Merge pull request #726 from aleixgil/bugfix/ticketUpdateProtection

On comment ticket, validation implementation. Response returned. Translations.

Author: BadChoice

app/Http/Controllers/Api/CommentsController.php

@@ -2,18 +2,34 @@
 
 namespace App\Http\Controllers\Api;
 
+use App\Requester;
 use App\Ticket;
 use Illuminate\Http\Response;
+use Illuminate\Support\Facades\App;
 
 class CommentsController extends ApiController
 {
     public function store(Ticket $ticket)
     {
-    	$comment = $ticket->addComment(null, strip_tags(request('body')), request('new_status'));
+        App::setLocale(request('language'));
+
+        $ticketRequester = Requester::findOrFail($ticket->requester_id);
+        try {
+            Requester::validateTicketComment(request('requester'), $ticketRequester);
+        } catch (\Exception $e) {
+            return $this->respond(['id' => null, 'message' => $e->getMessage()], Response::HTTP_BAD_REQUEST);
+        }
+
+        $comment = $ticket->addComment(null, strip_tags(request('body')), request('new_status'));
+
+        if (request('new_status') == $ticket::STATUS_SOLVED) {
+            return $this->respond(['id' => null, 'message' => __('validation.solvedTicket')], Response::HTTP_CREATED);
+        }
+
         if (! $comment) {
-            return $this->respond(['id' => null, 'message' => 'Can not create a comment with empty body'], Response::HTTP_OK);
+            return $this->respond(['id' => null, 'message' => __('validation.emptyBodyComment')], Response::HTTP_BAD_REQUEST);
         }
 
-        return $this->respond(['id' => $comment->id], Response::HTTP_CREATED);
+        return $this->respond(['id' => $comment->id, 'message' => __('validation.commentCreated')], Response::HTTP_CREATED);
     }
 }

app/Requester.php

@@ -17,6 +17,13 @@ public static function findOrCreate($name, $email = null)
         return self::firstOrCreate(['email' => $email], ['name' => $name]);
     }
 
+    public static function validateTicketComment($requester, $ticketRequester)
+    {
+        if (! ($requester['name'] == $ticketRequester->name && $requester['email'] == $ticketRequester->email)) {
+            throw new \Exception(__('validation.ticketCommentInjection'));
+        }
+    }
+
     public function tickets()
     {
         return $this->hasMany(Ticket::class);
@@ -42,7 +49,8 @@ public function closedTickets()
         return $this->tickets()->where('status', '=', Ticket::STATUS_CLOSED);
     }
 
-    public function shouldBeNotified(){
+    public function shouldBeNotified()
+    {
         return $this->no_reply == false;
     }
 }

resources/lang/ca/ticket.php

@@ -53,6 +53,6 @@
     'blocker'            => 'Bloquejant',
     'thanksForTheRating' => 'Moltes gràcies!',
     'rated'              => 'Classificats',
-    'ticketType'         => 'Tipo de tickets',
+    'ticketType'         => 'Tipo de tiquets',
     'needSubject'        => "Fa falta l'asumpte",
 ];

resources/lang/ca/validation.php

@@ -141,4 +141,8 @@
         'subject'               => 'assumpte',
         'message'               => 'missatge',
     ],
+    'emptyBodyComment'          => 'No pots crear un comentari buit.',
+    'commentCreated'            => 'Comentari creat.',
+    'ticketCommentInjection'    => 'Error al enviar el comentari. No s\'està guardant al tiquet que toca.',
+    'solvedTicket'              => 'Tiquet solucionat.',
 ];

resources/lang/en/validation.php

@@ -148,4 +148,8 @@
         'subject'               => 'subject',
         'message'               => 'message',
     ],
+    'emptyBodyComment'          => 'Can not create a comment with empty body.',
+    'commentCreated'            => 'Comment created.',
+    'ticketCommentInjection'    => 'Error submitting comment. It is not being sent to the correct ticket.',
+    'solvedTicket'              => 'Ticket résolu.',
 ];

resources/lang/es/validation.php

@@ -140,4 +140,8 @@
         'subject'               => 'asunto',
         'message'               => 'mensaje',
     ],
+    'emptyBodyComment'          => 'No puedes crear un comentario vacio.',
+    'commentCreated'            => 'Comentario creado.',
+    'ticketCommentInjection'    => 'Error al enviar el comentario. No se está enviando al ticket que toca.',
+    'solvedTicket'              => 'Ticket solucionado.',
 ];

resources/lang/fr/validation.php

@@ -141,4 +141,7 @@
         'available'             => 'disponible',
         'size'                  => 'taille',
     ],
+    'emptyBodyComment'          => 'Impossible de créer un commentaire avec un corps vide.',
+    'commentCreated'            => 'Commentaire créé.',
+    'ticketCommentInjection'    => 'Erreur lors de l\'envoi du commentaire. Il n\'est pas envoyé au bon ticket.',
 ];