Add Release Notes for v1.18.4

Reviewed-By: JediKev <kevin@enhancesoft.com>

.gitignore

@@ -7,6 +7,8 @@ setup/cli/modules/importer
 .vagrant
 ._.DS_Store
 Vagrantfile
+# VS Code workspace files
+*.code-workspace
 
 # Staging directory used for packaging script
 stage

README.md

@@ -22,13 +22,14 @@ easy to setup and use. The best part is, it's completely free.
 Requirements
 ------------
   * HTTP server running Microsoft® IIS or Apache
-  * PHP version 7.2 to 7.4, 7.4 is recommended
+  * PHP version 8.2 - 8.4 (8.4 recommended)
   * mysqli extension for PHP
-  * MySQL database version 5.5
+  * MySQL database version 5.5 (or greater)
 
 ### Recommendations
-  * gd, gettext, imap, json, mbstring, and xml extensions for PHP
-  * APC module enabled and configured for PHP
+  * ctype, fileinfo, gd, gettext, iconv, imap, intl, json, mbstring,
+    Zend OPcache, phar, xml, xml-dom, and zip extensions for PHP
+  * APCu module enabled and configured for PHP
 
 Deployment
 ----------
@@ -58,33 +59,9 @@ Upgrading
 ---------
 osTicket supports upgrading from 1.6-rc1 and later versions. As with any
 upgrade, strongly consider a backup of your attachment files, database, and
-osTicket codebase before embarking on an upgrade.
-
-To trigger the update process, fetch the osTicket tarball from either
-the osTicket [github](http://github.com/osTicket/osTicket/releases) page
-or from the [osTicket website](https://osticket.com). Extract the tarball
-into the folder of your osTicket codebase. This can also be accomplished
-with the zip file, and a FTP client can of course be used to upload the new
-source code to your server.
-
-Any way you choose your adventure, when you have your codebase upgraded to
-osTicket-1.7, visit the /scp page of you ticketing system. The upgrader will
-be presented and will walk you through the rest of the process. (The couple
-clicks needed to go through the process are pretty boring to describe).
-
-### Upgrading from v1.6
-**WARNING**: If you are upgrading from osTicket 1.6, please ensure that all
-    your files in your upload folder are both readable and writable to your
-    http server software. Unreadable files will not be migrated to the
-    database during the upgrade and will be effectively lost.
-
-After upgrading, we recommend migrating your attachments to the database or
-to the new filesystem plugin. Use the `file` command-line applet to perform
-the migration.
-
-    php manage.php file migrate --backend=6 --to=D
-
-View the UPGRADING.txt file for other todo items to complete your upgrade.
+osTicket codebase before embarking on an upgrade. Please review our [Upgrade
+Guide](https://docs.osticket.com/en/latest/Getting%20Started/Upgrade%20and%20Migration.html)
+or the [UPGRADING.txt file](UPGRADING.txt) for upgrade instructions.
 
 Help
 ----
@@ -101,18 +78,17 @@ the feature is published in your fork, send a pull request to begin the
 conversation of integrating your new feature into osTicket.
 
 ### Localization
-[![Crowdin](https://d322cqt584bo4o.cloudfront.net/osticket-official/localized.png)](http://i18n.osticket.com/project/osticket-official)
+[![Crowdin](https://badges.crowdin.net/osticket-official/localized.svg)](https://crowdin.com/project/osticket-official)
 
 The interface for osTicket is now completely translatable. Language packs
 are available on the [download page](https://osticket.com/download). If you
-do not see your language there, join the [Crowdin](http://i18n.osticket.com)
+do not see your language there, join the [Crowdin](https://crowdin.com/project/osticket-official)
 project and request to have your language added. Languages which reach 100%
 translated are are significantly reviewed will be made available on the
 osTicket download page.
 
-The software can also be translated in place in our [JIPT site]
-(http://jipt.i18n.osticket.com). Once you have a Crowdin account, login and
-translate the software in your browser!
+The software can also be translated in place in our [JIPT site](http://jipt.i18n.osticket.com).
+Once you have a Crowdin account, login and translate the software in your browser!
 
 Localizing strings in new code requires usage of a [few rules](setup/doc/i18n.md).
 
@@ -123,18 +99,19 @@ file for the gory details of the General Public License.
 
 osTicket is supported by several magical open source projects including:
 
-  * [Font-Awesome](http://fortawesome.github.com/Font-Awesome/)
-  * [HTMLawed](http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed)
-  * [jQuery dropdown](http://labs.abeautifulsite.net/jquery-dropdown/)
-  * [jsTimezoneDetect](http://pellepim.bitbucket.org/jstz/)
-  * [mPDF](http://www.mpdf1.com/)
-  * [PasswordHash](http://www.openwall.com/phpass/)
-  * [PEAR](http://pear.php.net/package/PEAR)
-  * [PEAR/Auth_SASL](http://pear.php.net/package/Auth_SASL)
-  * [PEAR/Mail](http://pear.php.net/package/mail)
-  * [PEAR/Net_SMTP](http://pear.php.net/package/Net_SMTP)
-  * [PEAR/Net_Socket](http://pear.php.net/package/Net_Socket)
-  * [PEAR/Serivces_JSON](http://pear.php.net/package/Services_JSON)
+  * [Font-Awesome](https://fontawesome.com/)
+  * [HTMLawed](https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed)
+  * [jQuery dropdown](https://labs.abeautifulsite.net/jquery-dropdown/) (Project Deleted)
+  * [jsTimezoneDetect](https://pellepim.bitbucket.org/jstz/)
+  * [laminas-mail](https://github.com/laminas/laminas-mail)
+  * [mPDF](https://github.com/mpdf/mpdf)
+  * [PasswordHash](https://www.openwall.com/phpass/)
+  * [PEAR](https://pear.php.net/package/PEAR)
+  * [PEAR/Auth_SASL](https://pear.php.net/package/Auth_SASL)
+  * [PEAR/Mail](https://pear.php.net/package/mail)
+  * [PEAR/Net_SMTP](https://pear.php.net/package/Net_SMTP)
+  * [PEAR/Net_Socket](https://pear.php.net/package/Net_Socket)
+  * [PEAR/Serivces_JSON](https://pear.php.net/package/Services_JSON)
   * [php-gettext](https://launchpad.net/php-gettext/)
-  * [phpseclib](http://phpseclib.sourceforge.net/)
-  * [Spyc](http://github.com/mustangostang/spyc)
+  * [phpseclib](https://phpseclib.sourceforge.net/)
+  * [Spyc](https://github.com/mustangostang/spyc)

UPGRADING.txt

@@ -1,5 +1,33 @@
-Welcome to osTicket 1.7
-=======================
+Upgrading osTicket
+==================
+osTicket supports upgrading from 1.6-rc1 and later versions. As with any
+upgrade, strongly consider a backup of your attachment files, database, and
+osTicket codebase before embarking on an upgrade.
+
+To trigger the update process, fetch the osTicket tarball from either
+the osTicket [GitHub](https://github.com/osTicket/osTicket/releases) page
+or from the [osTicket website](https://osticket.com/download). Extract the tarball
+into the folder of your osTicket codebase. This can also be accomplished
+with the zip file, and a FTP client can of course be used to upload the new
+source code to your server.
+
+Any way you choose your adventure, when you have your codebase upgraded,
+visit the /scp page of you ticketing system. The upgrader will
+be presented and will walk you through the rest of the process. (The couple
+clicks needed to go through the process are pretty boring to describe).
+
+### Upgrading from v1.6
+**WARNING**: If you are upgrading from osTicket 1.6, please ensure that all
+    your files in your upload folder are both readable and writable to your
+    http server software. Unreadable files will not be migrated to the
+    database during the upgrade and will be effectively lost.
+
+After upgrading, we recommend migrating your attachments to the database or
+to the new filesystem plugin. Use the `file` command-line applet to perform
+the migration.
+
+    php manage.php file migrate --backend=6 --to=D
+
 Some tasks are better left to a system administrator rather than a mindless
 upgrade script. These are those remaining things that we'd rather you take
 care of:

WHATSNEW.md

@@ -1,3 +1,490 @@
+osTicket v1.18.4
+================
+### Security
+* security: Latest Patches 06/2026 (52c366f, 5afdf54, c54a6ac, 1e39bf1, feccb6a, 6eb6b98, 078516e, 98abb05, e52e010, fd96bba, 7bbd8ab, ba6217a, 580e1c8, b535782, 5963797, d590a97, eaebe01, b4cc092, d457c14, 5600f94, 5ff9795, 119cefe, b4ede88, 2a0c388, 6558b33)
+
+osTicket v1.18.3
+================
+### Enhancements
+* mPDF: Upgrade To v8.2.7 (39cdd2b1)
+* htmLawed: Upgrade To 1.2.15 (877adf56)
+
+### Security
+* security: Latest Patches 01/2026 (c646c8cb, d1b634a9, 6852e719, 8db4d377, 1552cfa3, d832f243)
+
+osTicket v1.18.2
+================
+### Improvements
+* OAuth2: Show Scopes and Enforce Strict Mode (a77cf535, 390555db)
+
+osTicket v1.18.1
+================
+### Improvements
+* Update upgrade.php (9fd83eba)
+* Update upgrade.inc.php (8c8a7fd1)
+* update: PHP Requirements 1.18.x (1c0c670b)
+* CLI: Make sure manage util can be executed via CLI (0caf5864)
+* Update raphael-min.js to 2.3.0 (d4aeada1)
+
+osTicket v1.18
+==============
+### Enhancements
+* update: Laminas-Mail (66fa10af, bb45d37a)
+
+### Improvements
+* Database: Change Plugin Name to varchar(255) (aac546d0)
+* update: MAJOR_VERSION (3eac42e5)
+
+osTicket v1.17.8
+================
+### Security
+* security: Latest Patches 06/2026 (52c366f, 5afdf54, c54a6ac, 1e39bf1, feccb6a, 6eb6b98, 078516e, 98abb05, e52e010, fd96bba, 7bbd8ab, ba6217a, 580e1c8, b535782, 5963797, d590a97, eaebe01, b4cc092, d457c14, 5600f94, 5ff9795, 119cefe, b4ede88, 2a0c388, 6558b33)
+
+osTicket v1.17.7
+================
+### Enhancements
+* mPDF: Upgrade To v8.2.7 (39cdd2b1)
+* htmLawed: Upgrade To 1.2.15 (877adf56)
+
+### Improvements
+* join cdata table earlier (81ec2562)
+* issue: Content Management Errors (2a4fe6ad)
+* mail: SMTPUTF8 Backwards Compatibility (05b87199)
+* issue: SVG MIME Type (a6309e22)
+* Fix Banlist permission check (a7f14bf2)
+* issue: POP OAuth2 Error REGEX (10f38bd0)
+* issue: Kazakh Flag CSS (624c7171)
+* Fixing Argentinian flag (924380a9)
+* Update class.setup.php (8b6a0f05)
+* Fixes for Implicitly marking parameters as nullable (573e8496, ca13d888)
+* issue: Date Column Interval (1e38901e)
+* issue: PGP + S/MIME Mail Parsing (9aff6b03)
+* issue: Trim User Name (0fbafda1)
+* issue: Microsoft UTF-8 BOM (5074c032)
+* issue: Empty Dept Error On Topic Update (f1ba934b)
+* Fix typo in 'Add New Instance' title (ae434418)
+* Update class.file.php (1425fe1e)
+* issue: Regex OR Operator (331ca48d)
+* Revert "issue: Guest Session TTL" (c3819e4d)
+
+### Security
+* security: Latest Patches 01/2026 (c646c8cb, d1b634a9, 6852e719, 8db4d377, 1552cfa3, d832f243)
+
+osTicket v1.17.6
+================
+### Improvements
+* Fix PR #6283: DB column value of "local backend" is 'client' and not 'local' (7805cd94)
+* i18n: Tasks Department ID Missing (00bc6b1b)
+* issue: Checkbox Template Variable (09de9587)
+* Fixed mailfetch error message (cd4717a1)
+* issue: fix square characters being printed when printing tickets that's using languages like Thai (872a6492, 25844034)
+* issue: Position Styling.. Again (7f03a64b, b843fb15)
+* mysqli: Multi-Host Failure (0a8475fb)
+* issue: Task Last Respondent (5277c7ab)
+* i18n: Schedules getDays() (f2facda3)
+* issue: Referred Closed Tickets (a7b0711d)
+* php: Update Prerequisites (d331a44c)
+* i18n: Lang URL Param (fece6ff7)
+* mysql: Update Minimum Version (317ab967)
+* Fix ajax path for AddRemoteCollaborator (6df6cd98)
+* Fix staff mobile field class (f8455c82)
+* patches: Latest 05/28/2024 (2d65cb77, 36b4c94f, 854cf47c, d9fe3ada)
+* upgrade: Laminas-Mail (2.25.1) (c0a74162, 939a278c, f658268d)
+* hotfix: Fix getRawEmail() (c26d840c, 1eb71197)
+* issue: Linked Icon annotation (6c096cce)
+* fix(email): fix case sensitivity in "Action" header retrieval (07843598)
+* Upgrade mimeDecode.php from v1.48 to v1.5.6 2016-08-28 (cbd78ac8)
+* mailer: sendmail() Failure (14e2057b)
+* php: 8.3 Support (a3931f46, b38db372, fea5e1e0, 387a1c04, 136d372e)
+* issue: Ticket Relations (9426b2dd)
+* issue: Basic Search Selector (74b8bd0e)
+* mail: Reapply Memory Optimization (eaaa64d9, ab76ffe8)
+* php: iconv Recommendation (33ecc3a0)
+* Ignore VS Code Workspace Files (0da2e0e0)
+* issue: Email Remote Backend Name (b54dd584)
+* issue: Safari Response Content Disposition (64a5df68)
+* api: DueDate and Other Errors (14814ae2)
+* issue: Multiselect List Export (f3bf8553)
+* issue: Image Annotation (aeeb2850)
+* user: List Import (fec70c4a)
+* issue: Latest SQL Warnings (9bdfde5a)
+* fields: Variable Name Validation (0724d1ad)
+* issue: Transfer Empty Comments Var (ed87b257)
+* update: Composer symfony/process (59f25918)
+* issue: Client ACL Staff File Download (8255b2e7)
+* update: PHP Deprecations & Warnings (84c14ace)
+* issue: User Lookup Umlaut (504b0bfb)
+* issue: Department Field User Import (5c2b6a5d)
+* Fix force_https auto-enabling on settings page (3805bbfd)
+* queue: getTotal Incorrect Counts (4f137dc2)
+* issue: Referred Tickets Incorrect Queue Counts (b42cad6f)
+* php: 8.4 Support (a4c0f674, b4938b99, 5e5a9ff5, fb9a39ba)
+* issue: Canned Response Access (b930a68b)
+* issue: Excessive Fetching Errors (c546a167)
+* issue: Plain-text Base64 (216ded32)
+* i18n: Crowdin API v2 (0ec6670d)
+* issue: iFrame Logins (3a5da66b)
+* issue: mimeDecode .eml Attachments (7fc3d8c2)
+* patches: Latest 11/18/2024 (416b548b, 245e7554)
+* Revert part of 0784359 commit (ec76a203)
+
+### Security
+* security: Latest Vulns 01/2025 (193f5fe0, ab6672fa)
+
+osTicket v1.17.5
+================
+### Improvements
+* update: README.md PHP & Laminas (4baf9dc8, 555c4a74, 88294e2d, 30a4a6e9)
+* issue: putenv() Disabled (3c0d5f47)
+* i18n: Update Signing (98706274, 776c0f27)
+* i18n: Flags Position & Codes (3ee11112, 45f5b5b4)
+* mailer: Undefined SmtpAccount::getName() (560a4f1d)
+* issue: SystemSessionHandler (7e17daa6)
+* issue: Status List Overflow (1deee342)
+* faq: Category Notes Images (ccca0f59)
+* patches: Latest 10/03/2023 (65e12297, 48e8501d, a8d42a9d, 4475e03e, bd034712, 64b8c81d, 070eefcb, 1775ce75)
+* mail: NoValidateCert (d3c140ce)
+* issue: Choice/Selection Field Searches (00e22fad)
+* stubs: Add stubs to pass lint test (895c7236)
+* issue: Canned Response Inline Images (a503c160)
+* format: Viewable Images Bug (2a412883)
+
+### Security
+* issue: CSP Headers (6228f640)
+* security: Latest Vulns 09/2023 (04f4e611, 88a87a33, c4ad48de, 37cf8350)
+* issue: User Account Creation (777e6f0b)
+
+osTicket v1.17.4
+================
+### Improvements
+* issue: Thread Entry Actions z-index (215a0ce2)
+* oauth2: Strict Matching Bug (e014ffd2)
+* Make string translatable (1105cde7)
+* issue: Inline-Images Canned Responses (4493b126)
+* issue: Remove Old Login Code (e17ad463)
+* issue: i18n Audit Exports (45dd7c4f)
+* Bug: Custom File Upload Field Config (6371269a, 7283ac81, 902b5d35)
+* issue: Duplicate User Copy/Paste Import (b304cdb)
+* issue: Relocate Typeahead JS/CSS Files (62cd406)
+* issue: strftime() Deprecation (3fe132c4)
+* jquery: Update To 3.7.0 (ffa23da)
+* issue: glob() Empty Array (c64a2611)
+* issue: Email Only Attachment (9e45f3fa)
+* installer: Change Email (a11aee29)
+
+### Security
+* security: Latest Vulns 06/2023 (86c2ba02, 69244175, 73b997a, ae37925, e4bfb00)
+
+osTicket v1.17.3
+================
+### Enhancements
+* oauth2: Strict Matching (7275d67b, b7718be4, ca913ba2, cb3625e8, f531718a, c0cd8b16)
+* OAuth2 Resource Owner (5c239adb)
+
+### Improvements
+* session: Regenerate Session Id (d5853245)
+* fetcher: Mail Fetcher / Parser Error Handling (d4d9c424, 0a4498b2)
+* mysql: Support Sidecar Database Proxies (246aaa4d)
+* Misc. Fixes (e6beeb9b, 24fd5075, eac9960a, 10af29a5)
+* fetcher: Default Department (f410d4ec)
+* issue: LDAP Multi-Instance Fatal Error (f6486044)
+* issue: TicketDenied errno (6de7cf4c)
+* session: User Logged Out (00d409d3)
+* Uncaught Error: Call to a member function getId() on bool (af83896d)
+* Mailer: Inline Images (7efbdfd2, 8815d087, 64a8abf3)
+
+osTicket v1.17.2
+================
+### Improvements
+* Fix old reference to SessionData (cf8b8ce7)
+* Email Misc. Fixes (de620fe6, c19a5f03)
+* session: Memcache Max TTL (ea3e03d2)
+* mailer: Use Namespaced Mailer (133585f8)
+
+osTicket v1.17.1
+================
+### Enhancements
+* mail: Add plain:// encryption scheme hint (7c1b97b3, 39d76258)
+
+### Improvements
+* mailer: Make Headers Valid Again (c08a8a8a, aaee6b0f, 00981554, 2223877c, 020fa0d3, 60c8c884)
+* POP3 Configration can not saved (b84547b0, ccd8445e)
+* fetcher: Errors Handling & Logging (384aad13, 22edf2b4, c92006e6)
+* upgrader: Email Account Status (aee25d69)
+* issue: Plugin Config Item Exists (fdf9e412)
+* mailer: Improvements & Enhancements (845e5008, 23a80592, 977cf9aa)
+* smtp: Use proper name when saying What's Up (HELO/EHLO) (b0e5ac83)
+* email: Make sure Email Account is Active 4realz! (5efd9f14, a9b57496)
+* Session++ (ced0ef4d, b943a955, b6b63c99, f58e1c5d, 47df2b44, e2e6c0f4, 9ab5b4f1, da667366, f2c01840, c2be4ebf, db913bd3)
+* setup: Use Bootstrap:ini() to initialize setup dir sessions (48e436f0)
+* issue: Plugin Config Item Exists (fdf9e412)
+* upgrader: Email Account Status (aee25d69)
+* fetcher: Errors Handling & Logging (384aad13, 22edf2b4, c92006e6)
+* fetcher: Mail Fetch Order (f1639d41, 24338c2b)
+* SMTP: Dont send 'QUIT' on __destruct() (dbeae227)
+* issue: MTA Typo (03eeb8e2)
+* sendmail: Strip "To" and "Subject" headers (ac3855a4)
+* Mail Parse Error Handling (320981df, 75c5cfe9, a4e36d39, ba2d31cd, 30ad9cd4, 678098d8, 46b7899b, f85f9036)
+* Issue/session revisited (49d91b05, 4fc5f5cc)
+
+osTicket v1.17
+==============
+### Enhancements
+* email: Set Default Email Message Encoding to UTF-8 (4656cf4c, 8954f05b)
+* plugins: Multi-Instance Blacklist (56077516)
+* mailer: Reset FROM Address when SMTP fails (75605a3f)
+* Issue: File Storage Plugins Blacklist (1ba8d37a)
+* mail: Catch Possible Exceptions and Errors (81d5cb35)
+
+### Improvements
+* Update class.mail.php (d5545b4e)
+* Mail Fetcher Fixes (1eebcd66, 3decbe78)
+* 1.17.x Bug Fixes (6c2ecad2, 5d799ecd, 21e3a407)
+* plugins: Make Plugins Upgradeable Again! (80bcc191)
+* mailer: Skip Invalid Email Recipients (046f4327, 551f7864, d7d37c4c)
+* issue: Wrong Variable Order (12a4cb09)
+* mailer: Skip Missing Attachment Files (2218aaca)
+* fetcher: TicketDenied Exception + Throwable (58f64e65, 79209144, e027dcc4, be178da5)
+* files: Catch possible Storage Backends Errors (e685636e)
+* fetcher: Fail Safely on Email Parse Error (459520e8)
+* forms: Add getNotice func. to DynamicFormEntry (6e54e810)
+* bug: Users Password Policy (ebfc1d89)
+* v1.17 Misc. Fixes (d149ea0d)
+* plugins: Make Plugin Base Class Play Nice (7b26f665, 5787f9ae, 3163972b)
+
+osTicket v1.17-rc4
+==================
+### Enhancements
+* v1.17: Bug Fixes & Enhancements (bd300c44, ab9a8101, 3024d7f5, e705ff0f, 681bea08, bc154434, 246c1445, e4f594c2, 76bf7725, 4ee44d48, a7068668, 5e53b1a1, 481a0475, 2fa077ae, 13888292)
+
+### Improvements
+* mail: Mixed Mime Message with mixed multiparts (6de79a0b, c71ddade)
+* 2fa: Fix 2FA Backend Registry (f8f5d3dd, 2318714e)
+* issue: Dispatcher include_once (dab490dc)
+* plugins: Audit enable() (7796d60c)
+* issue: AuthenticationBackend getBkId() (29f01c09)
+
+osTicket v1.17-rc3
+==================
+### Improvements
+* Oauth2 / Modern Email Auth Latest Fixes (fdc5b0fa, d9b41f4e, fa8dc24d, 265065c1)
+
+osTicket v1.17-rc2
+==================
+### Improvements
+* Oauth2 / Modern Email Auth Latest Fixes (4da6fb07, 90ed880b, 72b2a249, 8a8c1a16, fa6cc040, 97a9b0af)
+
+osTicket v1.17-rc1
+==================
+### Enhancements
+* Oauth2 / Modern Email Authentication Support (d99ff6e1-163c28b5)
+
+osTicket v1.16.6
+================
+### Improvements
+* session: Collab View Ticket (6afe0efa)
+* issue: Static forTask() (1079011f)
+* issue: Featured FAQs (8df09581)
+* print: Hidden Thread Events (f63fc67d)
+* issue: Does Not Have A Value (d47fc2b1)
+* issue: Disabled Queues Run Counts (3ff3ce93)
+* issue: Queue Counts Incorrect (2428cc58)
+* jquery: Update jQueryUI 1.13.2 (b896f70d)
+* issue: Department Export (5418cf20)
+* jquery: Update To 3.6.3 (8d39a4cc)
+* i18n: make-pot (74274b5c)
+* update: README PHP Version (6087bc55)
+* issue: mPDF Font Files (427a8aa6)
+* issue: FileUpload False (8dd2ab61)
+* Add translation for "last resort" standard column labels (cb528044)
+* add translation for task status (46c005a0)
+* issue: getRealPath() Stub (32a229aa)
+
+### Security
+* security: Latest Security Patches 03/2023 (86f9693d, 091ddba9, ec604393, daee20fd, 9fb01bc1, 619ce0f6, 343a2b47, 8a55c29f, e2c8f799, ee7ce3d9, 263f71a3)
+
+osTicket v1.16.5
+================
+### Improvements
+* Fix trusted proxy wildcard check (04c0bb3a)
+* issue: Html Typo (50dfe931)
+* mailparse: Parse filenames with complex format (c8067212)
+* validator: Email Domain Verification (3c4a20a8)
+* user: Make sure User has a valid Email on create (55fbfcb5)
+
+osTicket v1.16.4
+================
+### Enhancements
+* i18n: Default Ticket Queue (7a5dd0eb)
+* mailparse: thread_entry_recipients to (a82af698)
+* issue: Unique Variable Names (0dc5a02e)
+* php: 8.1 Support (22b599e3, c24ee575, dd2b9a43)
+* issue: Session Cookie Refresh (1630459a)
+
+### Improvements
+* oops: jQuery UI Images (822a05fe)
+* issue: Manually Sorted Topics (a80db8a7)
+* issue: Queue Export Headings (47449758)
+* installer: Checking Existing Install (a3f2e246)
+* Catch storage error when mailing ticket response (ca5932ac)
+* issue: Staff Ticket Open Session (4f3d3cff)
+* issue: External Auth Regenerate Session (83252260)
+* issue: Searching Numbers (e00003f6)
+* Replace hacky way with ReflectionClass (55f61390)
+* Issue: Installer YAML (6780f29e)
+* issue: Fix Upgrader Session Issues (311089a6)
+* issue: Undefined Variable ORM (4009881a)
+* v1.16: Misc Bug Fixes (4c0341e2)
+* issue: User/Agent Password Reset (d3de1599)
+* issue: imagesx Boolean (5d06ee46)
+* file: Possible Key Collision (21c71c6e)
+* cli: User Import (4c43e46f)
+* issue: Miscellaneous Fixes (50bc1a21, 5002bef9, e036fd9a, 35684189, 9c280b49, c2a15b64, 5e970061)
+* issue: urldecode Dispatcher (c00b8e87)
+* issue: Information and SectionBreak Fields On Edit (7b60c576)
+* issue: Favicons Login Headers (61655ec6)
+* issue: Schedules stops_on (e2dcbb69)
+* Issue: Agent Permission to Assign Tickets (b4732b05)
+* issue: File Upload Size (45f554ad)
+
+### Security
+* security: Username XSS (5213ff13)
+* security: Refresh URL (3702a4fb)
+
+osTicket v1.16.3
+================
+### Improvements
+* installer: Help Topic Disabled Fields (81e99fe4)
+* Do not autocomplete new access fields of the (another) user (02633694)
+* issue: mPDF Table Print (38c0979e)
+* Make string localizable (4cc509b1, 612183ce)
+
+### Security
+* mpdf: Unregister PHAR (57721def)
+* issue: Form Elements & Attribute (45b6cf2e)
+* Security: Session Fixation (85a76f40)
+* security: Unvalidated Password Change (01a378f6)
+* xss: System Logs (334934ec)
+* xss: Agent Directory (a5c4d931)
+
+osTicket v1.16.2
+================
+### Improvements
+* Issue: Topic->getHelpTopics() don't return localized names when $allData = true (a078a0f)
+* class.email: allow empty smtp_passwd when existing (0d0d8a1)
+* Fixes permission issue when registration mode ist disabled (dee6a13)
+* email: use correct e-mail formatting (7692637)
+* Fix HTML syntax in thread view (84913f5)
+* Fix slugify regex (f72691c)
+* issue: preg_match Pass By Reference (148a2e7)
+* issue: php_analyze each() (f627a5e)
+* issue: Deprecated Required Parameter (0d0ab46)
+* tests: UninitializedVars (60f6ad7)
+* tests: Validation Checks (91e7d30)
+* issue: QueueSort (92e820c)
+* issue: Task Export (baa46d3)
+* issue: PEAR Mail parseAddressList() (7130056)
+* issue: Filter Events (8c9b392)
+* issue: Last Message Data Source (d185e50)
+* issue: Undefined Constant GLOB_BRACE (0499b97)
+* Update edit.inc.php (8b5ea64)
+* Update ticket-preview.tmpl.php (e6f437c)
+* Update ticket-view.inc.php (84c4eb8)
+* issue: Nullable date() Timestamp (a77158b)
+
+osTicket v1.16.1
+================
+### Improvements
+* issue: Remaining Deprecated each() (69db3a7)
+* issue: User sendUnlockEmail (13652db)
+* issue: Auth_SASL Non-Static (4378f77)
+* issue: Banlist Non-Static (96995e1)
+* issue: PHP Version Requirements 1.16.x (fdc0445)
+* issue: Email Templates Static (fb0b075)
+* issue: Status List getSortModes() (6d4650d)
+
+osTicket v1.16
+==============
+### Enhancements
+* PHP8: Static Method Lint Test (958a748)
+* Update MPDF (59dc587)
+
+### Improvements
+* prereqs: Update README.md (2767ad4)
+* upgrader: v1.16 Release (57347ab)
+* release: Prep Release (0905e7b)
+* php8: Temporarily Suppress Warnings (0afe2b2)
+* issue: PEAR each() (1eafd98)
+* issue: Further Fixes (03d203b)
+* issue: EmailDataParser (c4fc76c)
+* issue: Even More Fixes (998cd7d)
+* issue: Misc. Fixes (ec9c09d)
+* issue: Static to Non-Static (3bb36ff)
+* issue: create_function() (7668b71)
+* issue: Unparenthesized (64076e2)
+* issue: Undefined Key, Var, Prop (6974734)
+* issue: Undefined Function each() (e261a5f)
+* issue: Calling Non-Static Statically (a4ab19d)
+* Fix first problems with PHP 8 (ab77c0a, 29dcbd9, 6b3c7f9, 4d972b5, e63998e)
+
+osTicket v1.15.8
+================
+### Enhancements
+* issue: Check User Status (3a2f072d)
+* jquery: Update jQueryUI 1.13.1 (ed958d98)
+
+### Improvements
+* issue: Redactor Freezing (42525aca)
+
+### Security
+* mpdf: Unregister PHAR (57721def)
+* issue: Form Elements & Attribute (45b6cf2e)
+* Security: Session Fixation (85a76f40)
+* security: Unvalidated Password Change (01a378f6)
+* xss: System Logs (334934ec)
+* xss: Agent Directory (a5c4d931)
+
+osTicket v1.15.7
+================
+### Enhancements
+* i18n: Bosnian Flag CSS (94f5e95)
+* i18n: Translatable Tooltip (e2be9e7)
+* i18n: No Tasks String (01016db)
+
+### Improvements
+* Use HTTPS version of Crowdin project (d52cc40, da1309a)
+* fix staff login redirect loop when system is offline (38b8f53)
+* oops: Banlist Created (f0ae76f)
+* issue: MaxLength Attribute (225eb7a)
+* Update ticket-tasks.inc.php (b063504)
+* Issue: Disabled/Archived Primary Dept (0b7c9c2)
+* issue: Sweden Capitalization (3cb05ad)
+* typo: Emtpy To Empty (9c858b8)
+* issue: Fixes Test Errors (34cf2f2)
+
+osTicket v1.15.6
+================
+### Enhancements
+* i18n: Missing translations for the action buttons (823b5fb)
+
+### Improvements
+* issue: Required Custom Field User Registration (f4e693e)
+
+osTicket v1.15.5
+================
+### Enhancements
+* redactor: Upgrade to version 3.5.2 (4e4f82e)
+* auth: Allow AuthBackends to auto-register Users (6836b17)
+
+### Improvements
+* issue: Khmer Language Flag (f878f14)
+* issue: Assignee Item Property (3cde88a)
+* issue: CDATA Rebuild Issue (9da3b5e)
+* issue: Plus Symbol (b0f143e)
+* issue: Plain-Text Canned Responses (19c03ca)
+* issue: Improved Validation for Variable Names (35c8ca8)
+* Revert "issue: List Item Properties On Mouseover" (5c91f64)
+
 osTicket v1.15.4
 ================
 ### Enhancements
@@ -16,22 +503,6 @@ osTicket v1.15.4
 * xss: Advanced Search (4a8d3c8)
 * xss: Tasks (b01c6a2)
 
-osTicket v1.14.8
-================
-### Improvements
-* issue: Auto-Assign Comments Var (c3171c3)
-* issue: List Item Properties On Mouseover (a6a7192)
-* issue: def_assn_role (6ad568f)
-* search: Child Thread Relation (08785f9)
-
-### Security
-* security: PwReset Username and Username Discoverability (e282910, 86165c2)
-* security: SSRF External Images (1c6f98e)
-* xss: Stored XSS/Domain Whitelist Bypass (4b4da5b)
-* security: Recipient Injection via User's Name (7c5c584)
-* xss: Advanced Search (4a8d3c8)
-* xss: Tasks (b01c6a2)
-
 osTicket v1.15.3.1
 ==================
 ### Improvements
@@ -107,6 +578,22 @@ osTicket v1.15.1
 * readme: Update PHP Version (a4c85d7)
 * placeholder: Quote and encode html chars (0056d14)
 
+osTicket v1.14.8
+================
+### Improvements
+* issue: Auto-Assign Comments Var (c3171c3)
+* issue: List Item Properties On Mouseover (a6a7192)
+* issue: def_assn_role (6ad568f)
+* search: Child Thread Relation (08785f9)
+
+### Security
+* security: PwReset Username and Username Discoverability (e282910, 86165c2)
+* security: SSRF External Images (1c6f98e)
+* xss: Stored XSS/Domain Whitelist Bypass (4b4da5b)
+* security: Recipient Injection via User's Name (7c5c584)
+* xss: Advanced Search (4a8d3c8)
+* xss: Tasks (b01c6a2)
+
 osTicket v1.14.7
 ================
 ### Enhancements

account.php

@@ -60,7 +60,7 @@ elseif ($_POST) {
         $_POST['email'] = $thisclient->getEmail();
     }
 
-    if (!$user_form->isValid(function($f) { return !$f->isVisibleToUsers(); }))
+    if (!$user_form->isValid(function($f) { return $f->isVisibleToUsers(); }))
         $errors['err'] = __('Incomplete client information');
     elseif (!$_POST['backend'] && !$_POST['passwd1'])
         $errors['passwd1'] = __('New password is required');
@@ -125,6 +125,8 @@ elseif ($_POST) {
             }
             break;
         }
+        // Rotate CSRF on successful POST
+        $ost->getCSRF()->rotate();
     }
 
     if ($errors && $user && $user != $thisclient)

ajax.php

@@ -48,5 +48,5 @@ $dispatcher = patterns('',
     ))
 );
 Signal::send('ajax.client', $dispatcher);
-print $dispatcher->resolve($ost->get_path_info());
+print $dispatcher->resolve(Osticket::get_path_info());
 ?>

api/api.inc.php

@@ -15,14 +15,20 @@
 **********************************************************************/
 file_exists('../main.inc.php') or die('System Error');
 
+/*
+ * Why API_SESSION ??
+ * It indicates that the session is API - which session handler should handle as
+ * stateless for new sessions.
+ * Existing session continue to work as expected - this it's important for
+ * SSO authentication, which uses /api/auth/* endpoints. Such calls are not
+ * stateless.
+ *
+ */
+define('API_SESSION', true);
+
 // APICALL const.
 define('APICALL', true);
 
-// Disable sessions for the API. API should be considered stateless and
-// shouldn't chew up database records to store sessions
-if (!defined('DISABLE_SESSION'))
-    define('DISABLE_SESSION', true);
-
 require_once('../main.inc.php');
 require_once(INCLUDE_DIR.'class.http.php');
 require_once(INCLUDE_DIR.'class.api.php');

api/http.php

@@ -13,15 +13,9 @@
 
     vim: expandtab sw=4 ts=4 sts=4:
 **********************************************************************/
-// Use sessions — it's important for SSO authentication, which uses
-// /api/auth/ext
-define('DISABLE_SESSION', false);
-
 require 'api.inc.php';
-
 # Include the main api urls
 require_once INCLUDE_DIR."class.dispatcher.php";
-
 $dispatcher = patterns('',
         url_post("^/tickets\.(?P<format>xml|json|email)$", array('api.tickets.php:TicketApiController','create')),
         url('^/tasks/', patterns('',
@@ -29,8 +23,8 @@ $dispatcher = patterns('',
          ))
         );
 
+// Send api signal so backend can register endpoints
 Signal::send('api', $dispatcher);
-
 # Call the respective function
-print $dispatcher->resolve($ost->get_path_info());
+print $dispatcher->resolve(Osticket::get_path_info());
 ?>

api/pipe.php

@@ -18,10 +18,10 @@ ini_set('memory_limit', '256M'); //The concern here is having enough mem for ema
 @chdir(dirname(__FILE__).'/'); //Change dir.
 require('api.inc.php');
 
-//Only local piping supported via pipe.php
+// Only local piping supported via pipe.php
 if (!osTicket::is_cli())
     die(__('pipe.php only supports local piping - use http -> api/tickets.email'));
 
 require_once(INCLUDE_DIR.'api.tickets.php');
-PipeApiController::process();
+PipeApiController::process('cli');
 ?>

apps/dispatcher.php

@@ -28,4 +28,4 @@ require_once INCLUDE_DIR.'/class.dispatcher.php';
 $dispatcher = new Dispatcher();
 
 Signal::send('ajax.client', $dispatcher);
-print $dispatcher->resolve($ost->get_path_info());
+print $dispatcher->resolve(Osticket::get_path_info());

bootstrap.php

@@ -21,9 +21,7 @@ class Bootstrap {
         session_cache_limiter('nocache');
 
         #Error reporting...Good idea to ENABLE error reporting to a file. i.e display_errors should be set to false
-        $error_reporting = E_ALL & ~E_NOTICE;
-        if (defined('E_STRICT')) # 5.4.0
-            $error_reporting &= ~E_STRICT;
+        $error_reporting = E_ALL & ~E_NOTICE & ~E_WARNING;
         if (defined('E_DEPRECATED')) # 5.3.0
             $error_reporting &= ~(E_DEPRECATED | E_USER_DEPRECATED);
         error_reporting($error_reporting); //Respect whatever is set in php.ini (sysadmin knows better??)
@@ -45,11 +43,29 @@ class Bootstrap {
         }
         date_default_timezone_set('UTC');
 
+        if (!function_exists('exif_imagetype')) {
+            function exif_imagetype ($filename) {
+                if ((list($width,$height,$type,) = getimagesize($filename)) !== false)
+                    return $type;
+
+                return false;
+            }
+        }
+
+        if (!function_exists('exif_imagetype')) {
+            function exif_imagetype ($filename) {
+                if ((list($width,$height,$type,) = getimagesize($filename)) !== false)
+                    return $type;
+
+                return false;
+            }
+        }
+
         if (!isset($_SERVER['REMOTE_ADDR']))
             $_SERVER['REMOTE_ADDR'] = '';
     }
 
-    function https() {
+    static function https() {
        return osTicket::is_https();
     }
 
@@ -125,6 +141,7 @@ class Bootstrap {
         define('SLA_TABLE', $prefix.'sla');
 
         define('EMAIL_TABLE',$prefix.'email');
+        define('EMAIL_ACCOUNT_TABLE', $prefix.'email_account');
         define('EMAIL_TEMPLATE_GRP_TABLE',$prefix.'email_template_group');
         define('EMAIL_TEMPLATE_TABLE',$prefix.'email_template');
 
@@ -133,6 +150,7 @@ class Bootstrap {
         define('FILTER_ACTION_TABLE', $prefix.'filter_action');
 
         define('PLUGIN_TABLE', $prefix.'plugin');
+        define('PLUGIN_INSTANCE_TABLE', $prefix.'plugin_instance');
         define('SEQUENCE_TABLE', $prefix.'sequence');
         define('TRANSLATION_TABLE', $prefix.'translation');
         define('QUEUE_TABLE', $prefix.'queue');
@@ -150,7 +168,7 @@ class Bootstrap {
         define('TIMEZONE_TABLE',$prefix.'timezone');
     }
 
-    function loadConfig() {
+    static function loadConfig() {
         #load config info
         $configfile='';
         if(file_exists(INCLUDE_DIR.'ost-config.php')) //NEW config file v 1.6 stable ++
@@ -180,7 +198,7 @@ class Bootstrap {
         define('SESSION_TTL', 86400); // Default 24 hours
     }
 
-    function connect() {
+    static function connect() {
         #Connect to the DB && get configuration from database
         $ferror=null;
         $options = array();
@@ -191,19 +209,29 @@ class Bootstrap {
                 'key' => DBSSLKEY
             );
 
-        if (!db_connect(DBHOST, DBUSER, DBPASS, $options)) {
-            $ferror=sprintf('Unable to connect to the database — %s',db_connect_error());
-        }elseif(!db_select_database(DBNAME)) {
-            $ferror=sprintf('Unknown or invalid database: %s',DBNAME);
+        $hosts = explode(',', DBHOST);
+        foreach ($hosts as $host) {
+            $ferror  = null;
+            try {
+                if (!db_connect($host, DBUSER, DBPASS, $options))
+                    $ferror = sprintf('Unable to connect to the database — %s', db_connect_error());
+                elseif (!db_select_database(DBNAME))
+                    $ferror = sprintf('Unknown or invalid database: %s', DBNAME);
+            } catch (mysqli_sql_exception $e) {
+                $ferror = sprintf('Database error — %s', $e->getMessage());
+            }
+            // break if no error
+            if (!$ferror) break;
         }
 
-        if($ferror) //Fatal error
+        if ($ferror) //Fatal error
             self::croak($ferror);
     }
 
-    function loadCode() {
+    static function loadCode() {
         #include required files
         require_once INCLUDE_DIR.'class.util.php';
+        include_once INCLUDE_DIR.'class.controller.php';
         require_once INCLUDE_DIR.'class.translation.php';
         require_once(INCLUDE_DIR.'class.signal.php');
         require(INCLUDE_DIR.'class.model.php');
@@ -214,14 +242,13 @@ class Bootstrap {
         require(INCLUDE_DIR.'class.crypto.php');
         require(INCLUDE_DIR.'class.page.php');
         require_once(INCLUDE_DIR.'class.format.php'); //format helpers
-        require_once(INCLUDE_DIR.'class.validator.php'); //Class to help with basic form input validation...please help improve it.
-        require(INCLUDE_DIR.'class.mailer.php');
+        require_once(INCLUDE_DIR.'class.validator.php');
         require_once INCLUDE_DIR.'mysqli.php';
         require_once INCLUDE_DIR.'class.i18n.php';
         require_once INCLUDE_DIR.'class.queue.php';
     }
 
-    function i18n_prep() {
+    static function i18n_prep() {
         ini_set('default_charset', 'utf-8');
         ini_set('output_encoding', 'utf-8');
 
@@ -310,10 +337,10 @@ class Bootstrap {
         }
     }
 
-    function croak($message) {
+    static function croak($message) {
         $msg = $message."\n\n".THISPAGE;
-        Mailer::sendmail(ADMIN_EMAIL, 'osTicket Fatal Error', $msg,
-            sprintf('"osTicket Alerts"<%s>', ADMIN_EMAIL));
+        osTicket\Mail\Mailer::sendmail(ADMIN_EMAIL, 'osTicket Fatal Error', $msg,
+            sprintf('"osTicket Alerts" <%s>', ADMIN_EMAIL));
         //Display generic error to the user
         Http::response(500, "<b>Fatal Error:</b> Contact system administrator.");
     }
@@ -340,7 +367,7 @@ define('CLI_DIR', INCLUDE_DIR.'cli/');
 
 #Current version && schema signature (Changes from version to version)
 define('GIT_VERSION','$git');
-define('MAJOR_VERSION', '1.15');
+define('MAJOR_VERSION', '1.18');
 define('THIS_VERSION', MAJOR_VERSION.'-git'); //Shown on admin panel
 //Path separator
 if(!defined('PATH_SEPARATOR')){
@@ -366,7 +393,7 @@ if (!defined('ROOT_PATH') && ($rp = osTicket::get_root_path(dirname(__file__))))
 Bootstrap::init();
 
 #CURRENT EXECUTING SCRIPT.
-define('THISPAGE', Misc::currentURL());
+define('THISPAGE', Http::url());
 
 define('DEFAULT_MAX_FILE_UPLOADS', ini_get('max_file_uploads') ?: 5);
 define('DEFAULT_PRIORITY_ID', 1);

client.inc.php

@@ -67,8 +67,9 @@ if($thisclient && $thisclient->getId() && $thisclient->isValid()){
 }
 
 /******* CSRF Protectin *************/
-// Enforce CSRF protection for POSTS
-if ($_POST  && !$ost->checkCSRFToken()) {
+// Enforce CSRF protection for state-changing methods
+if (in_array($_SERVER['REQUEST_METHOD'], ['POST', 'PUT', 'PATCH', 'DELETE'])
+        && !$ost->checkCSRFToken()) {
     Http::redirect('index.php');
     //just incase redirect fails
     die('Action denied (400)!');
@@ -79,6 +80,8 @@ $ost->addExtraHeader('<meta name="csrf_token" content="'.$ost->getCSRFToken().'"
 
 /* Client specific defaults */
 define('PAGE_LIMIT', DEFAULT_PAGE_LIMIT);
+define('SESSION_MAXLIFE', $thisclient ? $thisclient->getMaxIdleTime() :
+        SESSION_TTL);
 
 require(INCLUDE_DIR.'class.nav.php');
 $nav = new UserNav($thisclient, 'home');

css/flags.css

@@ -30,10 +30,10 @@
 .flag.flag-bi {background-position: -112px -11px}
 .flag.flag-bj {background-position: -128px -11px}
 .flag.flag-bm {background-position: -144px -11px}
-.flag.flag-bn {background-position: -160px -11px}
+.flag.flag-bn {background-position: -32px -11px}
 .flag.flag-bo {background-position: -176px -11px}
 .flag.flag-br {background-position: -192px -11px}
-.flag.flag-bs {background-position: -208px -11px}
+.flag.flag-bs {background-position: 0px -11px}
 .flag.flag-bt {background-position: -224px -11px}
 .flag.flag-bv {background-position: -240px -11px}
 .flag.flag-bw {background-position: 0 -22px}
@@ -122,8 +122,9 @@
 .flag.flag-kg {background-position: -48px -77px}
 .flag.flag-kh {background-position: -64px -77px}
 .flag.flag-ki {background-position: -80px -77px}
-.flag.flag-km {background-position: -96px -77px}
+.flag.flag-km {background-position: -64px -77px}
 .flag.flag-kn {background-position: -112px -77px}
+.flag.flag-ko {background-position: -144px -77px}
 .flag.flag-kp {background-position: -128px -77px}
 .flag.flag-kr {background-position: -144px -77px}
 .flag.flag-kurdistan {background-position: -160px -77px}
@@ -186,7 +187,7 @@
 .flag.flag-pm {background-position: -48px -121px}
 .flag.flag-pn {background-position: -64px -121px}
 .flag.flag-pr {background-position: -80px -121px}
-.flag.flag-ps {background-position: -96px -121px}
+.flag.flag-ps {background-position: -48px 0px}
 .flag.flag-pt {background-position: -112px -121px}
 .flag.flag-pw {background-position: -128px -121px}
 .flag.flag-py {background-position: -144px -121px}
@@ -211,6 +212,7 @@
 .flag.flag-sn {background-position: -192px -132px}
 .flag.flag-so {background-position: -208px -132px}
 .flag.flag-somaliland {background-position: -224px -132px}
+.flag.flag-sq {background-position: -96px 0px}
 .flag.flag-sr {background-position: -240px -132px}
 .flag.flag-ss {background-position: 0 -143px}
 .flag.flag-st {background-position: -16px -143px}
@@ -244,7 +246,7 @@
 .flag.flag-vc {background-position: -208px -154px}
 .flag.flag-ve {background-position: -224px -154px}
 .flag.flag-vg {background-position: -240px -154px}
-.flag.flag-vi {background-position: 0 -165px}
+.flag.flag-vi {background-position: -16px -165px}
 .flag.flag-vn {background-position: -16px -165px}
 .flag.flag-vu {background-position: -32px -165px}
 .flag.flag-wales {background-position: -48px -165px}
@@ -256,3 +258,5 @@
 .flag.flag-zanzibar {background-position: -144px -165px}
 .flag.flag-zm {background-position: -160px -165px}
 .flag.flag-zw {background-position: -176px -165px}
+.flag.flag-fil {background-position: 0px -121px}
+.flag.flag-kk {background-position: -208px -77px}

file.php

@@ -45,9 +45,8 @@ if ($cfg->isAuthRequiredForFiles()
         ) {
 
     // Try and determine if an agent is viewing the page / file
-    if (strpos($_SERVER['HTTP_REFERRER'], ROOT_PATH .  'scp/') !== false) {
-        $_SESSION['_staff']['auth']['dest'] =
-            '/' . ltrim($_SERVER['REQUEST_URI'], '/');
+    if (strpos($_SERVER['HTTP_REFERER'], ROOT_PATH .  'scp/') !== false) {
+        $_SESSION['_staff']['auth']['dest'] = Http::refresh_url();
         Http::redirect(ROOT_PATH.'scp/login.php');
     } else {
         require 'secure.inc.php';
@@ -59,7 +58,7 @@ if ($cfg->isAuthRequiredForFiles()
 // and the user has access to the parent ticket!!
 if ($file->verifySignature($_GET['signature'], $_GET['expires'])) {
     try {
-        if (($s = @$_GET['s']) && strpos($file->getType(), 'image/') === 0)
+        if (($s = @$_GET['s']) && $file->isInlineSafeImage())
             return $file->display($s);
 
         // Download the file..
@@ -68,7 +67,8 @@ if ($file->verifySignature($_GET['signature'], $_GET['expires'])) {
         $file->download($filename, $disposition, @$_GET['expires']);
     }
     catch (Exception $ex) {
-        Http::response(500, 'Unable to find that file: '.$ex->getMessage());
+        $ost->logError(__('File download error'), $ex->getMessage());
+        Http::response(500, __('Unable to retrieve the requested file'));
     }
 }
 // else

include/JSON.php

@@ -152,7 +152,7 @@ class Services_JSON
             return mb_convert_encoding($utf16, 'UTF-8', 'UTF-16');
         }
 
-        $bytes = (ord($utf16{0}) << 8) | ord($utf16{1});
+        $bytes = (ord($utf16[0]) << 8) | ord($utf16[1]);
 
         switch(true) {
             case ((0x7F & $bytes) == $bytes):
@@ -205,17 +205,17 @@ class Services_JSON
             case 2:
                 // return a UTF-16 character from a 2-byte UTF-8 char
                 // see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-                return chr(0x07 & (ord($utf8{0}) >> 2))
-                     . chr((0xC0 & (ord($utf8{0}) << 6))
-                         | (0x3F & ord($utf8{1})));
+                return chr(0x07 & (ord($utf8[0]) >> 2))
+                     . chr((0xC0 & (ord($utf8[0]) << 6))
+                         | (0x3F & ord($utf8[1])));
 
             case 3:
                 // return a UTF-16 character from a 3-byte UTF-8 char
                 // see: http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-                return chr((0xF0 & (ord($utf8{0}) << 4))
-                         | (0x0F & (ord($utf8{1}) >> 2)))
-                     . chr((0xC0 & (ord($utf8{1}) << 6))
-                         | (0x7F & ord($utf8{2})));
+                return chr((0xF0 & (ord($utf8[0]) << 4))
+                         | (0x0F & (ord($utf8[1]) >> 2)))
+                     . chr((0xC0 & (ord($utf8[1]) << 6))
+                         | (0x7F & ord($utf8[2])));
         }
 
         // ignoring UTF-32 for now, sorry
@@ -260,7 +260,7 @@ class Services_JSON
                 */
                 for ($c = 0; $c < $strlen_var; ++$c) {
 
-                    $ord_var_c = ord($var{$c});
+                    $ord_var_c = ord($var[$c]);
 
                     switch (true) {
                         case $ord_var_c == 0x08:
@@ -283,18 +283,18 @@ class Services_JSON
                         case $ord_var_c == 0x2F:
                         case $ord_var_c == 0x5C:
                             // double quote, slash, slosh
-                            $ascii .= '\\'.$var{$c};
+                            $ascii .= '\\'.$var[$c];
                             break;
 
                         case (($ord_var_c >= 0x20) && ($ord_var_c <= 0x7F)):
                             // characters U-00000000 - U-0000007F (same as ASCII)
-                            $ascii .= $var{$c};
+                            $ascii .= $var[$c];
                             break;
 
                         case (($ord_var_c & 0xE0) == 0xC0):
                             // characters U-00000080 - U-000007FF, mask 110XXXXX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
-                            $char = pack('C*', $ord_var_c, ord($var{$c + 1}));
+                            $char = pack('C*', $ord_var_c, ord($var[$c + 1]));
                             $c += 1;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -304,8 +304,8 @@ class Services_JSON
                             // characters U-00000800 - U-0000FFFF, mask 1110XXXX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]));
                             $c += 2;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -315,9 +315,9 @@ class Services_JSON
                             // characters U-00010000 - U-001FFFFF, mask 11110XXX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}),
-                                         ord($var{$c + 3}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]),
+                                         ord($var[$c + 3]));
                             $c += 3;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -327,10 +327,10 @@ class Services_JSON
                             // characters U-00200000 - U-03FFFFFF, mask 111110XX
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}),
-                                         ord($var{$c + 3}),
-                                         ord($var{$c + 4}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]),
+                                         ord($var[$c + 3]),
+                                         ord($var[$c + 4]));
                             $c += 4;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -340,11 +340,11 @@ class Services_JSON
                             // characters U-04000000 - U-7FFFFFFF, mask 1111110X
                             // see http://www.cl.cam.ac.uk/~mgk25/unicode.html#utf-8
                             $char = pack('C*', $ord_var_c,
-                                         ord($var{$c + 1}),
-                                         ord($var{$c + 2}),
-                                         ord($var{$c + 3}),
-                                         ord($var{$c + 4}),
-                                         ord($var{$c + 5}));
+                                         ord($var[$c + 1]),
+                                         ord($var[$c + 2]),
+                                         ord($var[$c + 3]),
+                                         ord($var[$c + 4]),
+                                         ord($var[$c + 5]));
                             $c += 5;
                             $utf16 = $this->utf82utf16($char);
                             $ascii .= sprintf('\u%04s', bin2hex($utf16));
@@ -519,7 +519,7 @@ class Services_JSON
                     for ($c = 0; $c < $strlen_chrs; ++$c) {
 
                         $substr_chrs_c_2 = substr($chrs, $c, 2);
-                        $ord_chrs_c = ord($chrs{$c});
+                        $ord_chrs_c = ord($chrs[$c]);
 
                         switch (true) {
                             case $substr_chrs_c_2 == '\b':
@@ -549,7 +549,7 @@ class Services_JSON
                             case $substr_chrs_c_2 == '\\/':
                                 if (($delim == '"' && $substr_chrs_c_2 != '\\\'') ||
                                    ($delim == "'" && $substr_chrs_c_2 != '\\"')) {
-                                    $utf8 .= $chrs{++$c};
+                                    $utf8 .= $chrs[++$c];
                                 }
                                 break;
 
@@ -562,7 +562,7 @@ class Services_JSON
                                 break;
 
                             case ($ord_chrs_c >= 0x20) && ($ord_chrs_c <= 0x7F):
-                                $utf8 .= $chrs{$c};
+                                $utf8 .= $chrs[$c];
                                 break;
 
                             case ($ord_chrs_c & 0xE0) == 0xC0:
@@ -609,7 +609,7 @@ class Services_JSON
                 } elseif (preg_match('/^\[.*\]$/s', $str) || preg_match('/^\{.*\}$/s', $str)) {
                     // array, or object notation
 
-                    if ($str{0} == '[') {
+                    if ($str[0] == '[') {
                         $stk = array(SERVICES_JSON_IN_ARR);
                         $arr = array();
                     } else {
@@ -648,12 +648,12 @@ class Services_JSON
                         $top = end($stk);
                         $substr_chrs_c_2 = substr($chrs, $c, 2);
 
-                        if (($c == $strlen_chrs) || (($chrs{$c} == ',') && ($top['what'] == SERVICES_JSON_SLICE))) {
+                        if (($c == $strlen_chrs) || (($chrs[$c] == ',') && ($top['what'] == SERVICES_JSON_SLICE))) {
                             // found a comma that is not inside a string, array, etc.,
                             // OR we've reached the end of the character list
                             $slice = substr($chrs, $top['where'], ($c - $top['where']));
                             array_push($stk, array('what' => SERVICES_JSON_SLICE, 'where' => ($c + 1), 'delim' => false));
-                            //print("Found split at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found split at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
                             if (reset($stk) == SERVICES_JSON_IN_ARR) {
                                 // we are in an array, so just push an element onto the stack
@@ -690,48 +690,48 @@ class Services_JSON
 
                             }
 
-                        } elseif ((($chrs{$c} == '"') || ($chrs{$c} == "'")) && ($top['what'] != SERVICES_JSON_IN_STR)) {
+                        } elseif ((($chrs[$c] == '"') || ($chrs[$c] == "'")) && ($top['what'] != SERVICES_JSON_IN_STR)) {
                             // found a quote, and we are not inside a string
-                            array_push($stk, array('what' => SERVICES_JSON_IN_STR, 'where' => $c, 'delim' => $chrs{$c}));
-                            //print("Found start of string at {$c}\n");
+                            array_push($stk, array('what' => SERVICES_JSON_IN_STR, 'where' => $c, 'delim' => $chrs[$c]));
+                            //print("Found start of string at [$c]\n");
 
-                        } elseif (($chrs{$c} == $top['delim']) &&
+                        } elseif (($chrs[$c] == $top['delim']) &&
                                  ($top['what'] == SERVICES_JSON_IN_STR) &&
                                  ((strlen(substr($chrs, 0, $c)) - strlen(rtrim(substr($chrs, 0, $c), '\\'))) % 2 != 1)) {
                             // found a quote, we're in a string, and it's not escaped
                             // we know that it's not escaped becase there is _not_ an
                             // odd number of backslashes at the end of the string so far
                             array_pop($stk);
-                            //print("Found end of string at {$c}: ".substr($chrs, $top['where'], (1 + 1 + $c - $top['where']))."\n");
+                            //print("Found end of string at [$c]: ".substr($chrs, $top['where'], (1 + 1 + $c - $top['where']))."\n");
 
-                        } elseif (($chrs{$c} == '[') &&
+                        } elseif (($chrs[$c] == '[') &&
                                  in_array($top['what'], array(SERVICES_JSON_SLICE, SERVICES_JSON_IN_ARR, SERVICES_JSON_IN_OBJ))) {
                             // found a left-bracket, and we are in an array, object, or slice
                             array_push($stk, array('what' => SERVICES_JSON_IN_ARR, 'where' => $c, 'delim' => false));
-                            //print("Found start of array at {$c}\n");
+                            //print("Found start of array at [$c]\n");
 
-                        } elseif (($chrs{$c} == ']') && ($top['what'] == SERVICES_JSON_IN_ARR)) {
+                        } elseif (($chrs[$c] == ']') && ($top['what'] == SERVICES_JSON_IN_ARR)) {
                             // found a right-bracket, and we're in an array
                             array_pop($stk);
-                            //print("Found end of array at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found end of array at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
-                        } elseif (($chrs{$c} == '{') &&
+                        } elseif (($chrs[$c] == '{') &&
                                  in_array($top['what'], array(SERVICES_JSON_SLICE, SERVICES_JSON_IN_ARR, SERVICES_JSON_IN_OBJ))) {
                             // found a left-brace, and we are in an array, object, or slice
                             array_push($stk, array('what' => SERVICES_JSON_IN_OBJ, 'where' => $c, 'delim' => false));
-                            //print("Found start of object at {$c}\n");
+                            //print("Found start of object at [$c]\n");
 
-                        } elseif (($chrs{$c} == '}') && ($top['what'] == SERVICES_JSON_IN_OBJ)) {
+                        } elseif (($chrs[$c] == '}') && ($top['what'] == SERVICES_JSON_IN_OBJ)) {
                             // found a right-brace, and we're in an object
                             array_pop($stk);
-                            //print("Found end of object at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found end of object at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
                         } elseif (($substr_chrs_c_2 == '/*') &&
                                  in_array($top['what'], array(SERVICES_JSON_SLICE, SERVICES_JSON_IN_ARR, SERVICES_JSON_IN_OBJ))) {
                             // found a comment start, and we are in an array, object, or slice
                             array_push($stk, array('what' => SERVICES_JSON_IN_CMT, 'where' => $c, 'delim' => false));
                             $c++;
-                            //print("Found start of comment at {$c}\n");
+                            //print("Found start of comment at [$c]\n");
 
                         } elseif (($substr_chrs_c_2 == '*/') && ($top['what'] == SERVICES_JSON_IN_CMT)) {
                             // found a comment end, and we're in one now
@@ -741,7 +741,7 @@ class Services_JSON
                             for ($i = $top['where']; $i <= $c; ++$i)
                                 $chrs = substr_replace($chrs, ' ', $i, 1);
 
-                            //print("Found end of comment at {$c}: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
+                            //print("Found end of comment at [$c]: ".substr($chrs, $top['where'], (1 + $c - $top['where']))."\n");
 
                         }
 
@@ -762,7 +762,7 @@ class Services_JSON
     /**
      * @todo Ultimately, this should just call PEAR::isError()
      */
-    function isError($data, $code = null)
+    static function isError($data, $code = null)
     {
         if (class_exists('pear')) {
             return PEAR::isError($data, $code);

include/Spyc.php

@@ -146,7 +146,7 @@ class Spyc {
      * @return array
      * @param string $input Path of YAML file or string containing YAML
      */
-  function YAMLLoad($input) {
+  static function YAMLLoad($input) {
     $Spyc = new Spyc;
     return $Spyc->__load($input);
   }

include/ajax.admin.php

@@ -48,7 +48,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Department");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -95,7 +95,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Team");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -139,7 +139,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Role");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add-role.tmpl.php';
     }
@@ -186,7 +186,7 @@ class AdminAjaxAPI extends AjaxController {
         }
 
         $title = __("Add New Agent");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -225,10 +225,12 @@ class AdminAjaxAPI extends AjaxController {
             Http::response(403, 'Access denied');
 
         $sort = new QueueSort();
+        $errors = array();
         if ($_POST) {
+            $_POST['root'] = $root;
             $data_form = $sort->getDataConfigForm($_POST);
             if ($data_form->isValid()) {
-                $sort->update($data_form->getClean() + $_POST, $root);
+                $sort->update($data_form->getClean() + $_POST, $errors);
                 if ($sort->save())
                     Http::response(201, $this->encode(array(
                         'id' => $sort->getId(),

include/ajax.content.php

@@ -19,7 +19,12 @@ require_once INCLUDE_DIR.'class.ajax.php';
 
 class ContentAjaxAPI extends AjaxController {
 
-    function log($id) {
+    function syslog($id) {
+        global $thisstaff;
+
+        // Ensure there is a Staff and that they are an Administrator
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
 
         if($id && ($log=Log::lookup($id))) {
             $content=sprintf('<div
@@ -27,7 +32,7 @@ class ContentAjaxAPI extends AjaxController {
                     style="white-space:pre-line;">%s</p>
                     <hr><strong>%s:</strong> <em>%s</em> <strong>%s:</strong> <em>%s</em></div>',
                     $log->getTitle(),
-                    Format::display(str_replace(',',', ',$log->getText())),
+                    Format::display(str_replace(',',', ',Format::htmlchars($log->getText()))),
                     __('Log Date'),
                     Format::daydatetime($log->getCreateDate()),
                     __('IP Address'),
@@ -142,8 +147,8 @@ class ContentAjaxAPI extends AjaxController {
     function manageContent($id, $lang=false) {
         global $thisstaff, $cfg;
 
-        if (!$thisstaff)
-            Http::response(403, 'Login Required');
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
 
         $content = Page::lookup($id, $lang);
 
@@ -168,8 +173,8 @@ class ContentAjaxAPI extends AjaxController {
     function manageNamedContent($type, $lang=false) {
         global $thisstaff, $cfg;
 
-        if (!$thisstaff)
-            Http::response(403, 'Login Required');
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
 
         $langs = $cfg->getSecondaryLanguages();
 
@@ -180,10 +185,10 @@ class ContentAjaxAPI extends AjaxController {
     }
 
     function updateContent($id) {
-        global $thisstaff;
+        global $thisstaff, $cfg;
 
-        if (!$thisstaff)
-            Http::response(403, 'Login Required');
+        if (!$thisstaff || !$thisstaff->isAdmin())
+            Http::response(403, 'Access Denied');
         elseif (!($content = Page::lookup($id)))
             Http::response(404, 'No such content');
 
@@ -201,6 +206,7 @@ class ContentAjaxAPI extends AjaxController {
         }
         if (!$errors['err'])
             $errors['err'] = __('Correct any errors below and try again.');
+        $langs = Internationalization::getConfiguredSystemLanguages();
         $info = $_POST;
         $errors = Format::htmlchars($errors);
         include STAFFINC_DIR . 'templates/content-manage.tmpl.php';

include/ajax.draft.php

@@ -3,10 +3,11 @@
 if(!defined('INCLUDE_DIR')) die('!');
 
 require_once(INCLUDE_DIR.'class.draft.php');
+require_once(INCLUDE_DIR.'class.file.php');
 
 class DraftAjaxAPI extends AjaxController {
 
-    function _createDraft($vars) {
+    static function _createDraft($vars) {
         if (false === ($vars['body'] = self::_findDraftBody($_POST)))
             return JsonDataEncoder::encode(array(
                 'error' => __("Draft body not found in request"),
@@ -22,7 +23,7 @@ class DraftAjaxAPI extends AjaxController {
         ));
     }
 
-    function _getDraft($draft) {
+    static function _getDraft($draft) {
         if (!$draft || !$draft instanceof Draft)
             Http::response(205, "Draft not found. Create one first");
 
@@ -35,7 +36,7 @@ class DraftAjaxAPI extends AjaxController {
         ));
     }
 
-    function _updateDraft($draft) {
+    static function _updateDraft($draft) {
         if (false === ($body = self::_findDraftBody($_POST)))
             return JsonDataEncoder::encode(array(
                 'error' => array(
@@ -50,81 +51,83 @@ class DraftAjaxAPI extends AjaxController {
         echo "{}";
     }
 
-    function _uploadInlineImage($draft) {
+    static function _uploadInlineImage($draft) {
         global $cfg;
 
-        if (!isset($_POST['data']) && !isset($_FILES['file']))
+        if (!isset($_FILES['file']))
             Http::response(422, "File not included properly");
 
         # Fixup for expected multiple attachments
-        if (isset($_FILES['file'])) {
-            $file = AttachmentFile::format($_FILES['file']);
+        $file = AttachmentFile::format($_FILES['file']);
 
-            # Allow for data-uri uploaded files
-            $fp = fopen($file[0]['tmp_name'], 'rb');
-            if (fread($fp, 5) == 'data:') {
-                $data = 'data:';
-                while ($block = fread($fp, 8192))
-                  $data .= $block;
-                $file[0] = Format::parseRfc2397($data);
-                list(,$ext) = explode('/', $file[0]['type'], 2);
-                $file[0] += array(
-                    'name' => Misc::randCode(8).'.'.$ext,
-                    'size' => strlen($file[0]['data']),
-                );
-            }
-            fclose($fp);
-
-            # TODO: Detect unacceptable attachment extension
-            # TODO: Verify content-type and check file-content to ensure image
-            $type = $file[0]['type'];
-            if (strpos($file[0]['type'], 'image/') !== 0)
-                return Http::response(403,
-                    JsonDataEncoder::encode(array(
-                        'error' => 'File type is not allowed',
-                    ))
-                );
-
-            # TODO: Verify file size is acceptable
-            if ($file[0]['size'] > $cfg->getMaxFileSize())
-                return Http::response(403,
-                    JsonDataEncoder::encode(array(
-                        'error' => 'File is too large',
-                    ))
-                );
-
-            // Paste uploads in Chrome will have a name of 'blob'
-            if ($file[0]['name'] == 'blob')
-                $file[0]['name'] = 'screenshot-'.Misc::randCode(4);
-
-            $ids = $draft->attachments->upload($file);
-
-            if (!$ids) {
-                if ($file[0]['error']) {
-                    return Http::response(403,
-                        JsonDataEncoder::encode(array(
-                            'error' => $file[0]['error'],
-                        ))
-                    );
-                }
-                else
-                    return Http::response(500, 'Unable to attach image');
-            }
-
-            $id = (is_array($ids)) ? $ids[0] : $ids;
-        }
-        else {
-            $type = explode('/', $_POST['contentType']);
-            $info = array(
-                'data' => base64_decode($_POST['data']),
-                'name' => Misc::randCode(10).'.'.$type[1],
-                // TODO: Ensure _POST['contentType']
-                'type' => $_POST['contentType'],
+        // Allow one file at a time.
+        if (count($file) > 1)
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'Send one file at a time',
+                ))
+            );
+
+        # Allow for data-uri uploaded files
+        $fp = fopen($file[0]['tmp_name'], 'rb');
+        if (fread($fp, 5) == 'data:') {
+            $data = 'data:';
+            while ($block = fread($fp, 8192))
+              $data .= $block;
+            $file[0] = Format::parseRfc2397($data);
+            list(,$ext) = explode('/', $file[0]['type'], 2);
+            $file[0] += array(
+                'name' => Misc::randCode(8).'.'.$ext,
+                'size' => strlen($file[0]['data']),
             );
-            // TODO: Detect unacceptable filetype
-            // TODO: Verify content-type and check file-content to ensure image
-            $id = $draft->attachments->save($info);
         }
+        fclose($fp);
+
+        // Check file type to ensure image
+        $type = $file[0]['type'];
+        if (!AttachmentFile::isInlineSafeImageType($file[0]['type']))
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'File type is not allowed',
+                ))
+            );
+
+        // Check if file is truly an image
+        if (!FileUploadField::isValidFile($file[0]))
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'File is not valid',
+                ))
+            );
+
+        // Verify file size is acceptable
+        if ($file[0]['size'] > $cfg->getMaxFileSize())
+            return Http::response(403,
+                JsonDataEncoder::encode(array(
+                    'error' => 'File is too large',
+                ))
+            );
+
+        // Paste uploads in Chrome will have a name of 'blob'
+        if ($file[0]['name'] == 'blob')
+            $file[0]['name'] = 'screenshot-'.Misc::randCode(4);
+
+        $ids = $draft->attachments->upload($file);
+
+        if (!$ids) {
+            if ($file[0]['error']) {
+                return Http::response(403,
+                    JsonDataEncoder::encode(array(
+                        'error' => $file[0]['error'],
+                    ))
+                );
+
+            }
+            else
+                return Http::response(500, 'Unable to attach image');
+        }
+
+        $id = (is_array($ids)) ? $ids[0] : $ids;
         if (!($f = AttachmentFile::lookup($id)))
             return Http::response(500, 'Unable to attach image');
 
@@ -240,6 +243,7 @@ class DraftAjaxAPI extends AjaxController {
 
         $draft = Draft::create(array(
             'namespace' => $namespace,
+            'body' => ''
         ));
         if (!$draft->save())
             Http::response(500, 'Unable to create draft');
@@ -310,7 +314,8 @@ class DraftAjaxAPI extends AjaxController {
             Http::response(403, "Login required for image upload");
 
         $draft = Draft::create(array(
-            'namespace' => $namespace
+            'namespace' => $namespace,
+            'body' => ''
         ));
         if (!$draft->save())
             Http::response(500, 'Unable to create draft');
@@ -363,6 +368,9 @@ class DraftAjaxAPI extends AjaxController {
 
         $files = array();
         foreach ($images as $f) {
+            if (!$f->isInlineSafeImage())
+                continue;
+
             $url = $f->getDownloadUrl();
             $files[] = array(
                 // Don't send special sizing for thread items 'cause they
@@ -376,7 +384,7 @@ class DraftAjaxAPI extends AjaxController {
         echo JsonDataEncoder::encode($files);
     }
 
-    function _findDraftBody($vars) {
+    static function _findDraftBody($vars) {
         if (isset($vars['name'])) {
             $parts = array();
             // Support nested `name`, like trans[lang]

include/ajax.email.php

@@ -0,0 +1,59 @@
+<?php
+require_once INCLUDE_DIR . 'class.email.php';
+class EmailAjaxAPI extends AjaxController {
+    function access() {
+        global $thisstaff;
+        if (!$thisstaff || !$thisstaff->isAdmin())
+             Http::response(403, 'Access Denied');
+        return true;
+    }
+
+    function stashFormData($id) {
+        if (!($email=Email::lookup($id)))
+            Http::response(404, 'Unknown Email');
+        $email->stashFormData($_POST ?: []);
+        Http::response(201, 'Form Stashed Maybe!');
+    }
+
+    function configureAuth($id, $type, $auth) {
+        if (!($email=Email::lookup($id)))
+            Http::response(404, 'Unknown Email');
+        if (!($account=$email->getAuthAccount($type)))
+            Http::response(404, 'Unknown Authentication Type');
+        if (!($form=$account->getAuthConfigForm($auth, $_POST ?: null)))
+             Http::response(404, 'Unknown Authentication Provider');
+        $info = $errors = [];
+        if ($_POST && $account->saveAuth($auth, $form, $errors)) {
+            if ($account->isOAuthAuth()
+                    && $account->shouldAuthorize()) {
+                 Http::response(201, JsonDataEncoder::encode([
+                             'redirect' => sprintf('emails.php?id=%d&do=autho&bk=%s',
+                                 $email->getId(), $account->getBkId())]),
+                         'application/json');
+            } else {
+                Http::response(201, __('Successfully Updated Credentials.'));
+            }
+        }
+        // Passible types are basic or oauth2
+        list($authtype, $provider) = explode(':', $auth);
+        $template = sprintf('email-%sauth.tmpl.php', $authtype);
+        include INCLUDE_DIR . "staff/templates/$template";
+    }
+
+    /*
+     * Delete the OAuth2 token
+     */
+    function deleteToken($id, $type) {
+        // Check to make sure the email exists
+        if (!($email=Email::lookup($id)))
+            Http::response(404, 'Unknown Email');
+        // Get the authentication account
+        if (!($account=$email->getAuthAccount($type)))
+            Http::response(404, 'Unknown Authentication Type');
+        // Destory the account config which will delete the token
+        if ($account->destroyConfig())
+            Http::response(201, __('Token Deleted Successfully.'));
+        // Couldn't delete the Token
+        Http::response(404, 'Unable to delete token.');
+    }
+}

include/ajax.kbase.php

@@ -85,7 +85,7 @@ class KbaseAjaxAPI extends AjaxController {
 
         $title = __("Manage FAQ Access");
         $verb = __('Update');
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }

include/ajax.note.php

@@ -13,6 +13,9 @@ class NoteAjaxAPI extends AjaxController {
             Http::response(403, "Login required");
         elseif (!($note = QuickNote::lookup($id)))
             Http::response(205, "Note not found");
+        elseif (($note->staff_id !== $thisstaff->getId())
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
 
         Http::response(200, $note->display());
     }
@@ -24,6 +27,9 @@ class NoteAjaxAPI extends AjaxController {
             Http::response(403, "Login required");
         elseif (!($note = QuickNote::lookup($id)))
             Http::response(205, "Note not found");
+        elseif (($note->staff_id !== $thisstaff->getId())
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
         elseif (!isset($_POST['note']) || !$_POST['note'])
             Http::response(422, "Send `note` parameter");
 
@@ -41,6 +47,9 @@ class NoteAjaxAPI extends AjaxController {
             Http::response(403, "Login required");
         elseif (!($note = QuickNote::lookup($id)))
             Http::response(205, "Note not found");
+        elseif (($note->staff_id !== $thisstaff->getId())
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
         elseif (!$note->delete())
             Http::response(500, "Unable to remove note");
 
@@ -52,6 +61,9 @@ class NoteAjaxAPI extends AjaxController {
 
         if (!$thisstaff)
             Http::response(403, "Login required");
+        elseif (!in_array(substr($ext_id, 0, 1), ['O', 'U'])
+                && !$thisstaff->isAdmin())
+            Http::response(403, "Access Denied");
         elseif (!isset($_POST['note']) || !$_POST['note'])
             Http::response(422, "Send `note` parameter");
 

include/ajax.orgs.php

@@ -30,7 +30,7 @@ class OrgsAjaxAPI extends AjaxController {
         if (!$_REQUEST['q'])
             return $this->json_encode(array());
 
-        $q = $_REQUEST['q'];
+        $q = Format::sanitize($_REQUEST['q']);
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
 
         if (strlen(Format::searchable($q)) < 3)
@@ -55,7 +55,7 @@ class OrgsAjaxAPI extends AjaxController {
         foreach ($orgs as $O) {
             list($id, $name) = $O;
             $matched[] = array('name' => Format::htmlchars($name), 'info' => $name,
-                'id' => $id, '/bin/true' => $_REQUEST['q']);
+                'id' => $id, '/bin/true' => Format::htmlchars($q));
         }
 
         return $this->json_encode(array_values($matched));

include/ajax.plugins.php

@@ -0,0 +1,62 @@
+<?php
+require_once(INCLUDE_DIR . 'class.plugin.php');
+
+class PluginsAjaxAPI extends AjaxController {
+
+    /*
+     * Protect all routines in this controller
+     */
+    function access() {
+        global $thisstaff;
+        if (!$thisstaff || !$thisstaff->isAdmin())
+             Http::response(403, 'Access Denied');
+
+        return true;
+    }
+
+    // helper func to look up plugin & instance
+    private function lookup($plugin_id, $instance_id=0) {
+        if (!($plugin = PluginManager::lookup( (int) $plugin_id)))
+            Http::response(404, 'No such plugin');
+
+        if ($instance_id && !($instance = $plugin->getInstance( (int) $instance_id)))
+            Http::response(404, 'No such plugin instance');
+
+        return [$plugin, $instance];
+    }
+
+    function getInstances($plugin_id) {
+        list($plugin,)= $this->lookup($plugin_id);
+        $pjax_container = '#items';
+        include(STAFFINC_DIR . 'templates/plugin-instances.tmpl.php');
+    }
+
+    function updateInstance($plugin_id, $instance_id) {
+        list($plugin, $instance) = $this->lookup($plugin_id, $instance_id);
+        $errors = array();
+        if ($_POST && $instance->update($_POST, $errors))
+            Http::response(201, $this->encode([
+                'redirect' => sprintf('plugins.php?id=%d#instances',
+                    $plugin->getId())
+            ]));
+        $form = $instance->getForm();
+        $action = "#plugins/{$plugin->getId()}/instances/{$instance->getId()}/update";
+        include STAFFINC_DIR . 'templates/plugin-instance-modal.tmpl.php';
+    }
+
+    function addInstance($plugin_id) {
+        list($plugin,) = $this->lookup($plugin_id);
+        $errors = array();
+        if ($_POST  && ($instance=$plugin->addInstance($_POST, $errors)))
+            Http::response(201, $this->encode([
+                'redirect' => sprintf('plugins.php?id=%d#instances',
+                    $plugin->getId())
+            ]));
+        // This should return cached form with errors (if any)
+        $form = $plugin->getConfigForm();
+        // Set action
+        $action = "#plugins/{$plugin->getId()}/instances/add";
+        include(STAFFINC_DIR . 'templates/plugin-instance-modal.tmpl.php');
+    }
+}
+?>

include/ajax.search.php

@@ -31,7 +31,7 @@ class SearchAjaxAPI extends AjaxController {
         $search = new AdhocSearch(array(
             'root' => 'T',
             'staff_id' => $thisstaff->getId(),
-            'parent_id' => @$_GET['parent_id'] ?: 0,
+            'parent_id' => (int) @$_GET['parent_id'] ?: 0,
         ));
         if ($search->parent_id) {
             $search->flags |= SavedSearch::FLAG_INHERIT_COLUMNS;
@@ -125,8 +125,9 @@ class SearchAjaxAPI extends AjaxController {
             // the recent search list
             if (isset($_SESSION[$key])) {
                 reset($_SESSION[$key]);
-                while (count($keep) < 5) {
-                    list($k, $v) = each($_SESSION[$key]);
+                for ($i = 0; $i < 5; $i++) {
+                    $k = key($_SESSION[$key]);
+                    $v = current($_SESSION[$key]);
                     if (!$k)
                         break;
                     $keep[$k] = $v;
@@ -167,7 +168,7 @@ class SearchAjaxAPI extends AjaxController {
                     'title' => __('Add Queue'),
                     'root' => 'T',
                     'staff_id' => $thisstaff->getId(),
-                    'parent_id' =>  $_GET['pid'],
+                    'parent_id' => (int) $_GET['pid'],
                     ));
         $this->_tryAgain($search);
     }
@@ -187,11 +188,16 @@ class SearchAjaxAPI extends AjaxController {
                         'root' => 'T',
                         'staff_id' => $thisstaff->getId()
                         ));
+            $new = true;
         }
 
         if (false === $this->_saveSearch($search))
             return;
 
+        //store saved search count when it is created
+        if ($new)
+            $search->counts($thisstaff, false);
+
         $info = array(
                 'msg' => sprintf('%s %s %s',
                     __('Search'),
@@ -345,17 +351,16 @@ class SearchAjaxAPI extends AjaxController {
     function addCondition() {
         global $thisstaff;
 
-        if (!$thisstaff) {
+        if (!$thisstaff)
             Http::response(403, 'Agent login is required');
-        }
         elseif (!isset($_GET['field']) || !isset($_GET['id'])
-            || !isset($_GET['object_id'])
-        ) {
+                || !isset($_GET['object_id']))
             Http::response(400, '`field`, `id`, and `object_id` parameters required');
-        }
-        elseif (!is_numeric($_GET['object_id'])) {
+        elseif (!is_numeric($_GET['object_id']))
             Http::response(400, '`object_id` should be an integer');
-        }
+        elseif (!is_numeric($_GET['id']))
+            Http::response(400, '`id` should be an integer');
+
         $fields = SavedSearch::getSearchableFields('Ticket');
         if (!isset($fields[$_GET['field']])) {
             Http::response(400, sprintf('%s: No such searchable field'),
@@ -381,8 +386,8 @@ class SearchAjaxAPI extends AjaxController {
             Http::response(400, '`prop` and `condition` parameters required');
         }
 
-        $prop = $_GET['prop'];
-        $id = $_GET['condition'];
+        $prop = Format::htmlchars($_GET['prop']);
+        $id = Format::htmlchars($_GET['condition']);
         include STAFFINC_DIR . 'templates/queue-column-condition-prop.tmpl.php';
     }
 

include/ajax.staff.php

@@ -66,7 +66,7 @@ class StaffAjaxAPI extends AjaxController {
 
       $title = __("Set Agent Password");
       $verb = $id == 0 ? __('Set') : __('Update');
-      $path = ltrim($ost->get_path_info(), '/');
+      $path = ltrim(Osticket::get_path_info(), '/');
 
       include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
   }
@@ -119,7 +119,7 @@ class StaffAjaxAPI extends AjaxController {
 
         $title = __("Change Password");
         $verb = __('Update');
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }
@@ -163,7 +163,7 @@ class StaffAjaxAPI extends AjaxController {
 
         $title = __("Reset Agent Permissions");
         $verb = __("Continue");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/reset-agent-permissions.tmpl.php';
     }
@@ -205,7 +205,7 @@ class StaffAjaxAPI extends AjaxController {
 
         $title = __("Change Primary Department");
         $verb = __("Continue");
-        $path = ltrim($ost->get_path_info(), '/');
+        $path = ltrim(Osticket::get_path_info(), '/');
 
         include STAFFINC_DIR . 'templates/quick-add.tmpl.php';
     }

include/ajax.tasks.php

@@ -59,10 +59,17 @@ class TasksAjaxAPI extends AjaxController {
     }
 
     function triggerThreadAction($task_id, $thread_id, $action) {
+        global $thisstaff;
+
+        if (!($task = Task::lookup($task_id))
+                || !$task->checkStaffPerm($thisstaff))
+            Http::response(404, 'No such task thread entry');
+
         $thread = ThreadEntry::lookup($thread_id);
         if (!$thread)
             Http::response(404, 'No such task thread entry');
-        if ($thread->getThread()->getObjectId() != $task_id)
+        if ($thread->getThread()->getObjectType() != 'A'
+                || $thread->getThread()->getObjectId() != $task_id)
             Http::response(404, 'No such task thread entry');
 
         $valid = false;
@@ -269,7 +276,7 @@ class TasksAjaxAPI extends AjaxController {
                         break;
                     default:
                         $clean =  $field->getClean();
-                        $clean = is_array($clean) ? implode($clean, ',') :
+                        $clean = is_array($clean) ? implode(',', $clean) :
                             (string) $clean;
                         if (strlen($clean) > 200)
                              $clean = Format::truncate($clean, 200);
@@ -451,7 +458,7 @@ class TasksAjaxAPI extends AjaxController {
         case 'transfer':
             $inc = 'transfer.tmpl.php';
             $info[':action'] = '#tasks/mass/transfer';
-            $info[':title'] = sprintf('Transfer %s',
+            $info[':title'] = sprintf(__('Transfer %s'),
                     _N('selected task', 'selected tasks', $count));
             $form = TransferForm::instantiate($_POST);
             $form->hideDisabled();

include/ajax.thread.php

@@ -189,7 +189,7 @@ class ThreadAjaxAPI extends AjaxController {
         return $resp;
     }
 
-    function _addcollaborator($thread, $user=null, $form=null, $type=null, $info=array()) {
+    static function _addcollaborator($thread, $user=null, $form=null, $type=null, $info=array()) {
         global $thisstaff;
 
         $info += array(
@@ -227,7 +227,7 @@ class ThreadAjaxAPI extends AjaxController {
 
 
 
-    function _collaborator($collaborator, $form=null, $info=array()) {
+    static function _collaborator($collaborator, $form=null, $info=array()) {
         global $thisstaff;
 
         $info += array('action' => sprintf('#thread/%d/collaborators/%d',
@@ -243,7 +243,7 @@ class ThreadAjaxAPI extends AjaxController {
         return $resp;
     }
 
-    function _collaborators($thread, $info=array()) {
+    static function _collaborators($thread, $info=array()) {
 
         ob_start();
         include(STAFFINC_DIR . 'templates/collaborators.tmpl.php');

include/ajax.tickets.php

@@ -23,7 +23,7 @@ include_once INCLUDE_DIR . 'class.thread_actions.php';
 
 class TicketsAjaxAPI extends AjaxController {
 
-    function lookup() {
+    function lookup($wildcard=false) {
         global $thisstaff;
 
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
@@ -53,15 +53,19 @@ class TicketsAjaxAPI extends AjaxController {
             return $this->encode(array());
 
         global $ost;
-        $hits = $ost->searcher->find($q, $hits, false);
+        $hits = $ost->searcher->find($q, $hits, false, ['boolean' => $wildcard]);
 
-        if (preg_match('/\d{2,}[^*]/', $q, $T = array())) {
+        $T = array();
+        if (preg_match('/\d{2,}[^*]/', $q, $T)) {
             $hits = $this->lookupByNumber($limit, $visibility, $hits);
         }
-        elseif (!count($hits) && preg_match('`\w$`u', $q)) {
+        elseif (preg_match('/(.*@.{2,})|(.{2,}@.*)/', $q, $T)) {
+            $hits = $this->lookupByEmail($limit, $visibility, $hits);
+        }
+        elseif (!$wildcard && !count($hits) && preg_match('`^[a-zA-Z0-9]+$`u', $q)) {
             // Do wild-card fulltext search
             $_REQUEST['q'] = $q.'*';
-            return $this->lookup();
+            return $this->lookup(true);
         }
 
         // TODO: Why not aggregate based on relationship?
@@ -144,6 +148,50 @@ class TicketsAjaxAPI extends AjaxController {
         return $this->json_encode($tickets);
     }
 
+    function lookupByEmail($limit=false, $visibility=false, $matches=false) {
+        global $thisstaff;
+
+        if (!$limit)
+            $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
+
+        $tickets=array();
+        // Bail out of query is empty
+        if (!$_REQUEST['q'])
+            return $this->json_encode($tickets);
+
+        $q = trim($_REQUEST['q']);
+
+        if (!$visibility)
+            $visibility = $thisstaff->getTicketsVisibility();
+
+        $hits = Ticket::objects()
+            ->values('user__default_email__address', 'cdata__subject', 'user__name', 'ticket_id', 'thread__id', 'flags')
+            ->annotate(array(
+                'number' => new SqlCode('null'),
+                'tickets' => SqlAggregate::COUNT('ticket_id', true),
+                'tasks' => SqlAggregate::COUNT('tasks__id', true),
+                'collaborators' => SqlAggregate::COUNT('thread__collaborators__id', true),
+                'entries' => SqlAggregate::COUNT('thread__entries__id', true),
+            ))
+            ->filter($visibility)
+            ->filter(array('user__default_email__address__contains' => $q))
+            ->order_by('user__default_email__address')
+            ->limit($limit);
+
+        if ($matches && is_a($matches, 'QuerySet'))
+            return $hits->union($matches);
+
+        foreach ($hits as $T) {
+            $count = $T['tickets'];
+            $email = $T['user__default_email__address'];
+            $tickets[$email] = array('email'=>$email, 'value'=>$email,
+                'info'=>"$email ($count)", 'matches'=>$_REQUEST['q']);
+        }
+        $tickets = array_values($tickets);
+
+        return $this->json_encode($tickets);
+    }
+
     function acquireLock($tid) {
         global $cfg, $thisstaff;
 
@@ -318,7 +366,7 @@ class TicketsAjaxAPI extends AjaxController {
         return self::_userlookup($user, null, $info);
     }
 
-    function _userlookup($user, $form, $info) {
+    static function _userlookup($user, $form, $info) {
         global $thisstaff;
 
         ob_start();
@@ -450,7 +498,7 @@ class TicketsAjaxAPI extends AjaxController {
         return self::_updateMerge($parent, $tickets, $info);
     }
 
-    private function _updateMerge($ticket, $tickets, $info) {
+    static private function _updateMerge($ticket, $tickets, $info) {
         include(STAFFINC_DIR . 'templates/merge-tickets.tmpl.php');
     }
 
@@ -688,7 +736,7 @@ class TicketsAjaxAPI extends AjaxController {
                         break;
                     default:
                         $clean =  $field->getClean();
-                        $clean = is_array($clean) ? implode($clean, ',') :
+                        $clean = is_array($clean) ? implode(',', $clean) :
                             (string) $clean;
                 }
 
@@ -729,6 +777,8 @@ class TicketsAjaxAPI extends AjaxController {
 
         if (!($ticket=Ticket::lookup($tid)))
             Http::response(404, __('No such ticket'));
+        elseif (!$ticket->checkStaffPerm($thisstaff))
+            Http::response(403, __('Permission denied'));
         elseif (!($field=$ticket->getField($fid)))
             Http::response(404, __('No such field'));
 
@@ -994,7 +1044,7 @@ class TicketsAjaxAPI extends AjaxController {
             foreach ($tickets as $ticket) {
                 list($ticket_id, $flags, $dept_id, $ticket_pid) = $ticket;
                 $mergeType = Ticket::getMergeTypeByFlag($flags);
-                $isParent = Ticket::isParent($flags);
+                $isParent = Ticket::isParentStatic($flags);
                 $role = $thisstaff->getRole($dept_id);
                 $hasPermission[] = $role->hasPerm($permission);
 
@@ -1086,6 +1136,7 @@ class TicketsAjaxAPI extends AjaxController {
 
                         $depts = $tickets->values_flat('dept_id');
                     }
+                    //agents in depts $thisstaff can access
                     $members = $thisstaff->getDeptAgents(array('available' => true));
 
                     if ($depts) {
@@ -1163,6 +1214,9 @@ class TicketsAjaxAPI extends AjaxController {
                 $f->configure('prompt', $prompt);
 
             if ($_POST && $form->isValid()) {
+                // we need to clear this relation so we can create a fresh
+                // query that will get roles for all depts this agent can access
+                unset($thisstaff->ht['dept_access']);
                 foreach ($_POST['tids'] as $tid) {
                     if (($t=Ticket::lookup($tid))
                             // Make sure the agent is allowed to
@@ -1185,7 +1239,7 @@ class TicketsAjaxAPI extends AjaxController {
         case 'transfer':
             $inc = 'transfer.tmpl.php';
             $info[':action'] = '#tickets/mass/transfer';
-            $info[':title'] = sprintf('Transfer %s',
+            $info[':title'] = sprintf(__('Transfer %s'),
                     _N('selected ticket', 'selected tickets', $count));
             $form = TransferForm::instantiate($_POST);
             $form->hideDisabled();
@@ -1650,10 +1704,17 @@ class TicketsAjaxAPI extends AjaxController {
     }
 
     function triggerThreadAction($ticket_id, $thread_id, $action) {
+        global $thisstaff;
+
+        if (!($ticket = Ticket::lookup($ticket_id))
+                || !$ticket->checkStaffPerm($thisstaff))
+            Http::response(404, 'No such ticket thread entry');
+
         $thread = ThreadEntry::lookup($thread_id);
         if (!$thread)
             Http::response(404, 'No such ticket thread entry');
-        if ($thread->getThread()->getObjectId() != $ticket_id)
+        if ($thread->getThread()->getObjectType() != 'T'
+                || $thread->getThread()->getObjectId() != $ticket_id)
             Http::response(404, 'No such ticket thread entry');
 
         $valid = false;
@@ -1670,7 +1731,7 @@ class TicketsAjaxAPI extends AjaxController {
         $thread->triggerAction($action);
     }
 
-    private function _changeSelectedTicketsStatus($state, $info=array(), $errors=array()) {
+    private static function _changeSelectedTicketsStatus($state, $info=array(), $errors=array()) {
 
         $count = $_REQUEST['count'] ?:
             ($_REQUEST['tids'] ?  count($_REQUEST['tids']) : 0);
@@ -1702,7 +1763,7 @@ class TicketsAjaxAPI extends AjaxController {
         return self::_changeStatus($state, $info, $errors);
     }
 
-    private function _changeTicketStatus($ticket, $state, $info=array(), $errors=array()) {
+    private static function _changeTicketStatus($ticket, $state, $info=array(), $errors=array()) {
 
         $verb = TicketStateField::getVerb($state);
 
@@ -1738,7 +1799,7 @@ class TicketsAjaxAPI extends AjaxController {
         return self::_changeStatus($state, $info, $errors);
     }
 
-    private function _changeStatus($state, $info=array(), $errors=array()) {
+    private static function _changeStatus($state, $info=array(), $errors=array()) {
 
         if ($info && isset($info['errors']))
             $errors = array_merge($errors, $info['errors']);
@@ -1983,7 +2044,7 @@ class TicketsAjaxAPI extends AjaxController {
             } else {
                 $filename = sprintf('%s Tickets-%s.csv',
                         $queue->getName(),
-                        strftime('%Y%m%d'));
+                        date('Ymd'));
             }
 
             try {

include/ajax.users.php

@@ -34,7 +34,7 @@ class UsersAjaxAPI extends AjaxController {
         if (!$_REQUEST['q'])
             return $this->json_encode($matches);
 
-        $q = $_REQUEST['q'];
+        $q = Format::sanitize($_REQUEST['q']);
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
         $users=array();
         $emails=array();
@@ -74,16 +74,18 @@ class UsersAjaxAPI extends AjaxController {
                     return $this->search($type, $fulltext);
                 }
             } else {
-                $filter = Q::any(array(
-                    'emails__address__contains' => $q,
-                    'name__contains' => $q,
-                    'org__name__contains' => $q,
-                    'account__username__contains' => $q,
-                ));
-                if (UserForm::getInstance()->getField('phone'))
-                    $filter->add(array('cdata__phone__contains' => $q));
-
-                $users->filter($filter);
+                $base = clone $users;
+                $users->filter(array('name__contains' => $q));
+                $users->union($base->copy()->filter(array(
+                                'org__name__contains' => $q)), false);
+                $users->union($base->copy()->filter(array(
+                                'emails__address__contains' => $q)),  false);
+                $users->union($base->copy()->filter(array(
+                                'account__username__contains' => $q)), false);
+                if (UserForm::getInstance()->getField('phone')) {
+                      $users->union($base->copy()->filter(array(
+                                'cdata__phone__contains' => $q)), false);
+                }
             }
 
             // Omit already-imported remote users
@@ -105,7 +107,7 @@ class UsersAjaxAPI extends AjaxController {
                 }
                 $name = Format::htmlchars(new UsersName($name));
                 $matches[] = array('email'=>$email, 'name'=>$name, 'info'=>"$email - $name",
-                    "id" => $id, "/bin/true" => $_REQUEST['q']);
+                    "id" => $id, "/bin/true" => $q);
             }
             usort($matches, function($a, $b) { return strcmp($a['name'], $b['name']); });
         }
@@ -119,7 +121,12 @@ class UsersAjaxAPI extends AjaxController {
 
         if(!$thisstaff)
             Http::response(403, 'Login Required');
-        elseif(!($user = User::lookup($id)))
+
+        if (!$thisstaff->hasPerm(User::PERM_DIRECTORY)
+                && !$thisstaff->hasPerm(User::PERM_EDIT))
+            Http::response(403, 'Permission Denied');
+
+        if(!($user = User::lookup($id)))
             Http::response(404, 'Unknown user');
 
         $info = array(
@@ -178,7 +185,7 @@ class UsersAjaxAPI extends AjaxController {
         include(STAFFINC_DIR . 'templates/user.tmpl.php');
     }
 
-    function register($id) {
+    static function register($id) {
         global $thisstaff;
 
         if (!$thisstaff)
@@ -273,6 +280,14 @@ class UsersAjaxAPI extends AjaxController {
     }
 
     function getUser($id=false) {
+        global $thisstaff;
+
+        if (!$thisstaff)
+            Http::response(403, 'Login Required');
+
+        if (!$thisstaff->hasPerm(User::PERM_DIRECTORY)
+                && !$thisstaff->hasPerm(User::PERM_EDIT))
+            Http::response(403, 'Permission Denied');
 
         if(($user=User::lookup(($id) ? $id : $_REQUEST['id'])))
            Http::response(201, $user->to_json(), 'application/json');
@@ -286,7 +301,7 @@ class UsersAjaxAPI extends AjaxController {
         return self::addUser();
     }
 
-    function addUser() {
+    static function addUser() {
         global $thisstaff;
 
         $info = array();
@@ -321,7 +336,7 @@ class UsersAjaxAPI extends AjaxController {
         elseif (!$bk || !$id)
             Http::response(422, 'Backend and user id required');
         elseif (!($backend = AuthenticationBackend::getSearchDirectoryBackend($bk))
-                || !($user_info = $backend->lookup($id)))
+                || !($user_info = $backend->lookup(html_entity_decode($id))))
             Http::response(404, 'User not found');
 
         $form = UserForm::getUserForm()->getForm($user_info);
@@ -420,6 +435,8 @@ class UsersAjaxAPI extends AjaxController {
             Http::response(403, 'Login Required');
         elseif (!($user = User::lookup($id)))
             Http::response(404, 'Unknown user');
+        elseif (!$thisstaff->hasPerm(User::PERM_EDIT))
+            Http::response(403, 'Access Denied');
 
         $info = array();
         $info['title'] = sprintf(__('Organization for %s'),
@@ -432,6 +449,9 @@ class UsersAjaxAPI extends AjaxController {
                 if (!($org = Organization::lookup($_POST['orgid'])))
                     $info['error'] = __('Unknown organization selected');
             } else { //Creating new org.
+                if (!$thisstaff->hasPerm(Organization::PERM_CREATE))
+                    Http::response(403, 'Permission Denied');
+
                 $form = OrganizationForm::getDefaultForm()->getForm($_POST);
                 if (!($org = Organization::fromForm($form)))
                     $info['error'] = __('Unable to create organization.')

include/api.cron.php

@@ -3,40 +3,45 @@
 include_once INCLUDE_DIR.'class.cron.php';
 
 class CronApiController extends ApiController {
-
     function execute() {
 
-        if(!($key=$this->requireApiKey()) || !$key->canExecuteCron())
+        if (!($key=$this->requireApiKey()) || !$key->canExecuteCron())
             return $this->exerr(401, __('API key not authorized'));
 
         $this->run();
     }
 
-    /* private */
-    function run() {
-        global $ost;
-
+    protected function run() {
         Cron::run();
-       
-        $ost->logDebug(__('Cron Job'),__('Cron job executed').' ['.$_SERVER['REMOTE_ADDR'].']');
+        // TODO: Add elapsed time to the debug log
+        $this->debug(__('Cron Job'),
+                sprintf('%s [%s]', __('Cron job executed'), $this->getRemoteAddr()));
         $this->response(200,'Completed');
     }
 }
 
 class LocalCronApiController extends CronApiController {
 
-    function response($code, $resp) {
+    public function isCli() {
+        return true;
+    }
 
-        if($code == 200) //Success - exit silently.
+    protected function getRemoteAddr() {
+        // Local Cron doesn't have IP Addr set
+        return 'CLI';
+    }
+
+    public function response($code, $response) {
+
+        if ($code == 200) //Success - exit silently.
             exit(0);
-        
-        //On error echo the response (error)
-        echo $resp;
+
+        echo $response;
         exit(1);
     }
-        
-    function call() {
-        $cron = new LocalCronApiController();
+
+    static function call() {
+        $cron = new LocalCronApiController('cli');
         $cron->run();
     }
 }

include/api.tickets.php

@@ -43,15 +43,22 @@ class TicketApiController extends ApiController {
             foreach ($form->getFields() as $field)
                 $supported[] = $field->get('name');
 
-        if(!strcasecmp($format, 'email')) {
-            $supported = array_merge($supported, array('header', 'mid',
-                'emailId', 'to-email-id', 'ticketId', 'reply-to', 'reply-to-name',
-                'in-reply-to', 'references', 'thread-type', 'system_emails',
-                'mailflags' => array('bounce', 'auto-reply', 'spam', 'viral'),
-                'recipients' => array('*' => array('name', 'email', 'source'))
-                ));
-
-            $supported['attachments']['*'][] = 'cid';
+        switch ($format) {
+            case 'email':
+                $supported = array_merge($supported, [
+                    'header', 'mid', 'emailId', 'to-email-id', 'ticketId', 'reply-to',
+                    'reply-to-name', 'in-reply-to', 'references', 'thread-type', 'system_emails',
+                    'mailflags' => ['bounce', 'auto-reply', 'spam', 'viral'],
+                    'recipients' => ['*' => ['name', 'email', 'source']]
+                ]);
+                $supported['attachments']['*'][] = 'cid';
+                break;
+            case 'json':
+            case 'xml':
+                $supported = array_merge($supported, [
+                    'duedate', 'slaId', 'staffId'
+                ]);
+                break;
         }
 
         return $supported;
@@ -78,7 +85,7 @@ class TicketApiController extends ApiController {
             $data['attachments'] = array();
 
         //Validate attachments: Do error checking... soft fail - set the error and pass on the request.
-        if ($data['attachments'] && is_array($data['attachments'])) {
+        if (isset($data['attachments']) && is_array($data['attachments'])) {
             foreach($data['attachments'] as &$file) {
                 if ($file['encoding'] && !strcasecmp($file['encoding'], 'base64')) {
                     if(!($file['data'] = base64_decode($file['data'], true)))
@@ -105,61 +112,84 @@ class TicketApiController extends ApiController {
 
     function create($format) {
 
-        if(!($key=$this->requireApiKey()) || !$key->canCreateTickets())
+        if (!($key=$this->requireApiKey()) || !$key->canCreateTickets())
             return $this->exerr(401, __('API key not authorized'));
 
         $ticket = null;
-        if(!strcasecmp($format, 'email')) {
-            # Handle remote piped emails - could be a reply...etc.
-            $ticket = $this->processEmail();
+        if (!strcasecmp($format, 'email')) {
+            // Process remotely piped emails - could be a reply...etc.
+            $ticket = $this->processEmailRequest();
         } else {
-            # Parse request body
+            // Get and Parse request body data for the format
             $ticket = $this->createTicket($this->getRequest($format));
         }
 
-        if(!$ticket)
-            return $this->exerr(500, __("Unable to create new ticket: unknown error"));
 
-        $this->response(201, $ticket->getNumber());
+
+        if ($ticket)
+            $this->response(201, $ticket->getNumber());
+        else
+            $this->exerr(500, _S("unknown error"));
+
     }
 
     /* private helper functions */
 
-    function createTicket($data) {
+    function createTicket($data, $source = 'API') {
 
         # Pull off some meta-data
         $alert       = (bool) (isset($data['alert'])       ? $data['alert']       : true);
         $autorespond = (bool) (isset($data['autorespond']) ? $data['autorespond'] : true);
 
-        # Assign default value to source if not defined, or defined as NULL
-        $data['source'] = isset($data['source']) ? $data['source'] : 'API';
+        // Assign default value to source if not defined, or defined as NULL
+        $data['source'] ??= $source;
 
-        # Create the ticket with the data (attempt to anyway)
+        // Create the ticket with the data (attempt to anyway)
         $errors = array();
+        if (($ticket = Ticket::create($data, $errors, $data['source'],
+                        $autorespond, $alert)) &&  !$errors)
+            return $ticket;
 
-        $ticket = Ticket::create($data, $errors, $data['source'], $autorespond, $alert);
-        # Return errors (?)
+        // Ticket create failed Bigly - got errors?
+        $title = null;
+        // Got errors?
         if (count($errors)) {
-            if(isset($errors['errno']) && $errors['errno'] == 403)
-                return $this->exerr(403, __('Ticket denied'));
-            else
-                return $this->exerr(
-                        400,
-                        __("Unable to create new ticket: validation errors").":\n"
-                        .Format::array_implode(": ", "\n", $errors)
-                        );
-        } elseif (!$ticket) {
-            return $this->exerr(500, __("Unable to create new ticket: unknown error"));
+            // Ticket denied? Say so loudly so it can standout from generic
+            // validation errors
+            if (isset($errors['errno']) && $errors['errno'] == 403) {
+                $title = _S('Ticket denied');
+                $error = sprintf("%s: %s\n\n%s",
+                        $title, $data['email'], $errors['err']);
+            } else {
+                // unpack the errors
+                $error = Format::array_implode("\n", "\n", $errors);
+            }
+        } else {
+            // unknown reason - default
+            $error = _S('unknown error');
         }
 
-        return $ticket;
+        $error = sprintf('%s :%s',
+                _S('Unable to create new ticket'), $error);
+        return $this->exerr($errors['errno'] ?: 500, $error, $title);
     }
 
-    function processEmail($data=false) {
+    function processEmailRequest() {
+        return $this->processEmail();
+    }
 
-        if (!$data)
-            $data = $this->getEmailRequest();
+    function processEmail($data=false, array $defaults = []) {
 
+        try {
+            if (!$data)
+                $data = $this->getEmailRequest();
+            elseif (!is_array($data))
+                $data = $this->parseEmail($data);
+        } catch (Exception $ex)  {
+            throw new EmailParseError($ex->getMessage());
+        }
+
+        $data = array_merge($defaults, $data);
         $seen = false;
         if (($entry = ThreadEntry::lookupByEmailHeaders($data, $seen))
             && ($message = $entry->postEmail($data))
@@ -183,18 +213,34 @@ class TicketApiController extends ApiController {
         // All emails which do not appear to be part of an existing thread
         // will always create new "Tickets". All other objects will need to
         // be created via the web interface or the API
-        return $this->createTicket($data);
+        try {
+            return $this->createTicket($data, 'Email');
+        } catch (TicketApiError $err) {
+            // Check if the ticket was denied by a filter or banlist
+            if ($err->isDenied() && $data['mid']) {
+                // We need to log the Message-Id (mid) so we don't
+                // process the same email again in subsequent fetches
+                $entry = new ThreadEntry();
+                $entry->logEmailHeaders(0, $data['mid']);
+                // throw TicketDenied exception so the caller can handle it
+                // accordingly
+                throw new TicketDenied($err->getMessage());
+            } else {
+                // otherwise rethrow this bad baby as it is!
+                throw $err;
+            }
+        }
     }
-
 }
 
 //Local email piping controller - no API key required!
 class PipeApiController extends TicketApiController {
 
-    //Overwrite grandparent's (ApiController) response method.
+    // Overwrite grandparent's (ApiController) response method.
     function response($code, $resp) {
 
-        //Use postfix exit codes - instead of HTTP
+        // It's important to use postfix exit codes for local piping instead
+        // of HTTP's so the piping script can process them accordingly
         switch($code) {
             case 201: //Success
                 $exitcode = 0;
@@ -219,19 +265,33 @@ class PipeApiController extends TicketApiController {
             default: //Temp (unknown) failure - retry
                 $exitcode = 75;
         }
-
-        //echo "$code ($exitcode):$resp";
         //We're simply exiting - MTA will take care of the rest based on exit code!
         exit($exitcode);
     }
 
-    function  process() {
-        $pipe = new PipeApiController();
-        if(($ticket=$pipe->processEmail()))
-           return $pipe->response(201, $ticket->getNumber());
+    static function process($sapi=null) {
+        $pipe = new PipeApiController($sapi);
+        if (($ticket=$pipe->processEmail()))
+           return $pipe->response(201,
+                   is_object($ticket) ? $ticket->getNumber() : $ticket);
 
         return $pipe->exerr(416, __('Request failed - retry again!'));
     }
+
+    static function local() {
+        return self::process('cli');
+    }
 }
 
+class TicketApiError extends Exception {
+
+    // Check if exception is because of denial
+    public function isDenied() {
+        return ($this->getCode() === 403);
+    }
+}
+
+class TicketDenied extends Exception {}
+class EmailParseError extends Exception {}
+
 ?>

include/class.2fa.php

@@ -3,17 +3,17 @@
 /**
  * TwoFactorAuthentication backend
  *
- * Provides the basis of abstracting 2fa backends 
+ * Provides the basis of abstracting 2fa backends
 
  * The authentication backend should define a validate() method which
  * receives a user and OPT.
  */
-abstract class TwoFactorAuthenticationBackend {
+abstract class TwoFactorAuthenticationBackend extends ServiceRegistry {
     // Global registry
     static protected $registry = array();
     // Grace period in minutes before OTP is expired and user logged out
     // It's hardcoded to 6 minutes here but downstream backends can make it
-    // configurable 
+    // configurable
     protected $timeout = 6;
 
     // Maximum number of validation attempts before the user is logged out
@@ -36,14 +36,6 @@ abstract class TwoFactorAuthenticationBackend {
     // validate OTP provided by user
     abstract function validate($form, $user);
 
-    function getId() {
-        return static::$id;
-    }
-
-    function getName() {
-        return __(static::$name);
-    }
-
     function getDescription() {
         return __(static::$desc);
     }
@@ -64,7 +56,7 @@ abstract class TwoFactorAuthenticationBackend {
         return array();
     }
 
-    // stash OTP info in the session 
+    // stash OTP info in the session
     protected function store($otp) {
        $store =  &$_SESSION['_2fa'][$this->getId()];
        $store = ['otp' => $otp, 'time' => time(), 'strikes' => 0];
@@ -76,12 +68,12 @@ abstract class TwoFactorAuthenticationBackend {
     protected function _validate($otp, $strict=true) {
         $store = &$_SESSION['_2fa'][$this->getId()];
         // Track and check the attempts
-        $store['strikes'] += 1;   
+        $store['strikes'] += 1;
         if ($strict && $store['strikes'] > $this->getMaxStrikes())
             throw new ExpiredOTP(__('Too many attempts'));
 
         // Check timeout - if expired throw an exception.
-        if ($strict 
+        if ($strict
                 && ($timeout=$this->getTimeout())
                 && ($store['time']+($timeout*60)) < time())
             throw new ExpiredOTP(__('Expired OTP'));
@@ -120,18 +112,11 @@ abstract class TwoFactorAuthenticationBackend {
                 || !($class instanceof TwoFactorAuthenticationBackend))
             return false;
 
-        return static::_register($class);
-    }
-
-    static function _register($class) {
-        if (isset(static::$registry[$class::$id]))
-            return false;
-
-        static::$registry[$class::$id] = $class;
+        static::$registry[$class->getBkId()] = $class;
     }
 
     static function allRegistered() {
-        return static::$registry;
+        return array_merge(self::$registry, parent::getRegistry());
     }
 
     static function getBackend($id) {
@@ -154,38 +139,19 @@ class ExpiredOTP extends Exception {}
  *
  */
 abstract class Staff2FABackend extends TwoFactorAuthenticationBackend {
-    static private $_registry = array();
-   
-    static function _register($class) {
-        if (isset(static::$_registry[$class::$id]))
-            return false;
-
-        static::$_registry[$class::$id] = $class;
-    }
-
+    static protected $registry = array();
     static function allRegistered() {
-        return array_merge(self::$_registry, parent::allRegistered());
+        return array_merge(self::$registry, parent::allRegistered());
     }
-
-
     abstract function send($user);
     abstract function validate($form, $user);
 }
 
 abstract class User2FABackend extends TwoFactorAuthenticationBackend {
-    static private $_registry = array();
-
-    static function _register($class) {
-        if (isset(static::$_registry[$class::$id]))
-            return false;
-
-        static::$_registry[$class::$id] = $class;
-    }
-
+    static protected $registry = array();
     static function allRegistered() {
-        return array_merge(self::$_registry, parent::allRegistered());
+        return array_merge(self::$registry, parent::allRegistered());
     }
-
     abstract function send($user);
     abstract function validate($form, $user);
 }
@@ -193,8 +159,8 @@ abstract class User2FABackend extends TwoFactorAuthenticationBackend {
 /*
  * Email2FABackend
  *
- * Email based two factor authentication. 
- * 
+ * Email based two factor authentication.
+ *
  * This is the default 2FA that works out of the box once users configure
  * it.
  *
@@ -219,7 +185,7 @@ class Email2FABackend extends TwoFactorAuthenticationBackend {
         return array(
             'token' => new TextboxField(array(
                 'id'=>1, 'label'=>__('Verification Code'), 'required'=>true, 'default'=>'',
-                'validator'=>'number', 
+                'validator'=>'number',
                 'hint'=>__('Please enter the code you were sent'),
                 'configuration'=>array(
                     'size'=>40, 'length'=>40,
@@ -234,7 +200,7 @@ class Email2FABackend extends TwoFactorAuthenticationBackend {
 
     function validate($form, $user) {
         // Make sure form is valid and token exists
-        if (!($form->isValid() 
+        if (!($form->isValid()
                     && ($clean=$form->getClean())
                     && $clean['token']))
             return false;

include/class.ajax.php

@@ -25,12 +25,18 @@ require_once (INCLUDE_DIR.'class.api.php');
  * consistency.
  */
 class AjaxController extends ApiController {
+
     function staffOnly() {
         global $thisstaff;
-        if(!$thisstaff || !$thisstaff->isValid()) {
-            Http::response(401,sprintf(__('Access Denied. IP %s'),$_SERVER['REMOTE_ADDR']));
+
+        if (!$thisstaff || !$thisstaff->isValid()) {
+            $this->exerr(401, sprintf('%s (%s)',
+                        __('Access Denied'), $_SERVER['REMOTE_ADDR']));
         }
+
+        return true;
     }
+
     /**
      * Convert a PHP array into a JSON-encoded string
      */
@@ -43,6 +49,6 @@ class AjaxController extends ApiController {
     }
 
     function get($var, $default=null) {
-        return (isset($_GET[$var])) ? $_GET[$var] : $default;
+        return $_GET[$var] ?: $default;
     }
 }

include/class.api.php

@@ -13,6 +13,8 @@
 
     vim: expandtab sw=4 ts=4 sts=4:
 **********************************************************************/
+include_once INCLUDE_DIR.'class.controller.php';
+
 class API {
 
     var $id;
@@ -91,15 +93,15 @@ class API {
     }
 
     /** Static functions **/
-    function add($vars, &$errors) {
+    static function add($vars, &$errors) {
         return API::save(0, $vars, $errors);
     }
 
-    function validate($key, $ip) {
+    static function validate($key, $ip) {
         return ($key && $ip && self::getIdByKey($key, $ip));
     }
 
-    function getIdByKey($key, $ip='') {
+    static function getIdByKey($key, $ip='') {
 
         $sql='SELECT id FROM '.API_KEY_TABLE.' WHERE apikey='.db_input($key);
         if($ip)
@@ -111,15 +113,15 @@ class API {
         return $id;
     }
 
-    function lookupByKey($key, $ip='') {
+    static function lookupByKey($key, $ip='') {
         return self::lookup(self::getIdByKey($key, $ip));
     }
 
-    function lookup($id) {
+    static function lookup($id) {
         return ($id && is_numeric($id) && ($k= new API($id)) && $k->getId()==$id)?$k:null;
     }
 
-    function save($id, $vars, &$errors) {
+    static function save($id, $vars, &$errors) {
 
         if(!$id && (!$vars['ipaddr'] || !Validator::is_ip($vars['ipaddr'])))
             $errors['ipaddr'] = __('Valid IP is required');
@@ -144,7 +146,7 @@ class API {
             $sql='INSERT INTO '.API_KEY_TABLE.' SET '.$sql
                 .',created=NOW() '
                 .',ipaddr='.db_input($vars['ipaddr'])
-                .',apikey='.db_input(strtoupper(md5(time().$vars['ipaddr'].md5(Misc::randCode(16)))));
+                .',apikey='.db_input(strtoupper(Misc::randCode(48, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')));
 
             if(db_query($sql) && ($id=db_insert_id()))
                 return $id;
@@ -165,28 +167,51 @@ class API {
  * API request.
  */
 
-class ApiController {
+class ApiController extends Controller {
 
-    var $apikey;
+    private $sapi;
+    private $key;
+
+    public function __construct($sapi = null) {
+        // Set API Interface the request is coming from
+        $this->sapi = $sapi ?: (osTicket::is_cli() ? 'cli' : 'http');
+    }
+
+    public function isCli() {
+        return (strcasecmp($this->sapi, 'cli') === 0);
+    }
+
+    private function getInputStream() {
+        return $this->isCli() ? 'php://stdin' : 'php://input';
+    }
+
+    protected function getRemoteAddr() {
+       return $_SERVER['REMOTE_ADDR'];
+    }
+
+    protected function getApiKey() {
+        return $_SERVER['HTTP_X_API_KEY'];
+    }
 
     function requireApiKey() {
-        # Validate the API key -- required to be sent via the X-API-Key
-        # header
-
-        if(!($key=$this->getApiKey()))
+        // Require a valid API key sent as X-API-Key HTTP header
+        // see getApiKey method.
+        if (!($key=$this->getKey()))
             return $this->exerr(401, __('Valid API key required'));
-        elseif (!$key->isActive() || $key->getIPAddr()!=$_SERVER['REMOTE_ADDR'])
+        elseif (!$key->isActive() || $key->getIPAddr() != $this->getRemoteAddr())
             return $this->exerr(401, __('API key not found/active or source IP not authorized'));
 
         return $key;
     }
 
-    function getApiKey() {
+    function getKey() {
+        // Lookup record using sent API Key && IP Addr
+        if (!$this->key
+                && ($key=$this->getApiKey())
+                && ($ip=$this->getRemoteAddr()))
+            $this->key = API::lookupByKey($key, $ip);
 
-        if (!$this->apikey && isset($_SERVER['HTTP_X_API_KEY']) && isset($_SERVER['REMOTE_ADDR']))
-            $this->apikey = API::lookupByKey($_SERVER['HTTP_X_API_KEY'], $_SERVER['REMOTE_ADDR']);
-
-        return $this->apikey;
+        return $this->key;
     }
 
     /**
@@ -194,20 +219,28 @@ class ApiController {
      * hashtable. For JSON formats, this is mostly a noop, the conversion
      * work will be done for XML requests
      */
-    function getRequest($format) {
-        global $ost;
-
-        $input = osTicket::is_cli()?'php://stdin':'php://input';
-
+    function getRequest($format, $validate=true) {
+        $input = $this->getInputStream();
         if (!($stream = @fopen($input, 'r')))
-            $this->exerr(400, __("Unable to read request body"));
+            $this->exerr(400, sprintf('%s (%s)',
+                        __("Unable to read request body"), $input));
 
+        return $this->parseRequest($stream, $format, $validate);
+    }
+
+    function getEmailRequest() {
+        if (!($data=$this->getRequest('email', false)))
+            $this->exerr(400, __("Unable to read email request"));
+
+        return $data;
+    }
+
+    function parseRequest($stream, $format, $validate=true) {
         $parser = null;
         switch(strtolower($format)) {
             case 'xml':
                 if (!function_exists('xml_parser_create'))
-                    $this->exerr(501, __('XML extension not supported'));
-
+                    return $this->exerr(501, __('XML extension not supported'));
                 $parser = new ApiXmlDataParser();
                 break;
             case 'json':
@@ -217,23 +250,24 @@ class ApiController {
                 $parser = new ApiEmailDataParser();
                 break;
             default:
-                $this->exerr(415, __('Unsupported data format'));
+                return $this->exerr(415, __('Unsupported data format'));
         }
 
-        if (!($data = $parser->parse($stream)))
+        if (!($data = $parser->parse($stream)) || !is_array($data)) {
             $this->exerr(400, $parser->lastError());
+        }
 
         //Validate structure of the request.
-        $this->validate($data, $format, false);
+        if ($validate && $data)
+            $this->validate($data, $format, false);
 
         return $data;
     }
 
-    function getEmailRequest() {
-        return $this->getRequest('email');
+    function parseEmail($content) {
+        return $this->parseRequest($content, 'email', false);
     }
 
-
     /**
      * Structure to validate the request against -- must be overridden to be
      * useful
@@ -257,14 +291,11 @@ class ApiController {
             } elseif (in_array($key, $structure)) {
                 continue;
             }
-            if ($strict)
-                return $this->exerr(400, sprintf(__("%s: Unexpected data received in API request"), "$prefix$key"));
-            else
-                $ost->logWarning(__('API Unexpected Data'),
-                    sprintf(__("%s: Unexpected data received in API request"), "$prefix$key"),
-                    false);
-        }
 
+            $error = sprintf(__("%s: Unexpected data received in API request"),
+                    "$prefix$key");
+            $this->onError(400, $error, __('Unexpected Data'), !$strict);
+        }
         return true;
     }
 
@@ -280,37 +311,66 @@ class ApiController {
                 $strict);
     }
 
+    protected function debug($subj, $msg) {
+        return $this->log($subj, $msg, LOG_DEBUG);
+    }
+
+    protected function logError($subj, $msg, $fatal=false) {
+        // If error is not fatal then log it as a warning
+        return $this->log($subj, $msg, $fatal ? LOG_ERR : LOG_WARN);
+    }
+
+    protected function log($title, $msg, $level = LOG_WARN) {
+        global $ost;
+        switch ($level) {
+            case LOG_WARN:
+            case LOG_ERR:
+                // We are disabling email alerts on API errors / warnings
+                // due to potential abuse or loops that might cause email DOS
+                $ost->log($level, $title, $msg, false);
+                break;
+            case  LOG_DEBUG:
+            default:
+                $ost->logDebug($title, $msg);
+        }
+        return true;
+    }
+
     /**
      * API error & logging and response!
      *
+     * final - don not override downstream.
      */
+    final public function onError($code, $error, $title = null,
+            $logOnly = false) {
 
-    /* If possible - DO NOT - overwrite the method downstream */
-    function exerr($code, $error='') {
-        global $ost;
-
-        if($error && is_array($error))
+        // Unpack the errors to string if error is an array
+        if ($error && is_array($error))
             $error = Format::array_implode(": ", "\n", $error);
 
-        //Log the error as a warning - include api key if available.
+        // Log the error
         $msg = $error;
-        if($_SERVER['HTTP_X_API_KEY'])
-            $msg.="\n*[".$_SERVER['HTTP_X_API_KEY']."]*\n";
-        $ost->logWarning(__('API Error')." ($code)", $msg, false);
+        // TODO: Only include API Key when in debug mode to avoid
+        // potentialialy leaking a valid key in system logs
+        if (($key=$this->getApiKey()))
+            $msg .= sprintf("\n[%s]\n", Format::shroud($key, 8, 16));
 
-        if (PHP_SAPI == 'cli') {
-            fwrite(STDERR, "({$code}) $error\n");
-        }
-        else {
-            $this->response($code, $error); //Responder should exit...
-        }
-        return false;
-    }
+        $title = sprintf('%s (%s)', $title ?: __('API Error'), $code);
+        $this->logError($title, $msg, $logOnly);
 
-    //Default response method - can be overwritten in subclasses.
-    function response($code, $resp) {
-        Http::response($code, $resp);
-        exit();
+        // If the error is not deemed fatal then simply return
+        if ($logOnly)
+            return;
+
+        // If the API Interface is CLI then throw a TicketApiError exception
+        // so the caller can handle the error gracefully.
+        // Note that we set the error code as well
+        if ($this->isCli())
+            throw new TicketApiError($error, $code);
+
+        // Respond and exit since HTTP endpoint requests
+        // are considered stateless
+        $this->response($code, $error);
     }
 }
 
@@ -327,8 +387,8 @@ class ApiXmlDataParser extends XmlDataParser {
     function fixup($current) {
         global $cfg;
 
-		if($current['ticket'])
-			$current = $current['ticket'];
+        if (isset($current['ticket']))
+            $current = $current['ticket'];
 
         if (!is_array($current))
             return $current;
@@ -381,10 +441,10 @@ class ApiXmlDataParser extends XmlDataParser {
 
 include_once "class.json.php";
 class ApiJsonDataParser extends JsonDataParser {
-    function parse($stream, $tidy=false) {
-        return $this->fixup(parent::parse($stream));
+    static function parse($stream, $tidy=false) {
+        return self::fixup(parent::parse($stream));
     }
-    function fixup($current) {
+    static function fixup($current) {
         if (!is_array($current))
             return $current;
         foreach ($current as $key=>&$value) {
@@ -434,17 +494,17 @@ class ApiEmailDataParser extends EmailDataParser {
     function fixup($data) {
         global $cfg;
 
-        if(!$data) return $data;
+        if (!$data) return $data;
 
         $data['source'] = 'Email';
 
-        if(!$data['subject'])
+        if (!$data['subject'])
             $data['subject'] = '[No Subject]';
 
-        if(!$data['emailId'])
+        if (!$data['emailId'])
             $data['emailId'] = $cfg->getDefaultEmailId();
 
-        if(!$cfg->useEmailPriority())
+        if( !$cfg->useEmailPriority())
             unset($data['priorityId']);
 
         return $data;

include/class.app.php

@@ -28,7 +28,7 @@ class Application {
             array('desc'=>$desc, 'href'=>$href));
     }
 
-    function getStaffApps() {
+    static function getStaffApps() {
         return self::$staff_apps;
     }
 
@@ -37,7 +37,7 @@ class Application {
             array('desc'=>$desc, 'href'=>$href));
     }
 
-    function getClientApps() {
+    static function getClientApps() {
         return self::$client_apps;
     }
 
@@ -46,7 +46,7 @@ class Application {
             array('desc'=>$desc, 'href'=>$href));
     }
 
-    function getAdminApps() {
+    static function getAdminApps() {
         return self::$admin_apps;
     }
 }

include/class.attachment.php

@@ -120,10 +120,11 @@ extends InstrumentedList {
         }
         $attachments = array();
         // Format $new for upload() with new name
-        foreach ($ids as $id=>$name) {
+        foreach ($ids as $id=>$value) {
+            if (is_array($value)) list('id' => $id, 'name' => $value) = $value;
             $attachments[] = array(
                     'id' => $id,
-                    'name' => $name
+                    'name' => $value
                 );
         }
         // Everything remaining in $attachments is truly new
@@ -191,7 +192,7 @@ extends InstrumentedList {
     function getInlines($lang=false) { return $this->_getList(false, true, $lang); }
     function getSeparates($lang=false) { return $this->_getList(true, false, $lang); }
     function getAll($lang=false) { return $this->_getList(true, true, $lang); }
-    function count($lang=false) { return count($this->getSeparates($lang)); }
+    function count($lang=false): int { return count($this->getSeparates($lang)); }
 
     function _getList($separates=false, $inlines=false, $lang=false) {
         $base = $this;

include/class.auth.php

@@ -134,7 +134,7 @@ class ClientCreateRequest {
     function attemptAutoRegister() {
         global $cfg;
 
-        if (!$cfg || !$cfg->isClientRegistrationEnabled())
+        if (!$cfg || $cfg->isClientRegistrationMode(['disabled']))
             return false;
 
         // Attempt to automatically register
@@ -146,7 +146,7 @@ class ClientCreateRequest {
         );
         if ($bk->supportsInteractiveAuthentication())
             // User can only be authenticated against this backend
-            $defaults['backend'] = $bk::$id;
+            $defaults['backend'] = $bk->getBkId();
         if ($this_form->isValid(function($f) { return !$f->isVisibleToUsers(); })
                 && ($U = User::fromVars($this_form->getClean()))
                 && ($acct = ClientAccount::createForUser($U, $defaults))
@@ -159,6 +159,78 @@ class ClientCreateRequest {
     }
 }
 
+
+/**
+ * Authorization backend
+ *
+ * Abstract service registry to provide authorization backends.
+ */
+abstract class OAuth2Backend extends ServiceRegistry {
+    static $name;
+    static $id;
+    protected  $config;
+
+    static function register($bk) {
+        if (is_string($bk) && class_exists($bk))
+            $bk = new $bk();
+
+        if (!is_object($bk)
+                || !($bk instanceof OAuth2Backend))
+            return false;
+
+        static::$registry[$bk->getBkId()] = $bk;
+    }
+
+    static function allRegistered() {
+        return self::getRegistry();
+    }
+
+    static function getBackend($id) {
+        if ($id && ($registry = static::allRegistered())
+                && isset($registry[$id]))
+            return $registry[$id];
+    }
+}
+
+abstract class OAuth2AuthorizationBackend  extends OAuth2Backend {
+    static protected $registry = array();
+
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::allRegistered());
+    }
+
+    static function getBackend($id) {
+        if (($bk=parent::getBackend($id)))
+            return $bk;
+
+        // Overloaded backend load.
+        list($auth, $a, $i) = self::parseId($id);
+        if ($auth && ($bk=parent::getBackend($auth)))
+            return $bk;
+    }
+
+    static function parseId($id) {
+        return  preg_split('/(?(?<=oauth2):(?!\w+)|:)/', $id);
+    }
+
+    abstract function getConfigForm($configId);
+    abstract function triggerEmailAuth($id);
+    abstract function callback($resp, $ref);
+}
+
+abstract class OAuth2AuthenticationBackend  extends OAuth2Backend {
+    static protected $registry = array();
+
+    static function allRegistered() {
+        return array_merge(self::$registry, parent::allRegistered());
+    }
+
+    static function getBackend($id) {
+        if (($bk=parent::getBackend($id)))
+            return $bk;
+    }
+}
+
 /**
  * Authentication backend
  *
@@ -174,41 +246,61 @@ class ClientCreateRequest {
  * receives a username and optional password. If the authentication
  * succeeds, an instance deriving from <User> should be returned.
  */
-abstract class AuthenticationBackend {
-    static protected $registry = array();
+abstract class AuthenticationBackend extends ServiceRegistry {
     static $name;
     static $id;
+    protected  $config;
 
+    static function register($bk) {
+        if (is_string($bk) && class_exists($bk))
+            $bk = new $bk();
 
-    /* static */
-    static function register($class) {
-        if (is_string($class) && class_exists($class))
-            $class = new $class();
-
-        if (!is_object($class)
-                || !($class instanceof AuthenticationBackend))
+        if (!is_object($bk)
+                || !($bk instanceof AuthenticationBackend))
             return false;
 
-        return static::_register($class);
-    }
-
-    static function _register($class) {
-        // XXX: Raise error if $class::id is already in the registry
-        static::$registry[$class::$id] = $class;
+        static::$registry[$bk->getBkId()] = $bk;
     }
 
     static function allRegistered() {
-        return static::$registry;
+        return self::getRegistry();
+    }
+
+    static function getInteractive() {
+        $backends = [];
+        foreach (static::allRegistered() as $bk)
+            if ($bk->isInteractive())
+                $backends[] = $bk;
+        return $backends;
+    }
+
+    static function getExternal() {
+        $backends = [];
+        foreach (static::allRegistered() as $bk)
+            if ($bk->isExternal())
+                $backends[] = $bk;
+        return $backends;
     }
 
     static function getBackend($id) {
-
         if ($id
                 && ($backends = static::allRegistered())
                 && isset($backends[$id]))
             return $backends[$id];
     }
 
+    static function lookupBackend($id, $class=null) {
+        // Lookup both registries
+        if (!($bk = StaffAuthenticationBackend::getBackend($id)))
+            $bk = UserAuthenticationBackend::getBackend($id);
+
+        // See if specific type is requesred.
+        if ($class && !($bk instanceof $class))
+            return null;
+
+        return $bk;
+    }
+
     static function getSearchDirectoryBackend($id) {
 
         if ($id
@@ -238,7 +330,7 @@ abstract class AuthenticationBackend {
         foreach (static::allRegistered() as $bk) {
             if ($backends //Allowed backends
                     && $bk->supportsInteractiveAuthentication()
-                    && !in_array($bk::$id, $backends))
+                    && !in_array($bk->getBkId(), $backends))
                 // User cannot be authenticated against this backend
                 continue;
 
@@ -280,7 +372,7 @@ abstract class AuthenticationBackend {
      * $forcedAuth - indicate if authentication is required.
      *
      */
-    function processSignOn(&$errors, $forcedAuth=true) {
+    static function processSignOn(&$errors, $forcedAuth=true) {
 
         foreach (static::allRegistered() as $bk) {
             // All backends are queried here, even if they don't support
@@ -321,13 +413,13 @@ abstract class AuthenticationBackend {
         $backends = array();
         foreach (StaffAuthenticationBackend::allRegistered() as $bk)
             if ($bk instanceof AuthDirectorySearch)
-                $backends[$bk::$id] = $bk;
+                $backends[$bk->getBkId()] = $bk;
 
         foreach (UserAuthenticationBackend::allRegistered() as $bk)
             if ($bk instanceof AuthDirectorySearch)
-                $backends[$bk::$id] = $bk;
+                $backends[$bk->getBkId()] = $bk;
 
-        return array_unique($backends);
+        return array_unique($backends, SORT_REGULAR);
     }
 
     static function searchUsers($query) {
@@ -338,13 +430,6 @@ abstract class AuthenticationBackend {
         return $users;
     }
 
-    /**
-     * Fetches the friendly name of the backend
-     */
-    function getName() {
-        return static::$name;
-    }
-
     /**
      * Indicates if the backed supports authentication. Useful if the
      * backend is used for logging or lockout only
@@ -353,6 +438,21 @@ abstract class AuthenticationBackend {
         return true;
     }
 
+    /**
+     * Alias for supportsInteractiveAuthentication()
+     *
+     */
+    function isInteractive() {
+        return $this->supportsInteractiveAuthentication();
+    }
+
+    /**
+     * Indicates of the backend is External Authentication
+     */
+    function isExternal() {
+        return ($this instanceof ExternalAuthentication);
+    }
+
     /**
      * Indicates if the backend supports changing a user's password. This
      * would be done in two fashions. Either the currently-logged in user
@@ -437,7 +537,7 @@ abstract class AuthenticationBackend {
     abstract function authenticate($username, $password);
     abstract function login($user, $bk);
     abstract static function getUser(); //Validates  authenticated users.
-    abstract function getAllowedBackends($userid);
+    abstract static function getAllowedBackends($userid);
     abstract protected function getAuthKey($user);
     abstract static function signOut($user);
 }
@@ -478,23 +578,18 @@ interface ExternalAuthentication {
 }
 
 abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
-
-    static private $_registry = array();
-
-    static function _register($class) {
-        static::$_registry[$class::$id] = $class;
-    }
+    static protected $registry = array();
 
     static function allRegistered() {
-        return array_merge(self::$_registry, parent::allRegistered());
+        return array_merge(self::$registry, parent::allRegistered());
     }
 
-    function isBackendAllowed($staff, $bk) {
+    static function isBackendAllowed($staff, $bk) {
 
         if (!($backends=self::getAllowedBackends($staff->getId())))
             return true;  //No restrictions
 
-        return in_array($bk::$id, array_map('strtolower', $backends));
+        return in_array($bk->getBkId(), array_map('strtolower', $backends));
     }
 
     function getPasswordPolicies($user=null) {
@@ -502,14 +597,14 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
         $policies = PasswordPolicy::allActivePolicies();
         if ($cfg && ($policy = $cfg->getStaffPasswordPolicy())) {
             foreach ($policies as $P)
-                if ($policy == $P::$id)
+                if ($policy == $P->getBkId())
                     return array($P);
         }
 
         return $policies;
     }
 
-    function getAllowedBackends($userid) {
+    static function getAllowedBackends($userid) {
 
         $backends =array();
         //XXX: Only one backend can be specified at the moment.
@@ -556,16 +651,19 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
         }
 
         // Tag the authkey.
-        $authkey = $bk::$id.':'.$authkey;
+        $authkey = $bk->getBkId().':'.$authkey;
         // Now set session crap and lets roll baby!
         $authsession = &$_SESSION['_auth']['staff'];
         $authsession = array(); //clear.
         $authsession['id'] = $staff->getId();
         $authsession['key'] =  $authkey;
         $authsession['2fa'] =  $auth2fa;
-
+        // Set TIME_BOMB to regenerate the session 10 seconds after login
+        $_SESSION['TIME_BOMB'] = time() + 10;
+        // Set session token
+        $staff->setSessionToken();
+        // Set Auth Key
         $staff->setAuthKey($authkey);
-        $staff->refreshSession(true); //set the hash.
         Signal::send('auth.login.succeeded', $staff);
 
         if ($bk->supportsInteractiveAuthentication())
@@ -612,6 +710,7 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
         if (!($bk=static::getBackend($id)) //get the backend
                 || !($staff = $bk->validate($auth)) //Get AuthicatedUser
                 || !($staff instanceof Staff)
+                || !$staff->isActive()
                 || $staff->getId() != $_SESSION['_auth']['staff']['id'] // check ID
         )
             return null;
@@ -636,7 +735,9 @@ abstract class StaffAuthenticationBackend  extends AuthenticationBackend {
 
     protected function validate($authkey) {
 
-        if (($staff = StaffSession::lookup($authkey)) && $staff->getId())
+        if (($staff = StaffSession::lookup($authkey))
+            && $staff->getId()
+            && $staff->isActive())
             return $staff;
     }
 }
@@ -659,7 +760,8 @@ abstract class ExternalStaffAuthenticationBackend
                 $this->getServiceName());
         ?>
         <a class="external-sign-in" title="<?php echo $service; ?>"
-                href="login.php?do=ext&amp;bk=<?php echo urlencode(static::$id); ?>">
+                href="login.php?do=ext&amp;bk=<?php echo
+                urlencode($this->getBkId()); ?>">
 <?php if (static::$sign_in_image_url) { ?>
         <img class="sign-in-image" src="<?php echo static::$sign_in_image_url;
             ?>" alt="<?php echo $service; ?>"/>
@@ -677,15 +779,17 @@ abstract class ExternalStaffAuthenticationBackend
     }
 
     function triggerAuth() {
+        $_SESSION['ext:bk:id'] = $this->getBkId();
+        // For legacy plugins prior to v1.17
         $_SESSION['ext:bk:class'] = get_class($this);
     }
 }
 Signal::connect('api', function($dispatcher) {
     $dispatcher->append(
         url('^/auth/ext$', function() {
-            if ($class = $_SESSION['ext:bk:class']) {
-                $bk = StaffAuthenticationBackend::getBackend($class::$id)
-                    ?: UserAuthenticationBackend::getBackend($class::$id);
+            if ($id = $_SESSION['ext:bk:id']) {
+                $bk = StaffAuthenticationBackend::getBackend($id)
+                    ?: UserAuthenticationBackend::getBackend($id);
                 if ($bk instanceof ExternalAuthentication)
                     $bk->triggerAuth();
             }
@@ -694,31 +798,25 @@ Signal::connect('api', function($dispatcher) {
 });
 
 abstract class UserAuthenticationBackend  extends AuthenticationBackend {
-
-    static private $_registry = array();
-
-    static function _register($class) {
-        static::$_registry[$class::$id] = $class;
-    }
+    static protected $registry = array();
 
     static function allRegistered() {
-        return array_merge(self::$_registry, parent::allRegistered());
+        return array_merge(self::$registry, parent::allRegistered());
     }
 
-
     function getPasswordPolicies($user=null) {
         global $cfg;
         $policies = PasswordPolicy::allActivePolicies();
         if ($cfg && ($policy = $cfg->getClientPasswordPolicy())) {
             foreach ($policies as $P)
-                if ($policy == $P::$id)
+                if ($policy == $P->getId())
                     return array($P);
         }
 
         return $policies;
     }
 
-    function getAllowedBackends($userid) {
+    static function getAllowedBackends($userid) {
         $backends = array();
         $sql = 'SELECT A1.backend FROM '.USER_ACCOUNT_TABLE
               .' A1 INNER JOIN '.USER_EMAIL_TABLE.' A2 ON (A2.user_id = A1.user_id)'
@@ -739,7 +837,7 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
         global $ost;
 
         if (!$user || !$bk
-                || !$bk::$id //Must have ID
+                || !$bk->getBkId() //Must have ID
                 || !($authkey = $bk->getAuthKey($user)))
             return false;
 
@@ -754,13 +852,11 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
 
         // Tag the user and associated ticket in the SESSION
         $this->setAuthKey($user, $bk, $authkey);
-
+        // Set Session Token
+        $user->setSessionToken();
         //The backend used decides the format of the auth key.
         // XXX: encrypt to hide the bk??
         $user->setAuthKey($authkey);
-
-        $user->refreshSession(true); //set the hash.
-
         //Log login info...
         $msg=sprintf(_S('%1$s (%2$s) logged in [%3$s]'
                 /* Tokens are <username>, <id>, and <ip> */),
@@ -771,6 +867,9 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
         $type = array('type' => 'login');
         Signal::send('person.login', $u, $type);
 
+        // Set TIME_BOMB to regenerate the session 10 seconds after login
+        $_SESSION['TIME_BOMB'] = time() + 10;
+
         if ($bk->supportsInteractiveAuthentication() && ($acct=$user->getAccount()))
             $acct->cancelResetTokens();
 
@@ -784,7 +883,7 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
         $authkey = $key ?: $bk->getAuthKey($user);
 
         //Tag the authkey.
-        $authkey = $bk::$id.':'.$authkey;
+        $authkey = $bk->getBkId().':'.$authkey;
 
         //Set the session goodies
         $authsession = &$_SESSION['_auth']['user'];
@@ -831,6 +930,9 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
                 )
             return null;
 
+        if (($account=$user->getAccount()) && !$account->isActive())
+            return null;
+
         $user->setAuthKey($_SESSION['_auth']['user']['key']);
 
         return $user;
@@ -839,7 +941,9 @@ abstract class UserAuthenticationBackend  extends AuthenticationBackend {
     protected function validate($userid) {
         if (!($user = User::lookup($userid)))
             return false;
-        elseif (!$user->getAccount())
+        elseif (!($account=$user->getAccount()))
+            return false;
+        elseif (!$account->isActive())
             return false;
 
         return new ClientSession(new EndUser($user));
@@ -865,10 +969,11 @@ abstract class ExternalUserAuthenticationBackend
 
         ?>
         <a class="external-sign-in" title="<?php echo $service; ?>"
-                href="login.php?do=ext&amp;bk=<?php echo urlencode(static::$id); ?>">
+                href="login.php?do=ext&amp;bk=<?php echo
+                urlencode($this->getBkId()); ?>">
 <?php if (static::$sign_in_image_url) { ?>
         <img class="sign-in-image" src="<?php echo static::$sign_in_image_url;
-            ?>" alt="<?php $service; ?>"/>
+            ?>" alt="<?php echo $service; ?>"/>
 <?php } else { ?>
             <div class="external-auth-box">
             <span class="external-auth-icon">
@@ -883,6 +988,8 @@ abstract class ExternalUserAuthenticationBackend
     }
 
     function triggerAuth() {
+        $_SESSION['ext:bk:id'] = $this->getBkId();
+        // Legacy for plugins prior to v1.17
         $_SESSION['ext:bk:class'] = get_class($this);
     }
 }
@@ -928,7 +1035,7 @@ abstract class AuthStrikeBackend extends AuthenticationBackend {
         return false;
     }
 
-    function getAllowedBackends($userid) {
+    static function getAllowedBackends($userid) {
         return array();
     }
 
@@ -945,22 +1052,23 @@ abstract class AuthStrikeBackend extends AuthenticationBackend {
 
     }
 
-    abstract function authStrike($credentials);
-    abstract function authTimeout();
+    abstract static function authStrike($credentials);
+    abstract static function authTimeout();
 }
 
 /*
  * Backend to monitor staff's failed login attempts
  */
 class StaffAuthStrikeBackend extends  AuthStrikeBackend {
+    static $id = "authstrike.staff";
 
-    function authTimeout() {
+    static function authTimeout() {
         global $ost;
 
         $cfg = $ost->getConfig();
 
         $authsession = &$_SESSION['_auth']['staff'];
-        if (!$authsession['laststrike'])
+        if (!isset($authsession['laststrike']))
             return;
 
         //Veto login due to excessive login attempts.
@@ -975,7 +1083,7 @@ class StaffAuthStrikeBackend extends  AuthStrikeBackend {
         $authsession['strikes']=0;
     }
 
-    function authstrike($credentials) {
+    static function authstrike($credentials) {
         global $ost;
 
         $cfg = $ost->getConfig();
@@ -1022,8 +1130,9 @@ StaffAuthenticationBackend::register('StaffAuthStrikeBackend');
  * Backend to monitor user's failed login attempts
  */
 class UserAuthStrikeBackend extends  AuthStrikeBackend {
+    static $id = "authstrike.user";
 
-    function authTimeout() {
+    static function authTimeout() {
         global $ost;
 
         $cfg = $ost->getConfig();
@@ -1044,7 +1153,7 @@ class UserAuthStrikeBackend extends  AuthStrikeBackend {
         $authsession['strikes']=0;
     }
 
-    function authstrike($credentials) {
+    static function authstrike($credentials) {
         global $ost;
 
         $cfg = $ost->getConfig();
@@ -1146,7 +1255,7 @@ class PasswordResetTokenBackend extends StaffAuthenticationBackend {
                 || $id != $staff->getId())
             $errors['msg'] = __('Invalid reset token');
         elseif (!($ts = $_config->lastModified($_POST['token']))
-                && ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
+                || ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
             $errors['msg'] = __('Invalid reset token');
         elseif (!$staff->forcePasswdRest())
             $errors['msg'] = __('Unable to reset password');
@@ -1373,7 +1482,7 @@ class ClientPasswordResetTokenBackend extends UserAuthenticationBackend {
                 || $id != 'c'.$client->getId())
             $errors['msg'] = __('Invalid reset token');
         elseif (!($ts = $_config->lastModified($_POST['token']))
-                && ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
+                || ($ost->getConfig()->getPwResetWindow() < (time() - strtotime($ts))))
             $errors['msg'] = __('Invalid reset token');
         elseif (!$acct->forcePasswdReset())
             $errors['msg'] = __('Unable to reset password');
@@ -1422,9 +1531,7 @@ class BadPassword extends Exception {}
 class ExpiredPassword extends Exception {}
 class PasswordUpdateFailed extends Exception {}
 
-abstract class PasswordPolicy {
-    static protected $registry = array();
-
+abstract class PasswordPolicy extends ServiceRegistry {
     static $id;
     static $name;
 
@@ -1440,14 +1547,7 @@ abstract class PasswordPolicy {
     abstract function onLogin($user, $password);
 
     /*
-     * get friendly name of the policy
-     */
-    function getName() {
-        return static::$name;
-    }
-
-    /*
-     * Check a password aganist all available policies 
+     * Check a password aganist all available policies
      */
     static function checkPassword($new, $current, $bk=null) {
         if ($bk && is_a($bk, 'AuthenticationBackend'))
@@ -1461,7 +1561,7 @@ abstract class PasswordPolicy {
 
     static function allActivePolicies() {
         $policies = array();
-        foreach (array_reverse(static::$registry) as $P) {
+        foreach (array_reverse(self::getRegistry()) as $P) {
             if (is_string($P) && class_exists($P))
                 $P = new $P();
             if ($P instanceof PasswordPolicy)
@@ -1470,10 +1570,6 @@ abstract class PasswordPolicy {
         return $policies;
     }
 
-    static function register($policy) {
-        static::$registry[] = $policy;
-    }
-
     static function cleanSessions($model, $user=null) {
         $criteria = array();
 
@@ -1498,7 +1594,7 @@ abstract class PasswordPolicy {
                 return false;
         }
 
-        return SessionData::objects()->filter($criteria)->delete();
+        return DatabaseSessionRecord::objects()->filter($criteria)->delete();
     }
 }
 Signal::connect('auth.clean', array('PasswordPolicy', 'cleanSessions'));
@@ -1526,9 +1622,13 @@ extends PasswordPolicy {
     }
 
     function onSet($passwd, $current) {
-        if (strlen($passwd) < 6) {
+        $pwdlen = strlen($passwd);
+        if ($pwdlen < 6) {
             throw new BadPassword(
                 __('Password must be at least 6 characters'));
+        } elseif ($pwdlen > 128) {
+            throw new BadPassword(
+                sprintf('%s - %s', __('Password is too long'), __('maximum of 128 characters allowed')));
         }
         // XXX: Changing case is technicall changing the password
         if (0 === strcasecmp($passwd, $current)) {

include/class.avatar.php

@@ -52,7 +52,7 @@ abstract class AvatarSource {
             $this->mode = $mode;
     }
 
-    function getName() {
+    static function getName() {
         return __(static::$name);
     }
 

include/class.banlist.php

@@ -17,11 +17,11 @@
 require_once "class.filter.php";
 class Banlist {
 
-    function add($email,$submitter='') {
+    static function add($email,$submitter='') {
         return self::getSystemBanList()->addRule('email','equal',$email);
     }
 
-    function remove($email) {
+    static function remove($email) {
         return self::getSystemBanList()->removeRule('email','equal',$email);
     }
 
@@ -52,11 +52,11 @@ class Banlist {
         return false;
     }
 
-    function includes($email) {
+    static function includes($email) {
         return self::getSystemBanList()->containsRule('email','equal',$email);
     }
 
-    function ensureSystemBanList() {
+    static function ensureSystemBanList() {
 
         if (!($id=Filter::getByName('SYSTEM BAN LIST')))
             $id=self::createSystemBanList();
@@ -64,7 +64,7 @@ class Banlist {
         return $id;
     }
 
-    function createSystemBanList() {
+    static function createSystemBanList() {
         # XXX: Filter::create should return the ID!!!
         $errors=array();
         return Filter::create(array(
@@ -80,7 +80,7 @@ class Banlist {
         ), $errors);
     }
 
-    function getSystemBanList() {
+    static function getSystemBanList() {
         return self::ensureSystemBanList();
     }
 

include/class.base32.php

@@ -20,7 +20,7 @@ class Base32 {
      * to double performance
      */
 
-    function encode($inString)
+    static function encode($inString)
     {
         $outString = "";
         $compBits = "";
@@ -68,7 +68,7 @@ class Base32 {
      *
      */
 
-    function decode($inString) {
+    static function decode($inString) {
         /* declaration */
         $deCompBits = '';
         $outString = '';

include/class.canned.php

@@ -261,7 +261,7 @@ extends VerySimpleModel {
         return $responses;
     }
 
-    function responsesByDeptId($deptId, $explicit=false) {
+    static function responsesByDeptId($deptId, $explicit=false) {
         return self::getCannedResponses($deptId, $explicit);
     }
 
@@ -311,6 +311,12 @@ extends VerySimpleModel {
 
         return true;
     }
+
+    function staffCanAccess($staff) {
+        if (!$staff instanceof Staff)
+            return false;
+        return (!$this->dept || (($role = $staff->getRole($this->dept)) && $role->hasPerm(Canned::PERM_MANAGE)));
+    }
 }
 RolePermission::register( /* @trans */ 'Knowledgebase', Canned::getPermissions());
 

include/class.charset.php

@@ -74,7 +74,7 @@ class Charset {
     }
 
     //Wrapper for utf-8 transcoding.
-    function utf8($text, $charset=null) {
+    static function utf8($text, $charset=null) {
         return self::transcode($text, $charset, self::UTF8);
     }
 }

include/class.client.php

@@ -151,6 +151,19 @@ implements EmailContact, ITicketUser, TemplateVariable {
         return $this->user->getId();
     }
 
+    function getEmailAddress() {
+        $emailaddr =  (string) $this->getEmail();
+        if (($name=$this->getName()))
+            $emailaddr = sprintf('"%s" <%s>',
+                    (string) $name,
+                    $emailaddr);
+        return $emailaddr;
+    }
+
+    function __toString() {
+        return $this->getEmailAddress();
+    }
+
     abstract function getTicketId();
     abstract function getTicket();
 }
@@ -484,7 +497,7 @@ class ClientAccount extends UserAccount {
         if ($vars['backend']) {
             $this->set('backend', $vars['backend']);
             if ($vars['username'])
-                $this->set('username', $vars['username']);
+                $this->set('username', Format::sanitize($vars['username']));
         }
 
         if ($vars['passwd1']) {

include/class.collaborator.php

@@ -39,12 +39,6 @@ implements EmailContact, ITicketUser {
 
     var $active;
 
-    function __toString() {
-        return Format::htmlchars($this->toString());
-    }
-    function toString() {
-        return sprintf('"%s" <%s>', $this->getName(), $this->getEmail());
-    }
 
     function getId() {
         return $this->id;
@@ -81,6 +75,16 @@ implements EmailContact, ITicketUser {
     function getEmail() {
         return $this->user->getEmail();
     }
+
+    function getEmailAddress() {
+        $emailaddr =  (string) $this->getEmail();
+        if (($name=$this->getName()))
+            $emailaddr = sprintf('"%s" <%s>',
+                    (string) $name,
+                    $emailaddr);
+        return $emailaddr;
+    }
+
     function getName() {
         return $this->user->getName();
     }
@@ -135,6 +139,10 @@ implements EmailContact, ITicketUser {
         return $this->user_id;
     }
 
+    function __toString() {
+        return Format::htmlchars($this->getEmailAddress());
+    }
+
     function hasFlag($flag) {
         return ($this->get('flags', 0) & $flag) != 0;
     }

include/class.config.php

@@ -31,14 +31,13 @@ class Config {
     var $defaults = array();                # List of default values
 
     function __construct($section=null, $defaults=array()) {
+        if ($defaults)
+            $this->defaults = $defaults;
         if ($section)
             $this->section = $section;
-
         if ($this->section === null)
             return false;
 
-        if ($defaults)
-            $this->defaults = $defaults;
 
         if (isset($_SESSION['cfg:'.$this->section]))
             $this->session = &$_SESSION['cfg:'.$this->section];
@@ -62,6 +61,10 @@ class Config {
         return $info;
     }
 
+    function toArray() {
+        return $this->getInfo();
+    }
+
     function get($key, $default=null) {
         if (isset($this->session) && isset($this->session[$key]))
             return $this->session[$key];
@@ -74,7 +77,12 @@ class Config {
     }
 
     function exists($key) {
-        return $this->get($key, null) ? true : false;
+        if ((isset($this->session) && array_key_exists($key, $this->session))
+                || array_key_exists($key, $this->config)
+                || array_key_exists($key, $this->defaults))
+            return true;
+
+        return false;
     }
 
     function set($key, $value) {
@@ -187,7 +195,9 @@ extends VerySimpleModel {
             ))->delete();
     }
 
-    function getConfigsByNamespace($namespace=false, $key, $value=false) {
+
+    static function getConfigsByNamespace(?string $namespace, $key, $value=false) {
+      
         $filter = array();
 
          $filter['key'] = $key;
@@ -659,12 +669,15 @@ class OsticketConfig extends Config {
         return $this->alertEmail;
     }
 
-    function getDefaultSMTPEmail() {
+    function getDefaultSmtpAccount() {
+        if (!$this->defaultSmtpAccount && $this->get('default_smtp_id'))
+            $this->defaultSmtpAccount = SmtpAccount::lookup($this->get('default_smtp_id'));
 
-        if(!$this->defaultSMTPEmail && $this->get('default_smtp_id'))
-            $this->defaultSMTPEmail = Email::lookup($this->get('default_smtp_id'));
+        return $this->defaultSmtpAccount;
+    }
 
-        return $this->defaultSMTPEmail;
+    function getDefaultMTA() {
+        return $this->getDefaultSmtpAccount();
     }
 
     function getDefaultPriorityId() {
@@ -1778,7 +1791,7 @@ class OsticketConfig extends Config {
     }
 
     //Used to detect version prior to 1.7 (useful during upgrade)
-    /* static */ function getDBVersion() {
+    static function getDBVersion() {
         $sql='SELECT `ostversion` FROM '.TABLE_PREFIX.'config '
             .'WHERE id=1';
         return db_result(db_query($sql));

include/class.controller.php

@@ -0,0 +1,44 @@
+<?php
+/*********************************************************************
+    class.controller.php
+
+    Peter Rotich
+    Copyright (c)  osTicket
+    http://www.osticket.com
+
+    Released under the GNU General Public License WITHOUT ANY WARRANTY.
+    See LICENSE.TXT for details.
+
+    vim: expandtab sw=4 ts=4 sts=4:
+**********************************************************************/
+abstract class Controller {
+    /*
+     * access
+     *
+     * This routine can be defined downstream to check if user has
+     * permission to call routines in the controller.
+     *
+     */
+    function access() {
+        return true;
+    }
+
+    // Wrapper for onFatalError
+    public function exerr($code, $error='') {
+        return $this->onFatalError($code, $error);
+    }
+
+    public function onFatalError($code, $error) {
+        $this->onError($code, $error);
+        // On error should exit but we're making doubly sure
+        $this->response($code, $error);
+        exit();
+    }
+
+    protected function response($code, $response) {
+        Http::response($code, $response);
+        exit();
+    }
+
+    abstract function onError($code, $error, $title=null, $logOnly=false);
+}

include/class.cron.php

@@ -20,12 +20,12 @@ require_once INCLUDE_DIR.'class.signal.php';
 
 class Cron {
 
-    function MailFetcher() {
-        require_once(INCLUDE_DIR.'class.mailfetch.php');
-        MailFetcher::run(); //Fetch mail..frequency is limited by email account setting.
+    static function MailFetcher() {
+        require_once(INCLUDE_DIR.'class.email.php');
+        osTicket\Mail\Fetcher::run(); //Fetch mail..frequency is limited by email account setting.
     }
 
-    function TicketMonitor() {
+    static function TicketMonitor() {
         require_once(INCLUDE_DIR.'class.ticket.php');
         Ticket::checkOverdue(); //Make stale tickets overdue
         // Cleanup any expired locks
@@ -34,34 +34,34 @@ class Cron {
 
     }
 
-    function PurgeLogs() {
+    static function PurgeLogs() {
         global $ost;
         // Once a day on a 5-minute cron
         if (rand(1,300) == 42)
             if($ost) $ost->purgeLogs();
     }
 
-    function PurgeDrafts() {
+    static function PurgeDrafts() {
         require_once(INCLUDE_DIR.'class.draft.php');
         Draft::cleanup();
     }
 
-    function CleanOrphanedFiles() {
+    static function CleanOrphanedFiles() {
         require_once(INCLUDE_DIR.'class.file.php');
         AttachmentFile::deleteOrphans();
     }
 
-    function CleanExpiredSessions() {
+    static function CleanExpiredSessions() {
         require_once(INCLUDE_DIR.'class.ostsession.php');
-        DbSessionBackend::cleanup();
+        osTicketSession::cleanup();
     }
 
-    function CleanPwResets() {
+    static function CleanPwResets() {
         require_once(INCLUDE_DIR.'class.config.php');
         ConfigItem::cleanPwResets();
     }
 
-    function MaybeOptimizeTables() {
+    static function MaybeOptimizeTables() {
         // Once a week on a 5-minute cron
         $chance = rand(1,2000);
         switch ($chance) {
@@ -102,7 +102,7 @@ class Cron {
         }
     }
 
-    function run(){ //called by outside cron NOT autocron
+    static function run(){ //called by outside cron NOT autocron
         global $ost;
         if (!$ost || $ost->isUpgradePending())
             return;

include/class.crypto.php

@@ -104,7 +104,7 @@ class Crypto {
 
         list(, $crypt, $ciphertext) = explode('$', $ciphertext, 3);
         //Get crypto....  based on crypt tag.
-        if(!$crypt || !($crypto=Crypto::get($crypt)) || !$crypto->exists())
+        if(!$crypt || !($crypto=Crypto::get($crypt)))
             return false;
 
         $crypto->setKeys($key, $skey);
@@ -221,8 +221,7 @@ class Crypto {
  * decrypt() which will perform the respective operations on the text
  * subjects using a specific library.
  */
-/* abstract */
-class CryptoAlgo {
+abstract class CryptoAlgo {
 
     var $master_key;
     var $sub_key;
@@ -300,8 +299,7 @@ class CryptoAlgo {
      * available and supported. This method is abstract and should be
      * defined in extension classes.
      */
-    /* abstract */
-    function exists() { return false; }
+    abstract static function exists();
 
 
 }
@@ -341,7 +339,7 @@ Class CryptoMcrypt extends CryptoAlgo {
        return ($c
                && $c['name']
                && $c['mode']
-               && $this->exists()
+               && self::exists()
                && mcrypt_module_open($c['name'], '', $c['mode'], '')
                );
     }
@@ -357,7 +355,7 @@ Class CryptoMcrypt extends CryptoAlgo {
      */
     function encrypt($text, $cid=0) {
 
-        if(!$this->exists()
+        if(!self::exists()
                 || !$text
                 || !($cipher=$this->getCipher($cid))
                 || !$cipher['cid'])
@@ -394,7 +392,7 @@ Class CryptoMcrypt extends CryptoAlgo {
      */
     function decrypt($ciphertext) {
 
-         if(!$this->exists()
+         if(!self::exists()
                  || !$ciphertext
                  || $ciphertext[0] != '$'
                  )
@@ -431,7 +429,7 @@ Class CryptoMcrypt extends CryptoAlgo {
          return $plaintext;
     }
 
-    function exists() {
+    static function exists() {
         return (extension_loaded('mcrypt')
                 && function_exists('mcrypt_module_open'));
     }
@@ -473,7 +471,7 @@ class CryptoOpenSSL extends CryptoAlgo {
 
         return ($c
                 && $c['method']
-                && $this->exists()
+                && self::exists()
                 && openssl_cipher_iv_length($c['method'])
                 );
     }
@@ -489,7 +487,7 @@ class CryptoOpenSSL extends CryptoAlgo {
      */
     function encrypt($text, $cid=0) {
 
-        if(!$this->exists()
+        if(!self::exists()
                 || !$text
                 || !($cipher=$this->getCipher($cid)))
             return false;
@@ -517,7 +515,7 @@ class CryptoOpenSSL extends CryptoAlgo {
     function decrypt($ciphertext) {
 
 
-        if(!$this->exists() || !$ciphertext || $ciphertext[0] != '$')
+        if(!self::exists() || !$ciphertext || $ciphertext[0] != '$')
             return false;
 
         list(, $cid, $ciphertext) = explode('$', $ciphertext, 3);
@@ -539,7 +537,7 @@ class CryptoOpenSSL extends CryptoAlgo {
         return $plaintext;
     }
 
-    function exists() {
+    static function exists() {
         return  (extension_loaded('openssl') && function_exists('openssl_cipher_iv_length'));
     }
 }
@@ -595,7 +593,7 @@ class CryptoPHPSecLib extends CryptoAlgo {
 
     function encrypt($text, $cid=0) {
 
-        if(!$this->exists()
+        if(!self::exists()
                 || !$text
                 || !($cipher=$this->getCipher($cid))
                 || !($crypto=$this->getCrypto($cipher['cid']))
@@ -612,7 +610,7 @@ class CryptoPHPSecLib extends CryptoAlgo {
 
     function decrypt($ciphertext) {
 
-        if(!$this->exists() || !$ciphertext || $ciphertext[0] != '$')
+        if(!self::exists() || !$ciphertext || $ciphertext[0] != '$')
             return false;
 
         list(, $cid, $ciphertext) = explode('$', $ciphertext, 3);
@@ -634,7 +632,7 @@ class CryptoPHPSecLib extends CryptoAlgo {
         return $crypto->decrypt($ciphertext);
     }
 
-    function exists() {
+    static function exists() {
         return  class_exists('Crypt_AES');
     }
 }

include/class.csrf.php

@@ -60,7 +60,7 @@ Class CSRF {
 
     function getToken() {
 
-        if (!$this->csrf['token'] || $this->isExpired()) {
+        if ((!is_array($this->csrf) || !$this->csrf['token']) || $this->isExpired()) {
             $this->rotate();
         } else {
             //Reset the timer

include/class.dept.php

@@ -604,7 +604,7 @@ implements TemplateVariable, Searchable {
                 return true;
     }
 
-    function export($dept, $criteria=null, $filename='') {
+    static function export($dept, $criteria=null, $filename='') {
         include_once(INCLUDE_DIR.'class.error.php');
         $members = $dept->getMembers();
 
@@ -634,12 +634,12 @@ implements TemplateVariable, Searchable {
         return $row ? $row[0] : 0;
     }
 
-    function getNameById($id) {
+    static function getNameById($id) {
         $names = Dept::getDepartments();
         return $names[$id];
     }
 
-    function getDefaultDeptName() {
+    static function getDefaultDeptName() {
         global $cfg;
 
         return ($cfg
@@ -941,7 +941,8 @@ implements TemplateVariable, Searchable {
       $dropped = array();
       foreach ($this->extended as $DA)
           $dropped[$DA->staff_id] = 1;
-      while (list(, list($staff_id, $role_id, $alerts)) = each($access)) {
+      foreach ($access as $acc) {
+          list ($staff_id, $role_id, $alerts) = $acc;
           unset($dropped[$staff_id]);
           if (!$role_id || !Role::lookup($role_id))
               $errors['members'][$staff_id] = __('Select a valid role');

include/class.dispatcher.php

@@ -29,10 +29,14 @@ class Dispatcher {
     function resolve($url, $args=null) {
         if ($this->file) { $this->lazy_load(); }
         # Support HTTP method emulation with the _method GET argument
-        if (isset($_GET['_method'])) {
-            $_SERVER['REQUEST_METHOD'] = strtoupper($_GET['_method']);
-            unset($_GET['_method']);
+        if ($_SERVER['REQUEST_METHOD'] == 'POST'
+                && isset($_POST['_method'])
+                && in_array(strtoupper($_POST['_method']), array('PUT', 'PATCH', 'DELETE'))) {
+            $_SERVER['REQUEST_METHOD'] = strtoupper($_POST['_method']);
+            unset($_POST['_method']);
         }
+        // Decode URL for accurate matching
+        $url = urldecode($url);
         foreach ($this->urls as $matcher) {
             if ($matcher->matches($url)) {
                 return $matcher->dispatch($url, $args);
@@ -105,7 +109,7 @@ class UrlMatcher {
         $f = array_filter(array_keys($this->matches), 'is_numeric');
         $this->matches = array_intersect_key($this->matches, array_flip($f));
 
-        if (@get_class($this->func) == "Dispatcher") {
+        if (is_object($this->func) && (@get_class($this->func) == "Dispatcher")) {
             # Trim the leading match off the $url and call the
             # sub-dispatcher. This will be the case for lines in the URL
             # file like
@@ -136,7 +140,13 @@ class UrlMatcher {
         if ($class) {
             # Create instance of the class, which is the first item,
             # then call the method which is the second item
-            $func = array(new $class, $func);
+            $class = new $class;
+            # Check access at the controller level
+            if (!$class->access())
+                 Http::response(403,  __('Access Denied!!!'));
+            # Create callable function, class is the first item,
+            # then call the method is the second item
+            $func = array($class, $func);
         }
 
         if (!is_callable($func))
@@ -160,7 +170,7 @@ class UrlMatcher {
 
         if (strpos($class, ":")) {
             list($file, $class) = explode(":", $class, 2);
-            include $file;
+            include_once $file;
         }
         return array($class, $func);
     }

include/class.draft.php

@@ -65,16 +65,14 @@ class Draft extends VerySimpleModel {
             $draft_body = $draft->getBody();
         }
         $attrs[] = sprintf('data-draft-original="%s"',
-            Format::htmlchars(Format::viewableImages($original)));
+            Format::viewableImages($original, [], true));
 
-        return array(Format::htmlchars(Format::viewableImages($draft_body)),
+        return array(Format::viewableImages($draft_body, [], true),
             implode(' ', $attrs));
     }
 
-    function getAttachmentIds($body=false) {
+    static function getAttachmentIds($body=false) {
         $attachments = array();
-        if (!$body)
-            $body = $this->getBody();
         $body = Format::localizeInlineImages($body);
         $matches = array();
         if (preg_match_all('/"cid:([\\w.-]{32})"/', $body, $matches)) {
@@ -83,6 +81,7 @@ class Draft extends VerySimpleModel {
             foreach ($files as $F) {
                 $attachments[] = array(
                     'id' => $F->getId(),
+                    'name' => $F->getName(),
                     'inline' => true
                 );
             }

include/class.dynamic_forms.php

@@ -194,7 +194,7 @@ class DynamicForm extends VerySimpleModel {
     function save($refetch=false) {
         if (count($this->dirty))
             $this->set('updated', new SqlFunction('NOW'));
-        if ($rv = parent::save($refetch | $this->dirty))
+        if ($rv = parent::save($refetch || $this->dirty))
             return $this->saveTranslations();
         return $rv;
     }
@@ -291,7 +291,15 @@ class DynamicForm extends VerySimpleModel {
         return true;
     }
 
+    static function getNewInstance() {
+        return static::objects()
+                ->one()
+                ->instanciate();
+    }
+
     static function rebuildDynamicDataViews() {
+        // Flush the object cache
+        ModelInstanceManager::flushCache();
         return self::ensureDynamicDataViews(true, true);
     }
 
@@ -431,7 +439,7 @@ class DynamicForm extends VerySimpleModel {
     // @see http://code.google.com/p/flexviews/
     static function getDynamicDataViewFields($exclude) {
         $fields = array();
-        foreach (static::getInstance()->getFields() as $f) {
+        foreach (static::getNewInstance()->getFields() as $f) {
             if ($exclude && in_array($f->get('name'), $exclude))
                 continue;
 
@@ -485,13 +493,7 @@ class UserForm extends DynamicForm {
 
     static function getInstance() {
         if (!isset(static::$instance))
-            static::$instance = static::getUserForm()->instanciate();
-        return static::$instance;
-    }
-
-    static function getNewInstance() {
-        $o = static::objects()->one();
-        static::$instance = $o->instanciate();
+            static::$instance = self::getNewInstance();
         return static::$instance;
     }
 }
@@ -527,16 +529,9 @@ class TicketForm extends DynamicForm {
 
     static function getInstance() {
         if (!isset(static::$instance))
-            self::getNewInstance();
+            static::$instance = self::getNewInstance();
         return static::$instance;
     }
-
-    static function getNewInstance() {
-        $o = static::objects()->one();
-        static::$instance = $o->instanciate();
-        return static::$instance;
-    }
-
 }
 // Add fields from the standard ticket form to the ticket filterable fields
 Filter::addSupportedMatches(/* @trans */ 'Ticket Data', function() {
@@ -799,7 +794,7 @@ class DynamicFormField extends VerySimpleModel {
      * flags which should be set on the new field to implement the
      * requirement / visibility mode.
      */
-    function allRequirementModes() {
+    static function allRequirementModes() {
         return array(
             'a' => array('desc' => __('Optional'),
                 'flags' => self::FLAG_CLIENT_VIEW | self::FLAG_AGENT_VIEW
@@ -919,7 +914,7 @@ class DynamicFormField extends VerySimpleModel {
                 /* `variable` is used for automation. Internally it's called `name` */
                 ), "name");
         }
-        if (preg_match('/[.{}\'"`; ]/u', $this->get('name')))
+        if ($this->get('name') && !preg_match('/^(?!\d)([[:alnum:]]|_)+$/u', $this->get('name')))
             $this->addError(__(
                 'Invalid character in variable name. Please use letters and numbers only.'
             ), 'name');
@@ -1039,6 +1034,10 @@ class DynamicFormEntry extends VerySimpleModel {
         return $this->form->getInstructions();
     }
 
+    function getNotice() {
+        return  $this->form->getNotice();
+    }
+
     function getDynamicForm() {
         return $this->form;
     }
@@ -1203,7 +1202,7 @@ class DynamicFormEntry extends VerySimpleModel {
         return $vars;
     }
 
-    function forTicket($ticket_id, $force=false) {
+    static function forTicket($ticket_id, $force=false) {
         static $entries = array();
         if (!isset($entries[$ticket_id]) || $force) {
             $stuff = DynamicFormEntry::objects()
@@ -1216,7 +1215,7 @@ class DynamicFormEntry extends VerySimpleModel {
         return $entries[$ticket_id];
     }
 
-    function forTask($id, $force=false) {
+    static function forTask($id, $force=false) {
         static $entries = array();
         if (!isset($entries[$id]) || $force) {
             $stuff = DynamicFormEntry::objects()->filter(array(
@@ -1246,7 +1245,7 @@ class DynamicFormEntry extends VerySimpleModel {
         $this->object_id = $object_id;
     }
 
-    function forObject($object_id, $object_type) {
+    static function forObject($object_id, $object_type) {
         return DynamicFormEntry::objects()
             ->filter(array('object_id'=>$object_id, 'object_type'=>$object_type));
     }
@@ -1356,7 +1355,7 @@ class DynamicFormEntry extends VerySimpleModel {
                     //use getChanges if getClean returns an empty array
                     $fieldClean = $field->getClean() ?: $field->getChanges();
                     if (is_array($fieldClean) && $fieldClean[0])
-                        $fieldClean = json_decode($fieldClean[0], true);
+                        $fieldClean = is_string($fieldClean[0]) ? json_decode($fieldClean[0], true) : $fieldClean[0];
                 } else
                     $fieldClean = $field->getClean();
 
@@ -1594,7 +1593,7 @@ class SelectionField extends FormField {
         $selection = array();
 
         if ($value && !is_array($value))
-            $value = array($value);
+            $value = JsonDataParser::parse($value) ?: array($value);
 
         if ($value && is_array($value)) {
             foreach ($value as $k=>$v) {
@@ -1634,6 +1633,7 @@ class SelectionField extends FormField {
             $values = array();
             $choices = $this->getChoices();
             foreach (explode(',', $value) as $V) {
+                $V = trim($V);
                 if (isset($choices[$V]))
                     $values[$V] = $choices[$V];
             }
@@ -1734,6 +1734,7 @@ class SelectionField extends FormField {
                         ?: __('Unknown or invalid input');
                 }
             } elseif ($config['typeahead']
+                    && $entry
                     && ($entered = $this->getWidget()->getEnteredValue())
                     && !in_array($entered, $entry)
                     && $entered != $entry) {
@@ -1917,7 +1918,7 @@ class SelectionField extends FormField {
         $name = $name ?: $this->get('name');
         $val = $value;
         if ($value && is_array($value))
-            $val = '"?'.implode('("|,|$)|"?', array_keys($value)).'("|,|$)';
+            $val = '"?(?<![0-9])'.implode('("|,|$)|"?(?<![0-9])', array_keys($value)).'("|,|$)';
         switch ($method) {
         case '!includes':
             return Q::not(array("{$name}__regex" => $val));

include/class.export.php

@@ -259,7 +259,7 @@ class Export {
 
         // Filename or stream to export agents to
         $filename = $filename ?: sprintf('Agents-%s.csv',
-                strftime('%Y%m%d'));
+                date('Ymd'));
         Http::download($filename, "text/$how");
         $depts = Dept::getDepartments(null, true, Dept::DISPLAY_DISABLED);
         echo self::dumpQuery($agents, array(
@@ -296,7 +296,7 @@ static function departmentMembers($dept, $agents, $filename='', $how='csv') {
 
     // Filename or stream to export depts' agents to
     $filename = $filename ?: sprintf('%s-%s.csv', $dept->getName(),
-            strftime('%Y%m%d'));
+            date('Ymd'));
     Http::download($filename, "text/$how");
     echo self::dumpQuery($agents, array(
                 '::getName'  =>  'Name',
@@ -322,7 +322,7 @@ static function departmentMembers($dept, $agents, $filename='', $how='csv') {
     exit;
   }
 
-  static function audits($type, $filename='', $tableInfo='', $object='', $how='csv', $show_viewed=true, $data=array(), CsvExporter $exporter) {
+  static function audits($type, ?string $filename, ?string $tableInfo, ?string $object, ?string $how='csv', ?bool $show_viewed=true, ?array $data=array(), CsvExporter $exporter) {
       $headings = array('Description', 'Timestamp', 'IP');
       switch ($type) {
           case 'audit':
@@ -535,7 +535,7 @@ abstract class  Exporter {
                 || !($email=$cfg->getDefaultEmail()))
             return false;
 
-        $mailer = new Mailer($email);
+        $mailer = new osTicket\Mail\Mailer($email);
         $mailer->addFileObject($file);
         $subject = __("Export");
         $body = __("Attached is file containing the export you asked us to send you!");
@@ -620,7 +620,7 @@ class CsvExporter extends Exporter {
     }
 
     function write($data) {
-        fputcsv($this->fp, $this->escape($data), $this->getDelimiter());
+        fputcsv($this->fp, $this->escape($data), $this->getDelimiter(), "\"", "");
     }
 
 }
@@ -680,7 +680,7 @@ class ResultSetExporter {
                 }
             }
             // Evalutate :: function call on target current
-            if ($func && (method_exists($current, $func) || method_exists($current, '__call'))) {
+            if (($current && $func) && (method_exists($current, $func) || method_exists($current, '__call'))) {
                 $current = $current->{$func}();
             }
 
@@ -725,7 +725,7 @@ class CsvResultsExporter extends ResultSetExporter {
         $delimiter = $this->getDelimiter();
         // Output a UTF-8 BOM (byte order mark)
         fputs($this->output, chr(0xEF) . chr(0xBB) . chr(0xBF));
-        fputcsv($this->output, $this->getHeaders(), $delimiter);
+        fputcsv($this->output, $this->getHeaders(), $delimiter, "\"", "");
         while ($row=$this->next())
             fputcsv($this->output, array_map(
                 function($v){
@@ -733,7 +733,7 @@ class CsvResultsExporter extends ResultSetExporter {
                         return "'".$v;
                     return $v;
                 }, $row),
-            $delimiter);
+            $delimiter, "\"", "");
 
         if (!$tmp)
             fclose($this->output);
@@ -743,12 +743,11 @@ class CsvResultsExporter extends ResultSetExporter {
 class JsonResultsExporter extends ResultSetExporter {
     function dump() {
         require_once(INCLUDE_DIR.'class.json.php');
-        $exp = new JsonDataEncoder();
         $rows = array();
         while ($row=$this->nextArray()) {
             $rows[] = $row;
         }
-        echo $exp->encode($rows);
+        echo JsonDataEncoder::encode($rows);
     }
 }
 

include/class.faq.php

@@ -347,7 +347,7 @@ class FAQ extends VerySimpleModel {
 
     static function getFeatured() {
         return self::objects()
-            ->filter(array('ispublished__in'=>array(1,2), 'category__ispublic'=>1))
+            ->filter(array('ispublished'=>2, 'category__ispublic__in'=>[1,2]))
             ->order_by('-ispublished');
     }
 

include/class.file.php

@@ -15,6 +15,19 @@ require_once(INCLUDE_DIR.'class.signal.php');
 require_once(INCLUDE_DIR.'class.error.php');
 
 
+/**
+ * FileObject Interface
+ *
+ * Methods File Objects should support
+ **/
+interface FileObjectInterface {
+    function getUId();
+    function getKey();
+    function getName();
+    function getData();
+    function getMimeType();
+}
+
 /**
  * Represents a file stored in a storage backend. It is generally attached
  * to something; however company logos, login page backdrops, and other
@@ -29,8 +42,8 @@ require_once(INCLUDE_DIR.'class.error.php');
  *    - 'L' => Logo
  *    - 'B' => Backdrop
  */
-class AttachmentFile extends VerySimpleModel {
-
+class AttachmentFile extends VerySimpleModel
+    implements FileObjectInterface {
     static $meta = array(
         'table' => FILE_TABLE,
         'pk' => array('id'),
@@ -71,6 +84,10 @@ class AttachmentFile extends VerySimpleModel {
         return $this->id;
     }
 
+    function getUId() {
+        return $this->getId();
+    }
+
     function getType() {
         return $this->type;
     }
@@ -158,10 +175,14 @@ class AttachmentFile extends VerySimpleModel {
     }
 
     function display($scale=false, $ttl=86400) {
+        // Force download if not safe viewable image
+        if (!$this->isInlineSafeImage())
+            return $this->download(false, 'attachment');
+
         $this->makeCacheable($ttl);
 
-        if ($scale && extension_loaded('gd')) {
-            $image = imagecreatefromstring($this->getData());
+        if ($scale && extension_loaded('gd')
+                && ($image = imagecreatefromstring($this->getData()))) {
             $width = imagesx($image);
             if ($scale <= $width) {
                 $height = imagesy($image);
@@ -197,6 +218,12 @@ class AttachmentFile extends VerySimpleModel {
                             'type' => $options['type']))))
             $options['id'] = $a->getId();
 
+        // Force attachment disposition if not inline-safe image
+        if (isset($options['disposition'])
+                && strcasecmp($options['disposition'], 'inline') == 0
+                && !$this->isInlineSafeImage())
+            $options['disposition'] = 'attachment';
+
         return static::generateDownloadUrl($this->getId(),
                 strtolower($this->getKey()), $this->getSignature(),
                 $options);
@@ -207,7 +234,7 @@ class AttachmentFile extends VerySimpleModel {
     function getExternalDownloadUrl($options=array()) {
         global $cfg;
 
-        $download = self::getDownloadUrl($options);
+        $download = $this->getDownloadUrl($options);
         // Separate URL handle and args
         list($handle, $args) = explode('file.php?', $download);
 
@@ -250,7 +277,8 @@ class AttachmentFile extends VerySimpleModel {
 
         $check = static::_genUrlSignature($this->getId(), $this->getKey(),
             $this->getSignature(), $expires);
-        return $signature == $check;
+
+        return hash_equals($check, $signature);
     }
 
     static function _genUrlSignature($id, $key, $signature, $expires) {
@@ -270,7 +298,7 @@ class AttachmentFile extends VerySimpleModel {
         $inline = ($thisstaff ? ($thisstaff->getImageAttachmentView() === 'inline') : false);
         $disposition = ((($disposition && strcasecmp($disposition, 'inline') == 0)
               || $inline)
-              && strpos($this->getType(), 'image/') !== false)
+              && $this->isInlineSafeImage())
             ? 'inline' : 'attachment';
         $ttl = ($expires) ? $expires - Misc::gmtime() : false;
         $bk = $this->open();
@@ -284,7 +312,7 @@ class AttachmentFile extends VerySimpleModel {
         exit();
     }
 
-    function _getKeyAndHash($data=false, $file=false) {
+    static function _getKeyAndHash($data=false, $file=false) {
         if ($file) {
             $sha1 = base64_encode(sha1_file($data, true));
             $md5 = base64_encode(md5_file($data, true));
@@ -349,6 +377,7 @@ class AttachmentFile extends VerySimpleModel {
                 case IMAGETYPE_GIF:
                 case IMAGETYPE_JPEG:
                 case IMAGETYPE_PNG:
+                case IMAGETYPE_WEBP:
                     break;
                 default:
                     $error = __('Invalid image file type');
@@ -370,6 +399,7 @@ class AttachmentFile extends VerySimpleModel {
                 case IMAGETYPE_GIF:
                 case IMAGETYPE_JPEG:
                 case IMAGETYPE_PNG:
+                case IMAGETYPE_WEBP:
                     break;
                 default:
                     $error = __('Invalid image file type');
@@ -477,9 +507,11 @@ class AttachmentFile extends VerySimpleModel {
                 elseif ($bk->write($file['data']) && $bk->flush()) {
                     $succeeded = true; break;
                 }
-            }
-            catch (Exception $e) {
+            } catch (Throwable $t) {
                 // Try next backend
+                // Backends can throw an exception or error.
+                // TODO: Log any exceptions and errors for debugging
+                // purposes.
             }
             // Fallthrough to default backend if different?
         }
@@ -610,9 +642,16 @@ class AttachmentFile extends VerySimpleModel {
     static function lookupByHash($hash) {
         if (isset(static::$keyCache[$hash]))
             return static::$keyCache[$hash];
-
         // Cache a negative lookup if no such file exists
-        return parent::lookup(array('key' => $hash));
+        try {
+            return parent::lookup(array('key' => $hash));
+        } catch (ObjectNotUnique $e) {
+            // TODO: Figure out why key collission might be happening AND
+            // make key (hash) unique field in the file table as a
+            // protection measure. For now we're returning null to avoid possible wrong file
+            // being displayed.
+            return null;
+        }
     }
 
     static function lookup($id) {
@@ -624,7 +663,7 @@ class AttachmentFile extends VerySimpleModel {
     /*
       Method formats http based $_FILE uploads - plus basic validation.
      */
-    function format($files) {
+    static function format($files) {
         global $ost;
 
         if(!$files || !is_array($files))
@@ -693,6 +732,29 @@ class AttachmentFile extends VerySimpleModel {
             ->filter(array('ft' => 'B'))
             ->order_by('created');
     }
+
+    /**
+     * Determines whether a MIME type is safe to render inline as a passive image.
+     *
+     * @param string $type
+     * @return bool
+     */
+    static function isInlineSafeImageType($type) {
+        $type = strtolower(trim((string) $type));
+
+        return strpos($type, 'image/') === 0
+            && $type !== 'image/svg+xml'
+            && $type !== 'image/svg';
+    }
+
+    /**
+     * Determines whether this file is safe to render inline as a passive image.
+     *
+     * @return bool
+     */
+    function isInlineSafeImage() {
+        return static::isInlineSafeImageType($this->getType());
+    }
 }
 
 class FileStorageBackend {
@@ -1020,14 +1082,29 @@ class OneSixAttachments extends FileStorageBackend {
 FileStorageBackend::register('6', 'OneSixAttachments');
 
 // FileObject - wrapper for SplFileObject class
-class FileObject extends SplFileObject {
+class FileObject extends SplFileObject
+    implements FileObjectInterface {
 
+    protected $_key;
+    protected $_sig;
     protected $_filename;
 
     function __construct($file, $mode='r') {
         parent::__construct($file, $mode);
     }
 
+    function getUId() {
+        return $this->getKey();
+    }
+
+    function getKey() {
+        if (!isset($this->_key))
+            list($this->_key, $this->_sig) = AttachmentFile::_getKeyAndHash(
+                $this->getContents());
+
+        return $this->_key;
+    }
+
     /* This allows us to set REAL file name as opposed to basename of the
      * FS file in question
      */
@@ -1039,6 +1116,10 @@ class FileObject extends SplFileObject {
         return $this->_filename ?: parent::getFilename();
     }
 
+    function getName() {
+        return $this->getFilename();
+    }
+
     /*
      * Set mime type - well formated mime is expected.
      */
@@ -1047,12 +1128,8 @@ class FileObject extends SplFileObject {
     }
 
     function getMimeType() {
-        if (!isset($this->_mimetype)) {
-            // Try to to auto-detect mime type
-            $finfo = new finfo(FILEINFO_MIME);
-            $this->_mimetype = $finfo->buffer($this->getContents(),
-                    FILEINFO_MIME_TYPE);
-        }
+        if (!isset($this->_mimetype))
+            $this->_mimetype = self::mime_type($this->getRealPath());
 
         return $this->_mimetype;
     }
@@ -1068,6 +1145,28 @@ class FileObject extends SplFileObject {
     function getData() {
         return $this->getContents();
     }
+
+    /*
+     * Given a filepath - auto detect the mime type
+     *
+     */
+    static function mime_type($filepath) {
+        // Try to to auto-detect mime type
+        $type = null;
+        if (function_exists('finfo_open')) {
+            $finfo = finfo_open(FILEINFO_MIME_TYPE);
+            $type = finfo_file($finfo, $filepath);
+            finfo_close($finfo);
+        }
+        return $type ?: mime_content_type($filepath);
+    }
+
+    /*
+     * Compare mime type of file content to a given mime
+     */
+    static function mimecmp($filepath, $mime) {
+        return strcasecmp(self::mime_type($filepath), $mime) !== 0;
+    }
 }
 
 ?>

include/class.filter.php

@@ -165,7 +165,7 @@ extends VerySimpleModel {
         return ($this->use_replyto_email);
     }
 
-    function disableFilters($object) {
+    static function disableFilters($object) {
         switch (get_class($object)) {
             case 'Topic':
                 $object_id = 'topic_id';
@@ -207,7 +207,7 @@ extends VerySimpleModel {
                            'configuration__like' => sprintf('%%"%s":%s}', $object_id, $id)));
         foreach($actions as $fa) {
             // Put a flag on the filter
-            $fa->setFilterFlags(false, 'Filter::FLAG_DELETED_OBJECT', true);
+            FilterAction::setFilterFlags($fa, 'Filter::FLAG_DELETED_OBJECT', true);
             $fa->save();
 
             // Disable the filter
@@ -238,6 +238,7 @@ extends VerySimpleModel {
             $extra['notes'] = Format::sanitize($extra['notes']);
         $rule = array_merge($extra,array('what'=>$what, 'how'=>$how, 'val'=>$val));
         $rule = new FilterRule($rule);
+        $rule->created = SqlFunction::NOW();
         $this->rules->add($rule);
         if ($rule->save())
             return true;
@@ -374,7 +375,7 @@ extends VerySimpleModel {
         return $keys;
     }
 
-    /* static */ function getSupportedMatchTypes() {
+    static function getSupportedMatchTypes() {
         return array(
             'equal'=>       __('Equal'),
             'not_equal'=>   __('Not Equal'),
@@ -404,7 +405,7 @@ extends VerySimpleModel {
         elseif(($filter=static::getByName($vars['name'])) && $filter->id!=$this->id)
             $errors['name'] = __('Name already in use');
 
-        if(!$errors && !self::validate_rules($vars,$errors) && !$errors['rules'])
+        if(!$errors && !$this->validate_rules($vars,$errors) && !$errors['rules'])
             $errors['rules'] = __('Unable to validate rules as entered');
 
         $targets = self::getTargets();
@@ -475,7 +476,7 @@ extends VerySimpleModel {
     }
 
     /** static functions **/
-    function getTargets() {
+    static function getTargets() {
         return array(
                 'Any' => __('Any'),
                 'Web' => __('Web Forms'),
@@ -488,7 +489,7 @@ extends VerySimpleModel {
     }
 
     function validate_rules($vars,&$errors) {
-        $matches = array_keys(self::getSupportedMatchFields());
+        $matches = self::getSupportedMatchFields();
         $types = array_keys(self::getSupportedMatchTypes());
         $rules = array();
         foreach ($vars['rules'] as $i=>$rule) {
@@ -501,36 +502,34 @@ extends VerySimpleModel {
 
             if (is_array($rule)) {
                 if($rule["w"] || $rule["h"]) {
-                // Check for REGEX compile errors
-                if (in_array($rule["h"], array('match','not_match'))) {
-                    $wrapped = "/".$rule["v"]."/iu";
-                    if (false === @preg_match($rule["v"], ' ')
-                            && (false !== @preg_match($wrapped, ' ')))
-                        $rule["v"] = $wrapped;
+                    // Check for REGEX compile errors
+                    if (in_array($rule["h"], array('match','not_match'))) {
+                        $wrapped = "/".$rule["v"]."/iu";
+                        if (false === @preg_match($rule["v"], ' ')
+                                && (false !== @preg_match($wrapped, ' ')))
+                            $rule["v"] = $wrapped;
+                    }
+
+                    if(!$rule["w"] || !in_array($rule["w"],$matches))
+                        $errors["rule_$i"]=__('Invalid match selection');
+                    elseif(!$rule["h"] || !in_array($rule["h"],$types))
+                        $errors["rule_$i"]=__('Invalid match type selection');
+                    elseif(!$rule["v"])
+                        $errors["rule_$i"]=__('Value required');
+                    elseif($rule["w"]=='email'
+                            && $rule["h"]=='equal'
+                            && !Validator::is_email($rule["v"]))
+                        $errors["rule_$i"]=__('Valid email required for the match type');
+                    elseif (in_array($rule["h"], array('match','not_match'))
+                            && (false === @preg_match($rule["v"], ' ')))
+                        $errors["rule_$i"] = sprintf(__('Regex compile error: (#%s)'),
+                            preg_last_error());
+                    else //for everything-else...we assume it's valid.
+                        $rules[]=array('what'=>$rule["w"],
+                            'how'=>$rule["h"],'val'=>trim($rule["v"]));
+                } elseif($rule["v"]) {
+                    $errors["rule_$i"]=__('Incomplete selection');
                 }
-
-                if(!$rule["w"] || !in_array($rule["w"],$matches))
-                    $errors["rule_$i"]=__('Invalid match selection');
-                elseif(!$rule["h"] || !in_array($rule["h"],$types))
-                    $errors["rule_$i"]=__('Invalid match type selection');
-                elseif(!$rule["v"])
-                    $errors["rule_$i"]=__('Value required');
-                elseif($rule["w"]=='email'
-                        && $rule["h"]=='equal'
-                        && !Validator::is_email($rule["v"]))
-                    $errors["rule_$i"]=__('Valid email required for the match type');
-                elseif (in_array($rule["h"], array('match','not_match'))
-                        && (false === @preg_match($rule["v"], ' ')))
-                    $errors["rule_$i"] = sprintf(__('Regex compile error: (#%s)'),
-                        preg_last_error());
-
-
-                else //for everything-else...we assume it's valid.
-                    $rules[]=array('what'=>$rule["w"],
-                        'how'=>$rule["h"],'val'=>trim($rule["v"]));
-            }elseif($rule["v"]) {
-                $errors["rule_$i"]=__('Incomplete selection');
-            }
             }
         }
 
@@ -565,13 +564,22 @@ extends VerySimpleModel {
         return parent::save($refetch || $this->dirty);
     }
 
+    static function __create($vars,&$errors) {
+        $filter = new static($vars);
+        if ($filter->save()) {
+            $filter->save_rules($vars, $errors);
+            $filter->save_actions($filter->getId(), $vars, $errors);
+            return $filter;
+        }
+    }
+
     static function create($vars,&$errors) {
         $filter = new static($vars);
         if ($filter->save())
             return $filter;
     }
 
-    function validate_actions($vars, &$errors) {
+    static function validate_actions($vars, &$errors) {
         //allow the save if it is to set a filter flag
         if ($vars['pass'])
             return true;
@@ -907,6 +915,7 @@ class TicketFilter {
         );
 
         foreach ($auto_headers as $header=>$find) {
+            $header = strtolower($header);
             if(!isset($headers[$header])) continue;
 
             $value = strtoupper($headers[$header]);
@@ -930,8 +939,7 @@ class TicketFilter {
     }
 
     static function isBounce($headers) {
-
-        if($headers && !is_array($headers))
+        if ($headers && !is_array($headers))
             $headers = Mail_Parse::splitHeaders($headers);
 
         $bounce_headers = array(
@@ -946,6 +954,7 @@ class TicketFilter {
         );
 
         foreach ($bounce_headers as $header => $find) {
+            $header = strtolower($header);
             if(!isset($headers[$header])) continue;
 
             @list($func, $searches, $pos, $neg) = $find;
@@ -967,7 +976,7 @@ class TicketFilter {
      * Normalize ticket source to supported filter target
      *
      */
-    function origin2target($origin) {
+    static function origin2target($origin) {
         $sources=array('web' => 'Web', 'email' => 'Email', 'phone' => 'Web', 'staff' => 'Web', 'api' => 'API');
 
         return $sources[strtolower($origin)];

include/class.filter_action.php

@@ -89,13 +89,11 @@ class FilterAction extends VerySimpleModel {
         return $this->_impl;
     }
 
-    function setFilterFlags($actions=false, $flag, $bool) {
+    static function setFilterFlags(?object $actions, $flag, $bool) {
         $flag = constant($flag);
-        if ($actions) {
+        if ($actions)
             foreach ($actions as $action)
                 $action->setFilterFlag($flag, $bool);
-        } else
-            $this->setFilterFlag($flag, $bool);
     }
 
     function setFilterFlag($flag, $bool) {
@@ -644,7 +642,7 @@ class FA_SendEmail extends TriggerAction {
 
         // Honor FROM address settings
         if (!$config['from'] || !($mailer = Email::lookup($config['from'])))
-            $mailer = new Mailer();
+            $mailer = new osTicket\Mail\Mailer();
 
         // Allow %{user} in the To: line
         $replacer = new VariableReplacer();
@@ -653,10 +651,9 @@ class FA_SendEmail extends TriggerAction {
         ));
         $to = $replacer->replaceVars($config['recipients']);
 
-        require_once PEAR_DIR . 'Mail/RFC822.php';
         require_once PEAR_DIR . 'PEAR.php';
 
-        if (!($mails = Mail_RFC822::parseAddressList($to)) || PEAR::isError($mails))
+        if (!($mails = Mail_Parse::parseAddressList($to)) || PEAR::isError($mails))
             return false;
 
         // Allow %{recipient} in the body
@@ -695,7 +692,7 @@ class FA_SendEmail extends TriggerAction {
                     'size' => 80, 'length' => 1000,
                 ),
                 'validators' => function($self, $value) {
-                    if (!($mails = Mail_RFC822::parseAddressList($value)) || PEAR::isError($mails))
+                    if (!($mails = Mail_Parse::parseAddressList($value)) || PEAR::isError($mails))
                         $self->addError('Unable to parse address list. '
                             .'Use commas to separate addresses.');
 

include/class.format.php

@@ -20,7 +20,7 @@ require_once INCLUDE_DIR.'class.variable.php';
 class Format {
 
 
-    function file_size($bytes) {
+    static function file_size($bytes) {
 
         if(!is_numeric($bytes))
             return $bytes;
@@ -32,7 +32,7 @@ class Format {
         return round(($bytes/1048576),1).' mb';
     }
 
-    function filesize2bytes($size) {
+    static function filesize2bytes($size) {
         switch (substr($size, -1)) {
         case 'M': case 'm': return (int)$size <<= 20;
         case 'K': case 'k': return (int)$size <<= 10;
@@ -42,11 +42,11 @@ class Format {
         return $size;
     }
 
-    function filename($filename) {
+    static function filename($filename) {
         return preg_replace('/[^a-zA-Z0-9\-\._]/', '-', $filename);
     }
 
-    function mimedecode($text, $encoding='UTF-8') {
+    static function mimedecode($text, $encoding='UTF-8') {
         // Handle poorly or completely un-encoded header values (
         if (function_exists('mb_detect_encoding'))
             if (($src_enc = mb_detect_encoding($text))
@@ -76,7 +76,7 @@ class Format {
      * language sub-component is defined in RFC5646, and that the filename
      * is URL encoded (in the charset specified)
      */
-    function decodeRfc5987($filename) {
+    static function decodeRfc5987($filename) {
         $match = array();
         if (preg_match("/([\w!#$%&+^_`{}~-]+)'([\w-]*)'(.*)$/",
                 $filename, $match))
@@ -91,12 +91,12 @@ class Format {
      * Json Encoder
      *
      */
-    function json_encode($what) {
+    static function json_encode($what) {
         require_once (INCLUDE_DIR.'class.json.php');
         return JsonDataEncoder::encode($what);
     }
 
-	function phone($phone) {
+	static function phone($phone) {
 
 		$stripped= preg_replace("/[^0-9]/", "", $phone);
 		if(strlen($stripped) == 7)
@@ -107,7 +107,23 @@ class Format {
 			return $phone;
 	}
 
-    function truncate($string,$len,$hard=false) {
+    static function mask($str, $start = 0, $length = null, $mask="*") {
+        $mask = preg_replace("/\S/", $mask, $str);
+        if ($length)
+            $str = substr_replace($str, substr($mask, $start, $length), $start, $length);
+        else
+            $str = substr_replace ($str, substr($mask, $start), $start);
+
+        return $str;
+    }
+
+    static function shroud($str, $start=0, $length=null) {
+        $str = $length ? substr($str, 0, $length) : $str;
+        return self::mask($str, $start, $length);
+    }
+
+
+    static function truncate($string,$len,$hard=false) {
 
         if(!$len || $len>strlen($string))
             return $string;
@@ -117,15 +133,15 @@ class Format {
         return $hard?$string:(substr($string,0,strrpos($string,' ')).' ...');
     }
 
-    function strip_slashes($var) {
+    static function strip_slashes($var) {
         return is_array($var)?array_map(array('Format','strip_slashes'),$var):stripslashes($var);
     }
 
-    function wrap($text, $len=75) {
+    static function wrap($text, $len=75) {
         return $len ? wordwrap($text, $len, "\n", true) : $text;
     }
 
-    function html_balance($html, $remove_empty=true) {
+    static function html_balance($html, $remove_empty=true) {
         if (!extension_loaded('dom'))
             return $html;
 
@@ -178,7 +194,7 @@ class Format {
         return preg_replace('`^<div>|</div>$`', '', trim($html));
     }
 
-    function html($html, $config=array()) {
+    static function html($html, $config=array()) {
         require_once(INCLUDE_DIR.'htmLawed.php');
         $spec = false;
         if (isset($config['spec']))
@@ -202,7 +218,7 @@ class Format {
         return htmLawed($html, $config, $spec);
     }
 
-    function html2text($html, $width=74, $tidy=true) {
+    static function html2text($html, $width=74, $tidy=true) {
 
         if (!$html)
             return $html;
@@ -262,6 +278,11 @@ class Format {
             $props = array();
             foreach ($styles as $i=>&$s) {
                 @list($prop, $val) = explode(':', $s);
+                // Strip all CSS url() usages in inline styles
+                if (preg_match('/\burl\s*\(/i', $val)) {
+                    unset($styles[$i]);
+                    continue;
+                }
                 if (isset($props[$prop])) {
                     unset($styles[$i]);
                     continue;
@@ -294,7 +315,7 @@ class Format {
         }
     }
 
-    function safe_html($html, $options=array()) {
+    static function safe_html($html, $options=array()) {
         global $cfg;
 
         $options = array_merge(array(
@@ -318,9 +339,10 @@ class Format {
                   ':<html[^>]+:i',              # drop html attributes
                   ':<(a|span) (name|style)="(mso-bookmark\:)?_MailEndCompose">(.+)?<\/(a|span)>:', # Drop _MailEndCompose
                   ':<div dir=(3D)?"ltr">(.*?)<\/div>(.*):is', # drop Gmail "ltr" attributes
-                  ':data-cid="[^"]*":',         # drop image cid attributes
+                  '(position: ?(-webkit-)?(static|relative|fixed|absolute|sticky|initial|inherit);?)', # Position styling
+                  ':[\x{2002}-\x{200B}]+:u',    # unicode spaces
             ),
-            array('', '', '', '', '<html', '$4', '$2 $3', ''),
+            array('', '', '', '', '<html', '$4', '$2 $3', '', ' '),
             $html);
 
         // HtmLawed specific config only
@@ -329,7 +351,8 @@ class Format {
             'balance' => $options['balance'],
             'comment' => 1, //Remove html comments (OUTLOOK LOVE THEM)
             'tidy' => -1,
-            'deny_attribute' => 'id, formaction, on*',
+            'elements' => '*-form-input-button',
+            'deny_attribute' => 'id, formaction, action, srcset, data*, on*',
             'schemes' => 'href: aim, feed, file, ftp, gopher, http, https, irc, mailto, news, nntp, sftp, ssh, telnet; *:file, http, https; src: cid, http, https, data',
             'hook_tag' => function($e, $a=0) { return Format::__html_cleanup($e, $a); },
         );
@@ -338,34 +361,37 @@ class Format {
         if ($cfg)
             $whitelist = $cfg->getIframeWhitelist();
         if (!empty($whitelist)) {
-            $config['elements'] = '*+iframe';
+            $whitelist_quoted = array_map(function ($d) {
+                return preg_quote($d, '`');
+            }, $whitelist);
+            $config['elements'] .= '+iframe';
             $config['spec'] = 'iframe=-*,height,width,type,style,src(match="`^(https?:)?//(www\.)?('
-                .implode('|', $whitelist)
-                .')/?([^@]*)$`i"),frameborder'.($options['spec'] ? '; '.$options['spec'] : '').',allowfullscreen';
+                .implode('|', $whitelist_quoted)
+                .')(\?|/|#)([^@]*)$`i"),frameborder'.($options['spec'] ? '; '.$options['spec'] : '').',allowfullscreen';
         }
 
         return Format::html($html, $config);
     }
 
-    function localizeInlineImages($text) {
+    static function localizeInlineImages($text) {
         // Change file.php urls back to content-id's
         return preg_replace(
-            '`src="(?:https?:/)?(?:/[^/"]+)*?/file\\.php\\?(?:\w+=[^&]+&(?:amp;)?)*?key=([^&]+)[^"]*`',
-            'src="cid:$1', $text);
+            '`<img src="(?:https?:/)?(?:/[^/"]+)*?/file\\.php\\?(?:\w+=[^&"]+&(?:amp;)?)*?key=([^&]+)[^"]*`',
+            '<img src="cid:$1', $text);
     }
 
-    function sanitize($text, $striptags=false, $spec=false) {
+    static function sanitize($text, $striptags=false, $spec=false) {
+        // Localize inline images before sanitizing content
+        $text = self::localizeInlineImages($text);
 
         //balance and neutralize unsafe tags.
         $text = Format::safe_html($text, array('spec' => $spec));
 
-        $text = self::localizeInlineImages($text);
-
         //If requested - strip tags with decoding disabled.
         return $striptags?Format::striptags($text, false):$text;
     }
 
-    function htmlchars($var, $sanitize = false) {
+    static function htmlchars($var, $sanitize = false) {
         static $phpversion = null;
 
         if (is_array($var)) {
@@ -393,7 +419,7 @@ class Format {
         }
     }
 
-    function htmldecode($var) {
+    static function htmldecode($var) {
 
         if(is_array($var))
             return array_map(array('Format','htmldecode'), $var);
@@ -405,12 +431,20 @@ class Format {
         return htmlspecialchars_decode($var, $flags);
     }
 
-    function input($var) {
+    static function http_query_string(string $query, ?array $filter = null) {
+        $args = [];
+        parse_str($query, $args);
+        if ($filter && is_array($filter))
+            $args = array_diff_key($args, array_flip($filter));
+        return http_build_query($args);
+    }
+
+    static function input($var) {
         return Format::htmlchars($var);
     }
 
     //Format text for display..
-    function display($text, $inline_images=true, $balance=true) {
+    static function display($text, $inline_images=true, $balance=true) {
         global $cfg;
 
         // Exclude external images?
@@ -450,22 +484,23 @@ class Format {
         return $text;
     }
 
-    function stripExternalImages($input, $display=false) {
+    static function stripExternalImages($input, $display=false) {
         global $cfg;
 
         // Allowed Inline External Image Extensions
         $allowed = array('gif', 'png', 'jpg', 'jpeg');
         $exclude = !$cfg->allowExternalImages();
-        $local = false;
 
-        $input = preg_replace_callback('/<img ([^>]*)(src="([^"]+)")([^>]*)\/?>/',
-            function($match) use ($local, $allowed, $exclude, $display) {
-                if (strpos($match[3], 'cid:') !== false)
-                    $local = true;
+        $input = preg_replace_callback('/<img\b([^>]*?)\bsrc\s*=\s*(["\'])(.*?)\2([^>]*)\/?>/i',
+            function($match) use ($allowed, $exclude, $display) {
+                $src = $match[3];
+
+                // CID is only valid if it is the prefix of the src value
+                $local = (stripos(ltrim($src), 'cid:') === 0);
 
                 // Split the src URL and get the extension
-                $part = parse_url($match[3], PHP_URL_PATH);
-                $path = explode('.', $part);
+                $part = parse_url($src, PHP_URL_PATH);
+                $path = explode('.', (string) $part);
                 $ext = preg_split('/[^A-Za-z]/', end($path))[0];
 
                 if (!$local && (($exclude && $display) || !in_array($ext, $allowed)))
@@ -473,12 +508,13 @@ class Format {
                 else
                     return $match[0];
             },
-            $input);
+            $input
+        );
 
         return $input;
     }
 
-    function striptags($var, $decode=true) {
+    static function striptags($var, $decode=true) {
 
         if(is_array($var))
             return array_map(array('Format','striptags'), $var, array_fill(0, count($var), $decode));
@@ -487,7 +523,7 @@ class Format {
     }
 
     // Strip all Emoticon/Emoji characters until we support them
-    function strip_emoticons($text) {
+    static function strip_emoticons($text) {
         return preg_replace(array(
                 '/[\x{1F601}-\x{1F64F}]/u', # Emoticons
                 '/[\x{1F680}-\x{1F6C0}]/u', # Transport/Map
@@ -510,17 +546,18 @@ class Format {
                 '/[\x{23E0}-\x{23EF}]/u',   # More Buttons
                 '/[\x{2310}-\x{231F}]/u',   # Hourglass/Watch
                 '/[\x{1000B6}]/u',          # Private Use Area (Plane 16)
-                '/[\x{2322}-\x{232F}]/u'    # Keyboard
+                '/[\x{2322}-\x{232F}]/u',   # Keyboard
+                '/\x{00B0}|\x{00BA}/u'      # Degree Symbol
             ), '', $text);
     }
 
     // Insert </br> tag inside empty <p> tags to ensure proper editor spacing
-    function editor_spacing($text) {
+    static function editor_spacing($text) {
         return preg_replace('/<p><\/p>/', '<p><br></p>', $text);
     }
 
     //make urls clickable. Mainly for display
-    function clickableurls($text, $target='_blank') {
+    static function clickableurls($text, $target='_blank') {
         global $ost;
 
         // Find all text between tags
@@ -553,23 +590,27 @@ class Format {
             $text);
     }
 
-    function stripEmptyLines($string) {
+    static function stripEmptyLines($string) {
         return preg_replace("/\n{3,}/", "\n\n", trim($string));
     }
 
 
-    function viewableImages($html, $options=array()) {
+    static function viewableImages($html, $options=array(), $format=false) {
         $cids = $images = array();
         $options +=array(
                 'disposition' => 'inline');
-        return preg_replace_callback('/"cid:([\w._-]{32})"/',
+        $html = preg_replace_callback('/("|&quot;)cid:([\w._-]{32})("|&quot;)/',
         function($match) use ($options, $images) {
-            if (!($file = AttachmentFile::lookup($match[1])))
+            if (!($file = AttachmentFile::lookup($match[2])))
+                return $match[0];
+
+            if (!$file->isInlineSafeImage())
                 return $match[0];
 
             return sprintf('"%s" data-cid="%s"',
-                $file->getDownloadUrl($options), $match[1]);
+                $file->getDownloadUrl($options), $match[2]);
         }, $html);
+        return $format ? Format::htmlchars($html, true) : $html;
     }
 
 
@@ -583,7 +624,7 @@ class Format {
      * @param array $array The array to implode
      * @return string The imploded array
     */
-    function array_implode( $glue, $separator, $array ) {
+    static function array_implode( $glue, $separator, $array ) {
 
         if ( !is_array( $array ) ) return $array;
 
@@ -598,7 +639,7 @@ class Format {
         return implode( $separator, $string );
     }
 
-    function number($number, $locale=false) {
+    static function number($number, $locale=false) {
         if (is_array($number))
             return array_map(array('Format','number'), $number);
 
@@ -619,7 +660,7 @@ class Format {
      * TODO: Combine this routine with Format::number and pass in type of
      * formatting.
      */
-    function ordinalsuffix($number, $locale=false) {
+    static function ordinalsuffix($number, $locale=false) {
         if (is_array($number))
             return array_map(array('Format', 'ordinalsuffix'), $number);
 
@@ -646,7 +687,7 @@ class Format {
     }
 
     /* elapsed time */
-    function elapsedTime($sec) {
+    static function elapsedTime($sec) {
 
         if(!$sec || !is_numeric($sec)) return "";
 
@@ -660,7 +701,7 @@ class Format {
         return $tstring;
     }
 
-    function __formatDate($timestamp, $format, $fromDb, $dayType, $timeType,
+    static function __formatDate($timestamp, $format, $fromDb, $dayType, $timeType,
             $strftimeFallback, $timezone, $user=false) {
         global $cfg;
         static $cache;
@@ -701,7 +742,7 @@ class Format {
 
     // IntDateFormat
     // Format datetime to desired format in accorrding to desired locale
-    function IntDateFormat(DateTime $datetime, $format, $options=array()) {
+    static function IntDateFormat(DateTime $datetime, $format, $options=array()) {
         global $cfg;
 
         if (!$datetime instanceof DateTime)
@@ -730,11 +771,12 @@ class Format {
         if ($cfg && $cfg->isForce24HourTime())
             $format = str_replace('X', 'R', $format);
 
+        // TODO: Deprecated; replace this soon
         return strftime($format, $timestamp);
     }
 
     // Normalize ambiguous timezones
-    function timezone($tz, $default=false) {
+    static function timezone($tz, $default=false) {
 
         // Translate ambiguous 'GMT' timezone
         if ($tz == 'GMT')
@@ -765,7 +807,7 @@ class Format {
         return $tz;
     }
 
-    function parseDateTime($date, $locale=null, $format=false) {
+    static function parseDateTime($date, $locale=null, $format=false) {
         global $cfg;
 
         if (!$date)
@@ -795,7 +837,7 @@ class Format {
         return $datetime;
     }
 
-    function time($timestamp, $fromDb=true, $format=false, $timezone=false, $user=false) {
+    static function time($timestamp, $fromDb=true, $format=false, $timezone=false, $user=false) {
         global $cfg;
 
         return self::__formatDate($timestamp,
@@ -804,7 +846,7 @@ class Format {
             '%X', $timezone ?: $cfg->getTimezone(), $user);
     }
 
-    function date($timestamp, $fromDb=true, $format=false, $timezone=false, $user=false) {
+    static function date($timestamp, $fromDb=true, $format=false, $timezone=false, $user=false) {
         global $cfg;
 
         return self::__formatDate($timestamp,
@@ -813,7 +855,7 @@ class Format {
             '%x', $timezone ?: $cfg->getTimezone(), $user);
     }
 
-    function datetime($timestamp, $fromDb=true, $format=false,  $timezone=false, $user=false) {
+    static function datetime($timestamp, $fromDb=true, $format=false,  $timezone=false, $user=false) {
         global $cfg;
 
         return self::__formatDate($timestamp,
@@ -822,7 +864,7 @@ class Format {
                 '%x %X', $timezone ?: $cfg->getTimezone(), $user);
     }
 
-    function daydatetime($timestamp, $fromDb=true, $format=false,  $timezone=false, $user=false) {
+    static function daydatetime($timestamp, $fromDb=true, $format=false,  $timezone=false, $user=false) {
         global $cfg;
 
         return self::__formatDate($timestamp,
@@ -831,7 +873,7 @@ class Format {
                 '%x %X', $timezone ?: $cfg->getTimezone(), $user);
     }
 
-    function getStrftimeFormat($format) {
+    static function getStrftimeFormat($format) {
         static $codes, $ids;
 
         if (!isset($codes)) {
@@ -894,7 +936,7 @@ class Format {
     }
 
     // Translate php date / time formats to js equivalent
-    function dtfmt_php2js($format) {
+    static function dtfmt_php2js($format) {
 
         $codes = array(
         // Date
@@ -925,13 +967,13 @@ class Format {
 
     // Thanks, http://stackoverflow.com/a/2955878/1025836
     /* static */
-    function slugify($text) {
+    static function slugify($text) {
         // convert special characters to entities
         $text = htmlentities($text, ENT_NOQUOTES, 'UTF-8');
 
         // removes entity suffixes, leaving only un-accented characters
-        $text = preg_replace('~&([A-za-z])(?:acute|cedil|circ|grave|orn|ring|slash|th|tilde|uml);~', '$1', $text);
-        $text = preg_replace('~&([A-za-z]{2})(?:lig);~', '$1', $text);
+        $text = preg_replace('~&([A-Za-z])(?:acute|cedil|circ|grave|orn|ring|slash|th|tilde|uml);~', '$1', $text);
+        $text = preg_replace('~&([A-Za-z]{2})(?:lig);~', '$1', $text);
 
         // replace non letter or digits by -
         $text = preg_replace('~[^\p{L}\p{N}]+~u', '-', $text);
@@ -967,7 +1009,7 @@ class Format {
      * References:
      * http://www.ietf.org/rfc/rfc2397.txt
      */
-    function parseRfc2397($data, $output_encoding=false, $always_convert=true) {
+    static function parseRfc2397($data, $output_encoding=false, $always_convert=true) {
         if (substr($data, 0, 5) != "data:")
             return array('data'=>$data, 'type'=>'text/plain');
 
@@ -1004,7 +1046,7 @@ class Format {
 
     // Performs Unicode normalization (where possible) and splits words at
     // difficult word boundaries (for far eastern languages)
-    function searchable($text, $lang=false) {
+    static function searchable($text, $lang=false, $length=false) {
         global $cfg;
 
         if (function_exists('normalizer_normalize')) {
@@ -1036,10 +1078,14 @@ class Format {
             // Drop leading and trailing whitespace
             $text = trim($text);
         }
+
+        if ($length && (str_word_count($text) > $length))
+            return null;
+
         return $text;
     }
 
-    function relativeTime($to, $from=false, $granularity=1) {
+    static function relativeTime($to, $from=false, $granularity=1) {
         if (!$to)
             return false;
         $timestamp = $to;

include/class.forms.php

@@ -25,6 +25,7 @@ class Form {
     var $options = array();
     var $fields = array();
     var $title = '';
+    var $notice = '';
     var $instructions = '';
 
     var $validators = array();
@@ -39,6 +40,8 @@ class Form {
             $this->title = $options['title'];
         if (isset($options['instructions']))
             $this->instructions = $options['instructions'];
+        if (isset($options['notice']))
+            $this->notice = $options['notice'];
         if (isset($options['id']))
             $this->id = $options['id'];
 
@@ -53,6 +56,10 @@ class Form {
         $this->id = $id;
     }
 
+    function setNotice($notice) {
+        $this->notice = $notice;
+    }
+
     function data($source) {
         foreach ($this->fields as $name=>$f)
             if (isset($source[$name]))
@@ -112,6 +119,7 @@ class Form {
     }
 
     function getTitle() { return $this->title; }
+    function getNotice() { return $this->notice; }
     function getInstructions() { return Format::htmldecode($this->instructions); }
     function getSource() { return $this->_source; }
     function setSource($source) { $this->_source = $source; }
@@ -159,30 +167,54 @@ class Form {
         }
         return $this->_clean;
     }
+    /*
+     * Transform form data to database ready clean data.
+     *
+     */
+    function to_db($clean=null, $validate=true) {
+        if (!$clean
+                && !$this->isValid()
+                && !($clean=$this->getClean($validate)))
+            return false;
+        $data = [];
+        foreach ($clean as $name => $val) {
+            if (!($f = $this->getField($name)))
+                continue;
+            try {
+                $data[$name] = $f->to_database($val);
+            } catch (FieldUnchanged $e) {
+                // Unset field if it's unchanged...mainly
+                // useful for Secret/PasswordField
+                unset($data[$name]);
+            }
+        }
+        return $data;
+    }
 
     /*
      * Process the form input and return clean data.
      *
-     * It's similar to getClean but forms downstream can use it to return
-     * database ready data.
+     * It's similar to to_db but forms downstream can use it to skip or add
+     * extra validations
+
      */
     function process($validate=true) {
-        return $this->getClean($validate);
+        return $this->to_db($validate);
     }
 
+
     function errors($formOnly=false) {
         return ($formOnly) ? $this->_errors['form'] : $this->_errors;
     }
 
     function addError($message, $index=false) {
-
         if ($index)
             $this->_errors[$index] = $message;
         else
             $this->_errors['form'][] = $message;
     }
 
-    function addErrors($errors=array()) {
+    function addErrors($errors=[]) {
         foreach ($errors as $k => $v) {
             if (($f=$this->getField($k)))
                 $f->addError($v);
@@ -202,6 +234,9 @@ class Form {
             $this->title = $options['title'];
         if (isset($options['instructions']))
             $this->instructions = $options['instructions'];
+        if (isset($options['notice']))
+            $this->notice = $options['notice'];
+
         $form = $this;
         $template = $options['template'] ?: 'dynamic-form.tmpl.php';
         if (isset($options['staff']) && $options['staff'])
@@ -434,9 +469,14 @@ implements FormRenderer {
 ?>
       <table class="<?php echo 'grid form' ?>">
           <caption><?php echo Format::htmlchars($this->title ?: $form->getTitle()); ?>
-                  <div><small><?php echo Format::viewableImages($form->getInstructions()); ?></small></div>
-          </caption>
-          <tbody><tr><?php for ($i=0; $i<12; $i++) echo '<td style="width:8.3333%"/>'; ?></tr></tbody>
+            <div><small><?php echo Format::viewableImages($form->getInstructions()); ?></small></div>
+            <?php
+            if ($form->getNotice())
+                echo sprintf('<div><small><p id="msg_warning">%s</p></small></div>',
+                        Format::htmlchars($form->getNotice()));
+            ?>
+        </caption>
+        <tbody><tr><?php for ($i=0; $i<12; $i++) echo '<td style="width:8.3333%"/>'; ?></tr></tbody>
 <?php
       $row_size = 12;
       $cols = $row = 0;
@@ -580,7 +620,7 @@ class FormField {
     static $more_types = array();
     static $uid = null;
 
-    function _uid() {
+    static function _uid() {
         return ++self::$uid;
     }
 
@@ -604,7 +644,7 @@ class FormField {
             foreach (static::$more_types as $group => $entries)
                 foreach ($entries as $c)
                     static::$types[$group] = array_merge(
-                            static::$types[$group] ?: array(), call_user_func($c));
+                            static::$types[$group] ?? array(), call_user_func($c));
 
             static::$more_types = array();
         }
@@ -677,6 +717,12 @@ class FormField {
     function errors() {
         return $this->_errors;
     }
+
+    function resetErrors() {
+        $this->_errors = [];
+        return !($this->_errors);
+    }
+
     function addError($message, $index=false) {
         if ($index)
             $this->_errors[$index] = $message;
@@ -1234,7 +1280,7 @@ class FormField {
      * the default value will be reflected in the returned configuration.
      */
     function getConfiguration() {
-        if (!$this->_config) {
+        if (!isset($this->_config)) {
             $this->_config = $this->get('configuration');
             if (is_string($this->_config))
                 $this->_config = JsonDataParser::parse($this->_config);
@@ -1495,7 +1541,7 @@ class TextboxField extends FormField {
                 function($v) use ($config) {
                     $regex = $config['regex'];
                     return @preg_match($regex, $v);
-                }, __('Value does not match required pattern')
+                }, $config['validator-error'] ?? __('Value does not match required pattern')
             ),
         );
         // Support configuration forms, as well as GUI-based form fields
@@ -1539,6 +1585,15 @@ class PasswordField extends TextboxField {
             $this->set('validator', 'password');
     }
 
+    protected function getMasterKey() {
+        return SECRET_SALT;
+    }
+
+    protected function getSubKey() {
+        $config = $this->getConfiguration();
+        return $config['key'] ?: 'pwfield';
+    }
+
     function parse($value) {
         // Don't trim the value
         return $value;
@@ -1548,11 +1603,13 @@ class PasswordField extends TextboxField {
         // If not set in UI, don't save the empty value
         if (!$value)
             throw new FieldUnchanged();
-        return Crypto::encrypt($value, SECRET_SALT, 'pwfield');
+        return Crypto::encrypt($value, $this->getMasterKey(),
+                $this->getSubKey());
     }
 
     function to_php($value) {
-        return Crypto::decrypt($value, SECRET_SALT, 'pwfield');
+        return Crypto::decrypt($value, $this->getMasterKey(),
+                $this->getSubKey());
     }
 }
 
@@ -1732,6 +1789,10 @@ class BooleanField extends FormField {
         return ($value) ? __('Yes') : __('No');
     }
 
+    function asVar($value, $id=false) {
+        return $this->toString($value);
+    }
+
     function getClean($validate=true) {
         if (!isset($this->_clean)) {
             $this->_clean = (isset($this->value))
@@ -1806,7 +1867,10 @@ class ChoiceField extends FormField {
                 'id'=>1, 'label'=>__('Choices'), 'required'=>false, 'default'=>'',
                 'hint'=>__('List choices, one per line. To protect against spelling changes, specify key:value names to preserve entries if the list item names change.</br><b>Note:</b> If you have more than two choices, use a List instead.'),
                 'validator'=>'choices',
-                'configuration'=>array('html'=>false)
+                'configuration'=>array(
+                    'html' => false,
+                    'disabled' => false,
+                    )
             )),
             'default' => new TextboxField(array(
                 'id'=>3, 'label'=>__('Default'), 'required'=>false, 'default'=>'',
@@ -2025,7 +2089,7 @@ class ChoiceField extends FormField {
         $name = $name ?: $this->get('name');
         $val = $value;
         if ($value && is_array($value))
-            $val = '"?'.implode('("|,|$)|"?', array_keys($value)).'("|,|$)';
+            $val = '"?(?<![0-9])'.implode('("|,|$)|"?(?<![0-9])', array_keys($value)).'("|,|$)';
         switch ($method) {
         case '!includes':
             return Q::not(array("{$name}__regex" => $val));
@@ -2058,18 +2122,19 @@ class ChoiceField extends FormField {
     function applyQuickFilter($query, $qf_value, $name=false) {
         global $thisstaff;
 
+        $field = new AssigneeChoiceField();
         //special assignment quick filters
         switch (true) {
             case ($qf_value == 'assigned'):
             case ($qf_value == '!assigned'):
-                $result = AssigneeChoiceField::getSearchQ($qf_value, $qf_value);
+                $result = $field->getSearchQ($qf_value, $qf_value);
                 return $query->filter($result);
             case (strpos($qf_value, 's') !== false):
             case (strpos($qf_value, 't') !== false):
             case ($qf_value == 'M'):
             case ($qf_value == 'T'):
                 $value = array($qf_value => $qf_value);
-                $result = AssigneeChoiceField::getSearchQ('includes', $value);
+                $result = $field->getSearchQ('includes', $value);
                 return $query->filter($result);
                 break;
         }
@@ -2207,7 +2272,7 @@ class DatetimeField extends FormField {
         return $this->max;
     }
 
-    function getPastPresentLabels() {
+    static function getPastPresentLabels() {
       return array(__('Create Date'), __('Reopen Date'),
                     __('Close Date'), __('Last Update'));
     }
@@ -2504,26 +2569,26 @@ class DatetimeField extends FormField {
                 "{$name}__lte" =>  $right->format('Y-m-d H:i:s'),
             ));
         case 'ndaysago':
-            $int = $intervals[$value['int'] ?: 'd'] ?: 'DAY';
+            $int = $intervals[(string) $value['int'] ?: 'd'] ?: 'DAY';
             $interval = new SqlInterval($int, $value['until']);
             return new Q(array(
                 "{$name}__range" => array($now->minus($interval), $now),
             ));
         case 'ndays':
-            $int = $intervals[$value['int'] ?: 'd'] ?: 'DAY';
+            $int = $intervals[(string) $value['int'] ?: 'd'] ?: 'DAY';
             $interval = new SqlInterval($int, $value['until']);
             return new Q(array(
                 "{$name}__range" => array($now, $now->plus($interval)),
             ));
         // Distant past and future ranges
         case 'distpast':
-            $int = $intervals[$value['int'] ?: 'd'] ?: 'DAY';
+            $int = $intervals[(string) $value['int'] ?: 'd'] ?: 'DAY';
             $interval = new SqlInterval($int, $value['until']);
             return new Q(array(
                 "{$name}__lte" => $now->minus($interval),
             ));
         case 'distfut':
-            $int = $intervals[$value['int'] ?: 'd'] ?: 'DAY';
+            $int = $intervals[(string) $value['int'] ?: 'd'] ?: 'DAY';
             $interval = new SqlInterval($int, $value['until']);
             return new Q(array(
                 "{$name}__gte" => $now->plus($interval),
@@ -2700,6 +2765,14 @@ class SectionBreakField extends FormField {
     function isBlockLevel() {
         return true;
     }
+
+    function isEditableToStaff() {
+        return $this->isVisibleToStaff();
+    }
+
+    function isEditableToUsers() {
+        return $this->isVisibleToUsers();
+    }
 }
 
 class ThreadEntryField extends FormField {
@@ -2853,7 +2926,7 @@ class TopicField extends ChoiceField {
     }
 
     function whatChanged($before, $after) {
-        return FormField::whatChanged($before, $after);
+        return parent::whatChanged($before, $after);
     }
 
     function searchable($value) {
@@ -2961,7 +3034,7 @@ class SLAField extends ChoiceField {
     }
 
     function whatChanged($before, $after) {
-        return FormField::whatChanged($before, $after);
+        return parent::whatChanged($before, $after);
     }
 
     function searchable($value) {
@@ -3077,7 +3150,7 @@ class PriorityField extends ChoiceField {
     }
 
     function whatChanged($before, $after) {
-        return FormField::whatChanged($before, $after);
+        return parent::whatChanged($before, $after);
     }
 
     function searchable($value) {
@@ -3158,7 +3231,7 @@ class TimezoneField extends ChoiceField {
     }
 
     function whatChanged($before, $after) {
-        return FormField::whatChanged($before, $after);
+        return parent::whatChanged($before, $after);
     }
 
     function searchable($value) {
@@ -3199,7 +3272,7 @@ class DepartmentField extends ChoiceField {
 
         $config = $this->getConfiguration();
         $staff = $config['staff'] ?: $thisstaff;
-        $selected = self::getWidget();
+        $selected = $this->getWidget();
         if($selected && $selected->value) {
           if(is_array($selected->value)) {
             foreach ($selected->value as $k => $v) {
@@ -3263,7 +3336,7 @@ class DepartmentField extends ChoiceField {
 
     function getValue() {
          if (($value = parent::getValue()) && ($id=$this->getClean()))
-            return $value[$id];
+            return is_array($value) ? $value[$id] : $value;
      }
 
     function to_php($value, $id=false) {
@@ -3526,10 +3599,10 @@ class AssigneeField extends ChoiceField {
                 $name = $value->getName();
             }
 
-            return array(JsonDataEncoder::encode(array($key => $name)));
+            return JsonDataEncoder::encode(array($key => $name));
         }
         if (is_array($value)) {
-            return array(JsonDataEncoder::encode($value[0]));
+            return JsonDataEncoder::encode($value[0]);
         }
         return $value;
     }
@@ -3562,7 +3635,7 @@ class AssigneeField extends ChoiceField {
         // Compare old and new
         return ($old == $new)
             ? false
-            : array($old[0], $new[0]);
+            : array($old, $new);
     }
 
     function whatChanged($before, $after) {
@@ -3807,6 +3880,10 @@ class FileUploadField extends FormField {
                 'hint'=>__('Optionally, enter comma-separated list of additional file types, by extension. (e.g .doc, .pdf).'),
                 'configuration'=>array('html'=>false, 'rows'=>2),
             )),
+            'strictmimecheck' => new BooleanField([
+                'id' => 4, 'label'=>__('Strict Mime Type Check'), 'required' => false, 'default' => false,
+                'hint' => 'File Mime Type associations is OS dependent',
+                'configuration' => ['desc' => __('Enable strict Mime Type check')]]),
             'max' => new TextboxField(array(
                 'label'=>__('Maximum Files'),
                 'hint'=>__('Users cannot upload more than this many files.'),
@@ -3831,8 +3908,9 @@ class FileUploadField extends FormField {
             Http::response(400, 'Send one file at a time');
         $file = array_shift($files);
         $file['name'] = urldecode($file['name']);
+        $config = $this->getConfiguration();
 
-        if (!$this->isValidFile($file))
+        if (!self::isValidFile($file, $config['strictmimecheck']))
             Http::response(413, 'Invalid File');
 
         if (!$bypass && !$this->isValidFileType($file['name'], $file['type']))
@@ -3861,10 +3939,11 @@ class FileUploadField extends FormField {
         if (!$this->isValidFileType($file['name'], $file['type']))
             throw new FileUploadError(__('File type is not allowed'));
 
-        if (!$this->isValidFile($file))
+        $config = $this->getConfiguration();
+
+        if (!self::isValidFile($file, $config['strictmimecheck']))
              throw new FileUploadError(__('Invalid File'));
 
-        $config = $this->getConfiguration();
         if ($file['size'] > $config['size'])
             throw new FileUploadError(__('File size is too large'));
 
@@ -3901,13 +3980,25 @@ class FileUploadField extends FormField {
         return $F;
     }
 
-    function isValidFile($file) {
+    /**
+     * Strict mode can be enabled in Admin Panel > Settings > Tickets
+     *
+     * PS: Please note that the a mismatch can happen if the mime types
+     * database is not up to date or a little different compared to what the
+     * browser reports.
+     **/
+    static function isValidFile($file, $strict = false) {
+        // Strict mime check
+        if ($strict
+            && !empty($file['type'])
+            && FileObject::mimecmp($file['tmp_name'], $file['type']))
+            return false;
 
         // Check invalid image hacks
         if ($file['tmp_name']
                 && stripos($file['type'], 'image/') === 0
-                && function_exists('exif_imagetype')
-                && !exif_imagetype($file['tmp_name']))
+                && !(exif_imagetype($file['tmp_name'])
+                    || mime_content_type($file['tmp_name']) === 'image/svg+xml'))
             return false;
 
         return true;
@@ -3964,7 +4055,11 @@ class FileUploadField extends FormField {
     }
 
     function getConfiguration() {
+        global $cfg;
+
         $config = parent::getConfiguration();
+        // If no size present default to system setting
+        $config['size'] ??= $cfg->getMaxFileSize();
         $_types = self::getFileTypes();
         $mimetypes = array();
         $extensions = array();
@@ -4024,7 +4119,7 @@ class FileUploadField extends FormField {
         if (isset($this->attachments) && $this->attachments) {
             $this->attachments->keepOnlyFileIds($value);
         }
-        return JsonDataEncoder::encode($value);
+        return JsonDataEncoder::encode($value) ?? NULL;
     }
 
     function parse($value) {
@@ -4348,6 +4443,8 @@ class TextboxWidget extends Widget {
                     if ($v)
                         $attrs['data-translate-tag'] =  '"'.$v.'"';
                     break;
+                case 'length':
+                    $k = 'maxlength';
                 case 'size':
                 case 'maxlength':
                     if ($v && is_numeric($v))
@@ -4415,8 +4512,9 @@ class PasswordWidget extends TextboxWidget {
 
     function render($mode=false, $extra=false) {
         $extra = array();
-        if ($this->field->value) {
-            $extra['placeholder'] = '••••••••••••';
+        if (isset($this->field->value)) {
+            $extra['placeholder'] = str_repeat('•',
+                    strlen($this->field->value));
         }
         return parent::render($mode, $extra);
     }
@@ -4586,6 +4684,8 @@ class ChoicesWidget extends Widget {
                 echo ' data-'.$D.'="'.Format::htmlchars($V).'"';
             ?>
             data-placeholder="<?php echo Format::htmlchars($prompt); ?>"
+            <?php if ($config['disabled'])
+                echo ' disabled="disabled"'; ?>
             <?php if ($config['multiselect'])
                 echo ' multiple="multiple"'; ?>>
             <?php if ($showdefault || (!$have_def && !$config['multiselect'])) { ?>
@@ -5148,6 +5248,8 @@ class FileUploadWidget extends Widget {
     );
 
     function render($options=array()) {
+        global $ost;
+
         $config = $this->field->getConfiguration();
         $name = $this->field->getFormName();
         $id = substr(md5(spl_object_hash($this)), 10);
@@ -5211,7 +5313,7 @@ class FileUploadWidget extends Widget {
         // Get Form Type
         $type = $this->field->getForm()->type;
         // Determine if for Ticket/Task/Custom
-        if ($type) {
+        if ($type && !is_numeric($field_id)) {
             if ($type == 'T')
                 $field_id = 'ticket/attach';
             elseif ($type == 'A')
@@ -5233,6 +5335,7 @@ class FileUploadWidget extends Widget {
           url: 'ajax.php/form/upload/<?php echo $field_id; ?>',
           link: $('#<?php echo $id; ?>').find('a.manual'),
           paramname: 'upload[]',
+          data: {"__CSRFToken__": "<?php echo $ost->getCSRF()->getToken(); ?>"},
           fallback_id: 'file-<?php echo $id; ?>',
           allowedfileextensions: <?php echo JsonDataEncoder::encode(
             $config['__extensions'] ?: array()); ?>,
@@ -5335,6 +5438,14 @@ class FreeTextField extends FormField {
         return true;
     }
 
+    function isEditableToStaff() {
+        return $this->isVisibleToStaff();
+    }
+
+    function isEditableToUsers() {
+        return $this->isVisibleToUsers();
+    }
+
     /* utils */
 
     function to_config($config) {
@@ -5619,7 +5730,7 @@ class AssignmentForm extends Form {
                     'id'=>2, 'label'=>'', 'required'=>false,
                     'default'=>false,
                     'configuration'=>array(
-                        'desc' => 'Maintain referral access to current assignees')
+                        'desc' => __('Maintain referral access to current assignees'))
                     )
                 ),
             'comments' => new TextareaField(array(
@@ -6033,7 +6144,7 @@ class TransferForm extends Form {
             'refer' => new BooleanField(array(
                 'id'=>2, 'label'=>'', 'required'=>false, 'default'=>false,
                 'configuration'=>array(
-                    'desc' => 'Maintain referral access to current department')
+                    'desc' => __('Maintain referral access to current department'))
             )),
             'comments' => new TextareaField(array(
                     'id' => 3,
@@ -6075,7 +6186,7 @@ class TransferForm extends Form {
             break;
         default:
             throw new Exception(sprintf(__('%s: Unknown template style %s'),
-                        get_class(), $options['template']));
+                        get_class($this), $options['template']));
         }
 
         $form = $this;

include/class.http.php

@@ -15,7 +15,7 @@
 **********************************************************************/
 class Http {
 
-    function header_code_verbose($code) {
+    static function header_code_verbose($code) {
         switch($code):
         case 200: return '200 OK';
         case 201: return '201 Created';
@@ -33,7 +33,7 @@ class Http {
         endswitch;
     }
 
-    function response($code,$content=false,$contentType='text/html',$charset='UTF-8') {
+    static function response($code,$content=false,$contentType='text/html',$charset='UTF-8') {
 
         header('HTTP/1.1 '.Http::header_code_verbose($code));
 		header('Status: '.Http::header_code_verbose($code)."\r\n");
@@ -53,7 +53,7 @@ class Http {
      *  Flush the content to requester without exiting
      *
      */
-    function flush($code, $content, $contentType='text/html', $charset='UTF-8') {
+    static function flush($code, $content, $contentType='text/html', $charset='UTF-8') {
         self::response($code, null, $contentType, $charset);
         header('Cache-Control: no-cache, must-revalidate');
         header('Content-Length: '.strlen($content)."\r\n\r\n");
@@ -66,7 +66,7 @@ class Http {
             fastcgi_finish_request();
     }
 
-    function redirect($url,$delay=0,$msg='') {
+    static function redirect($url,$delay=0,$msg='') {
 
         $iis = strpos($_SERVER['SERVER_SOFTWARE'], 'IIS') !== false;
         @list($name, $version) = explode('/', $_SERVER['SERVER_SOFTWARE']);
@@ -84,7 +84,7 @@ class Http {
         exit;
     }
 
-    function cacheable($etag, $modified=false, $ttl=3600) {
+    static function cacheable($etag, $modified=false, $ttl=3600) {
         // Thanks, http://stackoverflow.com/a/1583753/1025836
         // Timezone doesn't matter here — but the time needs to be
         // consistent round trip to the browser and back.
@@ -108,21 +108,17 @@ class Http {
      * is browser dependent, so the user agent is inspected to determine the
      * best encoding format for the filename
      */
-    function getDispositionFilename($filename) {
+    static function getDispositionFilename($filename) {
         $user_agent = strtolower ($_SERVER['HTTP_USER_AGENT']);
         if (false !== strpos($user_agent,'msie')
                 && false !== strpos($user_agent,'win'))
             return 'filename='.rawurlencode($filename);
-        elseif (false !== strpos($user_agent, 'safari')
-                && false === strpos($user_agent, 'chrome'))
-            // Safari and Safari only can handle the filename as is
-            return 'filename='.str_replace(',', '', $filename);
         else
             // Use RFC5987
             return "filename*=UTF-8''".rawurlencode($filename);
     }
 
-    function download($filename, $type, $data=null, $disposition='attachment') {
+    static function download($filename, $type, $data=null, $disposition='attachment') {
         if (strpos($type, 'image/') !== false && preg_match('/image\/.*\+.*/', $type))
           $disposition='attachment';
 
@@ -151,5 +147,59 @@ class Http {
 
         return http_build_query($vars, '', $separator);
     }
+
+    static function domain() {
+        $domain = null;
+        if (isset($_SERVER['HTTP_HOST'])
+                && strpos($_SERVER['HTTP_HOST'], '.') !== false
+                && !Validator::is_ip($_SERVER['HTTP_HOST']))
+            // Remote port specification, as it will make an invalid domain
+            list($domain) = explode(':', $_SERVER['HTTP_HOST']);
+
+        return $domain;
+    }
+
+    // Get current url
+    static function url() {
+        // Scheme + Host.
+        $https =  osTicket::is_https();
+        $url  = sprintf('http%s://%s',
+                $https ? 's' : '',
+                $_SERVER['HTTP_HOST']);
+        //  Add Port if not 80 and not https
+        $port = osTicket::get_client_port();
+        if ($port && $port != 80 && !$https && !str_contains($url, $port))
+            $url .= ":{$port}";
+        // Path + Query string
+        if (isset($_SERVER['REQUEST_URI']))
+            $url  .= $_SERVER['REQUEST_URI'];
+        else
+            $url  .= sprintf('%s?$s',
+                    $_SERVER['PHP_SELF'], $_SERVER['QUERY_STRING']);
+
+        return $url;
+    }
+
+    // Parse path from given url or the current url
+    static function url_path(?string $url = null, bool $htmlentities = true) {
+        $path = parse_url($url ?: self::url(), PHP_URL_PATH);
+        return ($htmlentities && $path)
+            ? htmlentities($path) : $path;
+    }
+
+    // Parse query string from current url
+    static function query_string(?string $url = null) {
+        return parse_url($url ?: self::url(), PHP_URL_QUERY);
+    }
+
+    // Refresh url
+    static function refresh_url(array $queryFilter = []) {
+        $url = self::url();
+        $refresh_url = self::url_path($url);
+        if (($qs=self::query_string($url)))
+            $refresh_url .= sprintf('?%s',
+                    Format::http_query_string($qs, $queryFilter));
+        return $refresh_url;
+    }
 }
 ?>

include/class.i18n.php

@@ -49,14 +49,14 @@ class Internationalization {
     function loadDefaultData() {
         # notrans -- do not translate the contents of this array
         $models = array(
-            'department.yaml' =>    'Dept::__create',
             'sla.yaml' =>           'SLA::__create',
+            'department.yaml' =>    'Dept::__create',
             'form.yaml' =>          'DynamicForm::create',
             'list.yaml' =>          'DynamicList::create',
             // Note that department, sla, and forms are required for
             // help_topic
             'help_topic.yaml' =>    'Topic::__create',
-            'filter.yaml' =>        'Filter::create',
+            'filter.yaml' =>        'Filter::__create',
             'team.yaml' =>          'Team::__create',
             // Organization
             'organization.yaml' =>  'Organization::__create',
@@ -182,7 +182,7 @@ class Internationalization {
         global $thisstaff, $thisclient;
 
         $langs = self::availableLanguages();
-        $lang = strtolower($lang);
+        $lang = str_replace('-', '_', strtolower($lang));
         if (isset($langs[$lang])) {
             $info = &$langs[$lang];
             if (!isset($info['desc'])) {
@@ -213,7 +213,7 @@ class Internationalization {
 
     static function getLanguageInfo($lang) {
         $langs = self::availableLanguages();
-        return @$langs[strtolower($lang)] ?: array();
+        return @$langs[str_replace('-', '_', strtolower($lang))] ?: array();
     }
 
     static function availableLanguages($base=I18N_DIR) {
@@ -240,7 +240,7 @@ class Internationalization {
                     'code' => $base,
                 );
                 $installed[strtolower($base)]['flag'] = strtolower(
-                    $langs[$code]['flag'] ?: $locale ?: $code
+                    ($langs[$code]['flag'] ?? $locale) ?: $code
                 );
             }
         }
@@ -251,7 +251,7 @@ class Internationalization {
 
     static function isLanguageInstalled($code) {
         $langs = self::availableLanguages();
-        return isset($langs[strtolower($code)]);
+        return isset($langs[strtolower((string) $code)]);
     }
 
     static function isLanguageEnabled($code) {
@@ -382,7 +382,7 @@ class Internationalization {
                 return $lang;
 
         // Support the flag buttons for guests
-        if ((!$user || $user != $thisstaff) && $_SESSION['::lang'])
+        if ((!$user || $user != $thisstaff) && isset($_SESSION['::lang']))
             return $_SESSION['::lang'];
 
         return self::getDefaultLanguage();
@@ -465,11 +465,11 @@ class Internationalization {
         // Create formatter && cache
         $cache[$k] = $formatter = new IntlDateFormatter(
                 $options['locale'],
-                $options['daytype'] ?: null,
-                $options['timetype'] ?: null,
-                $options['timezone'] ?: null,
-                $options['calendar'] ?: IntlDateFormatter::GREGORIAN,
-                $options['pattern'] ?: null
+                $options['daytype'] ?? null,
+                $options['timetype'] ?? null,
+                $options['timezone'] ?? null,
+                $options['calendar'] ?? IntlDateFormatter::GREGORIAN,
+                $options['pattern'] ?? null
                 );
 
         return $formatter;

include/class.import.php

@@ -31,8 +31,6 @@ class CsvImporter {
     function __construct($stream) {
         // File upload
         if (is_array($stream) && !$stream['error']) {
-            // Properly detect Macintosh style line endings
-            ini_set('auto_detect_line_endings', true);
             $this->stream = fopen($stream['tmp_name'], 'r');
             // Skip Byte Order Mark (BOM) if present
             if (!self::isBOM(fgets($this->stream, 4)))
@@ -65,7 +63,7 @@ class CsvImporter {
                 $named_fields[$f->get('name')] = $f;
 
         // Read the first row and see if it is a header or not
-        if (!($data = fgetcsv($this->stream, 1000, ",")))
+        if (!($data = fgetcsv($this->stream, 1000, ",", "\"", "")))
             throw new ImportError(__('Whoops. Perhaps you meant to send some CSV records'));
 
         $headers = array();
@@ -172,7 +170,7 @@ implements Iterator {
 
     function next() {
         do {
-            if (($csv = fgetcsv($this->stream, 4096, ",")) === false) {
+            if (($csv = fgetcsv($this->stream, 4096, ",", "\"", "")) === false) {
                 // Read error
                 $this->current = false;
                 break;
@@ -191,7 +189,7 @@ implements Iterator {
             foreach ($this->headers as $h => $label) {
                 $f = $this->fields[$h];
                 $f->_errors = array();
-                $T = $f->parse($csv[$i]);
+                $T = $f->parse(trim($csv[$i]));
                 if ($f->validateEntry($T) && $f->errors())
                     throw new ImportDataError(sprintf(__(
                         /* 1 will be a field label, and 2 will be error messages */

include/class.json.php

@@ -21,7 +21,7 @@
 include_once "JSON.php";
 
 class JsonDataParser {
-    function parse($stream, $tidy=false) {
+    static function parse($stream, $tidy=false) {
         if (is_resource($stream)) {
             $contents = '';
             while (!feof($stream))
@@ -54,7 +54,7 @@ class JsonDataParser {
         return trim($content);
     }
 
-    function lastError() {
+    static function lastError() {
         if (function_exists("json_last_error")) {
             $errors = array(
             JSON_ERROR_NONE => __('No errors'),
@@ -75,7 +75,7 @@ class JsonDataParser {
 }
 
 class JsonDataEncoder {
-    function encode($var) {
+    static function encode($var) {
         if (function_exists('json_encode'))
             return json_encode($var);
         else {

include/class.list.php

@@ -181,7 +181,7 @@ class DynamicList extends VerySimpleModel implements CustomList {
         return ($this->getForm() && $this->getForm()->getFields());
     }
 
-    function getSortModes() {
+    static function sortModes() {
         return array(
             'Alpha'     => __('Alphabetical'),
             '-Alpha'    => __('Alphabetical (Reversed)'),
@@ -189,6 +189,10 @@ class DynamicList extends VerySimpleModel implements CustomList {
         );
     }
 
+    function getSortModes() {
+        return self::sortModes();
+    }
+
     function getSortMode() {
         return $this->sort_mode;
     }
@@ -592,8 +596,6 @@ class DynamicList extends VerySimpleModel implements CustomList {
 
     function importFromPost($stuff, $extra=array()) {
         if (is_array($stuff) && !$stuff['error']) {
-            // Properly detect Macintosh style line endings
-            ini_set('auto_detect_line_endings', true);
             $stream = fopen($stuff['tmp_name'], 'r');
         }
         elseif ($stuff) {
@@ -722,7 +724,7 @@ class DynamicListItem extends VerySimpleModel implements CustomListItem {
     function setConfiguration($vars, &$errors=array()) {
         $config = array();
         foreach ($this->getConfigurationForm($vars)->getFields() as $field) {
-            $config[$field->get('id')] = $field->to_php($field->getClean());
+            $config[$field->get('id')] = $field->to_database($field->getClean());
             $errors = array_merge($errors, $field->errors());
         }
 
@@ -797,13 +799,14 @@ class DynamicListItem extends VerySimpleModel implements CustomListItem {
     }
 
     function display() {
+
+        return $this->getValue();
         //TODO: Allow for display mode (edit, preview or both)
-        return sprintf('%s &nbsp;<a class="preview" href="#"
-                data-preview="#list/%d/items/%d/preview">
-                <i class="icon-info-sign"></i></a>',
-                $this->getValue(),
+        return sprintf('<a class="preview" href="#"
+                data-preview="#list/%d/items/%d/preview">%s</a>',
                 $this->getListId(),
-                $this->getId()
+                $this->getId(),
+                $this->getValue()
                 );
     }
 
@@ -926,9 +929,9 @@ class TicketStatusList extends CustomListHandler {
         $items = TicketStatus::objects();
         if ($filters)
             $items->filter($filters);
-        if ($criteria['limit'])
+        if (isset($criteria['limit']))
             $items->limit($criteria['limit']);
-        if ($criteria['offset'])
+        if (isset($criteria['offset']))
             $items->offset($criteria['offset']);
 
         $items->order_by($this->getListOrderBy());

include/class.log.php

@@ -69,7 +69,7 @@ class Log {
     }
 
     /*** static function ***/
-    function lookup($id){
+    static function lookup($id){
         return ($id && is_numeric($id) && ($l= new Log($id)) && $l->getId()==$id)?$l:null;
     }
 }

include/class.mailer.php

@@ -2,12 +2,12 @@
 /*********************************************************************
     class.mailer.php
 
-    osTicket mailer
+    osTicket/Mail/Mailer
 
-    It's mainly PEAR MAIL wrapper for now (more improvements planned).
+    Wrapper for sending emails via SMTP / SendMail
 
     Peter Rotich <peter@osticket.com>
-    Copyright (c)  2006-2013 osTicket
+    Copyright (c)  osTicket
     http://www.osticket.com
 
     Released under the GNU General Public License WITHOUT ANY WARRANTY.
@@ -15,67 +15,93 @@
 
     vim: expandtab sw=4 ts=4 sts=4:
 **********************************************************************/
-
-include_once(INCLUDE_DIR.'class.email.php');
-require_once(INCLUDE_DIR.'html2text.php');
+namespace osTicket\Mail;
 
 class Mailer {
-
-    var $email;
+    private $from = null;
+    var $email = null;
+    var $smtpAccounts = [];
 
     var $ht = array();
     var $attachments = array();
     var $options = array();
-
-    var $smtp = array();
     var $eol="\n";
 
-    function __construct($email=null, array $options=array()) {
+    function __construct(?\Email $email=null, array $options=array()) {
         global $cfg;
 
-        if(is_object($email) && $email->isSMTPEnabled() && ($info=$email->getSMTPInfo())) { //is SMTP enabled for the current email?
-            $this->smtp = $info;
-        } elseif($cfg && ($e=$cfg->getDefaultSMTPEmail()) && $e->isSMTPEnabled()) { //What about global SMTP setting?
-            $this->smtp = $e->getSMTPInfo();
-            if(!$e->allowSpoofing() || !$email)
-                $email = $e;
-        } elseif(!$email && $cfg && ($e=$cfg->getDefaultEmail())) {
-            if($e->isSMTPEnabled() && ($info=$e->getSMTPInfo()))
-                $this->smtp = $info;
-            $email = $e;
+        // Get all possible outgoing emails accounts (SMTP) to try
+        if (($email instanceof \Email)
+                && ($smtp=$email->getSmtpAccount(false))
+                && $smtp->isActive()) {
+            $this->smtpAccounts[$smtp->getId()] = $smtp;
+        }
+        if ($cfg)  {
+            // Get Default MTA  (SMTP)
+            if (($smtp=$cfg->getDefaultMTA()) && $smtp->isActive()) {
+                $this->smtpAccounts[$smtp->getId()] = $smtp;
+                // If email is not set then use Default MTA
+                if (!$email)
+                    $email = $smtp->getEmail();
+            } elseif (!$email && $cfg && ($email=$cfg->getDefaultEmail())) {
+                // as last resort we will send  via Default Email
+                if (($smtp=$email->getSmtpAccount(false)) && $smtp->isActive())
+                    $this->smtpAccounts[$smtp->getId()] = $smtp;
+            }
         }
 
         $this->email = $email;
         $this->attachments = array();
         $this->options = $options;
+        if (isset($this->options['eol']))
+            $this->eol = $this->options['eol'];
+        elseif (defined('MAIL_EOL') && is_string(MAIL_EOL))
+            $this->eol = MAIL_EOL;
     }
 
     function getEOL() {
         return $this->eol;
     }
 
+    function getSmtpAccounts() {
+        return $this->smtpAccounts;
+    }
+
     function getEmail() {
         return $this->email;
     }
 
-    function getSMTPInfo() {
-        return $this->smtp;
-    }
     /* FROM Address */
-    function setFromAddress($from) {
-        $this->ht['from'] = $from;
+    function setFromAddress($from=null, $name=null) {
+        if ($from instanceof \EmailAddress)
+            $this->from = $from;
+        elseif (\Validator::is_email($from)) {
+            $this->from = new \EmailAddress(
+                    str_contains($from, '<') ? $from : sprintf('"%s" <%s>', $name ?: '', $from));
+        } elseif (is_string($from))
+            $this->from = new \EmailAddress($from);
+        elseif (($email=$this->getEmail())) {
+            // we're assuming from was null or unexpected monster
+            $address = sprintf('"%s" <%s>',
+                    $name ?: $email->getName(),
+                    $email->getEmail());
+            $this->from = new \EmailAddress($address);
+        }
     }
 
     function getFromAddress($options=array()) {
+        if (!isset($this->from))
+            $this->setFromAddress(null, $options['from_name'] ?: null);
 
-        if (!$this->ht['from'] && ($email=$this->getEmail())) {
-            if (($name = $options['from_name'] ?: $email->getName()))
-                $this->ht['from'] =sprintf('"%s" <%s>', $name, $email->getEmail());
-            else
-                $this->ht['from'] =sprintf('<%s>', $email->getEmail());
-        }
+        return $this->from;
+    }
 
-        return $this->ht['from'];
+    function getFromName() {
+        return $this->getFromAddress()->getName();
+    }
+
+    function getFromEmail() {
+        return $this->getFromAddress()->getEmail();
     }
 
     /* attachments */
@@ -83,33 +109,42 @@ class Mailer {
         return $this->attachments;
     }
 
-    function addAttachment(Attachment $attachment) {
-        // XXX: This looks too assuming; however, the attachment processor
-        // in the ::send() method seems hard coded to expect this format
-        $this->attachments[] = $attachment;
+    function addAttachment(\Attachment $attachment) {
+        $this->attachments[$attachment->getFile()->getUId()] = $attachment;
     }
 
-    function addAttachmentFile(AttachmentFile $file) {
-        // XXX: This looks too assuming; however, the attachment processor
-        // in the ::send() method seems hard coded to expect this format
-        $this->attachments[] = $file;
+    function addAttachmentFile(\AttachmentFile $file) {
+        $this->attachments[$file->getUId()] = $file;
     }
 
-    function addFileObject(FileObject $file) {
-        $this->attachments[] = $file;
+    function addFileObject(\FileObject $file) {
+        $this->attachments[$file->getUId()] = $file;
     }
 
     function addAttachments($attachments) {
         foreach ($attachments as $a) {
-            if ($a instanceof Attachment)
+            if ($a instanceof \Attachment)
                 $this->addAttachment($a);
-            elseif ($a instanceof AttachmentFile)
+            elseif ($a instanceof \AttachmentFile)
                 $this->addAttachmentFile($a);
-            elseif ($a instanceof FileObject)
+            elseif ($a instanceof \FileObject)
                 $this->addFileObject($a);
         }
     }
 
+    /**
+     *  lookup Attached File by Key
+     */
+    function getFile(String $key) {
+        foreach ($this->getAttachments() as $uid => $F) {
+            if ($F instanceof \Attachment)
+                $F = $F->getFile();
+            if (strcasecmp($F->getKey(), $key) === 0)
+                return $F;
+        }
+        return \AttachmentFile::lookup($key);
+    }
+
     /**
      * getMessageId
      *
@@ -147,7 +182,7 @@ class Mailer {
      */
     function getMessageId($recipient, $options=array(), $version='B') {
         $tag = '';
-        $rand = Misc::randCode(5,
+        $rand = \Misc::randCode(5,
             // RFC822 specifies the LHS of the addr-spec can have any char
             // except the specials — ()<>@,;:\".[], dash is reserved as the
             // section separator, and + is reserved for historical reasons
@@ -155,32 +190,34 @@ class Mailer {
         $sig = $this->getEmail()?$this->getEmail()->getEmail():'@osTicketMailer';
         $sysid = static::getSystemMessageIdCode();
         // Create a tag for the outbound email
-        $entry = (isset($options['thread']) && $options['thread'] instanceof ThreadEntry)
+        $entry = (isset($options['thread'])
+                && ($options['thread'] instanceof \ThreadEntry))
             ? $options['thread'] : false;
         $thread = $entry ? $entry->getThread()
-            : (isset($options['thread']) && $options['thread'] instanceof Thread
+            : (isset($options['thread'])
+                    && ($options['thread'] instanceof \Thread)
                 ? $options['thread'] : false);
 
         switch (true) {
-        case $recipient instanceof Staff:
+        case $recipient instanceof \Staff:
             $utype = 'S';
             break;
-        case $recipient instanceof TicketOwner:
+        case $recipient instanceof \TicketOwner:
             $utype = 'U';
             break;
-        case $recipient instanceof Collaborator:
+        case $recipient instanceof \Collaborator:
             $utype = 'C';
             break;
-        case  $recipient instanceof MailingList:
+        case  $recipient instanceof \MailingList:
             $utype = 'M';
             break;
         default:
-            $utype = $options['utype'] ?: is_array($recipient) ? 'M' : '?';
+            $utype = ($options['utype'] ?: is_array($recipient)) ? 'M' : '?';
         }
 
 
         $tag = pack('VVVa',
-            $recipient instanceof EmailContact ? $recipient->getUserId() : 0,
+            $recipient instanceof \EmailContact ? $recipient->getUserId() : 0,
             $entry ? $entry->getId() : 0,
             $thread ? $thread->getId() : 0,
             $utype ?: '?'
@@ -304,31 +341,32 @@ class Mailer {
             0, 6);
     }
 
-    function send($recipients, $subject, $message, $options=null) {
+    function send($recipients, $subject, $body, $options=null) {
         global $ost, $cfg;
 
-        //Get the goodies
-        require_once (PEAR_DIR.'Mail.php'); // PEAR Mail package
-        require_once (PEAR_DIR.'Mail/mime.php'); // PEAR Mail_Mime packge
-
         $messageId = $this->getMessageId($recipients, $options);
         $subject = preg_replace("/(\r\n|\r|\n)/s",'', trim($subject));
-        $headers = array (
-            'From' => $this->getFromAddress($options),
-            'Subject' => $subject,
-            'Date'=> date('D, d M Y H:i:s O'),
-            'Message-ID' => "<{$messageId}>",
-            'X-Mailer' =>'osTicket Mailer',
-        );
+        $from = $this->getFromAddress($options);
+
+         // Create new ostTicket/Mail/Message object
+        $message = new Message();
+        // Set our custom Message-Id
+        $message->setMessageId($messageId);
+        // Set From Address
+        $message->setFrom($from->getEmail(), $from->getName());
+        // Set Subject
+        $message->setSubject($subject);
+
+        // Collect Generic Headers
+        $headers = ['X-Mailer' =>'osTicket Mailer'];
 
         // Add in the options passed to the constructor
         $options = ($options ?: array()) + $this->options;
-
         // Message Id Token
         $mid_token = '';
         // Check if the email is threadable
         if (isset($options['thread'])
-            && $options['thread'] instanceof ThreadEntry
+            && ($options['thread'] instanceof \ThreadEntry)
             && ($thread = $options['thread']->getThread())) {
 
             // Add email in-reply-to references if not set
@@ -336,15 +374,15 @@ class Mailer {
 
                 $entry = null;
                 switch (true) {
-                case $recipients instanceof MailingList:
+                case $recipients instanceof \MailingList:
                     $entry = $thread->getLastEmailMessage();
                     break;
-                case $recipients instanceof TicketOwner:
-                case $recipients instanceof Collaborator:
+                case $recipients instanceof \TicketOwner:
+                case $recipients instanceof \Collaborator:
                     $entry = $thread->getLastEmailMessage(array(
                                 'user_id' => $recipients->getUserId()));
                     break;
-                case $recipients instanceof Staff:
+                case $recipients instanceof \Staff:
                     //XXX: is it necessary ??
                     break;
                 }
@@ -370,9 +408,9 @@ class Mailer {
 
         // Return-Path
         if (isset($options['nobounce']) && $options['nobounce'])
-            $headers['Return-Path'] = '<>';
-        elseif ($this->getEmail() instanceof Email)
-            $headers['Return-Path'] = $this->getEmail()->getEmail();
+            $message->setReturnPath('<>');
+        elseif ($this->getEmail() instanceof \Email)
+            $message->setReturnPath($this->getEmail()->getEmail());
 
         // Bulk.
         if (isset($options['bulk']) && $options['bulk'])
@@ -394,74 +432,72 @@ class Mailer {
                     'Auto-Submitted' => 'auto-generated');
         // In-Reply-To
         if (isset($options['inreplyto']) && $options['inreplyto'])
-            $headers += array('In-Reply-To' => $options['inreplyto']);
+            $message->addInReplyTo($options['inreplyto']);
 
         // References
-        if (isset($options['references']) && $options['references']) {
-            if (is_array($options['references']))
-                $headers += array('References' =>
-                    implode(' ', $options['references']));
-            else
-                $headers += array('References' => $options['references']);
-        }
+        if (isset($options['references']) && $options['references'])
+            $message->addReferences($options['references']);
+
+        // Add Headers
+        $message->addHeaders($headers);
 
-        // Use general failsafe default initially
-        $eol = "\n";
-        // MAIL_EOL setting can be defined in `ost-config.php`
-        if (defined('MAIL_EOL') && is_string(MAIL_EOL))
-            $eol = MAIL_EOL;
-        $mime = new Mail_mime($eol);
         // Add recipients
-        if (!is_array($recipients) && (!$recipients instanceof MailingList))
+        if (!is_array($recipients) && (!$recipients instanceof \MailingList))
             $recipients =  array($recipients);
         foreach ($recipients as $recipient) {
-            if ($recipient instanceof ClientSession)
+            if ($recipient instanceof \ClientSession)
                 $recipient = $recipient->getSessionUser();
-            switch (true) {
-                case $recipient instanceof EmailRecipient:
-                    $addr = sprintf('"%s" <%s>',
-                            $recipient->getName(),
-                            $recipient->getEmail());
-                    switch ($recipient->getType()) {
-                        case 'to':
-                            $mime->addTo($addr);
-                            break;
-                        case 'cc':
-                            $mime->addCc($addr);
-                            break;
-                        case 'bcc':
-                            $mime->addBcc($addr);
-                            break;
-                    }
-                    break;
-                case $recipient instanceof TicketOwner:
-                case $recipient instanceof Staff:
-                    $mime->addTo(sprintf('"%s" <%s>',
-                                $recipient->getName(),
-                                $recipient->getEmail()));
-                    break;
-                case $recipient instanceof Collaborator:
-                    $mime->addCc(sprintf('"%s" <%s>',
-                                $recipient->getName(),
-                                $recipient->getEmail()));
-                    break;
-                case $recipient instanceof EmailAddress:
-                    $mime->addTo($recipient->getAddress());
-                    break;
-                default:
-                    // Assuming email address.
-                    $mime->addTo($recipient);
+            try {
+                switch (true) {
+                    case $recipient instanceof \EmailRecipient:
+                        $email = (string) $recipient->getEmail()->getEmail();
+                        $name =  (string) $recipient->getName();
+                        switch ($recipient->getType()) {
+                            case 'to':
+                                $message->addTo($email, $name);
+                                break;
+                            case 'cc':
+                                $message->addCc($email, $name);
+                                break;
+                            case 'bcc':
+                                $message->addBcc($email, $name);
+                                break;
+                        }
+                        break;
+                    case $recipient instanceof \TicketOwner:
+                    case $recipient instanceof \Staff:
+                        $message->addTo((string) $recipient->getEmail(),
+                                (string) $recipient->getName());
+                        break;
+                    case $recipient instanceof \Collaborator:
+                        $message->addCc((string) $recipient->getEmail(),
+                                 (string) $recipient->getName());
+                        break;
+                    case $recipient instanceof \EmailAddress:
+                        $message->addTo((string) $recipient->getEmail(),
+                                (string) $recipient->getName());
+                        break;
+                    default:
+                        // Assuming email address.
+                        if (is_string($recipient))
+                            $message->addTo($recipient);
+                }
+            } catch(\Exception $ex) {
+                $this->logWarning(sprintf("%s1\$s: %2\$s\n\n%3\$s\n",
+                        _S("Unable to add email recipient"),
+                        ($recipient instanceof EmailContact)
+                            ? $recipient->getEmailAddress()
+                            : (string) $recipient,
+                        $ex->getMessage()
+                    ));
             }
         }
 
         // Add in extra attachments, if any from template variables
-        if ($message instanceof TextWithExtras
-            && ($attachments = $message->getAttachments())
-        ) {
+        if ($body instanceof \TextWithExtras
+            && ($attachments = $body->getAttachments())) {
             foreach ($attachments as $a) {
-                $file = $a->getFile();
-                $mime->addAttachment($file->getData(),
-                    $file->getMimeType(), $file->getName(), false);
+                $message->addAttachment($a->getFile());
             }
         }
 
@@ -473,26 +509,26 @@ class Mailer {
             // Embed the data-mid in such a way that it should be included
             // in a response
             if ($options['reply-tag'] || $mid_token) {
-                $message = sprintf('<div style="display:none"
+                $body = sprintf('<div style="display:none"
                         class="mid-%s">%s</div>%s',
                         $mid_token,
                         $options['reply-tag'],
-                        $message);
+                        $body);
             }
 
-            $txtbody = rtrim(Format::html2text($message, 90, false))
+            $txtbody = rtrim(\Format::html2text($body, 90, false))
                 . ($messageId ? "\nRef-Mid: $messageId\n" : '');
-            $mime->setTXTBody($txtbody);
+            $message->setTextBody($txtbody);
         }
         else {
-            $mime->setTXTBody($message);
+            $message->setTextBody($body);
             $isHtml = false;
         }
 
         if ($isHtml && $cfg && $cfg->isRichTextEnabled()) {
             // Pick a domain compatible with pear Mail_Mime
             $matches = array();
-            if (preg_match('#(@[0-9a-zA-Z\-\.]+)#', $this->getFromAddress(), $matches)) {
+            if (preg_match('#(@[0-9a-zA-Z\-\.]+)#', (string) $this->getFromAddress(), $matches)) {
                 $domain = $matches[1];
             } else {
                 $domain = '@localhost';
@@ -500,136 +536,140 @@ class Mailer {
             // Format content-ids with the domain, and add the inline images
             // to the email attachment list
             $self = $this;
-            $message = preg_replace_callback('/cid:([\w.-]{32})/',
-                function($match) use ($domain, $mime, $self) {
-                    $file = false;
-                    foreach ($self->attachments as $id=>$F) {
-                        if ($F instanceof Attachment)
-                            $F = $F->getFile();
-                        if (strcasecmp($F->getKey(), $match[1]) === 0) {
-                            $file = $F;
-                            break;
-                        }
-                    }
-                    if (!$file)
-                        // Not attached yet attempt to attach it inline
-                        $file = AttachmentFile::lookup($match[1]);
-                    if (!$file)
+            $body = preg_replace_callback('/cid:([\w.-]{32})/',
+                function($match) use ($domain, $message, $self) {
+                    if (!($file=$self->getFile($match[1])))
                         return $match[0];
-                    $mime->addHTMLImage($file->getData(),
-                        $file->getMimeType(), $file->getName(), false,
-                        $match[1].$domain);
-                    // Don't re-attach the image below
-                    unset($self->attachments[$file->getId()]);
-                    return $match[0].$domain;
-                }, $message);
+
+                    try {
+                        $message->addInlineImage($match[1].$domain, $file);
+                        // Don't re-attach the image below
+                        unset($self->attachments[$file->getUId()]);
+                        return $match[0].$domain;
+                    }  catch(\Exception $ex) {
+                         $self->logWarning(sprintf("%1\$s:%2\$s\n\n%3\$s\n",
+                                     _S("Unable to retrieve email inline image"),
+                                     $match[1].$domain,
+                                     $ex->getMessage()));
+                    }
+                }, $body);
             // Add an HTML body
-            $mime->setHTMLBody($message);
+            $message->setHtmlBody($body);
         }
         //XXX: Attachments
         if(($attachments=$this->getAttachments())) {
             foreach($attachments as $file) {
-                // Read the filename from the Attachment if possible
-                if ($file instanceof Attachment) {
+                if ($file instanceof \Attachment) {
                     $filename = $file->getFilename();
                     $file = $file->getFile();
-                } elseif ($file instanceof AttachmentFile) {
+                } else {
                     $filename = $file->getName();
-                }  elseif ($file instanceof FileObject) {
-                    $filename = $file->getFilename();
-                } else
-                    continue;
+                }
 
-                $mime->addAttachment($file->getData(),
-                    $file->getMimeType(), $filename, false);
+                try {
+                    $message->addAttachment($file, $filename);
+                } catch(\Exception $ex) {
+                    $this->logWarning(sprintf("%1\$s:%2\$s\n\n%3\$s\n",
+                                     _S("Unable to retrieve email attachment"),
+                                     $filename,
+                                     $ex->getMessage()));
+                }
             }
         }
 
-        //Desired encodings...
-        $encodings=array(
-                'head_encoding' => 'quoted-printable',
-                'text_encoding' => 'base64',
-                'html_encoding' => 'base64',
-                'html_charset'  => 'utf-8',
-                'text_charset'  => 'utf-8',
-                'head_charset'  => 'utf-8'
-                );
-        //encode the body
-        $body = $mime->get($encodings);
-        //encode the headers.
-        $headers = $mime->headers($headers, true);
-        $to = implode(',', array_filter(array($headers['To'], $headers['Cc'],
-                    $headers['Bcc'])));
-        // Cache smtp connections made during this request
-        static $smtp_connections = array();
-        if(($smtp=$this->getSMTPInfo())) { //Send via SMTP
-            $key = sprintf("%s:%s:%s", $smtp['host'], $smtp['port'],
-                $smtp['username']);
-            if (!isset($smtp_connections[$key])) {
-                $mail = mail::factory('smtp', array(
-                    'host' => $smtp['host'],
-                    'port' => $smtp['port'],
-                    'auth' => $smtp['auth'],
-                    'username' => $smtp['username'],
-                    'password' => $smtp['password'],
-                    'timeout'  => 20,
-                    'debug' => false,
-                    'persist' => true,
+        // Try possible SMTP Accounts - connections are cached per request
+        // at the account level.
+        foreach ($this->getSmtpAccounts() ?: [] as $smtpAccount) {
+            try {
+                //  Check if SPOOFING is allowed.
+                if (!$smtpAccount->allowSpoofing()
+                        && strcasecmp($smtpAccount->getEmail()->getEmail(),
+                            $this->getFromEmail())) {
+                    // If the Account DOES NOT allow spoofing then set the
+                    // Sender as the smtp account sending out the email
+                    // TODO: Allow Aliases to Spoof parent account by
+                    // default.
+                    $message->setSender(
+                            // get Account Email
+                            (string) $smtpAccount->getEmail()->getEmail(),
+                            // Try to keep the name if available
+                            $this->getFromName() ?: $smtpAccount->getName() ?: $this->getEmail());
+                }
+                // Attempt to send the Message.
+                if (($smtp=$smtpAccount->getSmtpConnection())
+                        && $smtp->sendMessage($message))
+                     return $message->getId();
+            } catch (\Exception $ex) {
+                // Log the SMTP error
+                $this->logError(sprintf("%1\$s: %2\$s (%3\$s)\n\n%4\$s\n",
+                        _S("Unable to email via SMTP"),
+                        $smtpAccount->getEmail()->getEmail(),
+                        $smtpAccount->getHostInfo(),
+                        $ex->getMessage()
+                    ));
+            }
+            // Attempt  Failed:  Reset FROM to original email and clear Sender
+            $message->setOriginator($this->getFromEmail(), $this->getFromName());
+        }
+
+        // No SMTP or it FAILED....use Sendmail transport (PHP mail())
+        // Set Sender / Originator
+        if (isset($options['from_address'])) {
+            // This is often set via Mailer::sendmail()
+            $message->setSender($options['from_address']);
+        } elseif (($from=$this->getFromAddress())) {
+            // This should be already set but we're making doubly sure
+            $message->setOriginator($from->getEmail(), $from->getName());
+        }
+
+        try {
+            // ostTicket/Mail/Sendmail transport (mail())
+            // Set extra params as needed
+            // NOTE: Laminas Mail doesn't respect -f param set Sender (above)
+            $args = [];
+            $sendmail =  new  Sendmail($args);
+            if ($sendmail->sendMessage($message))
+                return $message->getId();
+        } catch (\Exception $ex) {
+            $this->logError(sprintf("%1\$s\n\n%2\$s\n",
+                        _S("Unable to email via Sendmail"),
+                        $ex->getMessage()
                 ));
-                if ($mail->connect())
-                    $smtp_connections[$key] = $mail;
-            }
-            else {
-                // Use persistent connection
-                $mail = $smtp_connections[$key];
-            }
-
-            $result = $mail->send($to, $headers, $body);
-            if(!PEAR::isError($result))
-                return $messageId;
-
-            // Force reconnect on next ->send()
-            unset($smtp_connections[$key]);
-
-            $alert=_S("Unable to email via SMTP")
-                    .sprintf(":%1\$s:%2\$d [%3\$s]\n\n%4\$s\n",
-                    $smtp['host'], $smtp['port'], $smtp['username'], $result->getMessage());
-            $this->logError($alert);
         }
+        return false;
+    }
 
-        //No SMTP or it failed....use php's native mail function.
-        $args = array();
-        if (isset($options['from_address']))
-            $args[] = '-f '.$options['from_address'];
-        elseif ($this->getEmail())
-            $args = array('-f '.$this->getEmail()->getEmail());
-        $mail = mail::factory('mail', $args);
-        $to = $headers['To'];
-        $result = $mail->send($to, $headers, $body);
-        if(!PEAR::isError($result))
-            return $messageId;
+    function log($msg, $type='warning') {
+        global $ost;
 
-        $alert=_S("Unable to email via php mail function")
-                .sprintf(":%1\$s\n\n%2\$s\n",
-                $to, $result->getMessage());
-        $this->logError($alert);
+        if (!$ost || !$msg)
+            return;
+
+        // No email alerts on email errors
+        switch ($type) {
+            case 'error':
+                return $ost->logError(_S('Mailer Error'), $msg, false);
+                break;
+            case 'warning':
+            default:
+                return $ost->logWarning(_S('Mailer Warning'), $msg, false);
+        }
         return false;
     }
 
     function logError($error) {
-        global $ost;
-        //NOTE: Admin alert override - don't email when having email trouble!
-        $ost->logError(_S('Mailer Error'), $error, false);
+        return $this->log($error, 'error');
     }
 
-    /******* Static functions ************/
+    function logWarning($warning) {
+        return $this->log($warning, 'warning');
+    }
 
     //Emails using native php mail function - if DB connection doesn't exist.
     //Don't use this function if you can help it.
-    function sendmail($to, $subject, $message, $from, $options=null) {
+    static function sendmail($to, $subject, $message, $from=null, $options=null) {
         $mailer = new Mailer(null, array('notice'=>true, 'nobounce'=>true));
-        $mailer->setFromAddress($from);
+        $mailer->setFromAddress($from, $options['from_name'] ?: null);
         return $mailer->send($to, $subject, $message, $options);
     }
 }
-?>

include/class.mailparse.php

@@ -27,6 +27,7 @@ class Mail_Parse {
     var $decode_bodies;
 
     var $struct;
+    var $headers;
 
     var $charset ='UTF-8'; //Default charset.
 
@@ -35,18 +36,15 @@ class Mail_Parse {
     function __construct(&$mimeMessage, $charset=null){
 
         $this->mime_message = &$mimeMessage;
-
-        if($charset)
-            $this->charset = $charset;
-
         $this->include_bodies = true;
         $this->decode_headers = false;
         $this->decode_bodies = true;
 
         //Desired charset
-        if($charset)
+        if ($charset)
             $this->charset = $charset;
 
+        $this->splitBodyHeader();
         $this->notes = array();
     }
 
@@ -61,14 +59,13 @@ class Mail_Parse {
         $info = array('raw' => &$this->mime_message);
         Signal::send('mail.received', $this, $info);
 
-        $this->splitBodyHeader();
-
         $decoder = new Mail_mimeDecode($this->mime_message);
         $this->struct = $decoder->decode($params);
 
         if (PEAR::isError($this->struct))
             return false;
 
+        $this->headers = &$this->struct->headers;
         $info = array(
             'raw_header' => &$this->header,
             'headers' => &$this->struct->headers,
@@ -132,14 +129,35 @@ class Mail_Parse {
         return (count($this->struct->headers) > 1);
     }
 
+    function getMimeMessage() {
+        return $this->mime_message;
+    }
+
+    function getMimeFile() {
+        $file = [
+            // Use subject if available otherwise use mid.
+            'name' => sprintf('%s.eml',
+                    $this->getSubject() ?: $this->getMessageId()),
+            'type' => 'message/rfc822',
+            'data' => $this->getMimeMessage(),
+        ];
+        // See if we have transfer encoding
+        if (($encoding=$this->getHeaderEntry('content-transfer-encoding')))
+            $file['encoding'] = $encoding;
+
+        return $file;
+    }
+
     function splitBodyHeader() {
         $match = array();
-        if (preg_match("/^(.*?)\r?\n\r?\n./s",
-                $this->mime_message,
-                $match)) {
+        if (!$this->header
+                && preg_match("/^(.*?)\r?\n\r?\n./s",
+                    $this->mime_message,
+                    $match)) {
             $this->header=$match[1];
         }
     }
+
     /**
      * Takes the header section of an email message with the form of
      * Header: Value
@@ -159,7 +177,7 @@ class Mail_Parse {
             if (in_array($headers[$i][0], array(" ", "\t"))) {
                 # Continuation from previous header (runon to next line)
                 $j=$i-1; while (!isset($headers[$j]) && $j>0) $j--;
-                $headers[$j] .= " ".ltrim($headers[$i]);
+                $headers[strtolower($j)] .= " ".ltrim($headers[$i]);
                 unset($headers[$i]);
             } elseif (strlen($headers[$i]) == 0) {
                 unset($headers[$i]);
@@ -169,6 +187,7 @@ class Mail_Parse {
         foreach ($headers as $hdr) {
             list($name, $val) = explode(": ", $hdr, 2);
             # Create list of values if header is specified more than once
+            $name = strtolower($name);
             if (isset($array[$name]) && $as_array) {
                 if (is_array($array[$name])) $array[$name][] = $val;
                 else $array[$name] = array($array[$name], $val);
@@ -180,13 +199,18 @@ class Mail_Parse {
     }
 
     /* static */
-    function findHeaderEntry($headers, $name, $allEntries=false) {
+    static function findHeaderEntry($headers, $name, $allEntries=false) {
         if (!is_array($headers))
             $headers = self::splitHeaders($headers, $allEntries);
-        foreach ($headers as $key=>$val)
-            if (strcasecmp($key, $name) === 0)
-                return $val;
-        return false;
+
+        $name = strtolower($name);
+        return $headers[$name] ?? false;
+    }
+
+    function getHeaderEntry($name) {
+        return $this->hasHeaders()
+            ? self::findHeaderEntry($this->getHeaders(), $name)
+            : false;
     }
 
     function getStruct(){
@@ -194,13 +218,26 @@ class Mail_Parse {
     }
 
     function getHeader() {
-        if(!$this->header) $this->splitBodyHeader();
+        if (!$this->header)
+            $this->splitBodyHeader();
 
         return $this->header;
     }
 
+    function getHeaders() {
+        if (!isset($this->headers))
+            $this->headers = self::splitHeaders($this->getHeader());
+
+        return $this->headers;
+    }
+
+    function hasHeaders() {
+        return ($this->getHeaders());
+    }
+
     function getError(){
-        return PEAR::isError($this->struct)?$this->struct->getMessage():'';
+        return PEAR::isError($this->struct)
+            ? $this->struct->getMessage() : '';
     }
 
 
@@ -208,68 +245,82 @@ class Mail_Parse {
         if (!($header = $this->struct->headers['from']))
             return null;
 
+        if (is_string($header) && (strpos($header, '<') !== false) && (strpos($header, '>') === false))
+            $header = $header.'>';
+
         return Mail_Parse::parseAddressList($header, $this->charset);
     }
 
     function getDeliveredToAddressList() {
-        if (!($header = $this->struct->headers['delivered-to']))
-            return null;
-
-        return Mail_Parse::parseAddressList($header, $this->charset);
+        return self::parseAddressList($this->getHeaderEntry('delivered-to'),
+                $this->charset);
     }
 
     function getToAddressList(){
-        // Delivered-to incase it was a BBC mail.
-        $tolist = array();
-        if ($header = $this->struct->headers['to'])
-            $tolist = array_merge($tolist,
-                Mail_Parse::parseAddressList($header, $this->charset));
-        return $tolist ? $tolist : null;
+        return  self::parseAddressList($this->getHeaderEntry('to'),
+                $this->charset);
     }
 
     function getCcAddressList(){
-        if (!($header = @$this->struct->headers['cc']))
-            return null;
-
-        return Mail_Parse::parseAddressList($header, $this->charset);
+        return self::parseAddressList($this->getHeaderEntry('cc'),
+                $this->charset);
     }
 
     function getBccAddressList(){
-        if (!($header = @$this->struct->headers['bcc']))
-            return null;
-
-        return Mail_Parse::parseAddressList($header, $this->charset);
+        return self::parseAddressList($this->getHeaderEntry('bcc'),
+                $this->charset);
     }
 
     function getMessageId(){
-        if (($mid = $this->struct->headers['message-id']) && is_array($mid))
-            $mid = array_pop(array_filter($mid));
-        if (!$mid)
+        if (!($mid = $this->getHeaderEntry('message-id')))
             $mid = sprintf('<%s@local>', md5($this->getHeader()));
 
+        if ($mid && is_array($mid))
+            $mid = array_pop(array_filter($mid));
+
         return $mid;
     }
 
     function getSubject(){
-        return Format::mimedecode($this->struct->headers['subject'], $this->charset);
+        return Format::mimedecode($this->getHeaderEntry('subject'), $this->charset);
     }
 
     function getReplyTo() {
-        if (!($header = @$this->struct->headers['reply-to']))
-            return null;
+        return self::parseAddressList($this->getHeaderEntry('reply-to'),
+                    $this->charset);
+    }
 
-        return Mail_Parse::parseAddressList($header, $this->charset);
+    function getInReplyTo() {
+        return $this->getHeaderEntry('in-reply-to');
+    }
+
+    function getReferences() {
+        return $this->getHeaderEntry('references');
+    }
+
+    function getRecipients() {
+        $recipients = [];
+        if (($to = $this->getToAddressList()))
+            $recipients['to'] = $to;
+        if (($cc = $this->getCcAddressList()))
+            $recipients['cc'] = $cc;
+        if (($dt = $this->getDeliveredToAddressList()))
+            $recipients['delivered-to'] = $dt;
+
+        return $recipients;
     }
 
     function isBounceNotice() {
-        if (!($body = $this->getPart($this->struct, 'message/delivery-status')))
+        if (!$this->struct
+                || !($body = $this->getPart($this->struct,
+                        'message/delivery-status')))
             return false;
 
         $info = self::splitHeaders($body);
-        if (!isset($info['Action']))
+        if (!isset($info['action']))
             return false;
 
-        return strcasecmp($info['Action'], 'failed') === 0;
+        return strcasecmp($info['action'], 'failed') === 0;
     }
 
     function getDeliveryStatusMessage() {
@@ -292,7 +343,7 @@ class Mail_Parse {
             // Handle rfc1892 style bounces
             if (strtolower($ctype) === 'text/rfc822-headers') {
                 $body = $p->body . "\n\nIgnored";
-                $T = new Mail_mimeDecode($body);
+                $T = new Mail_mimeDecode($body, ['attachOnParseError' => false]);
                 if ($struct = $T->decode())
                     return $struct->headers;
             }
@@ -303,6 +354,11 @@ class Mail_Parse {
     function getBody(){
         global $cfg;
 
+        // When struct is not set then it might mean decode error - return
+        // empty body
+        if (!$this->struct)
+            return new TextThreadEntryBody('');
+
         if ($cfg && $cfg->isRichTextEnabled()) {
             if ($html=$this->getPart($this->struct,'text/html'))
                 $body = new HtmlThreadEntryBody($html);
@@ -318,8 +374,7 @@ class Mail_Parse {
 
         if (!isset($body))
             $body = new TextThreadEntryBody('');
-
-        if ($cfg && $cfg->stripQuotedReply())
+        elseif ($cfg && $cfg->stripQuotedReply())
             $body->stripQuotedReply($cfg->getReplySeparator());
 
         return $body;
@@ -443,6 +498,11 @@ class Mail_Parse {
                     && $part->headers['content-disposition']
                     && preg_match('/filename="([^"]+)"/', $part->headers['content-disposition'], $matches)) {
                 $filename = Format::mimedecode($matches[1], $this->charset);
+            } elseif (preg_match('/filename\*\d+=([^;]+);/', $part->headers['content-disposition']) === 1) {
+                $filename = '';
+                foreach ($part->d_parameters as $key=>$fname)
+                    if (strpos($key, 'filename*') !== false)
+                        $filename .= Format::decodeRfc5987($fname);
             } else {
                 // Not an attachment?
                 return false;
@@ -490,8 +550,12 @@ class Mail_Parse {
             return $files;
         }
 
-        if($part==null)
+        if($part==null) {
             $part=$this->getStruct();
+            if (!$part->parts)
+                if($result=$this->getAttachments($part))
+                    $files=array_merge($files,$result);
+        }
 
         if($part->parts){
             foreach($part->parts as $k=>$p){
@@ -510,7 +574,7 @@ class Mail_Parse {
             // http://msdn.microsoft.com/en-us/library/ee237166(v=exchg.80).aspx
             $urgency = 4 - $this->tnef->Importance;
         }
-        elseif ($priority = Mail_Parse::parsePriority($this->getHeader())) {
+        elseif ($priority = self::parsePriority($this->getHeader())) {
             $urgency = $priority + 1;
         }
         if ($urgency) {
@@ -522,6 +586,114 @@ class Mail_Parse {
         }
     }
 
+    function getHeaderInfo() {
+        if (!$this->hasHeaders())
+            return null;
+
+        $info = [];
+        $info['emailId'] = 0;
+        $info['recipients'] = array();
+        $info['subject'] = $this->getSubject();
+        $info['header'] = $this->getHeader();
+        $info['mid'] = $this->getMessageId();
+        $info['priorityId'] = $this->getPriority();
+        $info['mailflags'] = new ArrayObject();
+        //FROM address: who sent the email.
+        if (($fromlist = $this->getFromAddressList())) {
+            $from=$fromlist[0]; //Default.
+            foreach ($fromlist as $fromobj) {
+                if(!Validator::is_email($fromobj->mailbox.'@'.$fromobj->host)) continue;
+                $from = $fromobj;
+                break;
+            }
+            $info['email'] = $from->mailbox.'@'.$from->host;
+            $info['name'] = trim($from->personal,'"');
+            if($from->comment && $from->comment[0])
+                $info['name'].= ' ('.$from->comment[0].')';
+
+            //Use email address as name  when FROM address doesn't  have a name.
+            if(!$info['name'] && $info['email'])
+                $info['name'] = $info['email'];
+        }
+
+        /* Scan through the list of addressees (via To, Cc, and Delivered-To headers), and identify
+         * how the mail arrived at the system. One of the mails should be in the system email list.
+         * The recipient list (without the Delivered-To addressees) will be made available to the
+         * ticket filtering system. However, addresses in the Delivered-To header should never be
+         * considered for the collaborator list.
+         */
+        $recipients = $this->getRecipients();
+        $info['system_emails'] = $info['thread_entry_recipients'] =  [];
+        foreach ($recipients as $source => $list) {
+            foreach($list as $addr) {
+                if (!($emailId=Email::getIdByEmail(strtolower($addr->mailbox).'@'.$addr->host))) {
+                    //Skip virtual Delivered-To addresses
+                    if ($source == 'delivered-to') continue;
+
+                    $name = trim(@$addr->personal, '"');
+                    $email = strtolower($addr->mailbox).'@'.$addr->host;
+                    $info['recipients'][] = array(
+                        'source' => sprintf(_S("Email (%s)"), $source),
+                        'name' => $name,
+                        'email' => $email);
+
+                    $info['thread_entry_recipients'][$source][] = sprintf('%s <%s>', $name, $email);
+                } elseif ($emailId) {
+                    $info['system_emails'][] = $emailId;
+                    $system_email = Email::lookup($emailId);
+                    $info['thread_entry_recipients']['to'][] = (string) $system_email;
+                    if (!$info['emailId'])
+                        $info['emailId'] = $emailId;
+                }
+            }
+        }
+        $info['thread_entry_recipients']['to'] = isset($info['thread_entry_recipients']['to'])
+                ? array_unique($info['thread_entry_recipients']['to'])
+                : [];
+
+        /*
+         * In the event that the mail was delivered to the system although none of the system
+         * mail addresses are in the addressee lists, be careful not to include the addressee
+         * in the collaborator list. Therefore, the delivered-to addressees should be flagged so they
+         * are not added to the collaborator list in the ticket creation process.
+         */
+        if (isset($recipients['delivered-to'])) {
+            foreach ($recipients['delivered-to'] as $addr) {
+                foreach ($info['recipients'] as $i=>$r) {
+                    if (strcasecmp($r['email'], $addr->mailbox.'@'.$addr->host) === 0)
+                        $info['recipients'][$i]['source'] = 'delivered-to';
+                }
+            }
+        }
+
+        //maybe we got BCC'ed??
+        if(isset($recipients['bcc'])) {
+            foreach ($recipients['bcc'] as $addr) {
+                if (($emailId=Email::getIdByEmail($addr->mailbox.'@'.$addr->host))) {
+                    $info['system_emails'][] = $emailId;
+                    if (!$info['emailId'])
+                        $info['emailId'] =  $emailId;
+                }
+            }
+        }
+
+        // reply to ?
+        if (($replyto = $this->getReplyTo())
+                && ($replyto = $replyto[0])) {
+            $info['reply-to'] = $replyto->mailbox.'@'.$replyto->host;
+            if ($replyto->personal)
+                $info['reply-to-name'] = trim($replyto->personal, " \t\n\r\0\x0B\x22");
+        }
+
+        $info['system_emails'] = array_unique($info['system_emails']);
+        $info['to-email-id'] = $info['emailId'];
+        $info['in-reply-to'] = $this->getInReplyTo();
+        $info['references'] = $this->getReferences();
+        $info['mailflags']['bounce'] = TicketFilter::isBounce($info['header']);
+
+        return $info;
+    }
+
     /**
      * Return a normalized priority urgency from the email headers received.
      *
@@ -561,7 +733,7 @@ class Mail_Parse {
     	return 0;
     }
 
-    function parseAddressList($address, $charset='UTF-8'){
+    static function parseAddressList($address, $charset='UTF-8'){
         if (!$address)
             return array();
 
@@ -569,7 +741,8 @@ class Mail_Parse {
         if (is_array($address))
             $address = implode(', ', $address);
 
-        $parsed = Mail_RFC822::parseAddressList($address, null, null,false);
+        $rfc822 = new Mail_RFC822();
+        $parsed = $rfc822->parseAddressList($address, null, null,false);
 
         if (PEAR::isError($parsed))
             return array();
@@ -596,11 +769,16 @@ class Mail_Parse {
 }
 
 class EmailDataParser {
-    var $stream;
-    var $error;
+    private $options = [
+        'attachOnParseError' => true
+    ];
+    private $stream;
+    private $errors = [];
 
-    function __construct($stream=null) {
+    function __construct($stream=null, array $options = []) {
         $this->stream = $stream;
+        if ($options)
+            $this->options = array_merge($this->options, $options);
     }
 
     function parse($stream) {
@@ -610,154 +788,68 @@ class EmailDataParser {
         if(is_resource($stream)) {
             while(!feof($stream))
                 $contents .= fread($stream, 8192);
-
         } else {
             $contents = $stream;
         }
 
         $parser= new Mail_Parse($contents);
-        if(!$parser->decode()) //Decode...returns false on decoding errors
-            return $this->err('Email parse failed ['.$parser->getError().']');
+        if (!$parser->decode())
+            return $this->onParseError($parser);
 
-        $data =array();
-        $data['emailId'] = 0;
-        $data['recipients'] = array();
-        $data['subject'] = $parser->getSubject();
-        $data['header'] = $parser->getHeader();
-        $data['mid'] = $parser->getMessageId();
-        $data['priorityId'] = $parser->getPriority();
-        $data['mailflags'] = new ArrayObject();
-
-        //FROM address: who sent the email.
-        if(($fromlist = $parser->getFromAddressList())) {
-            $from=$fromlist[0]; //Default.
-            foreach($fromlist as $fromobj) {
-                if(!Validator::is_email($fromobj->mailbox.'@'.$fromobj->host)) continue;
-                $from = $fromobj;
-                break;
-            }
-
-            $data['email'] = $from->mailbox.'@'.$from->host;
-
-            $data['name'] = trim($from->personal,'"');
-            if($from->comment && $from->comment[0])
-                $data['name'].= ' ('.$from->comment[0].')';
-
-            //Use email address as name  when FROM address doesn't  have a name.
-            if(!$data['name'] && $data['email'])
-                $data['name'] = $data['email'];
-        }
-
-        /* Scan through the list of addressees (via To, Cc, and Delivered-To headers), and identify
-         * how the mail arrived at the system. One of the mails should be in the system email list.
-         * The recipient list (without the Delivered-To addressees) will be made available to the
-         * ticket filtering system. However, addresses in the Delivered-To header should never be
-         * considered for the collaborator list.
-         */
-
-        $tolist = array();
-        if (($to = $parser->getToAddressList()))
-            $tolist['to'] = $to;
-
-        if (($cc = $parser->getCcAddressList()))
-            $tolist['cc'] = $cc;
-
-        if (($dt = $parser->getDeliveredToAddressList()))
-            $tolist['delivered-to'] = $dt;
-
-        $data['system_emails'] = array();
-        $data['thread_entry_recipients'] = array();
-        foreach ($tolist as $source => $list) {
-            foreach($list as $addr) {
-                if (!($emailId=Email::getIdByEmail(strtolower($addr->mailbox).'@'.$addr->host))) {
-                    //Skip virtual Delivered-To addresses
-                    if ($source == 'delivered-to') continue;
-
-                    $name = trim(@$addr->personal, '"');
-                    $email = strtolower($addr->mailbox).'@'.$addr->host;
-                    $data['recipients'][] = array(
-                        'source' => sprintf(_S("Email (%s)"), $source),
-                        'name' => $name,
-                        'email' => $email);
-
-                    $data['thread_entry_recipients'][$source][] = sprintf('%s <%s>', $name, $email);
-                } elseif ($emailId) {
-                    $data['system_emails'][] = $emailId;
-                    $system_email = Email::lookup($emailId);
-                    $data['thread_entry_recipients']['to'][] = (string) $system_email;
-                    if (!$data['emailId'])
-                        $data['emailId'] = $emailId;
-                }
-            }
-        }
-        $data['thread_entry_recipients']['to'] = array_unique($data['thread_entry_recipients']['to']);
-
-        /*
-         * In the event that the mail was delivered to the system although none of the system
-         * mail addresses are in the addressee lists, be careful not to include the addressee
-         * in the collaborator list. Therefore, the delivered-to addressees should be flagged so they
-         * are not added to the collaborator list in the ticket creation process.
-         */
-        if ($tolist['delivered-to']) {
-            foreach ($tolist['delivered-to'] as $addr) {
-                foreach ($data['recipients'] as $i=>$r) {
-                    if (strcasecmp($r['email'], $addr->mailbox.'@'.$addr->host) === 0)
-                        $data['recipients'][$i]['source'] = 'delivered-to';
-                }
-            }
-        }
-
-
-        //maybe we got BCC'ed??
-        if($bcc = $parser->getBccAddressList()) {
-            foreach ($bcc as $addr) {
-                if (($emailId=Email::getIdByEmail($addr->mailbox.'@'.$addr->host))) {
-                    $data['system_emails'][] = $emailId;
-                    if (!$data['emailId'])
-                        $data['emailId'] =  $emailId;
-                }
-            }
-        }
-
-        $data['system_emails'] = array_unique($data['system_emails']);
+        if (!($data = $parser->getHeaderInfo()))
+            return false;
 
         if ($parser->isBounceNotice()) {
             // Fetch the original References and assign to 'references'
-            if ($headers = $parser->getOriginalMessageHeaders()) {
+            if (($headers = $parser->getOriginalMessageHeaders())) {
                 $data['references'] = $headers['references'];
-                $data['in-reply-to'] = $headers['message-id'] ?: @$headers['in-reply-to'] ?: null;
+                $data['in-reply-to'] = $headers['message-id']
+                    ?: ($data['in-reply-to'] ?: null);
             }
             // Fetch deliver status report
             $data['message'] = $parser->getDeliveryStatusMessage() ?: $parser->getBody();
             $data['thread-type'] = 'N';
             $data['mailflags']['bounce'] = true;
-        }
-        else {
+        } else {
             // Typical email
             $data['message'] = $parser->getBody();
-            $data['in-reply-to'] = @$parser->struct->headers['in-reply-to'];
-            $data['references'] = @$parser->struct->headers['references'];
-            $data['mailflags']['bounce'] = TicketFilter::isBounce($data['header']);
         }
-
-        $data['to-email-id'] = $data['emailId'];
-
-        if (($replyto = $parser->getReplyTo())) {
-            $replyto = $replyto[0];
-            $data['reply-to'] = $replyto->mailbox.'@'.$replyto->host;
-            if ($replyto->personal)
-                $data['reply-to-name'] = trim($replyto->personal, " \t\n\r\0\x0B\x22");
-        }
-
         $data['attachments'] = $parser->getAttachments();
-
         return $data;
     }
 
-    function err($error) {
-        $this->error = $error;
+    private function attachOnParseError() {
+        return (bool) $this->options['attachOnParseError'];
+    }
 
-        return false;
+    private function onParseError($parser) {
+        $error = sprintf('%s: [%s]',
+                __('Email parse failed'),
+                $parser->getError());
+        if ($this->attachOnParseError()
+                && $parser
+                // Make sure we can get header info
+                && ($data=$parser->getHeaderInfo())) {
+            // Text thread entry body with the warning / error
+            $data['message'] = new TextThreadEntryBody($error);
+            // Add Mime message as  an Attachment
+            $data['attachments'][] = $parser->getMimeFile();
+            return $data;
+        }
+        return $this->err($error);
+    }
+
+    private function err($error) {
+        // add error and return false
+        return ($this->addError($error) && false);
+    }
+
+    function getErrors() {
+        return $this->errors;
+    }
+
+    function addError($error) {
+        $this->errors [] = $error;
     }
 
     function getError() {
@@ -765,7 +857,7 @@ class EmailDataParser {
     }
 
     function lastError() {
-        return $this->error;
+        return end($this->getErrors());
     }
 }
 ?>

include/class.message.php

@@ -183,7 +183,7 @@ abstract class BaseMessageStorage implements MessageStorageBackend {
         return $messages;
     }
 
-    function getIterator() {
+    function getIterator(): Traversable {
         $this->used = true;
         $messages = $this->load();
         if ($this->queued) {

include/class.migrater.php

@@ -78,9 +78,8 @@ class DatabaseMigrater {
      * If the hash file doesn't match the schema_signature on record, then an
      * update is triggered and the patches in the stream folder are used to
      * upgrade the database.
-	 */
-	/* static */
-    function getUpgradeStreams($basedir) {
+     */
+    static function getUpgradeStreams($basedir) {
 		static $streams = array();
         if ($streams) return $streams;
 

include/class.mime.php

@@ -0,0 +1,48 @@
+<?php
+/**
+ * class.mime.php
+ *
+ * osTicket MIME utilities — extensions for Laminas\Mime components.
+ *
+ * @author JediKev <kevin@enhancesoft.com>
+ * @copyright Copyright (c) osTicket <gpl@osticket.com>
+ *
+ */
+namespace osTicket\Mime {
+    use Laminas\Mime\Mime;
+    use Laminas\Mime\Part;
+
+    class Rfc2231Part extends Part {
+        private ?string $rawfilename = null;
+
+        /**
+         * Store the raw (UTF-8) filename for RFC-2231 emission.
+         */
+        public function setRawFilename(string $name): void {
+            $this->rawfilename = $name;
+        }
+
+        /**
+         * Override to append ; filename*=UTF-8''<percent-encoded> to Content-Disposition.
+         * Keep everything else from the parent as-is.
+         */
+        public function getHeadersArray($eol = Mime::LINEEND): array {
+            $headers = parent::getHeadersArray($eol);
+            if ($this->rawfilename === null || $this->rawfilename === '')
+                return $headers;
+
+            // RFC 2231: UTF-8 then percent-encode (spaces as %20)
+            $encoded = rawurlencode($this->rawfilename);
+
+            foreach ($headers as &$h) {
+                if (strcasecmp($h[0], 'Content-Disposition') === 0) {
+                    $h[1] .= "; filename*=UTF-8''{$encoded}";
+                    break;
+                }
+            }
+            unset($h);
+
+            return $headers;
+        }
+    }
+}

include/class.misc.php

@@ -16,7 +16,7 @@
 
 class Misc {
 
-	function randCode($len=8, $chars=false) {
+	static function randCode($len=8, $chars=false) {
         $chars = $chars ?: 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890_=';
 
         // Determine the number of bits we need
@@ -42,7 +42,7 @@ class Misc {
         return substr($output, 0, $len);
 	}
 
-    function __rand_seed($value=0) {
+    static function __rand_seed($value=0) {
         // Form a 32-bit figure for the random seed with the lower 16-bits
         // the microseconds of the current time, and the upper 16-bits from
         // received value
@@ -52,7 +52,7 @@ class Misc {
     }
 
     /* Helper used to generate ticket IDs */
-    function randNumber($len=6) {
+    static function randNumber($len=6) {
         $number = '';
         for ($i=0; $i<$len; $i++) {
             $min = ($i == 0) ? 1 : 0;
@@ -63,7 +63,7 @@ class Misc {
     }
 
     /* misc date helpers...this will go away once we move to php 5 */
-    function db2gmtime($var){
+    static function db2gmtime($var){
         static $dbtz;
         global $cfg;
 
@@ -83,7 +83,7 @@ class Misc {
     }
 
     // Take user's time and return GMT time.
-    function user2gmtime($timestamp=null, $user=null) {
+    static function user2gmtime($timestamp=null, $user=null) {
         global $cfg;
 
         $tz = new DateTimeZone($cfg->getTimezone($user));
@@ -103,7 +103,7 @@ class Misc {
     }
 
     //Take user time or gmtime and return db (mysql) time.
-    function dbtime($var=null){
+    static function dbtime($var=null){
         static $dbtz;
         global $cfg;
 
@@ -124,7 +124,7 @@ class Misc {
     }
 
     /*Helper get GM time based on timezone offset*/
-    function gmtime($time=false, $user=false) {
+    static function gmtime($time=false, $user=false) {
         global $cfg;
 
         $tz = new DateTimeZone($user ? $cfg->getDbTimezone($user) : 'UTC');
@@ -140,14 +140,14 @@ class Misc {
     }
 
     /* Needed because of PHP 4 support */
-    function micro_time() {
+    static function micro_time() {
         list($usec, $sec) = explode(" ", microtime());
 
         return ((float)$usec + (float)$sec);
     }
 
     // Date range for the period in a given time
-    function date_range($period, $time=false, $tz=null) {
+    static function date_range($period, $time=false, $tz=null) {
         $time = $time ?: self::gmtime();
         if (!($dt = Format::parseDateTime($time)))
             return null;
@@ -226,30 +226,7 @@ class Misc {
         return (object) array('start' => $start, 'end' => $end);
     }
 
-    //Current page
-    function currentURL() {
-
-        $str = 'http';
-        if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
-            $str .='s';
-        }
-        $str .= '://';
-        if (!isset($_SERVER['REQUEST_URI'])) { //IIS???
-            $_SERVER['REQUEST_URI'] = substr($_SERVER['PHP_SELF'],1 );
-            if (isset($_SERVER['QUERY_STRING'])) {
-                $_SERVER['REQUEST_URI'].='?'.$_SERVER['QUERY_STRING'];
-            }
-        }
-        if ($_SERVER['SERVER_PORT']!=80) {
-            $str .= $_SERVER['SERVER_NAME'].':'.$_SERVER['SERVER_PORT'].$_SERVER['REQUEST_URI'];
-        } else {
-            $str .= $_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
-        }
-
-        return $str;
-    }
-
-    function realpath($path) {
+    static function realpath($path) {
         $rp = realpath($path);
         return $rp ? $rp : $path;
     }

include/class.model.php

@@ -27,7 +27,7 @@ class ObjectModel {
     const OBJECT_TYPE_STAFF        = 'S';
     const OBJECT_TYPE_CHILD_TICKET = 'C';
 
-    private function objects() {
+    private static function objects() {
         static $objects = false;
         if ($objects == false) {
             $objects = array(

include/class.nav.php

@@ -125,7 +125,7 @@ class StaffNav {
     function getTabs(){
         global $thisstaff;
 
-        if(!$this->tabs) {
+        if(!isset($this->tabs)) {
             $this->tabs = array();
             $this->tabs['dashboard'] = array(
                 'desc'=>__('Dashboard'),'href'=>'dashboard.php','title'=>__('Agent Dashboard'), "class"=>"no-pjax"
@@ -210,7 +210,7 @@ class AdminNav extends StaffNav{
 
     function getTabs(){
 
-        if(!$this->tabs){
+        if(!isset($this->tabs)){
 
             $tabs=array();
             $tabs['dashboard']=array('desc'=>__('Dashboard'),'href'=>'logs.php','title'=>__('Admin Dashboard'));

include/class.oauth2.php

@@ -0,0 +1,134 @@
+<?php
+/**
+ * class.oauth2.php
+ *
+ * osTicket OAuth2 Utils & Helpers
+ *
+ * @author Peter Rotich <peter@osticket.com>
+ * @copyright Copyright (c) osTicket <gpl@osticket.com>
+ *
+ */
+namespace osTicket\OAuth2 {
+    // Define exceptions as RunTimeException
+    class Exception extends \RuntimeException { }
+    /**
+     *  osTicket OAuth2 Access Token
+     *
+     * Based on AcessToken class from league/oauth2-client library (MIT)
+     * @link http://tools.ietf.org/html/rfc6749#section-1.4 Access Token (RFC 6749, §1.4)
+     *
+     */
+    class AccessToken {
+        protected $accessToken;
+        protected $expires;
+        protected $refreshToken;
+        protected $resourceOwnerId;
+        protected $scope;
+        // osTicket specific
+        protected $resourceOwnerEmail;
+        protected $configSignature;
+
+        public function __construct(array $options = []) {
+            if (empty($options['access_token'])) {
+                throw new \InvalidArgumentException(sprintf(
+                            __('Required option not passed: "%s"'),
+                            'access_token'));
+            }
+
+            $this->accessToken = $options['access_token'];
+            if (!empty($options['refresh_token']))
+                $this->refreshToken = $options['refresh_token'];
+
+            if (!empty($options['expires']))
+                $this->expires = $options['expires'];
+
+            if (!empty($options['config_signature']))
+                $this->configSignature = $options['config_signature'];
+
+            if (!empty($options['resource_owner_id']))
+                $this->resourceOwnerId = $options['resource_owner_id'];
+
+            if (!empty($options['resource_owner_email']))
+                $this->resourceOwnerEmail = $options['resource_owner_email'];
+
+            if (!empty($options['scope']))
+                $this->scope = $options['scope'];
+        }
+
+        public function getToken() {
+            return $this->accessToken;
+        }
+
+        public function getAccessToken() {
+            return $this->getToken();
+        }
+
+        public function getRefreshToken() {
+            return $this->refreshToken;
+        }
+
+        public function getExpires() {
+            return $this->expires;
+        }
+
+        public function getResourceOwnerId() {
+            return $this->resourceOwnerId;
+        }
+
+        public function getResourceOwnerEmail() {
+            return $this->resourceOwnerEmail;
+        }
+
+        public function getResourceOwner() {
+            return $this->getResourceOwnerEmail();
+        }
+
+        public function getScope() {
+            return $this->scope;
+        }
+
+        public function getConfigSignature() {
+            return $this->configSignature;
+        }
+
+        public function hasExpired() {
+            $expires = $this->getExpires();
+            if (empty($expires))
+                throw new \RuntimeException('"expires" is not set on the token');
+
+            return $expires < time();
+        }
+
+        public function isExpired() {
+            return $this->hasExpired();
+        }
+
+        public function isMatch($email, $strict=false) {
+            return (!$strict || strcasecmp($this->getResourceOwnerEmail(), $email) === 0);
+        }
+
+        public function getAuthRequest($user=null) {
+            if ($this->hasExpired())
+                throw new Exception('Access Token is Expired');
+
+            return base64_encode(sprintf("user=%s\1auth=Bearer %s\1\1",
+                $user ?? $this->getResourceOwner(),
+                $this->getAccessToken()));
+        }
+
+        public function __toString() {
+            return (string) $this->getToken();
+        }
+
+        public function toArray() {
+            return [
+                'access_token'  => $this->getToken(),
+                'refresh_token' => $this->getRefreshToken(),
+                'expires' => $this->getExpires(),
+                'config_signature' => $this->getConfigSignature(),
+                'resource_owner_id' => $this->getResourceOwnerId(),
+                'resource_owner_email' => $this->getResourceOwnerEmail(),
+            ];
+        }
+    }
+}