bugfix: when user don't have access pemissions to any helpdesk queues…

… no result should be shown (fixes LMS+ chilek#470)
infoserwis · Jan 23, 2018 · 83088b2 · 83088b2
1 parent b6134ef
commit 83088b2
Showing 1 changed file with 11 additions and 5 deletions.
diff --git a/modules/rtsearch.php b/modules/rtsearch.php
@@ -86,10 +86,14 @@ function RTSearch($search, $order='createtime,desc')
 	if(!empty($search['name']))
 		$where[] = '(UPPER(requestor) ?LIKE? UPPER('.$DB->Escape('%'.$search['name'].'%').') OR '
 			.$DB->Concat('UPPER(customers.lastname)',"' '",'UPPER(customers.name)').' ?LIKE? UPPER('.$DB->Escape('%'.$search['name'].'%').'))';
-	if(isset($search['queue']) && is_array($search['queue']))
-		$where[] = 'queueid IN ('.implode(',', $search['queue']).')';
-	elseif(!empty($search['queue']))
-		$where[] = 'queueid = '.intval($search['queue']);
+	if (isset($search['queue'])) {
+		if (is_array($search['queue']))
+			$where[] = 'queueid IN (' . implode(',', $search['queue']) . ')';
+		elseif (empty($search['queue']))
+			return null;
+		else
+			$where[] = 'queueid = '.intval($search['queue']);
+	}
 	if(isset($search['catids']))
 		$where[] = 'tc.categoryid IN ('.implode(',', $search['catids']).')';
 
@@ -192,7 +196,9 @@ function RTSearch($search, $order='createtime,desc')
 	{
 		// if user hasn't got rights for all queues...
 		$queues = $DB->GetCol('SELECT queueid FROM rtrights WHERE userid=?', array(Auth::GetCurrentUser()));
-		if(sizeof($queues) != $DB->GetOne('SELECT COUNT(*) FROM rtqueues'))
+		if (!count($queues))
+			$search['queue'] = 0;
+		elseif (count($queues) != $DB->GetOne('SELECT COUNT(*) FROM rtqueues'))
 			$search['queue'] = $queues;
 	}
 	else