From ded90af175860a42e3cafeca0d01b9340ac13ba9 Mon Sep 17 00:00:00 2001 From: M_Viper Date: Thu, 5 Nov 2026 21:22:03 +0000 Subject: [PATCH] Upload via GUI (452 Dateien) --- DeskHub-Webseite/tests/ticket_done.php | 96 +++++ DeskHub-Webseite/tests/ticket_done_web.php | 157 ++++++++ DeskHub-Webseite/tests/update_security.php | 45 +++ .../tests/vacation_no_notifications.php | 1 + DeskHub-Webseite/tests/web_handoff.php | 362 +++++++++--------- DeskHub-Webseite/tools/fix-permissions.sh | 92 +++++ DeskHub-Webseite/tools/mail_preview.php | 35 ++ DeskHub-Webseite/tools/manual/build_manual.py | 109 ++++++ .../tools/manual/capture_extra.js | 85 ++++ .../tools/manual/capture_manual.js | 176 +++++++++ .../tools/manual/capture_roles.js | 80 ++++ .../tools/manual/capture_windows.js | 54 +++ DeskHub-Webseite/tools/manual/find_pages.py | 40 ++ .../tools/manual/handbuch/ch01.html | 37 ++ .../tools/manual/handbuch/ch02.html | 52 +++ .../tools/manual/handbuch/ch03.html | 59 +++ .../tools/manual/handbuch/ch04.html | 48 +++ .../tools/manual/handbuch/ch05.html | 35 ++ .../tools/manual/handbuch/ch06.html | 109 ++++++ .../tools/manual/handbuch/ch07.html | 28 ++ .../tools/manual/handbuch/ch08.html | 33 ++ .../tools/manual/handbuch/ch09.html | 32 ++ .../tools/manual/handbuch/ch10.html | 59 +++ .../tools/manual/handbuch/ch11.html | 70 ++++ .../tools/manual/handbuch/ch12.html | 104 +++++ .../tools/manual/handbuch/ch13.html | 69 ++++ .../tools/manual/handbuch/ch14.html | 76 ++++ .../tools/manual/handbuch/ch15.html | 102 +++++ .../tools/manual/handbuch/ch16.html | 63 +++ 29 files changed, 2127 insertions(+), 181 deletions(-) create mode 100644 DeskHub-Webseite/tests/ticket_done.php create mode 100644 DeskHub-Webseite/tests/ticket_done_web.php create mode 100644 DeskHub-Webseite/tools/fix-permissions.sh create mode 100644 DeskHub-Webseite/tools/mail_preview.php create mode 100644 DeskHub-Webseite/tools/manual/build_manual.py create mode 100644 DeskHub-Webseite/tools/manual/capture_extra.js create mode 100644 DeskHub-Webseite/tools/manual/capture_manual.js create mode 100644 DeskHub-Webseite/tools/manual/capture_roles.js create mode 100644 DeskHub-Webseite/tools/manual/capture_windows.js create mode 100644 DeskHub-Webseite/tools/manual/find_pages.py create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch01.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch02.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch03.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch04.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch05.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch06.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch07.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch08.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch09.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch10.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch11.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch12.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch13.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch14.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch15.html create mode 100644 DeskHub-Webseite/tools/manual/handbuch/ch16.html diff --git a/DeskHub-Webseite/tests/ticket_done.php b/DeskHub-Webseite/tests/ticket_done.php new file mode 100644 index 00000000..5779c606 --- /dev/null +++ b/DeskHub-Webseite/tests/ticket_done.php @@ -0,0 +1,96 @@ + date('Y-m-d H:i:s', time() - $h * 3600); +$dept = (int) $pdo->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn(); +$prio = (int) $pdo->query('SELECT id FROM priorities ORDER BY id LIMIT 1')->fetchColumn(); +$pdo->exec('DELETE FROM staff'); +$pdo->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)')->execute(['Agent', 'agent@test.de', 'x', 'agent', $dept, $now]); +$agent = (int) $pdo->lastInsertId(); + +$mk = function (string $n, string $status, array $o = []) use ($pdo, $dept, $prio, $now, $agent): int { + $pdo->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, assigned_staff_id, resolution_due_at, first_response_due_at, is_overdue, snoozed_until, snoozed_by, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)') + ->execute([$n, 'S ' . $n, 'K', 'k@example.org', $dept, $prio, $status, 'web', $agent, $o['due'] ?? null, $o['rdue'] ?? null, $o['overdue'] ?? 0, $o['snooze'] ?? null, $o['snooze'] ?? null ? $agent : null, $o['created'] ?? $now, $o['updated'] ?? $now]); + return (int) $pdo->lastInsertId(); +}; +$row = fn(int $id) => $pdo->query("SELECT * FROM tickets WHERE id = {$id}")->fetch(PDO::FETCH_ASSOC); + +// 1. Erledigen löscht „überfällig“ und die Wiedervorlage, für gelöst und geschlossen gleich +foreach (['resolved', 'closed'] as $st) { + $t = $mk('D-' . $st, 'open', ['due' => $ago(5), 'overdue' => 1, 'snooze' => $ago(-5), 'created' => $ago(60)]); + $pdo->prepare('UPDATE tickets SET status = ? WHERE id = ?')->execute([$st, $t]); + ticket_sla_status_transition($pdo, $t, 'open', $st); + $r = $row($t); + $check((int) $r['is_overdue'] === 0 && $r['snoozed_until'] === null, "offen → {$st}: nicht mehr überfällig, Wiedervorlage entfällt"); +} +// Ein offenes Ticket bleibt unberührt +$tOpen = $mk('D-open', 'open', ['due' => $ago(5), 'overdue' => 1, 'created' => $ago(60)]); +ticket_sla_status_transition($pdo, $tOpen, 'open', 'answered'); +$check((int) $row($tOpen)['is_overdue'] === 1, 'offen → beantwortet: bleibt überfällig'); +// gelöst → geschlossen: nichts Neues +$tc = $mk('D-rc', 'closed', ['due' => $ago(5), 'created' => $ago(60)]); +ticket_sla_status_transition($pdo, $tc, 'resolved', 'closed'); +$check((int) $row($tc)['is_overdue'] === 0, 'gelöst → geschlossen: weiter nicht überfällig'); + +// 2. SLA-Prüfung fasst erledigte Tickets nicht an und meldet nichts +$a = $mk('S-closed', 'closed', ['due' => $ago(9), 'rdue' => $ago(20), 'created' => $ago(80)]); +$b = $mk('S-resolved', 'resolved', ['due' => $ago(9), 'rdue' => $ago(20), 'created' => $ago(80)]); +$c = $mk('S-flag', 'closed', ['due' => $ago(9), 'overdue' => 1, 'created' => $ago(80)]); +$res = run_check_sla($pdo); +$check($row($a)['is_overdue'] == 0 && $row($b)['is_overdue'] == 0, 'SLA-Prüfung: geschlossene und gelöste Tickets werden nicht überfällig'); +$check((int) $row($c)['is_overdue'] === 0, 'SLA-Prüfung: ein übrig gebliebenes „überfällig“ bei einem erledigten Ticket wird entfernt'); +$check($res['newlyOverdue'] === 0, 'SLA-Prüfung: keine neue Überschreitung gemeldet'); +$hist = (int) $pdo->query("SELECT COUNT(*) FROM ticket_sla_history WHERE ticket_id IN ({$a},{$b}) AND event_type = 'overdue'")->fetchColumn(); +$check($hist === 0, 'SLA-Verlauf: für erledigte Tickets entsteht kein „überschritten“'); + +// 3. Eskalationsregeln erfassen keine erledigten Tickets +require_once dirname(__DIR__) . '/cron/check_escalations.php'; +$pdo->prepare("INSERT INTO escalation_rules (name,is_active,trigger_type,trigger_hours,action_notify_admin,action_notify_staff,sort_order,created_at) VALUES (?,?,?,?,?,?,?,?)") + ->execute(['Alt', 1, 'overdue', 1, 1, 1, 1, $now]); +$eo = $mk('E-open', 'open', ['due' => $ago(5), 'overdue' => 1, 'created' => $ago(50)]); +$ec = $mk('E-closed', 'closed', ['due' => $ago(5), 'overdue' => 1, 'created' => $ago(50)]); +$r = run_check_escalations($pdo); +$check((int) $pdo->query("SELECT COUNT(*) FROM escalation_log WHERE ticket_id = {$eo}")->fetchColumn() === 1, 'Eskalation: die Regel greift bei einem offenen Ticket (Gegenprobe)'); +$hit = (int) $pdo->query("SELECT COUNT(*) FROM escalation_log WHERE ticket_id IN ({$a},{$b},{$c},{$ec})")->fetchColumn(); +$check($hit === 0, 'Eskalation: erledigte Tickets werden nicht eskaliert'); + +// 4. Wiedervorlage: bei erledigten Tickets still entfernt, bei offenen mit Benachrichtigung +$sc = $mk('W-closed', 'closed', ['snooze' => $ago(1)]); +$so = $mk('W-open', 'open', ['snooze' => $ago(1)]); +$woken = ticket_snooze_wake_due($pdo); +$check($woken === 1, "Wiedervorlage: nur das offene Ticket wird zurückgeholt (war {$woken})"); +$check($row($sc)['snoozed_until'] === null && $row($so)['snoozed_until'] === null, 'Wiedervorlage: bei beiden aufgeräumt'); +$act = fn(int $id) => (int) $pdo->query("SELECT COUNT(*) FROM activity_log WHERE ticket_id = {$id} AND action LIKE '%Wiedervorlage fällig%'")->fetchColumn(); +$check($act($sc) === 0 && $act($so) === 1, 'Wiedervorlage: Hinweis „fällig“ nur beim offenen Ticket'); + +// 5. Erinnerung „Ticket wartet auf Antwort“ erfasst nur offene Tickets +set_setting('wait_reminder_enabled', '1'); +set_setting('wait_reminder_hours', '1'); +$wo = $mk('A-open', 'open', ['due' => $ago(-40), 'created' => $ago(100), 'updated' => $ago(100)]); +$wc = $mk('A-closed', 'closed', ['due' => $ago(-40), 'created' => $ago(100), 'updated' => $ago(100)]); +$wr = wait_reminders_run($pdo, $now); +$check((int) ($wr['sent'] ?? 0) === 1, 'Erinnerung: das offene Ticket wird erinnert (Gegenprobe)'); +$check($row($wc)['wait_reminded_at'] === null && $row($wo)['wait_reminded_at'] !== null, 'Erinnerung: für das erledigte Ticket wird nichts gesendet'); + +echo $failures ? "FEHLGESCHLAGEN:\n - " . implode("\n - ", $failures) . "\n" : ''; +echo "Ticket-erledigt-Test: " . ($total - count($failures)) . " von {$total} Prüfungen in Ordnung.\n"; +exit($failures ? 1 : 0); diff --git a/DeskHub-Webseite/tests/ticket_done_web.php b/DeskHub-Webseite/tests/ticket_done_web.php new file mode 100644 index 00000000..a7a12a0f --- /dev/null +++ b/DeskHub-Webseite/tests/ticket_done_web.php @@ -0,0 +1,157 @@ +getPathname(), strlen($root) + 1)); + if (preg_match($skip, $rel) && !preg_match('#^(backups|uploads|plugins)/(\.htaccess|README\.md)$#', $rel)) continue; + if ($f->isDir()) { @mkdir($tmp . '/' . $rel, 0755, true); continue; } + @mkdir(dirname($tmp . '/' . $rel), 0755, true); + copy($f->getPathname(), $tmp . '/' . $rel); +} +@mkdir($tmp . '/uploads'); +@mkdir($tmp . '/config'); +file_put_contents($tmp . '/config/config.php', ' bin2hex(random_bytes(32)), + 'db' => ['driver' => 'sqlite', 'sqlite_path' => $tmp . '/database/deskhub.sqlite'], + 'site' => ['name' => 'Test', 'url' => 'http://127.0.0.1', 'admin_email' => 'a@test.de', 'timezone' => 'Europe/Berlin'], + 'uploads' => ['max_size_bytes' => 10485760, 'allowed_extensions' => ['png'], 'path' => $tmp . '/uploads'], +], true) . ';'); + +putenv('DESKHUB_CONFIG_JSON'); +putenv('DESKHUB_SQLITE_PATH'); +putenv('DESKHUB_TESTING'); +putenv('DESKHUB_API_ALLOW_INSECURE=1'); +require_once $root . '/database/sqlite_schema.php'; +require_once $root . '/database/migrate.php'; +$db = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite'); +$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); +$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); +$db->exec('PRAGMA foreign_keys = ON'); +$db->exec(convert_schema_to_sqlite((string) file_get_contents($root . '/database/schema.sql'))); +run_migrations($db, true); +$now = date('Y-m-d H:i:s'); +$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn(); +$db->exec('DELETE FROM staff'); +$ins = $db->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)'); +foreach ([['Chef', 'chef@test.de', 'admin'], ['Eva', 'eva@test.de', 'agent'], ['Max', 'max@test.de', 'agent']] as [$n, $e, $r]) { + $ins->execute([$n, $e, password_hash('Sehr-Sicher-1234', PASSWORD_DEFAULT), $r, $dept, $now]); +} +$evaId = (int) $db->query("SELECT id FROM staff WHERE email = 'eva@test.de'")->fetchColumn(); +$db = null; + +$failures = []; +$total = 0; +$check = function (bool $ok, string $what) use (&$failures, &$total): void { $total++; if (!$ok) $failures[] = $what; }; +$webProc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$webPort", '-t', $tmp], [['pipe', 'r'], ['file', $work . '/web.out', 'w'], ['file', $work . '/web.out', 'a']], $wp, $tmp); + +try { + for ($i = 0; $i < 50; $i++) { if (@fsockopen('127.0.0.1', $webPort)) break; usleep(100000); } + $pdo = function () use ($tmp): PDO { + $p = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite'); + $p->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + $p->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); + return $p; + }; + $call = function (string $method, string $path, array $form, string $jar, ?string $bearer = null, ?array $json = null) use ($webPort): array { + $ch = curl_init("http://127.0.0.1:$webPort$path"); + $h = ['Sec-Fetch-Mode: navigate']; + if ($json !== null) $h[] = 'Content-Type: application/json'; + if ($bearer) $h[] = 'Authorization: Bearer ' . $bearer; + curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false, CURLOPT_TIMEOUT => 60, CURLOPT_HEADER => true, CURLOPT_HTTPHEADER => $h]); + if ($jar !== '') { curl_setopt($ch, CURLOPT_COOKIEJAR, $jar); curl_setopt($ch, CURLOPT_COOKIEFILE, $jar); } + if ($method === 'POST') { curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $json !== null ? json_encode($json) : http_build_query($form)); } + $raw = (string) curl_exec($ch); + $s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE); + $hs = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE); + curl_close($ch); + return [$s, substr($raw, $hs), substr($raw, 0, $hs)]; + }; + $login = function (string $email) use ($call): string { + $jar = tempnam(sys_get_temp_dir(), 'sow'); + [, $lp] = $call('GET', '/staff/login.php', [], $jar); + preg_match('/name="csrf_token" value="([a-f0-9]+)"/', $lp, $m); + $call('POST', '/staff/login.php', ['csrf_token' => $m[1] ?? '', 'email' => $email, 'password' => 'Sehr-Sicher-1234'], $jar); + return $jar; + }; + $csrf = function (string $path, string $jar) use ($call): string { + [, $p] = $call('GET', $path, [], $jar); + preg_match('/name="csrf_token" value="([a-f0-9]+)"/', $p, $mm); + return $mm[1] ?? ''; + }; + $loggedIn = function (string $jar) use ($call): bool { + [$s, $b] = $call('GET', '/staff/profile.php?tab=security', [], $jar); + return $s === 200 && str_contains($b, 'Von allen Geräten abmelden'); + }; + $apiToken = function (string $email) use ($call): string { + [, $b] = $call('POST', '/api/staff/v1/login.php', [], '', null, ['email' => $email, 'password' => 'Sehr-Sicher-1234', 'deviceName' => 'Test-Gerät']); + return (string) (json_decode($b, true)['token'] ?? ''); + }; + $apiOk = fn(string $tok) => $call('GET', '/api/staff/v1/me.php', [], '', $tok)[0]; + + $mk = function (string $n, string $status, array $o = []) use ($pdo, $now, $dept): int { + $p = $pdo(); + $prio = (int) $p->query('SELECT id FROM priorities ORDER BY id LIMIT 1')->fetchColumn(); + $p->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, resolution_due_at, first_response_due_at, is_overdue, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)') + ->execute([$n, 'Betreff ' . $n, 'K', 'k@example.org', $dept, $prio, $status, 'web', date('Y-m-d H:i:s', time() - 9 * 3600), date('Y-m-d H:i:s', time() - 20 * 3600), $o['overdue'] ?? 0, date('Y-m-d H:i:s', time() - 80 * 3600), $now]); + return (int) $p->lastInsertId(); + }; + $mk('Z-OPEN', 'open', ['overdue' => 1]); + $mk('Z-CLOSED', 'closed', ['overdue' => 1]); // alter Zustand: überfällig-Merker noch gesetzt + $mk('Z-RESOLVED', 'resolved'); + $jar = $login('chef@test.de'); + $rowOf = function (string $html, string $num): string { + return preg_match('#]*>(?:(?!).)*' . preg_quote($num, '#') . '(?:(?!).)*#s', $html, $m) ? $m[0] : ''; + }; + [, $list] = $call('GET', '/staff/tickets.php?tab=all', [], $jar); + $open = $rowOf($list, 'Z-OPEN'); $closed = $rowOf($list, 'Z-CLOSED'); $resolved = $rowOf($list, 'Z-RESOLVED'); + $check($open !== '' && $closed !== '' && $resolved !== '', 'Alle drei Tickets stehen in der Liste'); + $check(str_contains($open, 'überfällig'), 'Liste: das offene Ticket zeigt „überfällig“'); + $check(!str_contains($closed, 'überfällig') && !str_contains($closed, ' Std') && str_contains($closed, '–'), 'Liste: geschlossenes Ticket zeigt keine Fälligkeit und kein „überfällig“'); + $check(!str_contains($resolved, 'überfällig') && !str_contains($resolved, ' Std') && str_contains($resolved, '–'), 'Liste: gelöstes Ticket genauso'); + foreach (['Z-CLOSED' => 'geschlossen', 'Z-RESOLVED' => 'gelöst'] as $num => $label) { + [, $view] = $call('GET', '/staff/ticket_view.php?n=' . $num, [], $jar); + $check(!str_contains($view, 'überfällig') && str_contains($view, '✓ erledigt'), "Ticketansicht ($label): kein „überfällig“, die Lösung steht als erledigt"); + } + [, $view] = $call('GET', '/staff/ticket_view.php?n=Z-OPEN', [], $jar); + $check(str_contains($view, 'überfällig'), 'Ticketansicht (offen): „überfällig“ bleibt'); + $tok = $apiToken('chef@test.de'); + [, $b] = $call('GET', '/api/staff/v1/tickets.php?status=open,closed,resolved&perPage=50', [], '', $tok); + $items = json_decode($b, true)['tickets'] ?? json_decode($b, true)['items'] ?? []; + $by = []; + foreach ($items as $it) $by[$it['number'] ?? $it['ticketNumber'] ?? ''] = $it; + $check(isset($by['Z-OPEN'], $by['Z-CLOSED'], $by['Z-RESOLVED']), 'App-Schnittstelle liefert alle drei Tickets'); + $check(!empty($by['Z-OPEN']['isOverdue']) && str_contains((string) $by['Z-OPEN']['dueLabel'], 'überfällig'), 'App-Schnittstelle: offenes Ticket überfällig'); + $check(empty($by['Z-CLOSED']['isOverdue']) && array_key_exists('dueLabel', $by['Z-CLOSED']) && $by['Z-CLOSED']['dueLabel'] === null, 'App-Schnittstelle: geschlossenes Ticket ohne Fälligkeit und ohne „überfällig“'); + $check(empty($by['Z-RESOLVED']['isOverdue']) && array_key_exists('dueLabel', $by['Z-RESOLVED']) && $by['Z-RESOLVED']['dueLabel'] === null, 'App-Schnittstelle: gelöstes Ticket genauso'); + // Echtes Schließen über die Weboberfläche räumt auf + $t = $csrf('/staff/ticket_view.php?n=Z-OPEN', $jar); + [, $v0] = $call('GET', '/staff/ticket_view.php?n=Z-OPEN', [], $jar); + $call('POST', '/staff/ticket_view.php?n=Z-OPEN', ['csrf_token' => $t, 'action' => 'update_props', 'status' => 'closed', 'resolution_code' => 'fixed', 'resolution_note' => 'ok', 'priority_id' => (string) $pdo()->query("SELECT priority_id FROM tickets WHERE ticket_number = 'Z-OPEN'")->fetchColumn(), 'department_id' => (string) $dept, 'assigned_staff_id' => ''], $jar); + $st = $pdo()->query("SELECT status, is_overdue FROM tickets WHERE ticket_number = 'Z-OPEN'")->fetch(); + $check($st['status'] === 'closed' && (int) $st['is_overdue'] === 0, 'Nach dem Schließen in der Oberfläche ist das Ticket geschlossen und nicht mehr überfällig'); + @unlink($jar); +} finally { + if (is_resource($webProc)) { proc_terminate($webProc); proc_close($webProc); } + $rm = function (string $d) use (&$rm): void { foreach (glob($d . '/{,.}*', GLOB_BRACE) ?: [] as $e) { $b = basename($e); if ($b === '.' || $b === '..') continue; is_dir($e) ? $rm($e) : @unlink($e); } @rmdir($d); }; + $rm($work); +} + +if ($failures) { + fwrite(STDERR, "Fehlgeschlagen:\n - " . implode("\n - ", $failures) . "\n"); + exit(1); +} +echo "Ticket done web checks passed ({$total} Prüfungen).\n"; diff --git a/DeskHub-Webseite/tests/update_security.php b/DeskHub-Webseite/tests/update_security.php index c35cf69e..417be893 100644 --- a/DeskHub-Webseite/tests/update_security.php +++ b/DeskHub-Webseite/tests/update_security.php @@ -45,6 +45,10 @@ $z = new ZipArchive(); $z->open($zip, ZipArchive::CREATE); $z->addFromString('ve $check($code === 0 && is_file($zip . '.sig'), 'Signier-Werkzeug erzeugt die .sig-Datei: ' . $out); $sig = (string) @file_get_contents($zip . '.sig'); $check(update_verify_package('1.0.7', $zip, $sig) === null, 'Gültige Signatur wird akzeptiert'); +foreach (['docs/DeskHub-Handbuch.pdf' => false, 'docs/video/demo.mp4' => true, 'docs/anderes.pdf' => true, 'plugins/x/plugin.php' => true, 'uploads/a.png' => true, 'backups/b.zip' => true, + 'app_downloads/DeskHub.apk' => true, 'tools/x.php' => true, 'tests/x.php' => true, 'staff/help.php' => false, 'includes/mailer.php' => false, 'assets/js/passkey.js' => false, 'docs/DeskHub-Handbuch.pdf.bak' => true, 'config/config.php' => true, 'Config/Config.php' => true, 'config/config.example.php' => true, 'config/.htaccess' => true, './config/config.php' => true, '.env' => true, 'configure.php' => false, 'tools/fix-permissions.sh' => false, 'tools/release-sign.php' => true] as $path => $skipped) { + $check(update_path_is_skipped($path) === $skipped, 'Update-Pfad ' . $path . ($skipped ? ' wird übersprungen' : ' wird installiert')); +} $check(update_verify_package('v1.0.7', $zip, $sig) === null, 'Version mit führendem "v" passt ebenfalls'); $check(update_verify_package('1.0.8', $zip, $sig) !== null, 'Signatur einer anderen Version wird abgelehnt (kein Herunterstufen/Umetikettieren)'); $check(update_verify_package('1.0.7', $zip, '') !== null, 'Fehlende Signatur wird abgelehnt'); @@ -100,6 +104,47 @@ $check(update_http_headers() === [] && update_token_info() === ['', ''], 'ohne T putenv('DESKHUB_CATALOG_DEFAULTS=' . __DIR__ . '/fixtures/no-catalog.php'); $check(function_exists('plugin_publisher_key'), 'Hilfsfunktion vorhanden'); +putenv('DESKHUB_CATALOG_DEFAULTS=' . $tmp . '/defaults.php'); // wieder mit offiziellem Katalog +// ── Updates von der Plugin-Webseite ────────────────────────────────────────── +$check(update_publisher_endpoint(['list' => 1]) === 'https://plugins.example.test/app-release.php?platform=server&list=1', 'Update-Adresse liegt neben dem Katalog: ' . update_publisher_endpoint(['list' => 1])); +$GLOBALS['deskhub_catalog_defaults'] = ['plugins_url' => '', 'themes_url' => '', 'publisher_key' => $pub]; +$check(update_publisher_endpoint([]) === '' && update_publisher_releases() === [], 'Ohne offiziellen Katalog gibt es keine Update-Adresse'); +unset($GLOBALS['deskhub_catalog_defaults']); +$pubZip = $tmp . '/pub.zip'; +$z = new ZipArchive(); $z->open($pubZip, ZipArchive::CREATE); $z->addFromString('version.php', "close(); +$pubSha = hash_file('sha256', $pubZip); +openssl_sign(update_signature_message('1.0.9', $pubSha), $pubSigRaw, $k, OPENSSL_ALGO_SHA256); +$entry = ['platform' => 'server', 'version' => '1.0.9', 'sha256' => $pubSha, 'size' => filesize($pubZip), 'notes' => 'Neu', 'created_at' => '2026-11-05 10:00:00', 'signature' => base64_encode($pubSigRaw)]; +$older = ['platform' => 'server', 'version' => '1.0.8', 'sha256' => str_repeat('a', 64), 'size' => 10, 'notes' => '', 'created_at' => '2026-10-01 10:00:00', 'signature' => 'x']; +$served = [$older, $entry]; +$tamper = false; +$GLOBALS['deskhub_http_get'] = function (string $url, int $max, array $headers = []) use (&$served, &$tamper, $pubZip): array { + if (str_contains($url, 'list=1')) return [200, json_encode(['platform' => 'server', 'releases' => $served]), null]; + if (str_contains($url, 'version=1.0.9') && str_contains($url, 'download=1')) return [200, ($tamper ? 'X' : '') . file_get_contents($pubZip), null]; + return [404, null, 'HTTP 404']; +}; +$rels = update_publisher_releases(); +$check(count($rels) === 2 && $rels[0]['tag_name'] === '1.0.9' && $rels[0]['source'] === 'publisher' && $rels[0]['body'] === 'Neu', 'Plugin-Webseite: Versionen werden geladen, neueste zuerst'); +$check(update_publisher_find('v1.0.9')['sha256'] === $pubSha && update_publisher_find('9.9.9') === null, 'Version wird mit oder ohne „v“ gefunden'); +[$got, $err] = update_publisher_fetch($rels[0]); +$check($err === null && $got !== null && is_file($got), 'Gültiges Paket wird geladen und geprüft: ' . var_export($err, true)); +if ($got) @unlink($got); +$bad = $rels[0]; $bad['signature'] = base64_encode('falsch'); +[$got, $err] = update_publisher_fetch($bad); +$check($got === null && $err !== null, 'Falsche Signatur wird abgelehnt'); +$bad = $rels[0]; $bad['signature'] = ''; +[$got, $err] = update_publisher_fetch($bad); +$check($got === null && $err !== null, 'Fehlende Signatur wird abgelehnt (Seite ohne Signierschlüssel)'); +$tamper = true; +[$got, $err] = update_publisher_fetch($rels[0]); +$check($got === null && str_contains((string) $err, 'Prüfsumme'), 'Verändertes Paket scheitert an der Prüfsumme'); +$tamper = false; +$served = [['version' => '../../x', 'sha256' => $pubSha], ['version' => '2.0.0', 'sha256' => 'kurz'], 'kaputt']; +$check(update_publisher_releases() === [], 'Einträge mit ungültiger Version oder Prüfsumme werden ignoriert'); +$GLOBALS['deskhub_http_get'] = fn(string $url, int $max, array $h = []): array => [500, null, 'HTTP 500']; +$check(update_publisher_releases() === [], 'Fällt die Plugin-Webseite aus, ist die Liste leer (dann greift Gitea)'); +unset($GLOBALS['deskhub_http_get']); + // Aufräumen foreach (glob($tmp . '/*') ?: [] as $f) @unlink($f); @rmdir($tmp); diff --git a/DeskHub-Webseite/tests/vacation_no_notifications.php b/DeskHub-Webseite/tests/vacation_no_notifications.php index a7bf6d1b..fd87d549 100644 --- a/DeskHub-Webseite/tests/vacation_no_notifications.php +++ b/DeskHub-Webseite/tests/vacation_no_notifications.php @@ -15,6 +15,7 @@ require_once dirname(__DIR__) . '/includes/push.php'; $failures = []; $check = function (bool $ok, string $what) use (&$failures): void { if (!$ok) $failures[] = $what; }; $pdo = get_db(); +set_setting('sla_notify_mode', 'assignee'); // diese Prüfungen betreffen den Modus „Bearbeiter bzw. Abteilung“ (Standard ist „nur Administratoren“) $now = db_now(); $pdo->prepare('INSERT INTO departments (name, email) VALUES (?,?)')->execute(['Support', 'support@firma.example']); $dept = (int) $pdo->lastInsertId(); diff --git a/DeskHub-Webseite/tests/web_handoff.php b/DeskHub-Webseite/tests/web_handoff.php index b7862dbc..e9800869 100644 --- a/DeskHub-Webseite/tests/web_handoff.php +++ b/DeskHub-Webseite/tests/web_handoff.php @@ -1,181 +1,181 @@ -getPathname(), strlen($root) + 1)); - if (preg_match($skip, $rel) && !preg_match('#^(backups|uploads|plugins)/(\.htaccess|README\.md)$#', $rel)) continue; - if ($f->isDir()) { @mkdir($tmp . '/' . $rel, 0755, true); continue; } - @mkdir(dirname($tmp . '/' . $rel), 0755, true); - copy($f->getPathname(), $tmp . '/' . $rel); -} -@mkdir($tmp . '/uploads'); -@mkdir($tmp . '/config'); -file_put_contents($tmp . '/config/config.php', ' bin2hex(random_bytes(32)), - 'db' => ['driver' => 'sqlite', 'sqlite_path' => $tmp . '/database/deskhub.sqlite'], - 'site' => ['name' => 'Test', 'url' => 'http://127.0.0.1', 'admin_email' => 'a@test.de', 'timezone' => 'Europe/Berlin'], - 'uploads' => ['max_size_bytes' => 10485760, 'allowed_extensions' => ['png'], 'path' => $tmp . '/uploads'], -], true) . ';'); - -putenv('DESKHUB_CONFIG_JSON'); -putenv('DESKHUB_SQLITE_PATH'); -putenv('DESKHUB_TESTING'); -putenv('DESKHUB_API_ALLOW_INSECURE=1'); -require_once $root . '/database/sqlite_schema.php'; -require_once $root . '/database/migrate.php'; -$db = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite'); -$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); -$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); -$db->exec('PRAGMA foreign_keys = ON'); -$db->exec(convert_schema_to_sqlite((string) file_get_contents($root . '/database/schema.sql'))); -$mig = run_migrations($db, true); -$now = date('Y-m-d H:i:s'); -$dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn(); -$db->exec('DELETE FROM staff'); -$ins = $db->prepare('INSERT INTO staff (name, email, password_hash, role, department_id, is_active, created_at) VALUES (?,?,?,?,?,1,?)'); -$ids = []; -foreach ([['Chef', 'chef@test.de', 'admin'], ['Agent', 'agent@test.de', 'agent'], ['Pfleger', 'pfleger@test.de', 'agent']] as [$n, $e, $r]) { - $ins->execute([$n, $e, password_hash('Sehr-Sicher-1234', PASSWORD_DEFAULT), $r, $dept, $now]); - $ids[$n] = (int) $db->lastInsertId(); -} -$db = null; - -$failures = []; -$total = 0; -$check = function (bool $ok, string $what) use (&$failures, &$total): void { $total++; if (!$ok) $failures[] = $what; }; -$webProc = proc_open([PHP_BINARY, '-S', "127.0.0.1:$webPort", '-t', $tmp], [['pipe', 'r'], ['file', $work . '/web.out', 'w'], ['file', $work . '/web.out', 'a']], $wp, $tmp); - -try { - for ($i = 0; $i < 50; $i++) { if (@fsockopen('127.0.0.1', $webPort)) break; usleep(100000); } - $pdo = function () use ($tmp): PDO { - $p = new PDO('sqlite:' . $tmp . '/database/deskhub.sqlite'); - $p->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); - $p->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); - return $p; - }; - $api = function (string $method, string $path, ?array $json = null, ?string $bearer = null) use ($webPort): array { - $ch = curl_init("http://127.0.0.1:$webPort$path"); - $h = ['Content-Type: application/json']; - if ($bearer) $h[] = 'Authorization: Bearer ' . $bearer; - curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 60, CURLOPT_HTTPHEADER => $h, CURLOPT_CUSTOMREQUEST => $method]); - if ($json !== null) curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($json)); - $b = (string) curl_exec($ch); - $s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE); - curl_close($ch); - return [$s, json_decode($b, true) ?? $b]; - }; - $web = function (string $path, string $jar) use ($webPort): array { - $ch = curl_init("http://127.0.0.1:$webPort$path"); - curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => false, CURLOPT_HEADER => true, CURLOPT_TIMEOUT => 60, CURLOPT_COOKIEJAR => $jar, CURLOPT_COOKIEFILE => $jar, CURLOPT_HTTPHEADER => ['Sec-Fetch-Mode: navigate', 'Sec-Fetch-User: ?1']]); - $b = (string) curl_exec($ch); - $s = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE); - $hs = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE); - curl_close($ch); - $head = substr($b, 0, $hs); - preg_match('/^Location: (.+)$/mi', $head, $m); - return [$s, trim($m[1] ?? ''), substr($b, $hs)]; - }; - $loginApi = function (string $email) use ($api): string { - [, $r] = $api('POST', '/api/staff/v1/login.php', ['email' => $email, 'password' => 'Sehr-Sicher-1234', 'deviceName' => 'Test']); - return (string) ($r['token'] ?? ''); - }; - $db = $pdo(); - $db->prepare('INSERT INTO roles (name, permissions) VALUES (?,?)')->execute(['Assistent-Pfleger', json_encode(['reply_ticket' => true, 'manage_assistant' => true])]); - $roleId = (int) $db->lastInsertId(); - $db->prepare('UPDATE staff SET role_id = ? WHERE email = ?')->execute([$roleId, 'pfleger@test.de']); - $now = date('Y-m-d H:i:s'); - $dept = (int) $db->query('SELECT id FROM departments ORDER BY id LIMIT 1')->fetchColumn(); - $prio = (int) $db->query('SELECT id FROM priorities ORDER BY sort_order LIMIT 1')->fetchColumn(); - $db->prepare('INSERT INTO tickets (ticket_number, subject, requester_name, requester_email, department_id, priority_id, status, source, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?)') - ->execute(['T7001', 'Testticket', 'Kunde', 'kunde@example.org', $dept, $prio, 'open', 'web', $now, $now]); - - $chef = $loginApi('chef@test.de'); - $agent = $loginApi('agent@test.de'); - $pfleger = $loginApi('pfleger@test.de'); - $check($chef !== '' && $agent !== '' && $pfleger !== '', 'Anmeldung der drei Mitarbeiter in der App-Schnittstelle'); - - // ── Welche Seiten sieht wer? ─────────────────────────────────────────── - $keys = fn(string $t): array => array_column(($api('GET', '/api/staff/v1/web_pages.php', null, $t)[1]['pages'] ?? []), 'key'); - $kc = $keys($chef); $ka = $keys($agent); $kp = $keys($pfleger); - $check(count($kc) === 20 && in_array('settings', $kc, true) && in_array('backup', $kc, true) && in_array('assistant', $kc, true), 'Administrator sieht alle 20 Seiten'); - $check($ka === ['mentions', 'agent_directory', 'apps'], 'Mitarbeiter ohne Rechte sehen nur Erwähnungen, Verzeichnis und die Seite „Apps und Downloads“ ' . json_encode($ka)); - $check(in_array('assistant', $kp, true) && !in_array('settings', $kp, true) && !in_array('backup', $kp, true) && !in_array('plugins', $kp, true), 'Mit dem Recht „Assistent“ kommt genau diese Seite dazu, aber keine Systemseiten ' . json_encode($kp)); - - // ── Übergabe ─────────────────────────────────────────────────────────── - [$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/settings.php'], $agent); - $check($s === 403, 'Mitarbeiter ohne Recht bekommt keine Adresse für die Einstellungen (HTTP ' . $s . ')'); - [$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/assistant.php'], $agent); - $check($s === 403, '… und auch nicht für den Assistenten'); - [$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/staff_manage.php'], $chef); - $check($s === 403, 'Seiten, die nicht in der Liste stehen, werden auch Administratoren nicht übergeben'); - [$s] = $api('POST', '/api/staff/v1/web_pages.php', ['path' => '/staff/ticket_view.php?n=T7001&x=