fun/Task-Management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve 5 bugs — auth, ownership, crash, notification, and HTML issues

Browse Source 
- dashboard.php: fix PDO parameter count crash for users with no groups
  (used max(count,1) for placeholder count but provided 0 group params)
- index.php: add missing auth check on get_tasks_status API endpoint
  (was accessible without a session, exposing all task data)
- index.php: enforce ownership check on delete_comment API
  (any logged-in user could delete any comment; now requires authorship or admin)
- tasks.php: fix task creation notification using undefined $_SESSION['username']
  (replaced with $current_user['username'] so {assignor} template works correctly)
- tasks.php: remove duplicate id attribute on att-lightbox-body element

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
I-Fun
2026-03-30 23:21:15 +07:00
parent 83ba58ddcd
commit 0d27befed0
4 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
views/dashboard.php
View File

@@ -17,7 +17,7 @@ try {
// ── Task Counts ───────────────────────────────────────────────────────────────
$user_groups = get_user_groups($user_id);
$my_group_ids = array_column($user_groups, 'id');
$group_in = implode(',', array_fill(0, max(count($my_group_ids), 1), '?')) ?: '0';
$group_in = $my_group_ids ? implode(',', array_fill(0, count($my_group_ids), '?')) : '0';
$params_tasks = array_merge([$user_id, $user_id], $my_group_ids, $my_group_ids, [$user_id]);
$sql_tasks = "SELECT status, COUNT(*) as cnt FROM tasks WHERE
(assignee_type='user' AND assignee_id=?)

4
views/tasks.php
View File

@@ -155,7 +155,7 @@ if($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_task'])) {
}
// Handle notifications
$ctx = ['action' => 'Created', 'module' => 'Task', 'item' => $title, 'assignor' => $_SESSION['username'] ?? 'System', 'due_date' => $due_date ?: 'None'];
$ctx = ['action' => 'Created', 'module' => 'Task', 'item' => $title, 'assignor' => $current_user['username'] ?? 'System', 'due_date' => $due_date ?: 'None'];
foreach($to_list as $rec) {
$u = query("SELECT id FROM users WHERE username=?", [$rec])->fetch();
if($u) notify_user($u['id'], "You have been assigned a new task: $title", $ctx);
@@ -463,7 +463,7 @@ body.dark-mode .kanban-task { border: 1px solid rgba(255,255,255,0.05); border-l
<span id="att-lightbox-title">Preview</span>
<button id="att-lightbox-close" onclick="closeAttachmentPreview()" title="Close">✕</button>
</div>
<div id="att-lightbox-body" id="att-lightbox-body"></div>
<div id="att-lightbox-body"></div>
</div>
</div>