| @@ -15,8 +15,17 @@ | ||
| 15 | 15 | protected $table = 'fs_tickets'; |
| 16 | 16 | |
| 17 | 17 | protected $dates = ['waiting_since']; |
| 18 | 18 | |
| 19 | + /** | |
| 20 | + * The ticket hash is a bearer credential for the signed public ticket view, | |
| 21 | + * so it must never be serialized into an API response. PHP property access | |
| 22 | + * is unaffected, which is what Helper::getTicketViewSignedUrl() relies on. | |
| 23 | + * | |
| 24 | + * @var array | |
| 25 | + */ | |
| 26 | + protected $hidden = ['hash', 'content_hash']; | |
| 27 | + | |
| 19 | 28 | protected $appends = ['display_ticket_number']; |
| 20 | 29 | |
| 21 | 30 | /** |
| 22 | 31 | * The attributes that are mass assignable. |
| @@ -70,8 +79,17 @@ | ||
| 70 | 79 | $model->waiting_since = current_time('mysql'); |
| 71 | 80 | |
| 72 | 81 | }); |
| 73 | 82 | |
| 83 | + static::updating(function ($model) { | |
| 84 | + // A hash handed out for one customer must stop working the moment | |
| 85 | + // the ticket belongs to somebody else, otherwise every link already | |
| 86 | + // emailed for it keeps authorizing read, reply, close and reopen. | |
| 87 | + if ($model->isDirty('customer_id')) { | |
| 88 | + $model->hash = bin2hex(random_bytes(16)); | |
| 89 | + } | |
| 90 | + }); | |
| 91 | + | |
| 74 | 92 | static::created(function ($model) { |
| 75 | 93 | if (empty($model->serial_number) || empty($model->ticket_number)) { |
| 76 | 94 | $model->assignTicketNumber(); |
| 77 | 95 | } |
| @@ -931,9 +949,9 @@ | ||
| 931 | 949 | |
| 932 | 950 | if ($value) { |
| 933 | 951 | if (in_array($fieldType, $customRenderers) && $rendered) { |
| 934 | 952 | $value = apply_filters('fluent_support/custom_field_render_' . $fieldType, $value, $scope); |
| 935 | - } else if ($fieldType == 'checkbox') { | |
| 953 | + } else if (in_array($fieldType, ['checkbox', 'date-range'])) { | |
| 936 | 954 | $value = array_values(array_filter(explode('|', $value))); |
| 937 | 955 | } |
| 938 | 956 | |
| 939 | 957 | if (!is_array($value) && !is_object($value)) { |
