diff --git a/server/controllers/system/download.php b/server/controllers/system/download.php index 756fd56e..d6dc8074 100644 --- a/server/controllers/system/download.php +++ b/server/controllers/system/download.php @@ -23,9 +23,10 @@ class DownloadController extends Controller { $staffUser = Staff::getDataStore($fileName, 'profilePic'); if($staffUser->isNull()) { + $session = Session::getInstance(); $loggedUser = Controller::getLoggedUser(); - if($loggedUser->isNull()) { + if(!$session->sessionExists()) { print ''; return; } @@ -55,10 +56,22 @@ class DownloadController extends Controller { } private function isNotAuthor($ticket, $loggedUser) { - return Controller::isStaffLogged() || $ticket->author->id !== $loggedUser->id; + $session = Session::getInstance(); + + if($session->getTicketNumber()) { + return $session->getTicketNumber() !== $ticket->ticketNumber; + } else { + return Controller::getLoggedUser()->level >= 1 || $ticket->author->id !== $loggedUser->id; + } } private function isNotOwner($ticket, $loggedUser) { - return !Controller::isStaffLogged() || !$ticket->owner || $ticket->owner->id !== $loggedUser->id; + $session = Session::getInstance(); + + if($session->getTicketNumber()) { + return $session->getTicketNumber() !== $ticket->ticketNumber; + } else { + return !(Controller::getLoggedUser()->level >= 1) || !$ticket->owner || $ticket->owner->id !== $loggedUser->id; + } } } \ No newline at end of file diff --git a/server/libs/Controller.php b/server/libs/Controller.php index 57947954..2412af24 100644 --- a/server/libs/Controller.php +++ b/server/libs/Controller.php @@ -17,7 +17,7 @@ abstract class Controller { $this->validate(); $this->handler(); } catch (\Exception $exception) { - Response::respondError($exception->getMessage() . ' on line ' . $exception->getFile() . ':' . $exception->getLine()); + Response::respondError($exception->getMessage()); return; } }; diff --git a/tests/system/get-mail-templates.rb b/tests/system/get-mail-templates.rb index db0c43d6..34dd2600 100644 --- a/tests/system/get-mail-templates.rb +++ b/tests/system/get-mail-templates.rb @@ -10,6 +10,6 @@ describe'system/get-mail-templates' do (result['status']).should.equal('success') - (result['data'].size).should.equal(18) + (result['data'].size).should.equal(90) end end