+        $zip->addFile($pdf_file, "{$prefix}/{$task->getNumber()}.pdf");
+
+        // Include all the (non-inline) attachments
+        // XXX: Handle attachments with duplicate filenames between entry posts
+        $attachments = Attachment::objects()
+            ->filter([
+                'thread_entry__thread' => $task->getThread(),
+                'inline' => 0
+            ])
+            ->order_by('thread_entry__created')
+            ->select_related('file');
+
+        foreach ($attachments as $att) {
+            $zip->addFromString("{$prefix}/{$task->getNumber()}/{$att->getFilename()}",
+                $att->getFile()->getData());
+        }
+        // Include custom fields attachments
+        foreach (DynamicFormEntry::forTask($task->getId()) as $form) {
+            $answers = $form->getAnswers()->filter(
+                    array('field__type' => 'files'));
+            foreach ($answers as $answer) {
+                $field = $answer->getField();
+                foreach ($field->getAttachments() as $a)
+                    $zip->addFromString("{$prefix}/{$task->getNumber()}/{$a->getFilename()}",
+                            $a->getFile()->getData());
+            }
+        }
+    }
+
+    function download($options = array()) {
+        global $thisstaff;
+
+        $notes = isset($options['notes']) ? $options['notes'] : false;
+        $tasks = isset($options['tasks']) ? $options['tasks'] : false;
+
+        // TODO: Use a streaming ZIP library
+        $zipfile = tempnam(sys_get_temp_dir(), 'zip');
+        try {
+            $zip = new ZipArchive();
+            if (!$zip->open($zipfile, ZipArchive::CREATE))
+                return;
+
+            $prefix = "{$this->ticket->getNumber()}";
+
+            // Include a PDF of the ticket thread (with optional notes)
+            if (!$thisstaff || !($psize = $thisstaff->getDefaultPaperSize()))
+                $psize = 'Letter';
+
+            $this->addTicket($this->ticket, $zip, $prefix, $notes, $psize);
+
+            if ($tasks) {
+                foreach ($this->ticket->tasks as $task)
+                    $this->addTask($task, $zip, "{$prefix}/tasks", $notes, $psize);
+            }
+
+            $zip->close();
+            Http::download("ticket-{$this->ticket->getNumber()}.zip", "application/zip",
+                null, 'attachment');
+            $fp = fopen($zipfile, 'r');
+            fpassthru($fp);
+            fclose($fp);
+        }
+        finally {
+            foreach ($this->tmpfiles as $T)
+                @unlink($T);
+            unlink($zipfile);
+        }
+    }
+}

include/class.faq.php

@@ -155,7 +155,8 @@ class FAQ extends VerySimpleModel {
         include STAFFINC_DIR . 'templates/faq-print.tmpl.php';
         $html = ob_get_clean();
 
-        $pdf = new mPDFWithLocalImages('', $paper);
+        $pdf = new mPDFWithLocalImages(['mode' => 'utf-8', 'format' =>
+               $paper, 'tempDir'=>sys_get_temp_dir()]);
         // Setup HTML writing and load default thread stylesheet
         $pdf->WriteHtml(
             '<style>
@@ -301,8 +302,10 @@ class FAQ extends VerySimpleModel {
     function delete() {
         try {
             parent::delete();
+            $type = array('type' => 'deleted');
+            Signal::send('object.deleted', $this, $type);
             // Cleanup help topics.
-            $this->topics->delete();
+            $this->topics->expunge();
             // Cleanup attachments.
             $this->attachments->deleteAll();
         }
@@ -344,7 +347,7 @@ class FAQ extends VerySimpleModel {
 
     static function getFeatured() {
         return self::objects()
-            ->filter(array('ispublished__in'=>array(1,2), 'category__ispublic'=>1))
+            ->filter(array('ispublished'=>2, 'category__ispublic__in'=>[1,2]))
             ->order_by('-ispublished');
     }
 
@@ -392,11 +395,11 @@ class FAQ extends VerySimpleModel {
         $this->notes = Format::sanitize($vars['notes']);
         $this->keywords = ' ';
 
-        $this->updateTopics($vars['topics']);
-
         if (!$this->save())
             return false;
 
+        $this->updateTopics($vars['topics']);
+
         // General attachments (for all languages)
         // ---------------------
         // Delete removed attachments.

include/class.file.php

@@ -15,6 +15,19 @@ require_once(INCLUDE_DIR.'class.signal.php');
 require_once(INCLUDE_DIR.'class.error.php');
 
 
+/**
+ * FileObject Interface
+ *
+ * Methods File Objects should support
+ **/
+interface FileObjectInterface {
+    function getUId();
+    function getKey();
+    function getName();
+    function getData();
+    function getMimeType();
+}
+
 /**
  * Represents a file stored in a storage backend. It is generally attached
  * to something; however company logos, login page backdrops, and other
@@ -29,8 +42,8 @@ require_once(INCLUDE_DIR.'class.error.php');
  *    - 'L' => Logo
  *    - 'B' => Backdrop
  */
-class AttachmentFile extends VerySimpleModel {
-
+class AttachmentFile extends VerySimpleModel
+    implements FileObjectInterface {
     static $meta = array(
         'table' => FILE_TABLE,
         'pk' => array('id'),
@@ -71,16 +84,20 @@ class AttachmentFile extends VerySimpleModel {
         return $this->id;
     }
 
+    function getUId() {
+        return $this->getId();
+    }
+
     function getType() {
         return $this->type;
     }
 
-    function getBackend() {
-        return $this->bk;
+    function getMimeType() {
+        return $this->getType();
     }
 
-    function getMime() {
-        return $this->getType();
+    function getBackend() {
+        return $this->bk;
     }
 
     function getSize() {
@@ -95,6 +112,10 @@ class AttachmentFile extends VerySimpleModel {
         return $this->key;
     }
 
+    function getAttrs() {
+        return $this->attrs;
+    }
+
     function getSignature($cascade=false) {
         $sig = $this->signature;
         if (!$sig && $cascade) return $this->getKey();
@@ -109,9 +130,9 @@ class AttachmentFile extends VerySimpleModel {
         return FileStorageBackend::getInstance($this);
     }
 
-    function sendData($redirect=true, $disposition='inline') {
+    function sendData($redirect=true, $ttl=false, $disposition='inline') {
         $bk = $this->open();
-        if ($redirect && $bk->sendRedirectUrl($disposition))
+        if ($redirect && $bk->sendRedirectUrl($disposition, $ttl))
             return;
 
         @ini_set('zlib.output_compression', 'Off');
@@ -153,11 +174,15 @@ class AttachmentFile extends VerySimpleModel {
         Http::cacheable($this->getSignature(true), $this->lastModified(), $ttl);
     }
 
-    function display($scale=false) {
-        $this->makeCacheable();
+    function display($scale=false, $ttl=86400) {
+        // Force download if not safe viewable image
+        if (!$this->isInlineSafeImage())
+            return $this->download(false, 'attachment');
 
-        if ($scale && extension_loaded('gd')) {
-            $image = imagecreatefromstring($this->getData());
+        $this->makeCacheable($ttl);
+
+        if ($scale && extension_loaded('gd')
+                && ($image = imagecreatefromstring($this->getData()))) {
             $width = imagesx($image);
             if ($scale <= $width) {
                 $height = imagesy($image);
@@ -180,6 +205,7 @@ class AttachmentFile extends VerySimpleModel {
         }
         header('Content-Type: '.($this->getType()?$this->getType():'application/octet-stream'));
         header('Content-Length: '.$this->getSize());
+        header("Content-Security-Policy: default-src 'self'");
         $this->sendData();
         exit();
     }
@@ -192,6 +218,12 @@ class AttachmentFile extends VerySimpleModel {
                             'type' => $options['type']))))
             $options['id'] = $a->getId();
 
+        // Force attachment disposition if not inline-safe image
+        if (isset($options['disposition'])
+                && strcasecmp($options['disposition'], 'inline') == 0
+                && !$this->isInlineSafeImage())
+            $options['disposition'] = 'attachment';
+
         return static::generateDownloadUrl($this->getId(),
                 strtolower($this->getKey()), $this->getSignature(),
                 $options);
@@ -202,7 +234,7 @@ class AttachmentFile extends VerySimpleModel {
     function getExternalDownloadUrl($options=array()) {
         global $cfg;
 
-        $download = self::getDownloadUrl($options);
+        $download = $this->getDownloadUrl($options);
         // Separate URL handle and args
         list($handle, $args) = explode('file.php?', $download);
 
@@ -245,7 +277,8 @@ class AttachmentFile extends VerySimpleModel {
 
         $check = static::_genUrlSignature($this->getId(), $this->getKey(),
             $this->getSignature(), $expires);
-        return $signature == $check;
+
+        return hash_equals($check, $signature);
     }
 
     static function _genUrlSignature($id, $key, $signature, $expires) {
@@ -261,24 +294,25 @@ class AttachmentFile extends VerySimpleModel {
     }
 
     function download($name=false, $disposition=false, $expires=false) {
-        $disposition = $disposition ?: 'inline';
-        $bk = $this->open();
-        if ($bk->sendRedirectUrl($disposition))
-            return;
+        $thisstaff = StaffAuthenticationBackend::getUser();
+        $inline = ($thisstaff ? ($thisstaff->getImageAttachmentView() === 'inline') : false);
+        $disposition = ((($disposition && strcasecmp($disposition, 'inline') == 0)
+              || $inline)
+              && $this->isInlineSafeImage())
+            ? 'inline' : 'attachment';
         $ttl = ($expires) ? $expires - Misc::gmtime() : false;
+        $bk = $this->open();
+        if ($bk->sendRedirectUrl($disposition, $ttl))
+            return;
         $this->makeCacheable($ttl);
         $type = $this->getType() ?: 'application/octet-stream';
-        if (isset($_REQUEST['overridetype']))
-            $type = $_REQUEST['overridetype'];
-        elseif (!strcasecmp($disposition, 'attachment'))
-            $type = 'application/octet-stream';
         Http::download($name ?: $this->getName(), $type, null, $disposition);
         header('Content-Length: '.$this->getSize());
         $this->sendData(false);
         exit();
     }
 
-    function _getKeyAndHash($data=false, $file=false) {
+    static function _getKeyAndHash($data=false, $file=false) {
         if ($file) {
             $sha1 = base64_encode(sha1_file($data, true));
             $md5 = base64_encode(md5_file($data, true));
@@ -343,6 +377,7 @@ class AttachmentFile extends VerySimpleModel {
                 case IMAGETYPE_GIF:
                 case IMAGETYPE_JPEG:
                 case IMAGETYPE_PNG:
+                case IMAGETYPE_WEBP:
                     break;
                 default:
                     $error = __('Invalid image file type');
@@ -364,6 +399,7 @@ class AttachmentFile extends VerySimpleModel {
                 case IMAGETYPE_GIF:
                 case IMAGETYPE_JPEG:
                 case IMAGETYPE_PNG:
+                case IMAGETYPE_WEBP:
                     break;
                 default:
                     $error = __('Invalid image file type');
@@ -387,12 +423,15 @@ class AttachmentFile extends VerySimpleModel {
                 $file['data'] = base64_decode($file['data']);
             }
         }
-        if (isset($file['data'])) {
+
+        if (!isset($file['data']) && isset($file['data_cbk'])
+                && is_callable($file['data_cbk'])) {
             // Allow a callback function to delay or avoid reading or
             // fetching ihe file contents
-            if (is_callable($file['data']))
-                $file['data'] = $file['data']();
+            $file['data'] = $file['data_cbk']();
+        }
 
+        if (isset($file['data'])) {
             list($key, $file['signature'])
                 = self::_getKeyAndHash($file['data']);
             if (!$file['key'])
@@ -468,9 +507,11 @@ class AttachmentFile extends VerySimpleModel {
                 elseif ($bk->write($file['data']) && $bk->flush()) {
                     $succeeded = true; break;
                 }
-            }
-            catch (Exception $e) {
+            } catch (Throwable $t) {
                 // Try next backend
+                // Backends can throw an exception or error.
+                // TODO: Log any exceptions and errors for debugging
+                // purposes.
             }
             // Fallthrough to default backend if different?
         }
@@ -480,6 +521,7 @@ class AttachmentFile extends VerySimpleModel {
         }
 
         $f->bk = $bk->getBkChar();
+        $f->attrs = $bk->getAttrs() ?: NULL;
 
         if (!isset($file['size'])) {
             if ($size = $bk->getSize())
@@ -563,6 +605,7 @@ class AttachmentFile extends VerySimpleModel {
         }
 
         $this->bk = $target->getBkChar();
+        $this->attrs = $target->getAttrs() ?: NULL;
         if (!$this->save())
             return false;
 
@@ -599,9 +642,16 @@ class AttachmentFile extends VerySimpleModel {
     static function lookupByHash($hash) {
         if (isset(static::$keyCache[$hash]))
             return static::$keyCache[$hash];
-
         // Cache a negative lookup if no such file exists
-        return parent::lookup(array('key' => $hash));
+        try {
+            return parent::lookup(array('key' => $hash));
+        } catch (ObjectNotUnique $e) {
+            // TODO: Figure out why key collission might be happening AND
+            // make key (hash) unique field in the file table as a
+            // protection measure. For now we're returning null to avoid possible wrong file
+            // being displayed.
+            return null;
+        }
     }
 
     static function lookup($id) {
@@ -613,7 +663,7 @@ class AttachmentFile extends VerySimpleModel {
     /*
       Method formats http based $_FILE uploads - plus basic validation.
      */
-    function format($files) {
+    static function format($files) {
         global $ost;
 
         if(!$files || !is_array($files))
@@ -629,6 +679,8 @@ class AttachmentFile extends VerySimpleModel {
 
         //Basic validation.
         foreach($attachments as $i => &$file) {
+            $file['name'] = Format::sanitize($file['name']);
+
             //skip no file upload "error" - why PHP calls it an error is beyond me.
             if($file['error'] && $file['error']==UPLOAD_ERR_NO_FILE) {
                 unset($attachments[$i]);
@@ -680,6 +732,29 @@ class AttachmentFile extends VerySimpleModel {
             ->filter(array('ft' => 'B'))
             ->order_by('created');
     }
+
+    /**
+     * Determines whether a MIME type is safe to render inline as a passive image.
+     *
+     * @param string $type
+     * @return bool
+     */
+    static function isInlineSafeImageType($type) {
+        $type = strtolower(trim((string) $type));
+
+        return strpos($type, 'image/') === 0
+            && $type !== 'image/svg+xml'
+            && $type !== 'image/svg';
+    }
+
+    /**
+     * Determines whether this file is safe to render inline as a passive image.
+     *
+     * @return bool
+     */
+    function isInlineSafeImage() {
+        return static::isInlineSafeImageType($this->getType());
+    }
 }
 
 class FileStorageBackend {
@@ -813,7 +888,7 @@ class FileStorageBackend {
      * false to indicate that the read() method should be used to retrieve
      * the data and broker it to the user agent.
      */
-    function sendRedirectUrl($disposition='inline') {
+    function sendRedirectUrl($disposition='inline', $ttl=false) {
         return false;
     }
 
@@ -855,6 +930,16 @@ class FileStorageBackend {
     function getSize() {
         return false;
     }
+
+    /**
+     * getAttrs
+     *
+     * Get backend storage attributes.
+     *
+     */
+    function getAttrs() {
+        return false;
+    }
 }
 
 
@@ -995,4 +1080,93 @@ class OneSixAttachments extends FileStorageBackend {
     }
 }
 FileStorageBackend::register('6', 'OneSixAttachments');
+
+// FileObject - wrapper for SplFileObject class
+class FileObject extends SplFileObject
+    implements FileObjectInterface {
+
+    protected $_key;
+    protected $_sig;
+    protected $_filename;
+
+    function __construct($file, $mode='r') {
+        parent::__construct($file, $mode);
+    }
+
+    function getUId() {
+        return $this->getKey();
+    }
+
+    function getKey() {
+        if (!isset($this->_key))
+            list($this->_key, $this->_sig) = AttachmentFile::_getKeyAndHash(
+                $this->getContents());
+
+        return $this->_key;
+    }
+
+    /* This allows us to set REAL file name as opposed to basename of the
+     * FS file in question
+     */
+    function setFilename($filename) {
+        $this->_filename = $filename;
+    }
+
+    function getFilename() {
+        return $this->_filename ?: parent::getFilename();
+    }
+
+    function getName() {
+        return $this->getFilename();
+    }
+
+    /*
+     * Set mime type - well formated mime is expected.
+     */
+    function setMimeType($type) {
+        $this->_mimetype = $type;
+    }
+
+    function getMimeType() {
+        if (!isset($this->_mimetype))
+            $this->_mimetype = self::mime_type($this->getRealPath());
+
+        return $this->_mimetype;
+    }
+
+    function getContents() {
+        $this->fseek(0);
+        return $this->fread($this->getSize());
+    }
+
+    /*
+     * XXX: Needed for mailer attachments interface
+     */
+    function getData() {
+        return $this->getContents();
+    }
+
+    /*
+     * Given a filepath - auto detect the mime type
+     *
+     */
+    static function mime_type($filepath) {
+        // Try to to auto-detect mime type
+        $type = null;
+        if (function_exists('finfo_open')) {
+            $finfo = finfo_open(FILEINFO_MIME_TYPE);
+            $type = finfo_file($finfo, $filepath);
+            finfo_close($finfo);
+        }
+        return $type ?: mime_content_type($filepath);
+    }
+
+    /*
+     * Compare mime type of file content to a given mime
+     */
+    static function mimecmp($filepath, $mime) {
+        return strcasecmp(self::mime_type($filepath), $mime) !== 0;
+    }
+}
+
 ?>

include/class.filter.php

@@ -34,6 +34,7 @@ extends VerySimpleModel {
 
     const FLAG_INACTIVE_HT = 0x0001;
     const FLAG_INACTIVE_DEPT  = 0x0002;
+    const FLAG_DELETED_OBJECT  = 0x0004;
 
     static $match_types = array(
         /* @trans */ 'User Information' => array(
@@ -164,6 +165,58 @@ extends VerySimpleModel {
         return ($this->use_replyto_email);
     }
 
+    static function disableFilters($object) {
+        switch (get_class($object)) {
+            case 'Topic':
+                $object_id = 'topic_id';
+                $FAClass = 'FA_AssignTopic';
+                break;
+            case 'Dept':
+                $object_id = 'dept_id';
+                $FAClass = 'FA_RouteDepartment';
+                break;
+            case 'Staff':
+                $object_id = 'staff_id';
+                $FAClass = 'FA_AssignAgent';
+                break;
+            case 'Team':
+                $object_id = 'team_id';
+                $FAClass = 'FA_AssignTeam';
+                break;
+            case 'SLA':
+                $object_id = 'sla_id';
+                $FAClass = 'FA_AssignSLA';
+                break;
+            case 'TicketStatus':
+                $object_id = 'status_id';
+                $FAClass = 'FA_SetStatus';
+                break;
+            case 'Email':
+                $object_id = 'from';
+                $FAClass = 'FA_SendEmail';
+                break;
+            case 'Canned':
+                $object_id = 'canned_id';
+                $FAClass = 'FA_AutoCannedResponse';
+            default:
+                return false;
+        }
+        $id = $object->getId();
+        $actions = FilterAction::objects()
+            ->filter(array('type' => $FAClass::$type,
+                           'configuration__like' => sprintf('%%"%s":%s}', $object_id, $id)));
+        foreach($actions as $fa) {
+            // Put a flag on the filter
+            FilterAction::setFilterFlags($fa, 'Filter::FLAG_DELETED_OBJECT', true);
+            $fa->save();
+
+            // Disable the filter
+            $filter = Filter::lookup($fa->filter_id);
+            $filter->isactive = 0;
+            $filter->save();
+        }
+    }
+
     function disableAlerts() {
         return ($this->disable_autoresponder);
     }
@@ -181,10 +234,14 @@ extends VerySimpleModel {
     }
 
     function addRule($what, $how, $val,$extra=array()) {
+        if (isset($extra['notes']))
+            $extra['notes'] = Format::sanitize($extra['notes']);
         $rule = array_merge($extra,array('what'=>$what, 'how'=>$how, 'val'=>$val));
         $rule = new FilterRule($rule);
+        $rule->created = SqlFunction::NOW();
         $this->rules->add($rule);
-        $rule->save();
+        if ($rule->save())
+            return true;
     }
 
     function removeRule($what, $how, $val) {
@@ -200,7 +257,7 @@ extends VerySimpleModel {
     }
 
     function getRuleById($id) {
-        return FilterRule::lookup($id, $this->getId());
+        return FilterRule::lookup(array('id'=>$id, 'filter_id'=>$this->getId()));
     }
 
     function containsRule($what, $how, $val) {
@@ -277,8 +334,14 @@ extends VerySimpleModel {
      * If the matches() method returns TRUE, send the initial ticket to this
      * method to apply the filter actions defined
      */
-    function apply(&$ticket, $vars) {
+    function apply(&$ticket, $vars, $postCreate=false) {
         foreach ($this->getActions() as $a) {
+            //control when certain actions should be applied
+            //if action is send email and postCreate == false, skip
+            //if action is not send email and postCreate == true, skip
+            if ((($a->type == 'email') ? !$postCreate : $postCreate))
+                continue;
+
             $a->setFilter($this);
             $a->apply($ticket, $vars);
         }
@@ -312,7 +375,7 @@ extends VerySimpleModel {
         return $keys;
     }
 
-    /* static */ function getSupportedMatchTypes() {
+    static function getSupportedMatchTypes() {
         return array(
             'equal'=>       __('Equal'),
             'not_equal'=>   __('Not Equal'),
@@ -330,6 +393,8 @@ extends VerySimpleModel {
         if (!self::validate_actions($vars, $errors))
             return false;
 
+        $vars['flags'] = $this->flags;
+
         if(!$vars['execorder'])
             $errors['execorder'] = __('Order required');
         elseif(!is_numeric($vars['execorder']))
@@ -340,7 +405,7 @@ extends VerySimpleModel {
         elseif(($filter=static::getByName($vars['name'])) && $filter->id!=$this->id)
             $errors['name'] = __('Name already in use');
 
-        if(!$errors && !self::validate_rules($vars,$errors) && !$errors['rules'])
+        if(!$errors && !$this->validate_rules($vars,$errors) && !$errors['rules'])
             $errors['rules'] = __('Unable to validate rules as entered');
 
         $targets = self::getTargets();
@@ -399,6 +464,8 @@ extends VerySimpleModel {
     function delete() {
         try {
             parent::delete();
+            $type = array('type' => 'deleted');
+            Signal::send('object.deleted', $this, $type);
             $this->rules->expunge();
             $this->actions->expunge();
         }
@@ -409,7 +476,7 @@ extends VerySimpleModel {
     }
 
     /** static functions **/
-    function getTargets() {
+    static function getTargets() {
         return array(
                 'Any' => __('Any'),
                 'Web' => __('Web Forms'),
@@ -422,7 +489,7 @@ extends VerySimpleModel {
     }
 
     function validate_rules($vars,&$errors) {
-        $matches = array_keys(self::getSupportedMatchFields());
+        $matches = self::getSupportedMatchFields();
         $types = array_keys(self::getSupportedMatchTypes());
         $rules = array();
         foreach ($vars['rules'] as $i=>$rule) {
@@ -435,36 +502,34 @@ extends VerySimpleModel {
 
             if (is_array($rule)) {
                 if($rule["w"] || $rule["h"]) {
-                // Check for REGEX compile errors
-                if (in_array($rule["h"], array('match','not_match'))) {
-                    $wrapped = "/".$rule["v"]."/iu";
-                    if (false === @preg_match($rule["v"], ' ')
-                            && (false !== @preg_match($wrapped, ' ')))
-                        $rule["v"] = $wrapped;
+                    // Check for REGEX compile errors
+                    if (in_array($rule["h"], array('match','not_match'))) {
+                        $wrapped = "/".$rule["v"]."/iu";
+                        if (false === @preg_match($rule["v"], ' ')
+                                && (false !== @preg_match($wrapped, ' ')))
+                            $rule["v"] = $wrapped;
+                    }
+
+                    if(!$rule["w"] || !in_array($rule["w"],$matches))
+                        $errors["rule_$i"]=__('Invalid match selection');
+                    elseif(!$rule["h"] || !in_array($rule["h"],$types))
+                        $errors["rule_$i"]=__('Invalid match type selection');
+                    elseif(!$rule["v"])
+                        $errors["rule_$i"]=__('Value required');
+                    elseif($rule["w"]=='email'
+                            && $rule["h"]=='equal'
+                            && !Validator::is_email($rule["v"]))
+                        $errors["rule_$i"]=__('Valid email required for the match type');
+                    elseif (in_array($rule["h"], array('match','not_match'))
+                            && (false === @preg_match($rule["v"], ' ')))
+                        $errors["rule_$i"] = sprintf(__('Regex compile error: (#%s)'),
+                            preg_last_error());
+                    else //for everything-else...we assume it's valid.
+                        $rules[]=array('what'=>$rule["w"],
+                            'how'=>$rule["h"],'val'=>trim($rule["v"]));
+                } elseif($rule["v"]) {
+                    $errors["rule_$i"]=__('Incomplete selection');
                 }
-
-                if(!$rule["w"] || !in_array($rule["w"],$matches))
-                    $errors["rule_$i"]=__('Invalid match selection');
-                elseif(!$rule["h"] || !in_array($rule["h"],$types))
-                    $errors["rule_$i"]=__('Invalid match type selection');
-                elseif(!$rule["v"])
-                    $errors["rule_$i"]=__('Value required');
-                elseif($rule["w"]=='email'
-                        && $rule["h"]=='equal'
-                        && !Validator::is_email($rule["v"]))
-                    $errors["rule_$i"]=__('Valid email required for the match type');
-                elseif (in_array($rule["h"], array('match','not_match'))
-                        && (false === @preg_match($rule["v"], ' ')))
-                    $errors["rule_$i"] = sprintf(__('Regex compile error: (#%s)'),
-                        preg_last_error());
-
-
-                else //for everything-else...we assume it's valid.
-                    $rules[]=array('what'=>$rule["w"],
-                        'how'=>$rule["h"],'val'=>trim($rule["v"]));
-            }elseif($rule["v"]) {
-                $errors["rule_$i"]=__('Incomplete selection');
-            }
             }
         }
 
@@ -499,20 +564,29 @@ extends VerySimpleModel {
         return parent::save($refetch || $this->dirty);
     }
 
+    static function __create($vars,&$errors) {
+        $filter = new static($vars);
+        if ($filter->save()) {
+            $filter->save_rules($vars, $errors);
+            $filter->save_actions($filter->getId(), $vars, $errors);
+            return $filter;
+        }
+    }
+
     static function create($vars,&$errors) {
         $filter = new static($vars);
         if ($filter->save())
             return $filter;
     }
 
-    function validate_actions($vars, &$errors) {
+    static function validate_actions($vars, &$errors) {
         //allow the save if it is to set a filter flag
         if ($vars['pass'])
             return true;
 
         if (!is_array(@$vars['actions']))
             return;
-      foreach ($vars['actions'] as $sort=>$v) {
+        foreach ($vars['actions'] as $sort=>$v) {
           if (is_array($v)) {
               $info = $v['type'];
               $sort = $v['sort'] ?: $sort;
@@ -522,18 +596,38 @@ extends VerySimpleModel {
               'type'=>$info,
               'sort' => (int) $sort,
           ));
-          $errors = array();
-          $action->setConfiguration($errors, $vars);
+          $err = array();
+          $action->setConfiguration($err, $vars);
           $config = json_decode($action->ht['configuration'], true);
           if (is_numeric($action->ht['type'])) {
               foreach ($config as $key => $value) {
-                  if ($key == 'topic_id') {
-                      $action->ht['type'] = 'topic';
-                      $config['topic_id'] = $value;
-                  }
-                  if ($key == 'dept_id') {
-                      $action->ht['type'] = 'dept';
-                      $config['dept_id'] = $value;
+                  switch ($key) {
+                      case 'topic_id':
+                          $action->ht['type'] = 'topic';
+                          $config['topic_id'] = $value;
+                          break;
+                      case 'dept_id':
+                          $action->ht['type'] = 'dept';
+                          $config['dept_id'] = $value;
+                          break;
+                      case 'sla_id':
+                          $action->ht['type'] = __('SLA');
+                          break;
+                      case 'team_id':
+                          $action->ht['type'] = __('Team');
+                          break;
+                      case 'staff_id':
+                          $action->ht['type'] = __('Agent');
+                          break;
+                      case 'status_id':
+                          $action->ht['type'] = __('Ticket Status');
+                          break;
+                      case 'canned_id':
+                          $action->ht['type'] = __('Canned Response');
+                          break;
+                      default:
+                          $action->ht['type'] = __('All Actions');
+                          break;
                   }
               }
           }
@@ -555,14 +649,25 @@ extends VerySimpleModel {
                   break;
                 default:
                   foreach ($config as $key => $value) {
-                    if (!$value) {
-                      $errors['err'] = sprintf(__('Unable to save: Please insert a value for %s'), ucfirst($action->ht['type']));
+                    if (!$value || is_null($value)) {
+                        $errors['err'] = sprintf(__('Unable to save: Please insert a value for %s'), $action->ht['type']);
+                        return 1;
                     }
                   }
                   break;
               }
           }
       }
+      if (count($errors) == 0) {
+          $fa = FilterAction::lookup($info);
+          if ($fa) {
+              $filter = Filter::lookup($fa->getFilterId());
+              //Clear flags that may have been set on a successful save
+              $filter->setFlag(constant('Filter::FLAG_DELETED_OBJECT'), false);
+              $filter->setFlag(constant('Filter::FLAG_INACTIVE_DEPT'), false);
+              $filter->setFlag(constant('Filter::FLAG_INACTIVE_HT'), false);
+          }
+      }
       return count($errors) == 0;
     }
 
@@ -604,6 +709,7 @@ extends VerySimpleModel {
         }
     }
 }
+Signal::connect('object.deleted', array('Filter', 'disableFilters'));
 
 class FilterRule
 extends VerySimpleModel {
@@ -758,9 +864,9 @@ class TicketFilter {
      * should be rejected, the first filter that matches and has reject
      * ticket set is returned.
      */
-    function apply(&$ticket) {
+    function apply(&$ticket, $postCreate=false) {
         foreach ($this->getMatchingFilterList() as $filter) {
-            $filter->apply($ticket, $this->vars);
+            $filter->apply($ticket, $this->vars, $postCreate);
             if ($filter->stopOnMatch()) break;
         }
     }
@@ -799,7 +905,7 @@ class TicketFilter {
             'Precedence'        => array('AUTO_REPLY', 'BULK', 'JUNK', 'LIST'),
             'X-Precedence'      => array('AUTO_REPLY', 'BULK', 'JUNK', 'LIST'),
             'X-Autoreply'       => 'YES',
-            'X-Auto-Response-Suppress' => array('ALL', 'DR', 'RN', 'NRN', 'OOF', 'AutoReply'),
+            'X-Auto-Response-Suppress' => array('AutoReply'),
             'X-Autoresponse'    => '*',
             'X-AutoReply-From'  => '*',
             'X-Autorespond'     => '*',
@@ -809,6 +915,7 @@ class TicketFilter {
         );
 
         foreach ($auto_headers as $header=>$find) {
+            $header = strtolower($header);
             if(!isset($headers[$header])) continue;
 
             $value = strtoupper($headers[$header]);
@@ -832,8 +939,7 @@ class TicketFilter {
     }
 
     static function isBounce($headers) {
-
-        if($headers && !is_array($headers))
+        if ($headers && !is_array($headers))
             $headers = Mail_Parse::splitHeaders($headers);
 
         $bounce_headers = array(
@@ -848,6 +954,7 @@ class TicketFilter {
         );
 
         foreach ($bounce_headers as $header => $find) {
+            $header = strtolower($header);
             if(!isset($headers[$header])) continue;
 
             @list($func, $searches, $pos, $neg) = $find;
@@ -869,7 +976,7 @@ class TicketFilter {
      * Normalize ticket source to supported filter target
      *
      */
-    function origin2target($origin) {
+    static function origin2target($origin) {
         $sources=array('web' => 'Web', 'email' => 'Email', 'phone' => 'Web', 'staff' => 'Web', 'api' => 'API');
 
         return $sources[strtolower($origin)];

include/class.filter_action.php

@@ -28,6 +28,11 @@ class FilterAction extends VerySimpleModel {
     function setFilter($filter) {
         $this->_filter = $filter;
     }
+
+    function getFilterId() {
+        return $this->filter_id;
+    }
+
     function getFilter() {
         return $this->_filter;
     }
@@ -84,14 +89,17 @@ class FilterAction extends VerySimpleModel {
         return $this->_impl;
     }
 
-    function setFilterFlag($actions, $flag, $bool) {
-        foreach ($actions as $action) {
-          $filter = Filter::lookup($action->filter_id);
-          if ($filter && ($flag == 'dept') && ($filter->hasFlag(Filter::FLAG_INACTIVE_DEPT) != $bool))
-            $filter->setFlag(Filter::FLAG_INACTIVE_DEPT, $bool);
-          if ($filter && ($flag == 'topic') && ($filter->hasFlag(Filter::FLAG_INACTIVE_HT) != $bool))
-            $filter->setFlag(Filter::FLAG_INACTIVE_HT, $bool);
-        }
+    static function setFilterFlags(?object $actions, $flag, $bool) {
+        $flag = constant($flag);
+        if ($actions)
+            foreach ($actions as $action)
+                $action->setFilterFlag($flag, $bool);
+    }
+
+    function setFilterFlag($flag, $bool) {
+        $filter = Filter::lookup($this->filter_id);
+        if ($filter && ($filter->hasFlag($flag) != $bool))
+          $filter->setFlag($flag, $bool);
     }
 
     function apply(&$ticket, array $info) {
@@ -152,6 +160,10 @@ abstract class TriggerAction {
         return array();
     }
 
+    function getEventDescription($action, $filterName) {
+        return null;
+    }
+
     function getConfigurationForm($source=false) {
         if (!$this->_cform) {
             $config = $this->getConfiguration();
@@ -305,11 +317,25 @@ class FA_RouteDepartment extends TriggerAction {
         if ($config['dept_id']) {
           $dept = Dept::lookup($config['dept_id']);
 
-          if ($dept->isActive())
+          if ($dept && $dept->isActive())
             $ticket['deptId'] = $config['dept_id'];
         }
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['dept_id']) {
+            $dept = Dept::lookup($config['dept_id']);
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $dept ? $dept->getName() : false,
+                    'filter' => $filterName, 'type' => 'Department'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
       $depts = Dept::getDepartments(null, true, false);
 
@@ -349,6 +375,20 @@ class FA_AssignPriority extends TriggerAction {
             $ticket['priorityId'] = $config['priority'];
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['priority']) {
+            $priority = Priority::lookup($config['priority']);
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $priority ? $priority->getDesc() : false,
+                    'filter' => $filterName, 'type' => 'Priority'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
         $sql = 'SELECT priority_id, priority_desc FROM '.PRIORITY_TABLE
               .' ORDER BY priority_urgency DESC';
@@ -377,6 +417,21 @@ class FA_AssignSLA extends TriggerAction {
             $ticket['slaId'] = $config['sla_id'];
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['sla_id']) {
+            $sla = SLA::lookup($config['sla_id']);
+
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $sla ? $sla->getName() : false,
+                    'filter' => $filterName, 'type' => 'SLA'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
         $choices = SLA::getSLAs();
         return array(
@@ -399,6 +454,20 @@ class FA_AssignTeam extends TriggerAction {
             $ticket['teamId'] = $config['team_id'];
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['team_id']) {
+            $team = Team::lookup($config['team_id']);
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $team ? $team->getName() : false,
+                    'filter' => $filterName, 'type' => 'Team'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
         $choices = Team::getTeams();
         return array(
@@ -430,6 +499,20 @@ class FA_AssignAgent extends TriggerAction {
             $ticket['staffId'] = $config['staff_id'];
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['staff_id']) {
+            $staff = Staff::lookup($config['staff_id']);
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $staff ? $staff->getName()->name : false,
+                    'filter' => $filterName, 'type' => 'Agent'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
         $choices = Staff::getStaffMembers();
         return array(
@@ -450,12 +533,25 @@ class FA_AssignTopic extends TriggerAction {
         $config = $this->getConfiguration();
         if ($config['topic_id']) {
           $topic = Topic::lookup($config['topic_id']);
-
-          if ($topic->isActive())
+          if ($topic && $topic->isActive())
             $ticket['topicId'] = $config['topic_id'];
         }
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['topic_id']) {
+            $topic = Topic::lookup($config['topic_id']);
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $topic ? $topic->getName() : false,
+                    'filter' => $filterName, 'type' => 'Topic'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
         $choices = Topic::getHelpTopics(false, false);
 
@@ -486,6 +582,20 @@ class FA_SetStatus extends TriggerAction {
             $ticket['statusId'] = $config['status_id'];
     }
 
+    function getEventDescription($action, $filterName) {
+        $config = $action->getConfiguration();
+        $info = array();
+
+        if ($config['status_id']) {
+            $status = Team::lookup($config['status_id']);
+            $info = array('type' => 'edited',
+                    'desc' => array('value' => $status ? $status->getName() : false,
+                    'filter' => $filterName, 'type' => 'Ticket Status'));
+        }
+
+        return $info;
+    }
+
     function getConfigurationOptions() {
         $choices = array();
         foreach (TicketStatusList::getStatuses(array(
@@ -516,16 +626,23 @@ class FA_SendEmail extends TriggerAction {
     function apply(&$ticket, array $info) {
         global $ost;
 
+        if (!$ticket['ticket'])
+            return false;
+
         $config = $this->getConfiguration();
-        $info = array('subject' => $config['subject'],
-            'message' => $config['message']);
-        $info = $ost->replaceTemplateVariables(
-            $info, array('ticket' => $ticket)
+        $vars = array(
+            'url' => $ost->getConfig()->getBaseUrl(),
+            'ticket' => $ticket['ticket'],
+            'recipient' => $ticket['ticket']->getOwner(),
         );
+        $info = $ost->replaceTemplateVariables(array(
+            'subject' => $config['subject'],
+            'message' => $config['message'],
+        ), $vars);
 
         // Honor FROM address settings
         if (!$config['from'] || !($mailer = Email::lookup($config['from'])))
-            $mailer = new Mailer();
+            $mailer = new osTicket\Mail\Mailer();
 
         // Allow %{user} in the To: line
         $replacer = new VariableReplacer();
@@ -534,10 +651,9 @@ class FA_SendEmail extends TriggerAction {
         ));
         $to = $replacer->replaceVars($config['recipients']);
 
-        require_once PEAR_DIR . 'Mail/RFC822.php';
         require_once PEAR_DIR . 'PEAR.php';
 
-        if (!($mails = Mail_RFC822::parseAddressList($to)) || PEAR::isError($mails))
+        if (!($mails = Mail_Parse::parseAddressList($to)) || PEAR::isError($mails))
             return false;
 
         // Allow %{recipient} in the body
@@ -549,7 +665,6 @@ class FA_SendEmail extends TriggerAction {
             $I = $replacer->replaceVars($info);
             $mailer->send($recipient, $I['subject'], $I['message']);
         }
-
     }
 
     static function getVarScope() {
@@ -577,7 +692,7 @@ class FA_SendEmail extends TriggerAction {
                     'size' => 80, 'length' => 1000,
                 ),
                 'validators' => function($self, $value) {
-                    if (!($mails = Mail_RFC822::parseAddressList($value)) || PEAR::isError($mails))
+                    if (!($mails = Mail_Parse::parseAddressList($value)) || PEAR::isError($mails))
                         $self->addError('Unable to parse address list. '
                             .'Use commas to separate addresses.');