Fixed evaluation of ticket ID parameter in generic interface operatio…

…n TicketGet.
znuny · Aug 23, 2024 · 92b917d · 92b917d
1 parent 1c5641c
commit 92b917d
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 5 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,4 +1,5 @@
 # 7.1.3 2024-??-??
+ - 2024-08-23 Fixed evaluation of ticket ID parameter in generic interface operation TicketGet.
  - 2024-08-22 Console command Admin::PostMasterFilter::Import now will also update existing filters instead of only create new ones. Thanks to @meisterheister for reporting the issue. [#527](https://github.com/znuny/Znuny/issues/527)
  - 2024-08-22 Added '--single-transaction' option to scripts/backup.pl for MySQL/MariaDB. The --single-transaction flag will start a transaction before running.
  - 2024-08-21 Improved CSS for skin 'Dark'. [#584](https://github.com/znuny/Znuny/issues/584)

diff --git a/Kernel/GenericInterface/Operation/Ticket/TicketGet.pm b/Kernel/GenericInterface/Operation/Ticket/TicketGet.pm
@@ -274,7 +274,7 @@ sub Run {
     # all needed variables
     my @TicketIDs;
     if ( IsStringWithData( $Param{Data}->{TicketID} ) ) {
-        @TicketIDs = split( /,/, $Param{Data}->{TicketID} );
+        @TicketIDs = split( /\s*,\s*/, $Param{Data}->{TicketID} );
     }
     elsif ( IsArrayRefWithData( $Param{Data}->{TicketID} ) ) {
         @TicketIDs = @{ $Param{Data}->{TicketID} };
@@ -286,6 +286,15 @@ sub Run {
         );
     }
 
+    # Check for IDs being integers.
+    my $NumberOfIntegers = grep { $_ =~ m{\A[1-9]\d*\z} } @TicketIDs;
+    if ( $NumberOfIntegers != @TicketIDs ) {
+        return $Self->ReturnError(
+            ErrorCode    => 'TicketGet.WrongStructure',
+            ErrorMessage => "TicketGet: Invalid ticket ID parameter(s) found!",
+        );
+    }
+
     # Get the list of article dynamic fields
     my $ArticleDynamicFieldList = $Kernel::OM->Get('Kernel::System::DynamicField')->DynamicFieldList(
         ObjectType => 'Article',

diff --git a/scripts/test/GenericInterface/Operation/Ticket/TicketGet.t b/scripts/test/GenericInterface/Operation/Ticket/TicketGet.t
@@ -1169,19 +1169,19 @@ my @Tests = (
         ExpectedReturnLocalData => {
             Data => {
                 Error => {
-                    ErrorCode => 'TicketGet.AccessDenied',
+                    ErrorCode => 'TicketGet.WrongStructure',
                     ErrorMessage =>
-                        'TicketGet: User does not have access to the ticket!'
+                        'TicketGet: Invalid ticket ID parameter(s) found!'
                 }
             },
             Success => 1
         },
         ExpectedReturnRemoteData => {
             Data => {
                 Error => {
-                    ErrorCode => 'TicketGet.AccessDenied',
+                    ErrorCode => 'TicketGet.WrongStructure',
                     ErrorMessage =>
-                        'TicketGet: User does not have access to the ticket!'
+                        'TicketGet: Invalid ticket ID parameter(s) found!'
                 }
             },
             Success => 1