Upload via GUI (452 Dateien)

DeskHub-Webseite/api/staff/v1/availability.php

@@ -63,8 +63,8 @@ if (!in_array($newStatus, AVAILABILITY_STATUSES, true)) {
 // Ein Admin darf den Status eines anderen Mitarbeiters setzen (staffId), alle anderen nur den eigenen
 $targetId = (int) $staff['id'];
 if (isset($body['staffId']) && (int) $body['staffId'] !== $targetId) {
-    if (($staff['role'] ?? '') !== 'admin') {
+    if (!has_permission($staff, 'manage_availability')) {
-        api_error(403, 'FORBIDDEN', 'Nur Administratoren dürfen den Status anderer Mitarbeiter ändern.');
+        api_error(403, 'FORBIDDEN', 'Für den Status anderer Mitarbeiter fehlt die erforderliche Berechtigung.');
     }
     $targetId = (int) $body['staffId'];
     $exists = $pdo->prepare('SELECT COUNT(*) FROM staff WHERE id = ? AND is_active = 1');

DeskHub-Webseite/api/staff/v1/banlist.php

@@ -4,7 +4,7 @@ require_once __DIR__ . '/common.php';
 
 api_require_method('GET', 'POST');
 $staff = api_require_staff();
-api_require_admin($staff);
+api_require_admin_or_permission($staff, 'manage_banlist');
 $pdo = get_db();
 
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {

DeskHub-Webseite/api/staff/v1/common.php

@@ -170,10 +170,7 @@ function api_require_staff(): array
 
 function api_staff_payload(array $staff): array
 {
-    $permissionNames = array_merge([
+    $permissionNames = array_keys(permission_labels());   // alle Rechte des Katalogs (includes/permissions.php)
-        'reply_ticket', 'close_ticket', 'post_note', 'assign_ticket', 'transfer_ticket',
-        'create_ticket', 'view_reports',
-    ], array_keys(admin_section_permissions()));
     $permissions = [];
     foreach ($permissionNames as $permission) {
         $permissions[$permission] = has_permission($staff, $permission);
@@ -289,7 +286,7 @@ function api_ticket_summary(array $ticket): array
         // (überfällig)") – bewusst serverseitig über dieselbe time_until()-Funktion wie im
         // Web berechnet, statt das Datumsformat in Kotlin nachzubauen (siehe die Lehren aus
         // den PHP-Datums-Bugs dieser Session: eine einzige Quelle der Wahrheit fürs Format).
-        'dueLabel' => !empty($ticket['sla_paused_at']) && ticket_sla_is_paused_status((string) $ticket['status']) ? 'Pausiert' : (!empty($ticket['resolution_due_at']) ? time_until($ticket['resolution_due_at']) : null),
+        'dueLabel' => in_array($ticket['status'], ['resolved', 'closed'], true) ? null : (!empty($ticket['sla_paused_at']) && ticket_sla_is_paused_status((string) $ticket['status']) ? 'Pausiert' : (!empty($ticket['resolution_due_at']) ? time_until($ticket['resolution_due_at']) : null)),
         'isSpam' => !empty($ticket['is_spam']),
         'createdAt' => $ticket['created_at'],
         'updatedAt' => $ticket['updated_at'],

DeskHub-Webseite/api/staff/v1/mail_fetch.php

@@ -9,6 +9,7 @@ require_once __DIR__ . '/../../../includes/mail_fetch_manual.php';
  */
 api_require_method('POST');
 $staff = api_require_staff();
+api_require_permission($staff, 'fetch_mail');
 $pdo = get_db();
 $r = mail_fetch_manual($pdo);
 audit_log((int) $staff['id'], 'E-Mail-Abruf von Hand gestartet über die App (' . $r['processed'] . ' E-Mail(s))');

DeskHub-Webseite/api/staff/v1/queues.php

@@ -22,7 +22,7 @@ $action = $body['action'] ?? '';
 
 try {
     if ($action === 'save') {
-        $id = queue_create($pdo, (int) $staff['id'], (string) ($body['name'] ?? ''), (array) ($body['filters'] ?? []), !empty($body['isShared']));
+        $id = queue_create($pdo, (int) $staff['id'], (string) ($body['name'] ?? ''), (array) ($body['filters'] ?? []), !empty($body['isShared']) && has_permission($staff, 'share_views'));
         api_json(['id' => $id]);
     }
     if ($action === 'delete') {

DeskHub-Webseite/api/staff/v1/report_builder.php

@@ -38,7 +38,7 @@ if ($action === 'save') {
     $cfg = report_clean_config($pdo, (array) ($body['config'] ?? []));
     $now = db_now();
     $pdo->prepare('INSERT INTO saved_reports (staff_id, name, config, is_shared, created_at, updated_at) VALUES (?,?,?,?,?,?)')
-        ->execute([$staff['id'], mb_substr($name, 0, 120), json_encode($cfg, JSON_UNESCAPED_UNICODE), !empty($body['isShared']) ? 1 : 0, $now, $now]);
+        ->execute([$staff['id'], mb_substr($name, 0, 120), json_encode($cfg, JSON_UNESCAPED_UNICODE), (!empty($body['isShared']) && has_permission($staff, 'share_views')) ? 1 : 0, $now, $now]);
     api_json(['id' => (int) $pdo->lastInsertId()]);
 }
 if ($action === 'delete') {

DeskHub-Webseite/version.php

@@ -1,7 +1,7 @@
 <?php
 if (defined('DESKHUB_VERSION')) return;
 
-define('DESKHUB_VERSION',     '1.0.71');
+define('DESKHUB_VERSION',     '1.1.0');
 define('DESKHUB_RELEASE_URL', 'https://git.viper.ipv64.net/M_Viper/deskhub/releases');
 
 // Kein eingebautes Zugangstoken: Das Update liest die öffentlichen Releases. Ist das Repository privat, kann ein Token