| @@ -571,12 +571,21 @@ | ||
| 571 | 571 | * @return array |
| 572 | 572 | */ |
| 573 | 573 | public static function agent_autocomplete( $filters ) { |
| 574 | 574 | |
| 575 | + // Whitelisted map of accepted sort_by values to actual DB columns - only | |
| 576 | + // the two options offered in the sort-by dropdown are valid here. | |
| 577 | + $sortable_columns = array( | |
| 578 | + 'name' => 'name', | |
| 579 | + 'workload' => 'workload', | |
| 580 | + ); | |
| 581 | + $orderby = isset( $sortable_columns[ $filters['sort_by'] ] ) ? | |
| 582 | + $sortable_columns[ $filters['sort_by'] ] : 'name'; | |
| 583 | + | |
| 575 | 584 | $args = array( |
| 576 | 585 | 'search' => $filters['term'], |
| 577 | 586 | 'items_per_page' => 25, |
| 578 | - 'orderby' => $filters['sort_by'], | |
| 587 | + 'orderby' => $orderby, | |
| 579 | 588 | 'order' => 'ASC', |
| 580 | 589 | 'meta_query' => array( |
| 581 | 590 | 'relation' => 'AND', |
| 582 | 591 | array( |
| @@ -1184,8 +1193,46 @@ | ||
| 1184 | 1193 | |
| 1185 | 1194 | $sql = $sql . $joins . $where; |
| 1186 | 1195 | |
| 1187 | 1196 | return (int) $wpdb->get_var( $sql ); |
| 1197 | + } | |
| 1198 | + | |
| 1199 | + /** | |
| 1200 | + * Check current user ticket access for capability | |
| 1201 | + * | |
| 1202 | + * @param WPSC_Ticket|WPSC_Archive_Ticket $ticket Ticket object. | |
| 1203 | + * @param string $cap - capability name. | |
| 1204 | + * @return boolean | |
| 1205 | + */ | |
| 1206 | + public static function has_ticket_cap( $ticket, $cap ) { | |
| 1207 | + | |
| 1208 | + $current_user = WPSC_Current_User::$current_user; | |
| 1209 | + | |
| 1210 | + $assigned_agents = array_map( | |
| 1211 | + fn ( $agent ) => $agent->id, | |
| 1212 | + $ticket->assigned_agent | |
| 1213 | + ); | |
| 1214 | + | |
| 1215 | + $flag = false; | |
| 1216 | + if ( | |
| 1217 | + ( | |
| 1218 | + ! $ticket->assigned_agent && | |
| 1219 | + $current_user->agent->has_cap( $cap . '-unassigned' ) | |
| 1220 | + ) || | |
| 1221 | + ( | |
| 1222 | + in_array( $current_user->agent->id, $assigned_agents ) && | |
| 1223 | + $current_user->agent->has_cap( $cap . '-assigned-me' ) | |
| 1224 | + ) || | |
| 1225 | + ( | |
| 1226 | + $ticket->assigned_agent && | |
| 1227 | + ! in_array( $current_user->agent->id, $assigned_agents ) && | |
| 1228 | + $current_user->agent->has_cap( $cap . '-assigned-others' ) | |
| 1229 | + ) | |
| 1230 | + ) { | |
| 1231 | + $flag = true; | |
| 1232 | + } | |
| 1233 | + | |
| 1234 | + return apply_filters( 'wpsc_it_has_ticket_cap', $flag, $ticket, $cap ); | |
| 1188 | 1235 | } |
| 1189 | 1236 | } |
| 1190 | 1237 | endif; |
| 1191 | 1238 | |
