diff --git a/admin_helpdesk.php b/admin_helpdesk.php index 9a4c27c..46f4304 100644 --- a/admin_helpdesk.php +++ b/admin_helpdesk.php @@ -3,122 +3,107 @@ protect_page(); admin_only($user_data); // Declare as int -$view = (int)$_GET['view']; -if ($view){ - +$view = (isset($_GET['view']) && (int)$_GET['view'] > 0) ? (int)$_GET['view'] : false; +if ($view !== false){ if (!empty($_POST['reply_text'])) { - sanitize($_POST['reply_text']); + sanitize($_POST['reply_text']); // Save ticket reply on database $query = array( - 'tid' => $_GET['view'], - 'username'=> $_POST['username'], - 'message' => $_POST['reply_text'], + 'tid' => $view, + 'username'=> getValue($_POST['username']), + 'message' => getValue($_POST['reply_text']), 'created' => time(), ); + $fields = '`'. implode('`, `', array_keys($query)) .'`'; + $data = '\''. implode('\', \'', $query) .'\''; - //Sanitize array - array_walk($query, 'array_sanitize'); - - $fields = '`'. implode('`, `', array_keys($query)) .'`'; - $data = '\''. implode('\', \'', $query) .'\''; - mysql_insert("INSERT INTO `znote_tickets_replies` ($fields) VALUES ($data)"); - mysql_update("UPDATE `znote_tickets` SET `status`='Staff-Reply' WHERE `id`=". $_GET['view']); - - } - -$ticketData = mysql_select_single("SELECT * FROM znote_tickets WHERE id=". addslashes((int)$_GET['view'])); + mysql_insert("INSERT INTO `znote_tickets_replies` ($fields) VALUES ($data)"); + mysql_update("UPDATE `znote_tickets` SET `status`='Staff-Reply' WHERE `id`='$view' LIMIT 1;"); + } + $ticketData = mysql_select_single("SELECT * FROM znote_tickets WHERE id='$view' LIMIT 1;"); ?> -

View Ticket #

- - - - - - - - -
- - - Created by: - -
-

-
- - View Ticket # + + + + + + + +
+ + - Created by: + +
+

+
+ + + + + + + + +
+ - - - - - - - -
- - - Posted by: - -
-

-
-
- - -
-
- -
- - - -
- - -

Latest Tickets

- + - Posted by: + +
+

+
+
+
+
+
+ +
+ +

Latest Tickets

+ - - - - - - - - +
ID:Subject:Creation:Status:
+ + + + + + + '; + echo ''; + echo ''; + echo ''; + echo ''; + echo ''; + } + ?> +
ID:Subject:Creation:Status:
'. $ticket['id'] .''. $ticket['subject'] .''. getClock($ticket['creation'], true) .''. $ticket['status'] .'
'; - echo ''. $ticket['id'] .''; - echo ''. $ticket['subject'] .''; - echo ''. getClock($ticket['creation'], true) .''; - echo ''. $ticket['status'] .''; - }} - ?> - - - +?> \ No newline at end of file diff --git a/helpdesk.php b/helpdesk.php index df1f22e..5704c55 100644 --- a/helpdesk.php +++ b/helpdesk.php @@ -1,243 +1,223 @@ 0) ? (int)$_GET['view'] : false; +if ($view !== false) { if (!empty($_POST['reply_text'])) { - sanitize($_POST['reply_text']); // Save ticket reply on database $query = array( - 'tid' => $_GET['view'], - 'username'=> $_POST['username'], - 'message' => $_POST['reply_text'], + 'tid' => $view, + 'username'=> getValue($_POST['username']), + 'message' => getValue($_POST['reply_text']), 'created' => time(), ); + $fields = '`'. implode('`, `', array_keys($query)) .'`'; + $data = '\''. implode('\', \'', $query) .'\''; + mysql_insert("INSERT INTO `znote_tickets_replies` ($fields) VALUES ($data)"); + mysql_update("UPDATE `znote_tickets` SET `status`='Player-Reply' WHERE `id`='$view' LIMIT 1;"); + } + $ticketData = mysql_select_single("SELECT * FROM znote_tickets WHERE id='$view' LIMIT 1;"); - //Sanitize array - array_walk($query, 'array_sanitize'); - - $fields = '`'. implode('`, `', array_keys($query)) .'`'; - $data = '\''. implode('\', \'', $query) .'\''; - mysql_insert("INSERT INTO `znote_tickets_replies` ($fields) VALUES ($data)"); - mysql_update("UPDATE `znote_tickets` SET `status`='Player-Reply' WHERE `id`=". $_GET['view']); - - } - -$ticketData = mysql_select_single("SELECT * FROM znote_tickets WHERE id=". addslashes((int)$_GET['view'])); - -if($ticketData['owner'] != $session_user_id){ -echo 'You can not view this ticket!'; -die; -} + if($ticketData['owner'] != $session_user_id) { + echo 'You can not view this ticket!'; + include 'layout/overall/footer.php'; + die; + } ?> -

View Ticket #

- - - - - - - - -
- - - Created by: - -
-

-
- +

View Ticket #

+ + + + + + + +
- - - - - - - -
- - - Posted by: - -
-

-
-
- - -
-
- -
- - -
-$value) { - if (empty($value) && in_array($key, $required_fields) === true) { - $errors[] = 'You need to fill in all fields.'; - break 1; - } - } - - // check errors (= user exist, pass long enough - if (empty($errors) === true) { - /* Token used for cross site scripting security */ - if (!Token::isValid($_POST['token'])) { - $errors[] = 'Token is invalid.'; - } - if ($config['use_captcha']) { - include_once 'captcha/securimage.php'; - $securimage = new Securimage(); - if ($securimage->check($_POST['captcha_code']) == false) { - $errors[] = 'Captcha image verification was submitted wrong.'; - } - } - if (validate_ip(getIP()) === false && $config['validate_IP'] === true) { - $errors[] = 'Failed to recognize your IP address. (Not a valid IPv4 address).'; - } - } -} - -?> -

Latest Tickets

- - - - - - - - - - - '; - echo ''; - echo ''; - echo ''; - echo ''; - }} - ?> -
ID:Subject:Creation:Status:
'. $ticket['id'] .''. $ticket['subject'] .''. getClock($ticket['creation'], true) .''. $ticket['status'] .'
- - - - -

Helpdesk

- $session_user_id, - 'username'=> $_POST['username'], - 'subject' => $_POST['subject'], - 'message' => $_POST['message'], - 'ip' => ip2long(getIP()), - 'creation' => time(), - 'status' => 'Open' - ); - - - //Sanitize array - array_walk($query, 'array_sanitize'); - - $fields = '`'. implode('`, `', array_keys($query)) .'`'; - $data = '\''. implode('\', \'', $query) .'\''; - mysql_insert("INSERT INTO `znote_tickets` ($fields) VALUES ($data)"); - - header('Location: helpdesk.php?success'); - exit(); - - } else if (empty($errors) === false){ - echo ''; - echo output_errors($errors); - echo ''; - } -?> -
-
    -
  • - Account Name:
    - -
    • -
  • - Email:
    - -
    • -
  • - Subject:
    - -
    • -
  • - Message:
    - -
    • - + - Created by: + +
+

+
+ + + + + + + + +
+ + - Posted by: + +
+

+
+
+ + +
+
+ + + $value) { + if (empty($value) && in_array($key, $required_fields) === true) { + $errors[] = 'You need to fill in all fields.'; + break 1; + } + } + + // check errors (= user exist, pass long enough + if (empty($errors) === true) { + /* Token used for cross site scripting security */ + if (!Token::isValid($_POST['token'])) { + $errors[] = 'Token is invalid.'; + } + if ($config['use_captcha']) { + include_once 'captcha/securimage.php'; + $securimage = new Securimage(); + if ($securimage->check($_POST['captcha_code']) == false) { + $errors[] = 'Captcha image verification was submitted wrong.'; + } + } + // Reversed this if, so: first check if you need to validate, then validate. + if ($config['validate_IP'] === true && validate_ip(getIP()) === false) { + $errors[] = 'Failed to recognize your IP address. (Not a valid IPv4 address).'; + } + } + } + ?> +

Latest Tickets

+ + + + + + + + + '; + echo ''; + echo ''; + echo ''; + echo ''; + echo ''; + } + ?> +
ID:Subject:Creation:Status:
'. $ticket['id'] .''. $ticket['subject'] .''. getClock($ticket['creation'], true) .''. $ticket['status'] .'
+ + +

Helpdesk

+ $session_user_id, + 'username'=> getValue($_POST['username']), + 'subject' => getValue($_POST['subject']), + 'message' => getValue($_POST['message']), + 'ip' => ip2long(getIP()), + 'creation' => time(), + 'status' => 'Open' + ); + + $fields = '`'. implode('`, `', array_keys($query)) .'`'; + $data = '\''. implode('\', \'', $query) .'\''; + mysql_insert("INSERT INTO `znote_tickets` ($fields) VALUES ($data)"); + + header('Location: helpdesk.php?success'); + exit(); + + } else if (empty($errors) === false) { + echo ''; + echo output_errors($errors); + echo ''; + } + ?> +
+ -
- +
  • + Write the image symbols in the text field to verify that you are a human: + CAPTCHA Image
    + + [ Different Image ]

    +
    • + + +
  • + + +
    • + + + +?> \ No newline at end of file