<?php

/*******************************************************************************

* Title: Help Desk Software HESK

* Version: 2.6.4 from 22nd June 2015

* Author: Klemen Stirn

* Website: http://www.hesk.com

********************************************************************************

* COPYRIGHT AND TRADEMARK NOTICE

* Copyright 2005-2015 Klemen Stirn. All Rights Reserved.

* HESK is a registered trademark of Klemen Stirn.

* The HESK may be used and modified free of charge by anyone

* AS LONG AS COPYRIGHT NOTICES AND ALL THE COMMENTS REMAIN INTACT.

* By using this code you agree to indemnify Klemen Stirn from any

* liability that might arise from it's use.

* Selling the code for this program, in part or full, without prior

* written consent is expressly forbidden.

* Using this code, in part or full, to create derivate work,

* new scripts or products is expressly forbidden. Obtain permission

* before redistributing this software over the Internet or in

* any other medium. In all cases copyright and header must remain intact.

* This Copyright is in full effect in any country that has International

* Trade Agreements with the United States of America or

* with the European Union.

* Removing any of the copyright notices without purchasing a license

* is expressly forbidden. To remove HESK copyright notice you must purchase

* a license for this script. For more information on how to obtain

* a license please visit the page below:

* https://www.hesk.com/buy.php

*******************************************************************************/

define('IN_SCRIPT',1);

define('HESK_PATH','./');

/* Get all the required files and functions */

require(HESK_PATH . 'hesk_settings.inc.php');

require(HESK_PATH . 'inc/common.inc.php');

// Are we in maintenance mode?

hesk_check_maintenance();

hesk_load_database_functions();

require(HESK_PATH . 'inc/email_functions.inc.php');

require(HESK_PATH . 'inc/posting_functions.inc.php');

// We only allow POST requests to this file

if ( $_SERVER['REQUEST_METHOD'] != 'POST' )

{

header('Location: index.php');

exit();

}

// Check for POST requests larger than what the server can handle

if ( empty($_POST) && ! empty($_SERVER['CONTENT_LENGTH']) )

{

hesk_error($hesklang['maxpost']);

}

session_start();

/* A security check */

# hesk_token_check('POST');

$hesk_error_buffer = array();

// Tracking ID

$trackingID = hesk_cleanID('orig_track') or die($hesklang['int_error'].': No orig_track');

// Email required to view ticket?

$my_email = hesk_getCustomerEmail();

// Get message

$message = hesk_input( hesk_POST('message') );

// If the message was entered, further parse it

if ( strlen($message) )

{

// Make links clickable

$message = hesk_makeURL($message);

// Turn newlines into <br />

$message = nl2br($message);

}

else

{

$hesk_error_buffer[] = $hesklang['enter_message'];

}

/* Attachments */

if ($hesk_settings['attachments']['use'])

{

require(HESK_PATH . 'inc/attachments.inc.php');

$attachments = array();

for ($i=1;$i<=$hesk_settings['attachments']['max_number'];$i++)

{

$att = hesk_uploadFile($i);

if ($att !== false && !empty($att))

{

$attachments[$i] = $att;

}

}

}

$myattachments='';

/* Any errors? */

if (count($hesk_error_buffer)!=0)

{

$_SESSION['ticket_message'] = hesk_POST('message');

// If this was a reply after re-opening a ticket, force the form at the top

if ( hesk_POST('reopen') == 1)

{

$_SESSION['force_form_top'] = true;

}

// Remove any successfully uploaded attachments

if ($hesk_settings['attachments']['use'])

{

hesk_removeAttachments($attachments);

}

$tmp = '';

foreach ($hesk_error_buffer as $error)

{

$tmp .= "<li>$error</li>\n";

}

$hesk_error_buffer = $tmp;

$hesk_error_buffer = $hesklang['pcer'].'<br /><br /><ul>'.$hesk_error_buffer.'</ul>';

hesk_process_messages($hesk_error_buffer,'ticket.php?track='.$trackingID.$hesk_settings['e_param'].'&Refresh='.rand(10000,99999));

}

/* Connect to database */

hesk_dbConnect();

// Check if this IP is temporarily locked out

$res = hesk_dbQuery("SELECT `number` FROM `".hesk_dbEscape($hesk_settings['db_pfix'])."logins` WHERE `ip`='".hesk_dbEscape($_SERVER['REMOTE_ADDR'])."' AND `last_attempt` IS NOT NULL AND DATE_ADD(`last_attempt`, INTERVAL ".intval($hesk_settings['attempt_banmin'])." MINUTE ) > NOW() LIMIT 1");

if (hesk_dbNumRows($res) == 1)

{

if (hesk_dbResult($res) >= $hesk_settings['attempt_limit'])

{

unset($_SESSION);

hesk_error( sprintf($hesklang['yhbb'],$hesk_settings['attempt_banmin']) , 0);

}

}

/* Get details about the original ticket */

$res = hesk_dbQuery("SELECT * FROM `".hesk_dbEscape($hesk_settings['db_pfix'])."tickets` WHERE `trackid`='{$trackingID}' LIMIT 1");

if (hesk_dbNumRows($res) != 1)

{

hesk_error($hesklang['ticket_not_found']);

}

$ticket = hesk_dbFetchAssoc($res);

/* If we require e-mail to view tickets check if it matches the one in database */

hesk_verifyEmailMatch($trackingID, $my_email, $ticket['email']);

/* Ticket locked? */

if ($ticket['locked'])

{

hesk_process_messages($hesklang['tislock2'],'ticket.php?track='.$trackingID.$hesk_settings['e_param'].'&Refresh='.rand(10000,99999));

exit();

}

// Prevent flooding ticket replies

$res = hesk_dbQuery("SELECT `staffid` FROM `".hesk_dbEscape($hesk_settings['db_pfix'])."replies` WHERE `replyto`='{$ticket['id']}' AND `dt` > DATE_SUB(NOW(), INTERVAL 10 MINUTE) ORDER BY `id` ASC");

if (hesk_dbNumRows($res) > 0)

{

$sequential_customer_replies = 0;

while ($tmp = hesk_dbFetchAssoc($res))

{

$sequential_customer_replies = $tmp['staffid'] ? 0 : $sequential_customer_replies + 1;

}

if ($sequential_customer_replies > 10)

{

hesk_dbQuery("INSERT INTO `".hesk_dbEscape($hesk_settings['db_pfix'])."logins` (`ip`, `number`) VALUES ('".hesk_dbEscape($_SERVER['REMOTE_ADDR'])."', ".intval($hesk_settings['attempt_limit'] + 1).")");

hesk_error( sprintf($hesklang['yhbr'],$hesk_settings['attempt_banmin']) , 0);

}

}

/* Insert attachments */

if ($hesk_settings['attachments']['use'] && !empty($attachments))

{

foreach ($attachments as $myatt)

{

hesk_dbQuery("INSERT INTO `".hesk_dbEscape($hesk_settings['db_pfix'])."attachments` (`ticket_id`,`saved_name`,`real_name`,`size`) VALUES ('{$trackingID}','".hesk_dbEscape($myatt['saved_name'])."','".hesk_dbEscape($myatt['real_name'])."','".intval($myatt['size'])."')");

$myattachments .= hesk_dbInsertID() . '#' . $myatt['real_name'] .',';

}

}

// If staff hasn't replied yet, keep ticket status "New", otherwise set it to "Waiting reply from staff"

$ticket['status'] = $ticket['status'] ? 1 : 0;

/* Update ticket as necessary */

$res = hesk_dbQuery("UPDATE `".hesk_dbEscape($hesk_settings['db_pfix'])."tickets` SET `lastchange`=NOW(), `status`='{$ticket['status']}', `replies`=`replies`+1, `lastreplier`='0' WHERE `id`='{$ticket['id']}' LIMIT 1");

if(isset($_SESSION['id']['user'])){

$name = $_SESSION['id']['user'];

}else{

$name = $ticket['name'];

}

// Insert reply into database

hesk_dbQuery("INSERT INTO `".hesk_dbEscape($hesk_settings['db_pfix'])."replies` (`replyto`,`name`,`message`,`dt`,`attachments`) VALUES ({$ticket['id']},'".hesk_dbEscape($name)."','".hesk_dbEscape($message)."',NOW(),'".hesk_dbEscape($myattachments)."')");

/*** Need to notify any staff? ***/

// --> Prepare reply message

// 1. Generate the array with ticket info that can be used in emails

$info = array(

'email' => $ticket['email'],

'category' => $ticket['category'],

'priority' => $ticket['priority'],

'owner' => $ticket['owner'],

'trackid' => $ticket['trackid'],

'status' => $ticket['status'],

'name' => $ticket['name'],

'lastreplier' => $ticket['name'],

'subject' => $ticket['subject'],

'message' => stripslashes($message),

'attachments' => $myattachments,

'dt' => hesk_date($ticket['dt'], true),

'lastchange' => hesk_date($ticket['lastchange'], true),

'id' => $ticket['id'],

);

//insert to ERP

//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

include('oe_api.php');

$valid_services = array("SCA" => "mail.message", "PIS"=>"project.issue"); //klasat e ERP me te cilat do te punojme

$oeapi = new OpenerpApi();

$params1 = array(); // array me vlerat e ticket_id

$params = array(); // array me vlerat e reply_message

$params1[0] = $ticket['id'];

$data = $oeapi->search_helpdeskID($valid_services["PIS"], $ticket['id']); // gjejme ceshtjen ky helpdesk_id = ticket_id

//Ermedita - lista e emaileve te staffit qe jan te lidhur me ceshtjen

$issue_id = hesk_dbQuery("SELECT `contract_ticket_id` FROM `".hesk_dbEscape($hesk_settings['db_pfix'])."tickets` WHERE `id`=".$ticket['id']);

$i_id = mysqli_fetch_array($issue_id);

$users = hesk_dbQuery("SELECT `userId` FROM `".hesk_dbEscape($hesk_settings['db_pfix'])."userforcontract` WHERE `contractId`=".$i_id[0]);

$u = array();

while($user = mysqli_fetch_array($users)){

$u[] = $user['userId'];

}

$ulist = implode(',',$u);

$u_emails = hesk_dbQuery("SELECT `email` FROM `".hesk_dbEscape($hesk_settings['db_pfix'])."users` WHERE `id` IN (".$ulist.")");

$array_email = array();

while($e = mysqli_fetch_array($u_emails)){

$array_email[] = $e['email'];

}

$ulist_emails = implode(',',$array_email);

//var_dump($ulist_emails);

//exit();

$params['subject'] = $ticket['subject'];

$params['user_id'] = 11; // Do krijohet nga ERP nje user default dhe do vendosim ID e tij

$params['body_text'] = stripslashes($message);

$params['date'] = hesk_date($ticket['dt'], true);

$params['res_id'] = $data[0];

$params['model'] = "project.issue";

$params['email_from'] = $ticket['email'];

$params['email_to'] = $ulist_emails;

$data = $oeapi->create_record($params ,$valid_services["SCA"]); // dergojme te dhenat e reply_message tek ceshtje e duhur

//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

// 2. Add custom fields to the array

foreach ($hesk_settings['custom_fields'] as $k => $v)

{

$info[$k] = $v['use'] ? $ticket[$k] : '';

}

// 3. Make sure all values are properly formatted for email

$ticket = hesk_ticketToPlain($info, 1, 0);

// --> If ticket is assigned just notify the owner

if ($ticket['owner'])

{

//hesk_notifyAssignedStaff(false, 'new_reply_by_customer', 'notify_reply_my');

hesk_notifyCustomer_multiple('new_reply_by_customer',$array_email);

}

// --> No owner assigned, find and notify appropriate staff

else

{

hesk_notifyCustomer_multiple('new_reply_by_customer',$array_email);

}

/* Clear unneeded session variables */

hesk_cleanSessionVars('ticket_message');

/* Show the ticket and the success message */

hesk_process_messages($hesklang['reply_submitted_success'],'ticket.php?track='.$trackingID.$hesk_settings['e_param'].'&Refresh='.rand(10000,99999),'SUCCESS');

exit();

?>