M_Viper/deskhub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Upload via GUI (452 Dateien)

Browse Source
This commit is contained in:
M_Viper
2026-11-05 21:21:27 +00:00
parent cdec2d346b
commit 7c664f0a6b
7 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DeskHub-Webseite/api/staff/v1/availability.php
+2 -2
View File
@@ -63,8 +63,8 @@ if (!in_array($newStatus, AVAILABILITY_STATUSES, true)) {
// Ein Admin darf den Status eines anderen Mitarbeiters setzen (staffId), alle anderen nur den eigenen
$targetId = (int) $staff['id'];
if (isset($body['staffId']) && (int) $body['staffId'] !== $targetId) {
if (($staff['role'] ?? '') !== 'admin') {
api_error(403, 'FORBIDDEN', 'Nur Administratoren dürfen den Status anderer Mitarbeiter ändern.');
if (!has_permission($staff, 'manage_availability')) {
api_error(403, 'FORBIDDEN', 'Für den Status anderer Mitarbeiter fehlt die erforderliche Berechtigung.');
}
$targetId = (int) $body['staffId'];
$exists = $pdo->prepare('SELECT COUNT(*) FROM staff WHERE id = ? AND is_active = 1');
DeskHub-Webseite/api/staff/v1/banlist.php
+1 -1
View File
@@ -4,7 +4,7 @@ require_once __DIR__ . '/common.php';
api_require_method('GET', 'POST');
$staff = api_require_staff();
api_require_admin($staff);
api_require_admin_or_permission($staff, 'manage_banlist');
$pdo = get_db();
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
DeskHub-Webseite/api/staff/v1/common.php
+2 -5
View File
@@ -170,10 +170,7 @@ function api_require_staff(): array
function api_staff_payload(array $staff): array
{
$permissionNames = array_merge([
'reply_ticket', 'close_ticket', 'post_note', 'assign_ticket', 'transfer_ticket',
'create_ticket', 'view_reports',
], array_keys(admin_section_permissions()));
$permissionNames = array_keys(permission_labels()); // alle Rechte des Katalogs (includes/permissions.php)
$permissions = [];
foreach ($permissionNames as $permission) {
$permissions[$permission] = has_permission($staff, $permission);
@@ -289,7 +286,7 @@ function api_ticket_summary(array $ticket): array
// (überfällig)") – bewusst serverseitig über dieselbe time_until()-Funktion wie im
// Web berechnet, statt das Datumsformat in Kotlin nachzubauen (siehe die Lehren aus
// den PHP-Datums-Bugs dieser Session: eine einzige Quelle der Wahrheit fürs Format).
'dueLabel' => !empty($ticket['sla_paused_at']) && ticket_sla_is_paused_status((string) $ticket['status']) ? 'Pausiert' : (!empty($ticket['resolution_due_at']) ? time_until($ticket['resolution_due_at']) : null),
'dueLabel' => in_array($ticket['status'], ['resolved', 'closed'], true) ? null : (!empty($ticket['sla_paused_at']) && ticket_sla_is_paused_status((string) $ticket['status']) ? 'Pausiert' : (!empty($ticket['resolution_due_at']) ? time_until($ticket['resolution_due_at']) : null)),
'isSpam' => !empty($ticket['is_spam']),
'createdAt' => $ticket['created_at'],
'updatedAt' => $ticket['updated_at'],
DeskHub-Webseite/api/staff/v1/mail_fetch.php
+1
View File
@@ -9,6 +9,7 @@ require_once __DIR__ . '/../../../includes/mail_fetch_manual.php';
*/
api_require_method('POST');
$staff = api_require_staff();
api_require_permission($staff, 'fetch_mail');
$pdo = get_db();
$r = mail_fetch_manual($pdo);
audit_log((int) $staff['id'], 'E-Mail-Abruf von Hand gestartet über die App (' . $r['processed'] . ' E-Mail(s))');
DeskHub-Webseite/api/staff/v1/queues.php
+1 -1
View File
@@ -22,7 +22,7 @@ $action = $body['action'] ?? '';
try {
if ($action === 'save') {
$id = queue_create($pdo, (int) $staff['id'], (string) ($body['name'] ?? ''), (array) ($body['filters'] ?? []), !empty($body['isShared']));
$id = queue_create($pdo, (int) $staff['id'], (string) ($body['name'] ?? ''), (array) ($body['filters'] ?? []), !empty($body['isShared']) && has_permission($staff, 'share_views'));
api_json(['id' => $id]);
}
if ($action === 'delete') {
DeskHub-Webseite/api/staff/v1/report_builder.php
+1 -1
View File
@@ -38,7 +38,7 @@ if ($action === 'save') {
$cfg = report_clean_config($pdo, (array) ($body['config'] ?? []));
$now = db_now();
$pdo->prepare('INSERT INTO saved_reports (staff_id, name, config, is_shared, created_at, updated_at) VALUES (?,?,?,?,?,?)')
->execute([$staff['id'], mb_substr($name, 0, 120), json_encode($cfg, JSON_UNESCAPED_UNICODE), !empty($body['isShared']) ? 1 : 0, $now, $now]);
->execute([$staff['id'], mb_substr($name, 0, 120), json_encode($cfg, JSON_UNESCAPED_UNICODE), (!empty($body['isShared']) && has_permission($staff, 'share_views')) ? 1 : 0, $now, $now]);
api_json(['id' => (int) $pdo->lastInsertId()]);
}
if ($action === 'delete') {