opensupports / opensupports Goto Github PK

There is a missing email validation when creating a ticket without users.
https://github.com/opensupports/opensupports/blob/master/server/controllers/ticket/create.php#L70

I'm evaluating helpdesks for internal use, and I see a fairly major issue with the "new ticket" form:

It asks for a Department, but it preselects a default department.

I don't know about your typical users, but ours are sales people, and there is absolutely no way they will ever bother to edit the default before submitting a ticket. Which means we'd need to manually triage every single ticket to the right department.

Hopefully it'd be simple enough to make the field have no default and require a selection. It would also probably help encourage use of the field if it used a standard drop-down select control.

It would be great if a ticket would automatically be created once a customer writes an email to our support email address.

It is necessary to parse special characters like ( when uploading a file.

We should never return the csrf_token for security reasons, a ERRORS::INVALID_TOKEN should be returned instead

https://github.com/opensupports/opensupports/blob/master/server/controllers/ticket/comment.php#L66
https://github.com/opensupports/opensupports/blob/master/server/controllers/ticket/get.php#L55

When I will open a ticket and try attachment appear a Window repeted and I have close the browser.
A lot of functions in the admin area do not work.

It took quite a few attempts to get the script installed on a local Windows 7 dev server running Ampps v.3.7 (Apache 2.2, PHP 5.6, MySql 5.), and it was even more difficult with the install to what will be a production server, running on Linux (Cloud Linux, w/ cPanel on shared hosting) w/LiteSpeed/PHP 5.6/MariaDB. These act exactly the same as if it were a standard LAMP stack, so there wouldn't be any code conflicts.

1. SMTP field data either isn't accepted and/or displaying properly with both installs.

• There's no way to select authentications, and I have no idea what type of filtering or ordering you might have in place for any of the other field arrays, so there's no way of knowing - without the authentication info available - if the mail functions would even work in my case.

• For the local install, I had to omit the mail server data entirely to finish the install, and then add the entries manually from the admin backend. My SMTP test server app (Papercut) didn't even log any attempts on port 25 - which you mention in the documentation - so I have no way of telling if any connection attempt was ever really made. I tried with 'localhost', '127.0.0.1', and my internal '192.168...' IP address, along with my PC Windows workgroup ID. None of them were acceptable for testing and/or proceeding to the next step. Papercut will automatically accept any connection attempt and process incoming mail without checking for authentication, or even if the mailbox is correct.

• For the production install, it accepted all the entries (using a different mail server, of course) and eventually finished the install okay - but - only half of the SMTP entries showed up on the admin config page, and were in the wrong fields. Browsing the database itself in the settings table does confirm that the right entries are in the right fields, but I have no idea why they don't all show, or why they're in the wrong place.

• The local install was fixable by saving the added entries from the admin configuration page - the production server wouldn't save at all without throwing errors, and it also flagged the support center URL as 'invalid', no matter what type of entry was placed in it. It is correct in the settings table in the DB, but is ignored during the settings update logic.

2. There was another issue during the production install that I had to correct... The database user name and the DB name itself seems to have some type of restriction on the entry values. Since cPanel will always preface both the DB user and the DB name with the shared hosting account's shortened account name followed with an underscore (like 'whakydo_', for whackydoodle.com's account), and I'll use a 2nd underscore as an added separator - i.e., 'whackydo_help_2017'. For whatever reason, I had to remove the 2nd underscore in both entries, and ended up making a new DB and user name without them before I could finish the install. If your using regex or limiters of some type, you really should find out what various hosting panels will allow as entries before setting up any filtering for your installers.

3. I should also mention that the SMTP password value in the settings table is in plain-text. This really should contain an encrypted hash instead. I would NOT be too happy if the site got hacked and my mail server turns into a SPAM machine and I end up with a flagged site on every blacklist known to man.

4. Once transferred to the admin panel after the install completes, there are lots of errors on the production install, but the local install seems fine. For each of the admin tabs I get 'An error occurred while trying to retrieve...' type errors. There were no 'add articles' button or an article list, no user or staff lists - but I can see buttons for adding new users or departments, and there is no ticket list, etc. I can see the main dashboard panel and a few other panels, but I haven't attempted adding anything in. It's pointless to try if not everything works.

5. I can't use the login panel to get back to the install on a different browser. I installed with Chrome, and while the admin was logged in there, I tried to start up a new FireFox window, but it keeps flagging the admin user as having an invalid password. Maybe because it doesn't show me as a user in the staff list, I assume. I'll try adding a new user in Chrome while it's still open to the admin pages to get a new login, but that may only be a partial and temporary fix if it works.

6. Ultimately the biggest issue seems to be in the DB setup itself. My local install shows 85 tables created, while the production install shows only 7 tables in total. I'd say this would be why I get the above 'retrieve' errors - but - one of the 7 tables populated is the users table, so there was still some type of a user creation issue for the admin superuser.

Well.... I'd like to be able to use the script, but It's not cooperating on the server where it matters. It seems like there are major permissions issues somewhere, or there's something missing in triggering the important function calls on a Linux install. I'm early in development of the main site and not in a mad rush yet to get a support script in place, so if there are fixes coming sometime soon, I can try them before deciding - or - answer a few questions to help until I need to swap to something else.

I could also try a clean reinstall on the production server without the SMTP data if that would be a better option.

When a user (regular or admin):

• logs in
• opens one or more tabs (besides the one he is using already)
• logs out from one of the tabs

Then if he do not refresh the other tabs, he will appear as being logged in in the other tabs, making he receive tons of errors if he tries to interact with the system, since he is actually not authorized to do any request.

A similar problem happens when he is not logged in. If he opens 2 or more tabs, first being not logged in, then he logs in in one of the tabs, if he doesn't refresh the other tabs, it will seem as if he is not logged in, but he actually is in the other tab.

The same problem arises from inactivity, after a couple of minutes, the system doesn't kick you out, but it doesn't let you do anything giving errors all over the place.

Hi !
As a staff member viewing a ticket with an attachment, I can click on it (in order to view/download it), which leads me to a blank page.
In code, checks are made to only allow author or owner of the ticket to download attachment.
And this work, as the author, or if I assign ticket to myself, I can now download attachment.

First, I suggest to return a specific message when trying to download unauthorized attachment (at least a HTTP 403 error).
Secondly, I think staff members could access to attachments even if they are not the owner (sometimes, viewing attachment can help to assign ticket to the right person).

Thanks!

If you go to admin->system preferences and you choose, for example, Spanish as the only supported and allowed language, the Default Language field will change its value to Spanish (which is correct); but after updating the settings, it doesn't get updated as the default language in the setting table of the database (unless you actually open the dropdown and select it).
If you then go the app home, the language selected by default will be Spanish but it will be all in English (even if you erase the LocalStorage and reload), because it is not changed in the database.

Hello,

i try to install OpenSupports but i get a blank page (/index.php) after transfer the opensupports folder via FTP.

The Sourcecode of the blank page:

<!doctype html>
<html class="no-js" lang="">
    <head>
        <meta charset="utf-8">
        <meta http-equiv="X-UA-Compatible" content="IE=edge">
        <meta name="description" content="">
        <meta name="viewport" content="width=device-width">
    
        <title>OpenSupports</title>
    
        <link rel="stylesheet" href="http://support.mmsfotografie.de/css/main.css">
        <link rel="icon" type="image/x-icon" href="http://support.mmsfotografie.de/images/icon.png">
    </head>
    <body>
        <div id="app"></div>
        
        <script>
            root = "http://support.mmsfotografie.de";
            apiRoot = 'http://support.mmsfotografie.de/api';
            globalIndexPath = "";
        </script>
        <script src="http://support.mmsfotografie.de/js/main.js"></script>
    </body>
</html>

And here the Sourcecode from the index.php in webspace (unchanged):

<?php
    $path = rtrim(dirname($_SERVER['PHP_SELF']), '/');
    $url = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $path;
?>
<!doctype html>
<html class="no-js" lang="">
    <head>
        <meta charset="utf-8">
        <meta http-equiv="X-UA-Compatible" content="IE=edge">
        <meta name="description" content="">
        <meta name="viewport" content="width=device-width">
    
        <title>OpenSupports</title>
    
        <link rel="stylesheet" href="<?=$url ?>/css/main.css">
        <link rel="icon" type="image/x-icon" href="<?=$url ?>/images/icon.png">
    </head>
    <body>
        <div id="app"></div>
        
        <script>
            root = "<?=$url ?>";
            apiRoot = '<?=$url ?>/api';
            globalIndexPath = "<?=$path ?>";
        </script>
        <script src="<?=$url ?>/js/main.js"></script>
    </body>
</html>

Very Thanks for Help!

Hello guys
I´ve installed the script, for now is all fine, but i can´t find the files to modify some things in the layout, for example.. add a new header with my logo, adapt other things.. colours etc.
Apparently all working using a BIG js file main.js ??
No HTML code or template files in any place ;(

Thanks
Fabian

We've received a lot of feedback regarding the SMTP configuration. The following changes shall be made:

• If there is no SMTP configuration, cancel the verification through email.
• Add SMTP configuration options to the installation.
• Add a check script, so we can be sure that the configuration is working before setting it.

The recover password email is not rendered the url in the link for recovery.

The following line needs to be added inside setTemplate parameters of this file: https://github.com/opensupports/opensupports/blob/master/server/controllers/user/send-recover-password.php#L76

'url' => Setting::getSetting('url')->getValue(),

We are currently using a version of development of React in our production code. We should update it.

Hi
I am having an issue where the installation does not run after extracting the download onto our server. I have confirmed PHP, MySQL and Apache are working fine.

Below is an image of what I am receiving in the browser, is there any advice on what might be causing this?

I found a little inconsistency between API and client: API allows staff to comment their ticket without assigning it while client don't.

Edit: only tested with user system disabled.

Trying to perform a fresh install on Ubunutu 14.04, Apache, MariaDB, PHP5.6 but it just hangs.

Thanks,

D

1. Go to system preferences in admin panel
2. Add some text inside a recaptcha field and save
3. Erase the text inside the recaptcha field and save

It is expected that catpcha keys were empty, but they aren't. This is caused because we're checking the string value instead of the existence of the key https://github.com/opensupports/opensupports/blob/master/server/controllers/system/edit-settings.php#L56

It looks like we're having an alignment in the admin dashboard with some languages that have longer text than English in some instances.

Here is a screenshot of the bug in Portuguese:

I downloaded the file and put it in the www folder of the wamp server, but when I access the page for installation, it goes blank and does not load anything.

After looking at the folders, there is no install folder in the downloaded file...

Hi !

Since OpenSupports use a REST API and server and client code are already clearly distinct, it would be great to maintain two different projects on github ; let's say opensupports/opensupports-server and opensupports/opensupports-client.

Advantages I see:

• allow users to use their own integrated client (using API or directly source) without requiring the official client
• allow maintainers to distribute server commits more quickly
• easiest composer integration for those importing server code
• allow the emergence of others clients based on other technology
• distinct Travis CI configs for distinct technology which will save time and reduce complexity

Thanks !

It is showing when installing opensupports.

Please help.

Got this Error (I followed the Instruction on the GitHub Page):

$ gulp dev
[13:05:02] Using gulpfile E:\localhost\opensupports\opensupports\client\gulpfile.js
[13:05:02] Starting 'clean'...
[13:05:02] Finished 'clean' after 16 ms
[13:05:02] Starting 'dev'...
[13:05:02] Starting 'sass'...
[13:05:02] Starting 'imagemin'...
[13:05:02] Starting 'browserify'...
[13:05:02] Rebundle...
[13:05:02] Starting 'copyFonts'...
[13:05:02] Starting 'copyIndex'...
[13:05:02] Finished 'copyIndex' after 1.48 ms
[13:05:02] Starting 'copyIcons'...
[13:05:02] Starting 'config'...
[13:05:02] Finished 'copyIcons' after 18 ms
[13:05:03] Finished 'config' after 190 ms

events.js:160
throw er; // Unhandled 'error' event
^
Error: src\main.scss
Error: File to import not found or unreadable: E:/localhost/opensupports/opensupports/client/src/app/admin­min-login-page.scss
Parent style sheet: E:/localhost/opensupports/opensupports/client/src/main.scss
on line 49 of src/main.scss

@import "E:/localhost/opensupports/opensupports/client/src/app/admin\admin-log
^

at options.error (E:\localhost\opensupports\opensupports\client\node_modules\node-sass\lib\index.js:286:26)

We need to add a prefix for the data stored in the localStorage. If you have more than one instance of OpenSupports in the same domain, it will have an unexpected behavior.

1. Generate a "storePrefix" as a Setting in init-settings.php
2. Return the prefix in get-settings.php
3. Use the prefix in the frontend when storing localStorage data with SessionStore class library.

Allow the ability to authenticate users using SSO.

I'm running Caddy v0.10.3 on Ubuntu 16.04 with PHP 7, MariaDB with a fairly simple config for PHP 7.0.

Caddyfile:
`support.skycade.net www.support.skycade.net {

    root /var/www/support

    fastcgi / /run/php/php7.0-fpm.sock php {
            env PATH /bin
    }

    log ../helpdesk.log








    header / Strict-Transport-Security "max-age=15768000"

}`

I'm getting the following error in the console and am unsure of what to do at this point. Any ideas?

Downloaded release directly to server, unzip and changed ownership of all files.
Ubuntu 16.04
Apache 2.4+
PHP 5.6.30
MySQL 5.7.18
Database client version: libmysql - mysqlnd 5.0.11
PHP Warning: require_once(vendor/autoload.php): failed to open stream: Permission denied in /home/admin/web/public_html/api/index.php on line 3, referer: PHP Stack trace:, referer: PHP 1. {main}() /home/admin/web//public_html/api/index.php:0, referer:

The code needs to be updated with a new version of Slim: 3.8.1.

UI keeps loading when clicking on "All notifications" in "Last Activity" tab.
JSON answer of get-logs controller is:

status	"fail"
message	"Trying to get property of non-object"
data	null

Tested on v4.1 with user system disabled.

Hi to all,

when you are adding a new DEPARTMENT, you are not able to save the new one if the name has an accent.
In my case: Language SPANISH and the department should be: Técnico.
If I write Tecnico (with out accent, it works, but the word is not correct).

Regards and thanks very much!

Hi,
Could you give me an example on how to authenticate a staff member with the API ? I use Guzzle an everytime i get INVALID_CREDENTIALS.
Sorry for my english.
Thanks

Hi !
OpenSupports sounds promising, I was about to test it in order to know if I could easily integrate it with one of my project (since there is absolutely no API doc yet), but I'm unable to launch the start wizard (unzing the given zip, and following installation instructions).

Got 3 HTTP404 while requesting host/os/ (host base route).

Maybe I miss some prerequisites ?
Wiki only mentions PHP + Mysql + PDO.

Thanks!

The defaultLanguage form the server is not correctly retrieved in the frontend.

These two should be payload.data.language instead of payload.language
https://github.com/opensupports/opensupports/blob/master/client/src/reducers/config-reducer.js#L38
https://github.com/opensupports/opensupports/blob/master/client/src/reducers/config-reducer.js#L42

This issue make English always as default. If you don't have English allowed, the ticket won't be created unless you click twice in the language dropdown.

To reproduce:

1. Select a language as allowed except English
2. Select that language as default language
3. In the user panel, try to create a ticket

The ticket won't be created because the default language will still be 'en', it should change to the real default language. The backend will reject it because English is not allowed, this is frontend issue.

Hi !

Since API documentation is not yet available, could you please suggest me what is the most appropriate solution to integrate opensupports with a PHP project ?
I precise that it is a PHP project because, maybe, it could be easier to just add opensupports to my project dependencies rather than trying to implementing API on my side.
(When I say "easy" and "appropriate", I mean requiring less coding on my side and shorter integration time ;) )

What is your advice ?
Thanks!

Hi
How can I add a new language?

When a new staff member is created, its last login shows as undefined null.

The idea of this feature is that a staff can check/uncheck from the admin panel if they want to receive mails when a new ticket is created/answered.
Currently, we are always sending those kind of mails to the regular users, not to staff members. The idea was to avoid bother the staff members with too many mails, but we should allow it if a ticket is created once in a while, so the admin doesn't have to be checking all the time.

We need some help with the translation of languages that are not Spanish or English.

These are the files that we have to improve:
Chinese
Turkish
Russian
Portuguese
Japanese
Hindi
French
German

Any contribution will be appreciated.

Would it be possible to add the ability to restrict support staff to departments.

A real world example would be say i have the following departments:

IT Support
Finance
HR
Facilities

Say i have one person working in each department in the above list who only provide that function, so four staff members, but one for each department, i would only want them to be able to access the departments they need access to.

So say the IT Support person has access to all departments, but facilities only has access to the facilities dept, finance to finance and HR to HR.

It would be great to amend the support staff to define what groups that can access as at the moment they can just access everything.

The other reason is that the less people have access to the less likely they can screw up someone else's tickets, so say the HR person deletes a ticket by accident they only have themselves to blame or the IT people, not HR or facilities as they dont have access to those tickets.

Would it be possible to look to adding this feature in future please ?

We are currently using a different "mail content" for each language of the same mail. We should only store the template in the database and use a language file as it is done in frontend.

The account info from here:
https://www.opensupports.com/demo/

Demo with User System
Login/Admin email: [email protected]
Login/Admin password: demouser

Demo without User System
Admin email: [email protected]
Admin password: demouser

both of the demo sites have the same problem.

eg:
https://www.opensupports.com/demos/demo2/admin

Everytime I walk through the initial Setup wizzard everything is fine. But if I later want to login to my just now created account system keeps telling me "invalid password" if I try to recover it tells "email does not exists"

A close look into the DB show the existing user with email and a hashed password, also others tables were populated by the installation script.

Any clue?

PHP 7.0.18-0ubuntu0.16.04.1
Apache/2.4.18
Mysql 5.7.18-0

On one of my project, I already have a wiki and don't want to use the article system.
I think it would be nice to remove the "articles" menu on home page if no article exists.
Perhaps, it would be even better to allow admin to disable article system.

Hi,
I come back to you because i got an other problem.
The authentification with the API is ok, i got userid and token. Now i try a simple request '/article/get-all' and everytime i get the error 'no permission'.
Here my request :
$client = new \GuzzleHttp\Client();
$article = $client->post('http://ops:apikey@myip/ops/api/article/get-all',
array('form_params' => array(
'csrf_userid' => $userid,
'csrf_token' => $token)));
$userid ans $token comes from valid authentification.
Thank you for your help !

I know we can have multiple departments and switch between them which is great :)

But what if a user only uses one department 90% of the time, having to change the department constantly could be annoying.

What about if we can set the default department each user can use ? Just means less flicking through departments if you only want to see tickets from one dept.

Very useful if you have an IT, HR and Facilities dept, the facilities guys dont care about anything but their tickets (just like each other dept only caring about their tickets), so would be great to have a default dept for each user

Hi at present we can delete and ban a user which deletes all their current tickets.

Can we have the option to disable a user please?

In the event of a user leaving a company we would not want to delete all their tickets, but we would want to disable them from being able to login again.

Could this option be added please ?

Thanks

Hello,

Please excuse my English.

I try to install opensupports for test before potentially install in production.

in step 5, I complete all fields, smpt config is OK but when I validate with button next, I obtain :
INVALID REQUEST
error

INIT_SETTINGS_DONE

I make many test, drop database, user and restart install from step 1 but obtain always the same error.

please, can you help me.

Anyway, thanks for your concern.

Would love to see LDAP / Active Directory Support in the future.

In admin panel, when trying to list users with user system disabled, printed error message is not very explanatory: "An error occurred while trying to retrieve users."
Could be something like "User system is currently disabled."

Tested on v4.1 with user system disabled.