95 lines
3.0 KiB
PHP
95 lines
3.0 KiB
PHP
<?php
|
|
|
|
class CommentController {
|
|
|
|
use CheckCSRF;
|
|
|
|
/**
|
|
* Add a new comment to a ticket.
|
|
* Expects POST data: comment (text)
|
|
* Route: POST /ticket/@id/comment
|
|
*/
|
|
public function create($f3){
|
|
// check logged in
|
|
if(!$f3->exists('SESSION.user')){
|
|
$f3->reroute('/login');
|
|
}
|
|
|
|
$this->checkCSRF($f3, '/ticket/' . $f3->get('PARAMS.id'));
|
|
|
|
$ticket_id = (int) $f3->get('PARAMS.id');
|
|
$comment_text = $f3->get('POST.comment');
|
|
$current_user_id = $f3->get('SESSION.user.id');
|
|
|
|
if(empty($comment_text)){
|
|
$f3->set('SESSION.error', 'ticket not updated. No content');
|
|
$f3->reroute('/ticket/' . $ticket_id);
|
|
}
|
|
|
|
// insert comment
|
|
$db = $f3->get('DB');
|
|
$db->exec(
|
|
'INSERT INTO ticket_comments (ticket_id, comment, created_by, created_at)
|
|
VALUES (?, ?, ?, NOW())',
|
|
[$ticket_id, $comment_text, $current_user_id]
|
|
);
|
|
|
|
$f3->reroute('/ticket/' . $ticket_id);
|
|
}
|
|
|
|
/**
|
|
* Delete an existing comment
|
|
* Route: GET /tickey/@id/comment/@comment_id/delete
|
|
*/
|
|
public function delete($f3){
|
|
if(!$f3->exists('SESSION.user')){
|
|
$f3->reroute('/login');
|
|
}
|
|
|
|
$ticket_id = (int) $f3->get('PARAMS.id');
|
|
$comment_id = (int) $f3->get('PARAMS.comment_id');
|
|
$current_user = $f3->get('SESSION.user');
|
|
|
|
$db = $f3->get('DB');
|
|
|
|
//optional: check if user is allowed to delete comment.
|
|
// fetch who created the comment
|
|
$comment_row = $db->exec(
|
|
'SELECT created_by FROM ticket_comments WHERE id = ? AND ticket_id = ? LIMIT 1',
|
|
[$comment_id, $ticket_id]
|
|
);
|
|
if(!$comment_row){
|
|
$f3->set('SESSION.error', 'Error: Ticket comment ID not found.');
|
|
$f3->reroute('/ticket/'.$ticket_id);
|
|
}
|
|
$comment_owner = $comment_row[0]['created_by'];
|
|
// TODO: $is_admin = ()
|
|
if($current_user['id'] !== $comment_owner){
|
|
// no permission
|
|
$f3->set('SESSION.error', 'You do not have permission to delete this ticket');
|
|
$f3->reroute('/ticket/'. $ticket_id);
|
|
}
|
|
|
|
// Delete - addition, rather than delete, we set a delete flag
|
|
$db->exec('UPDATE ticket_comments SET deleted = 1 WHERE id = ?', [$comment_id]);
|
|
$f3->reroute('/ticket/' . $ticket_id);
|
|
}
|
|
|
|
// view comments
|
|
public function index($f3){
|
|
$ticket_id = (int) $f3->get('PARAMS.id');
|
|
$db = $f3->get('DB');
|
|
$results = $db->exec('
|
|
SELECT c.*, u.username AS author_name
|
|
FROM ticket_comments c
|
|
LEFT JOIN users u ON c.created_by = u.id
|
|
WHERE c.ticket_id = ?
|
|
ORDER BY c.created_at DESC',
|
|
[$ticket_id]
|
|
);
|
|
$comments = $results;
|
|
$f3->set('comments', $comments);
|
|
|
|
echo \Template::instance()->render('views/comments/view.html');
|
|
}
|
|
} |