← All changes | app/Http/Controllers/AgentController.php +13 -25 2.3.1 → 2.4.5 View file →

		@@ -10,14 +10,9 @@
10	10	use FluentSupport\App\Modules\PermissionManager;
11	11	use FluentSupport\App\Http\Requests\AgentCreateRequest;
12	12
13	13	/**
14		- * AgentController class for REST API
15		- * This class is responsible for getting data for all request related to agent
16		- *
17		- * @package FluentSupport\App\Http\Controllers
18		- *
19		- * @version 1.0.0
	14	+ * Support staff (agent) endpoints.
20	15	*/
21	16	class AgentController extends Controller
22	17	{
23	18	public function index(Request $request, Agent $agent)
		@@ -29,9 +24,8 @@
29	24	];
30	25	}
31	26
32	27	/**
33		- * addAgent method will add new agent in person table
34	28	* @param AgentCreateRequest $request
35	29	* @return \WP_REST_Response | array
36	30	* @throws \FluentSupport\Framework\Validator\ValidationException
37	31	*/
		@@ -51,12 +45,11 @@
51	45	}
52	46	}
53	47
54	48	/**
55		- * updateAgent method will update the information of an exiting agent
56	49	* @param AgentCreateRequest $request
57	50	* @param Agent $agent
58		- * @param $agent_id
	51	+ * @param int $agent_id
59	52	* @return \WP_REST_Response | array
60	53	* @throws \FluentSupport\Framework\Validator\ValidationException
61	54	*/
62	55	public function updateAgent(AgentCreateRequest $request, Agent $agent, $agent_id)
		@@ -80,12 +73,13 @@
80	73	}
81	74	}
82	75
83	76	/**
84		- * deleteAgent will delete an exiting agent and add an alternative agent as replacement
	77	+ * The agent's tickets and data move to fallback_agent_id.
	78	+ *
85	79	* @param Request $request
86	80	* @param Agent $agent
87		- * @param $agent_id
	81	+ * @param int $agent_id
88	82	* @return \WP_REST_Response | array
89	83	* @throws \FluentSupport\Framework\Validator\ValidationException
90	84	*/
91	85	public function deleteAgent(Request $request, Agent $agent, $agent_id)
		@@ -108,13 +102,11 @@
108	102	* @return \WP_REST_Response | array
109	103	*/
110	104	public function myStats(Request $request)
111	105	{
112		- // Get logged in agent information.
113	106	$agent = Helper::getAgentByUserId();
114	107
115	108	try {
116		- // Get ticket statistics.
117	109	$stats = StatModule::getAgentStat($agent->id);
118	110	$with = $request->get('with', []);
119	111	$with = is_array($with) ? map_deep($with, 'sanitize_text_field') : [];
120	112
		@@ -149,10 +141,8 @@
149	141	return [];
150	142	}
151	143
152	144	/**
153		- * addOrUpdateProfileImage method will upload profile picture for a given agent id
154		- * For a successful upload it's required to send file object, agent id and the user type(agent)
155	145	* @param Request $request
156	146	* @param AvatarUploder $avatarUploder
157	147	* @return \WP_REST_Response | array
158	148	*/
		@@ -167,17 +157,18 @@
167	157	}
168	158	}
169	159
170	160	/**
171		- * resetAvatar method will restore a Support Staff avatar
172		- * For a successful upload it's required to send file object, Support Staff id and the user type(Support Staff)
173		- * @param Agent $agent
174		- * @param $agent_id
	161	+ * No Agent type-hint: route-model binding runs before the policy, which would
	162	+ * let unauthenticated callers probe agent IDs. Resolve after auth.
	163	+ *
	164	+ * @param int|string $agent
175	165	* @return array
176	166	*/
177		- public function resetAvatar(Agent $agent)
	167	+ public function resetAvatar($agent)
178	168	{
179	169	try {
	170	+ $agent = Agent::findOrFail((int) $agent);
180	171	$agent->restoreAvatar();
181	172
182	173	return [
183	174	'message' => __('Support Staff avatar reset to gravatar default', 'fluent-support')
		@@ -203,10 +194,8 @@
203	194	];
204	195	}
205	196
206	197	/**
207		- * Sanitize payload data for create/update operations.
208		- *
209	198	* @param AgentCreateRequest $request
210	199	* @param bool $includeEmail
211	200	* @return array
212	201	*/
		@@ -223,9 +212,10 @@
223	212	'restrictions' => $this->sanitizeRestrictions($request->get('restrictions')),
224	213	];
225	214
226	215	if ($request->has('agent_signature')) {
227		- $data['agent_signature'] = wp_kses_post(wp_unslash($request->get('agent_signature', '')));
	216	+ // Already unslashed by the request. Don't unslash again or literal backslashes are lost.
	217	+ $data['agent_signature'] = wp_kses_post($request->get('agent_signature', ''));
228	218	}
229	219
230	220	if ($request->has('agent_signature_enabled')) {
231	221	$data['agent_signature_enabled'] = $request->get('agent_signature_enabled') === 'yes' ? 'yes' : 'no';
		@@ -238,10 +228,8 @@
238	228	return $data;
239	229	}
240	230
241	231	/**
242		- * Sanitize restrictions data for agent
243		- *
244	232	* @param mixed $restrictions
245	233	* @return array
246	234	*/
247	235	private function sanitizeRestrictions($restrictions)