diff --git a/CHANGES.md b/CHANGES.md index 941f5d3158..25ef6ecb2e 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,4 +1,5 @@ # 7.1.3 2024-??-?? + - 2024-08-23 Fixed evaluation of ticket ID parameter in generic interface operation TicketGet. - 2024-08-22 Console command Admin::PostMasterFilter::Import now will also update existing filters instead of only create new ones. Thanks to @meisterheister for reporting the issue. [#527](https://github.com/znuny/Znuny/issues/527) - 2024-08-22 Added '--single-transaction' option to scripts/backup.pl for MySQL/MariaDB. The --single-transaction flag will start a transaction before running. - 2024-08-21 Improved CSS for skin 'Dark'. [#584](https://github.com/znuny/Znuny/issues/584) diff --git a/Kernel/GenericInterface/Operation/Ticket/TicketGet.pm b/Kernel/GenericInterface/Operation/Ticket/TicketGet.pm index c6ddf438cc..23ba397e0b 100644 --- a/Kernel/GenericInterface/Operation/Ticket/TicketGet.pm +++ b/Kernel/GenericInterface/Operation/Ticket/TicketGet.pm @@ -274,7 +274,7 @@ sub Run { # all needed variables my @TicketIDs; if ( IsStringWithData( $Param{Data}->{TicketID} ) ) { - @TicketIDs = split( /,/, $Param{Data}->{TicketID} ); + @TicketIDs = split( /\s*,\s*/, $Param{Data}->{TicketID} ); } elsif ( IsArrayRefWithData( $Param{Data}->{TicketID} ) ) { @TicketIDs = @{ $Param{Data}->{TicketID} }; @@ -286,6 +286,15 @@ sub Run { ); } + # Check for IDs being integers. + my $NumberOfIntegers = grep { $_ =~ m{\A[1-9]\d*\z} } @TicketIDs; + if ( $NumberOfIntegers != @TicketIDs ) { + return $Self->ReturnError( + ErrorCode => 'TicketGet.WrongStructure', + ErrorMessage => "TicketGet: Invalid ticket ID parameter(s) found!", + ); + } + # Get the list of article dynamic fields my $ArticleDynamicFieldList = $Kernel::OM->Get('Kernel::System::DynamicField')->DynamicFieldList( ObjectType => 'Article', diff --git a/scripts/test/GenericInterface/Operation/Ticket/TicketGet.t b/scripts/test/GenericInterface/Operation/Ticket/TicketGet.t index 22f3911448..5ba531021f 100644 --- a/scripts/test/GenericInterface/Operation/Ticket/TicketGet.t +++ b/scripts/test/GenericInterface/Operation/Ticket/TicketGet.t @@ -1169,9 +1169,9 @@ my @Tests = ( ExpectedReturnLocalData => { Data => { Error => { - ErrorCode => 'TicketGet.AccessDenied', + ErrorCode => 'TicketGet.WrongStructure', ErrorMessage => - 'TicketGet: User does not have access to the ticket!' + 'TicketGet: Invalid ticket ID parameter(s) found!' } }, Success => 1 @@ -1179,9 +1179,9 @@ my @Tests = ( ExpectedReturnRemoteData => { Data => { Error => { - ErrorCode => 'TicketGet.AccessDenied', + ErrorCode => 'TicketGet.WrongStructure', ErrorMessage => - 'TicketGet: User does not have access to the ticket!' + 'TicketGet: Invalid ticket ID parameter(s) found!' } }, Success => 1