Copyright (c) 2006-2013 osTicket http://www.osticket.com Released under the GNU General Public License WITHOUT ANY WARRANTY. See LICENSE.TXT for details. vim: expandtab sw=4 ts=4 sts=4: **********************************************************************/ # Override staffLoginPage() defined in staff.inc.php to return an # HTTP/Forbidden status rather than the actual login page. # XXX: This should be moved to the AjaxController class function staffLoginPage($msg='Unauthorized') { Http::response(403,'Must login: '.Format::htmlchars($msg)); exit; } define('AJAX_REQUEST', 1); require('staff.inc.php'); //Clean house...don't let the world see your crap. ini_set('display_errors', '0'); // Set by installer ini_set('display_startup_errors', '0'); // Set by installer //TODO: disable direct access via the browser? i,e All request must have REFER? if(!defined('INCLUDE_DIR')) Http::response(500, 'Server configuration error'); require_once INCLUDE_DIR.'/class.dispatcher.php'; require_once INCLUDE_DIR.'/class.ajax.php'; $dispatcher = patterns('', url('^/kb/', patterns('ajax.kbase.php:KbaseAjaxAPI', # Send ticket-id as a query arg => canned-response/33?ticket=83 url_get('^canned-response/(?P\d+).(?Pjson|txt)', 'cannedResp'), url('^faq/(?P\d+)/access', 'manageFaqAccess'), url_get('^faq/(?P\d+)$', 'faq') )), url('^/content/', patterns('ajax.content.php:ContentAjaxAPI', url_get('^log/(?P\d+)', 'log'), url_get('^context$', 'context'), url_get('^ticket_variables', 'ticket_variables'), url_get('^signature/(?P\w+)(?:/(?P\d+))?$', 'getSignature'), url_get('^(?P\d+)/(?:(?P\w+)/)?manage$', 'manageContent'), url_get('^(?P[\w-]+)/(?:(?P\w+)/)?manage$', 'manageNamedContent'), url_post('^(?P\d+)(?:/(?P\w+))?$', 'updateContent') )), url('^/config/', patterns('ajax.config.php:ConfigAjaxAPI', url_get('^scp', 'scp'), url_get('^links', 'templateLinks'), url_get('^date-format', 'dateFormat') )), url('^/form/', patterns('ajax.forms.php:DynamicFormsAjaxAPI', url_get('^help-topic/(?P\d+)$', 'getFormsForHelpTopic'), url_get('^field-config/(?P\d+)$', 'getFieldConfiguration'), url_post('^field-config/(?P\d+)$', 'saveFieldConfiguration'), url_delete('^answer/(?P\d+)/(?P\d+)$', 'deleteAnswer'), url_post('^upload/(\d+)?$', 'upload'), url_post('^upload/(\w+)?$', 'attach'), url_post('^upload/(?Pticket|task)/(\w+)$', 'attach'), url_get('^(?P\d+)/fields/view$', 'getAllFields') )), url('^/filter/', patterns('ajax.filter.php:FilterAjaxAPI', url_get('^action/(?P\w+)/config$', 'getFilterActionForm') )), url('^/schedule/', patterns('ajax.schedule.php:ScheduleAjaxAPI', url('^add$', 'add'), url('^(?P\d+)/clone$', 'cloneSchedule'), url('^(?P\d+)/diagnostic$', 'diagnostic'), url_post('^(?P\d+)/delete-entries$', 'deleteEntries'), url('^(?P\d+)/entry/add$', 'addEntry'), url('^(?P\d+)/entry/(?P\d+)/update$', 'updateEntry') )), url('^/list/', patterns('ajax.forms.php:DynamicFormsAjaxAPI', url_get('^(?P\w+)/items$', 'getListItems'), url_get('^(?P\w+)/items/search$', 'searchListItems'), url_get('^(?P\w+)/item/(?P\d+)/update$', 'getListItem'), url_post('^(?P\w+)/item/(?P\d+)/update$', 'saveListItem'), url_get('^(?P\w+)/items/(?P\d+)/preview$', 'previewListItem'), url('^(?P\w+)/item/add$', 'addListItem'), url('^(?P\w+)/import$', 'importListItems'), url('^(?P\w+)/manage$', 'massManageListItems'), url_post('^(?P\w+)/delete$', 'deleteItems'), url_post('^(?P\w+)/disable$', 'disableItems'), url_post('^(?P\w+)/enable$', 'undisableItems') )), url('^/report/overview/', patterns('ajax.reports.php:OverviewReportAjaxAPI', # Send url_get('^graph$', 'getPlotData'), url_get('^table/groups$', 'enumTabularGroups'), url_get('^table/export$', 'downloadTabularData'), url_get('^table$', 'getTabularData') )), url('^/users', patterns('ajax.users.php:UsersAjaxAPI', url_get('^$', 'search'), url_get('^/local$', 'search', array('local')), url_get('^/remote$', 'search', array('remote')), url_get('^/(?P\d+)$', 'getUser'), url_post('^/(?P\d+)$', 'updateUser'), url_get('^/(?P\d+)/preview$', 'preview'), url_get('^/(?P\d+)/edit$', 'editUser'), url('^/lookup$', 'getUser'), url_get('^/lookup/form$', 'lookup'), url_post('^/lookup/form$', 'addUser'), url_get('^/add$', 'addUser'), url('^/import$', 'importUsers'), url_get('^/select$', 'selectUser'), url_get('^/select/(?P\d+)$', 'selectUser'), url_get('^/select/auth:(?P\w+):(?P.+)$', 'addRemoteUser'), url_get('^/(?P\d+)/register$', 'register'), url_post('^/(?P\d+)/register$', 'register'), url_get('^/(?P\d+)/delete$', 'delete'), url_post('^/(?P\d+)/delete$', 'delete'), url_get('^/(?P\d+)/manage(?:/(?P\w+))?$', 'manage'), url_post('^/(?P\d+)/manage(?:/(?P\w+))?$', 'manage'), url_get('^/(?P\d+)/org(?:/(?P\d+))?$', 'updateOrg'), url_post('^/(?P\d+)/org$', 'updateOrg'), url_get('^/staff$', 'searchStaff'), url_post('^/(?P\d+)/note$', 'createNote'), url_get('^/(?P\d+)/forms/manage$', 'manageForms'), url_post('^/(?P\d+)/forms/manage$', 'updateForms'), url('^/(?P\d+)/tickets/export$', 'exportTickets') )), url('^/orgs', patterns('ajax.orgs.php:OrgsAjaxAPI', url_get('^$', 'search'), url_get('^/search$', 'search'), url_get('^/(?P\d+)$', 'getOrg'), url_post('^/(?P\d+)$', 'updateOrg'), url_post('^/(?P\d+)/profile$', 'updateOrg', array(true)), url('^/(?P\d+)/tickets/export$', 'exportTickets'), url_get('^/(?P\d+)/edit$', 'editOrg'), url_get('^/lookup/form$', 'lookup'), url_post('^/lookup$', 'lookup'), url_get('^/add$', 'addOrg'), url_post('^/add$', 'addOrg'), url_get('^/select$', 'selectOrg'), url_get('^/select/(?P\d+)$', 'selectOrg'), url_get('^/(?P\d+)/add-user(?:/(?P\d+))?$', 'addUser'), url_get('^/(?P\d+)/add-user(?:/auth:(?P.+))?$', 'addUser', array(true)), url_post('^/(?P\d+)/add-user$', 'addUser'), url('^/(?P\d+)/import-users$', 'importUsers'), url_get('^/(?P\d+)/delete$', 'delete'), url_delete('^/(?P\d+)/delete$', 'delete'), url_post('^/(?P\d+)/note$', 'createNote'), url_get('^/(?P\d+)/forms/manage$', 'manageForms'), url_post('^/(?P\d+)/forms/manage$', 'updateForms') )), url('^/lock/', patterns('ajax.tickets.php:TicketsAjaxAPI', url_post('^ticket/(?P\d+)$', 'acquireLock'), url_post('^(?P\d+)/ticket/(?P\d+)/renew', 'renewLock'), url_post('^(?P\d+)/release', 'releaseLock') )), url('^/tickets/', patterns('ajax.tickets.php:TicketsAjaxAPI', url_get('^(?P\d+)/change-user$', 'changeUserForm'), url_post('^(?P\d+)/change-user$', 'changeUser'), url_get('^(?P\d+)/user$', 'viewUser'), url_post('^(?P\d+)/user$', 'updateUser'), url_get('^(?P\d+)/preview', 'previewTicket'), url_get('^(?P\d+)/forms/manage$', 'manageForms'), url_post('^(?P\d+)/forms/manage$', 'updateForms'), url_get('^(?P\d+)/merge$', 'mergeTickets'), url_post('^(?P\d+)/merge$', 'updateMerge'), url_get('^(?P\d+)/link', 'mergeTickets'), url_post('^(?P\d+)/link', 'updateMerge'), url_get('^(?P\d+)/merge/preview$', 'previewMerge'), url_get('^(?P\d+)/relations', 'relations'), url_get('^(?P\d+)/canned-resp/(?P\w+).(?Pjson|txt)', 'cannedResponse'), url_get('^(?P\d+)/status/(?P\w+)(?:/(?P\d+))?$', 'changeTicketStatus'), url_post('^(?P\d+)/status$', 'setTicketStatus'), url('^(?P\d+)/thread/(?P\d+)/(?P\w+)$', 'triggerThreadAction'), url_get('^status/(?P\w+)(?:/(?P\d+))?$', 'changeSelectedTicketsStatus'), url_post('^status/(?P\w+)$', 'setSelectedTicketsStatus'), url_get('^(?P\d+)/tasks$', 'tasks'), url('^(?P\d+)/add-task$', 'addTask'), url_get('^(?P\d+)/tasks/(?P\d+)/view$', 'task'), url_post('^(?P\d+)/tasks/(?P\d+)$', 'task'), url_get('^lookup', 'lookup'), url_get('^number-lookup', 'lookupByNumber'), url('^mass/(?P\w+)(?:/(?P\w+))?', 'massProcess'), url('^(?P\d+)/transfer$', 'transfer'), url('^(?P\d+)/field/(?P\d+)/edit$', 'editField'), url('^(?P\d+)/field/(?P\w+)/edit$', 'editField'), url('^(?P\d+)/field/(?P\d+)/view$', 'viewField'), url('^(?P\d+)/field/(?P\w+)/view$', 'viewField'), url('^(?P\d+)/assign(?:/(?P\w+))?$', 'assign'), url('^(?P\d+)/release$', 'release'), url('^(?P\d+)/mark/(?P\w+)$', 'markAs'), url('^(?P\d+)/refer(?:/(?P\w+))?$', 'refer'), url('^(?P\d+)/referrals$', 'referrals'), url('^(?P\d+)/claim$', 'claim'), url('^export/(?P\d+)$', 'export'), url('^export/adhoc,(?P[\w=/+]+)$', 'export'), url('^search', patterns('ajax.search.php:SearchAjaxAPI', url_get('^$', 'getAdvancedSearchDialog'), url_post('^$', 'doSearch'), url_get('^/(?P\d+)$', 'editSearch'), url_get('^/adhoc,(?P[\w=/+]+)$', 'getAdvancedSearchDialog'), url_get('^/create$', 'createSearch'), url_post('^/(?P\d+)/save$', 'saveSearch'), url_post('^/save$', 'saveSearch'), url_delete('^/(?P\d+)$', 'deleteSearch'), url_get('^/field/(?P[\w_!:]+)$', 'addField'), url('^/column/edit/(?P\d+)$', 'editColumn'), url('^/sort/edit/(?P\d+)$', 'editSort'), url_post('^(?P\d+)/delete$', 'deleteQueues'), url_post('^(?P\d+)/disable$', 'disableQueues'), url_post('^(?P\d+)/enable$', 'undisableQueues') )) )), url('^/tasks/', patterns('ajax.tasks.php:TasksAjaxAPI', url_get('^(?P\d+)/preview$', 'preview'), url_get('^(?P\d+)/edit', 'edit'), url_post('^(?P\d+)/edit$', 'edit'), url('^(?P\d+)/field/(?P\d+)/edit$', 'editField'), url('^(?P\d+)/field/(?P\w+)/edit$', 'editField'), url_get('^(?P\d+)/transfer', 'transfer'), url_post('^(?P\d+)/transfer$', 'transfer'), url('^(?P\d+)/assign(?:/(?P\w+))?$', 'assign'), url('^(?P\d+)/claim$', 'claim'), url_get('^(?P\d+)/delete', 'delete'), url_post('^(?P\d+)/delete$', 'delete'), url('^(?P\d+)/close', 'close'), url('^(?P\d+)/reopen', 'reopen'), url_get('^(?P\d+)/view$', 'task'), url_post('^(?P\d+)$', 'task'), url('^(?P\d+)/thread/(?P\d+)/(?P\w+)$', 'triggerThreadAction'), url('^add$', 'add'), url('^(?P\d+)/add', 'add'), url('^lookup', 'lookup'), url('^mass/(?P\w+)(?:/(?P\w+))?', 'massProcess') )), url('^/thread/', patterns('ajax.thread.php:ThreadAjaxAPI', url_get('^(?P\d+)/collaborators/(?P\d+)/preview$', 'previewCollaborators'), url_get('^(?P\d+)/collaborators/(?P\d+)$', 'showCollaborators'), url_post('^(?P\d+)/collaborators$', 'updateCollaborators'), url_get('^(?P\d+)/add-collaborator/(?P\w+)/(?P\d+)$', 'addCollaborator'), url_get('^(?P\d+)/add-collaborator/(?P\w+)/auth:(?P\w+):(?P.+)$', 'addRemoteCollaborator'), url('^(?P\d+)/add-collaborator/(?P\w+)$', 'addCollaborator'), url_get('^(?P\d+)/collaborators/(?P\d+)/view$', 'viewCollaborator'), url_post('^(?P\d+)/collaborators/(?P\d+)$', 'updateCollaborator') )), url('^/draft/', patterns('ajax.draft.php:DraftAjaxAPI', url_post('^(?P\d+)$', 'updateDraft'), url_delete('^(?P\d+)$', 'deleteDraft'), url_post('^(?P\d+)/attach$', 'uploadInlineImage'), url_post('^(?P[\w.]+)/attach$', 'uploadInlineImageEarly'), url_get('^(?P[\w.]+)$', 'getDraft'), url_post('^(?P[\w.]+)$', 'createDraft'), url_get('^images/browse$', 'getFileList') )), url('^/export/', patterns('ajax.export.php:ExportAjaxAPI', url('^(?P\w+)/check$', 'check') )), url('^/note/', patterns('ajax.note.php:NoteAjaxAPI', url_get('^(?P\d+)$', 'getNote'), url_post('^(?P\d+)$', 'updateNote'), url_delete('^(?P\d+)$', 'deleteNote'), url_post('^attach/(?P\w\d+)$', 'createNote') )), url('^/sequence/', patterns('ajax.sequence.php:SequenceAjaxAPI', url_get('^(?P\d+)$', 'current'), url_get('^manage$', 'manage'), url_post('^manage$', 'manage') )), url_post('^/upgrader', array('ajax.upgrader.php:UpgraderAjaxAPI', 'upgrade')), url('^/help/', patterns('ajax.tips.php:HelpTipAjaxAPI', url_get('^tips/(?P[\w_.]+)$', 'getTipsJson'), url_get('^(?P[\w_]+)?/tips/(?P[\w_.]+)$', 'getTipsJsonForLang') )), url('^/i18n/', patterns('ajax.i18n.php:i18nAjaxAPI', url_get('^langs/all$', 'getConfiguredLanguages'), url_get('^langs$', 'getSecondaryLanguages'), url_get('^translate/(?P\w+)$', 'getTranslations'), url_post('^translate/(?P\w+)$', 'updateTranslations'), url_get('^(?P[\w_]+)/(?P\w+)$', 'getLanguageFile') )), url('^/admin', patterns('ajax.admin.php:AdminAjaxAPI', url('^/quick-add', patterns('ajax.admin.php:AdminAjaxAPI', url('^/department$', 'addDepartment'), url('^/team$', 'addTeam'), url('^/role$', 'addRole'), url('^/staff$', 'addStaff'), url('^/queue-column$', 'addQueueColumn'), url('^/queue-sort$', 'addQueueSort') )), url_get('^/role/(?P\d+)/perms', 'getRolePerms') )), url('^/staff', patterns('ajax.staff.php:StaffAjaxAPI', url('^/(?P\d+)/set-password$', 'setPassword'), url('^/(?P\d+)/change-password$', 'changePassword'), url_get('^/(?P\d+)/perms', 'getAgentPerms'), url('^/reset-permissions', 'resetPermissions'), url('^/change-department', 'changeDepartment'), url('^/(?P\d+)/avatar/change', 'setAvatar'), url('^/(?P\d+)/2fa/configure(?:/(?P.+))?$', 'configure2FA'), url('^/(?P\d+)/reset-2fa', 'reset2fA') )), url('^/queue/', patterns('ajax.search.php:SearchAjaxAPI', url('^(?P\d+/)?preview$', 'previewQueue'), url_get('^(?P\d+)$', 'getQueue'), url_get('^addColumn$', 'addColumn'), url_get('^condition/add$', 'addCondition'), url_get('^condition/addProperty$', 'addConditionProperty'), url_get('^counts$', 'collectQueueCounts'), url('^(?P\d+)/delete$', 'deleteQueue') )) ); Signal::send('ajax.scp', $dispatcher); # Call the respective function $rv = $dispatcher->resolve($ost->get_path_info()); // Indicate JSON response content-type if (is_string($rv) && $rv[0] == '{') Http::response(200, $rv, 'application/json'); print $rv; ?>