From 07036453044f66811ad92b44f6c98284aecc9134 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 21 Feb 2023 20:47:35 +0100 Subject: [PATCH] Fix missing protection on ajax public ticket page --- htdocs/public/ticket/ajax/ajax.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/htdocs/public/ticket/ajax/ajax.php b/htdocs/public/ticket/ajax/ajax.php index a75c796539c..0ddc6529996 100644 --- a/htdocs/public/ticket/ajax/ajax.php +++ b/htdocs/public/ticket/ajax/ajax.php @@ -57,6 +57,14 @@ $action = GETPOST('action', 'aZ09'); $id = GETPOST('id', 'int'); $email = GETPOST('email', 'alphanohtml'); +if (!isModEnabled('ticket')) { + httponly_accessforbidden('Module Ticket not enabled'); +} + +if (empty($conf->global->TICKET_CREATE_THIRD_PARTY_WITH_CONTACT_IF_NOT_EXIST)) { + httponly_accessforbidden('Option TICKET_CREATE_THIRD_PARTY_WITH_CONTACT_IF_NOT_EXIST of module ticket is not enabled'); +} + /* * View