@@ -598,6 +598,7 @@ public function getAllGrouped($searchCriteria): array
598598 $ ticketGroups ['all ' ] = [
599599 'label ' => 'all ' ,
600600 'id ' => 'all ' ,
601+ 'value ' => '' ,
601602 'class ' => '' ,
602603 'items ' => $ tickets ,
603604 ];
@@ -729,6 +730,7 @@ public function getAllGrouped($searchCriteria): array
729730 'label ' => $ label ,
730731 'more-info ' => $ moreInfo ,
731732 'id ' => $ sortId ?? strtolower ($ groupedFieldValue ),
733+ 'value ' => $ groupedFieldValue ,
732734 'class ' => $ class ,
733735 'color ' => $ groupColor ,
734736 'items ' => [$ ticket ],
@@ -876,6 +878,7 @@ private function groupTicketsByDueDate(array $tickets): array
876878 $ ticketGroups [$ bucketKey ] = [
877879 'label ' => $ bucketDef ['label ' ],
878880 'id ' => $ bucketDef ['id ' ],
881+ 'value ' => $ bucketKey ,
879882 'class ' => $ bucketDef ['class ' ],
880883 'more-info ' => '' ,
881884 'items ' => [],
@@ -2159,13 +2162,19 @@ public function updateTicket($values): array|bool
21592162 */
21602163 public function patch ($ id , $ params ): bool
21612164 {
2162-
2163- // $params is an array of field names. Exclude id
2164- if (is_array ($ params )) {
2165- unset($ params ['id ' ]);
2166- unset($ params ['act ' ]);
2165+ if (! is_array ($ params )) {
2166+ return false ;
21672167 }
21682168
2169+ // Strip non-ticket fields that may leak in from the framework or form submissions
2170+ unset(
2171+ $ params ['id ' ],
2172+ $ params ['act ' ],
2173+ $ params ['request_parts ' ],
2174+ $ params ['saveTicket ' ],
2175+ $ params ['saveAndCloseTicket ' ],
2176+ );
2177+
21692178 $ ticket = $ this ->getTicket ($ id );
21702179
21712180 if (! $ ticket ) {
@@ -2176,10 +2185,14 @@ public function patch($id, $params): bool
21762185
21772186 $ return = $ this ->ticketRepository ->patchTicket ($ id , $ params );
21782187
2188+ if (! $ return ) {
2189+ return false ;
2190+ }
2191+
21792192 self ::dispatchEvent ('ticket_updated ' );
21802193
21812194 // Todo: create events and move notification logic to notification module
2182- if (isset ($ params ['status ' ]) && $ return ) {
2195+ if (isset ($ params ['status ' ])) {
21832196 $ ticket = $ this ->getTicket ($ id );
21842197 $ subject = sprintf ($ this ->language ->__ ('email_notifications.todo_update_subject ' ), $ id , strip_tags ($ ticket ->headline ));
21852198 $ actual_link = BASE_URL .'/dashboard/home#/tickets/showTicket/ ' .$ id ;
@@ -2199,14 +2212,9 @@ public function patch($id, $params): bool
21992212 $ notification ->message = $ message ;
22002213
22012214 $ this ->projectService ->notifyProjectUsers ($ notification );
2202-
2203- self ::dispatchEvent ('ticket_updated ' );
2204-
2205- // Update ticket
2206- return $ this ->patch ($ ticket ->id , ['projectId ' => $ ticket ->projectId , 'sprint ' => '' , 'dependingTicketId ' => '' , 'milestoneid ' => '' ]);
22072215 }
22082216
2209- return false ;
2217+ return ( bool ) $ return ;
22102218 }
22112219
22122220 /**
0 commit comments