← All changes | app/Http/Controllers/UploaderController.php +56 -2 2.4.0 → 2.4.5 View file →

		@@ -4,8 +4,9 @@
4	4
5	5	use FluentSupport\App\Models\Attachment;
6	6	use FluentSupport\App\Models\Ticket;
7	7	use FluentSupport\App\Modules\PermissionManager;
	8	+use FluentSupport\App\Services\CustomerPortalService;
8	9	use FluentSupport\App\Services\EmailNotification\Settings;
9	10	use FluentSupport\App\Services\Helper;
10	11	use FluentSupport\Framework\Http\Request\Request;
11	12	use FluentSupport\App\Services\Includes\UploadService;
		@@ -18,8 +19,15 @@
18	19	*/
19	20	class UploaderController extends Controller
20	21	{
21	22	/**
	23	+ * Uploads sent with on_behalf belong to that customer, and their ticket_id is the
	24	+ * public ticket number. Remote portals check for this constant to know which
	25	+ * ticket reference to send. Don't remove it.
	26	+ */
	27	+ const ON_BEHALF_UPLOADS = true;
	28	+
	29	+ /**
22	30	* uploadTicketFiles method will upload all the attached file in a ticket
23	31	* @param Request $request
24	32	* @return array[]
25	33	* @throws \FluentSupport\Framework\Validator\ValidationException
		@@ -38,11 +46,23 @@
38	46	if ($partsError = $this->rejectUnexpectedFileParts($files)) {
39	47	return $partsError;
40	48	}
41	49
42		- $ticketId = $this->resolveTicketId($request);
43		- $person = $this->resolvePerson($ticketId, $request);
	50	+ $onBehalf = (new CustomerPortalService())->sanitizeOnBehalf($request->get('on_behalf', []));
44	51
	52	+ if ($onBehalf) {
	53	+ try {
	54	+ list($ticketId, $person) = $this->resolveOnBehalfUploader($onBehalf, $request);
	55	+ } catch (\Exception $e) {
	56	+ return $this->sendError([
	57	+ 'message' => Helper::getSafeErrorMessage($e),
	58	+ ]);
	59	+ }
	60	+ } else {
	61	+ $ticketId = $this->resolveTicketId($request);
	62	+ $person = $this->resolvePerson($ticketId, $request);
	63	+ }
	64	+
45	65	if ($permissionError = $this->checkPermissionToUploadFile($person)) {
46	66	return $permissionError;
47	67	}
48	68
		@@ -172,8 +192,42 @@
172	192
173	193	$ticket = Ticket::wherePublicIdentifier($ticketId)->first();
174	194
175	195	return $ticket ? $ticket->id : null;
	196	+ }
	197	+
	198	+ /**
	199	+ * A remote portal (PortalPolicy has allowed on_behalf) uploads as the customer it
	200	+ * acts for, so the file belongs to that customer and counts toward their quota only.
	201	+ * ticket_id is the public ticket number, as on every other portal endpoint.
	202	+ *
	203	+ * @return array [ticket id or null, customer]
	204	+ * @throws \Exception
	205	+ */
	206	+ private function resolveOnBehalfUploader($onBehalf, Request $request)
	207	+ {
	208	+ $portalService = new CustomerPortalService();
	209	+ $identifier = $request->getSafe('ticket_id', 'intval');
	210	+
	211	+ if (!$identifier) {
	212	+ return [null, $portalService->resolveCustomer($onBehalf, $request->getIp(), true)];
	213	+ }
	214	+
	215	+ $ticket = Ticket::wherePublicIdentifier($identifier)->first();
	216	+
	217	+ if (!$ticket) {
	218	+ throw new \Exception(esc_html__('Sorry, You do not have permission to this support ticket', 'fluent-support'));
	219	+ }
	220	+
	221	+ // getCustomer() also holds an agent to their own mailbox and ticket access.
	222	+ $customer = $portalService->getCustomer([
	223	+ 'on_behalf' => $onBehalf,
	224	+ 'user_ip' => $request->getIp(),
	225	+ ], $ticket);
	226	+
	227	+ $portalService->checkCustomerTicketAccess($customer, $ticket, 'response');
	228	+
	229	+ return [$ticket->id, $customer];
176	230	}
177	231
178	232	private function resolvePerson($ticketId, Request $request)
179	233	{