'."\n";
diff --git a/htdocs/public/ticket/create_ticket.php b/htdocs/public/ticket/create_ticket.php
index 7987205419ec5..2846222949799 100644
--- a/htdocs/public/ticket/create_ticket.php
+++ b/htdocs/public/ticket/create_ticket.php
@@ -149,7 +149,7 @@
$action = 'create_ticket';
}
- if ($action == 'create_ticket' && GETPOST('save', 'alpha')) {
+ if ($action == 'create_ticket' && GETPOST('save', 'alpha')) { // Test on permission not required. This is a public form. Security is managed by mitigation.
$error = 0;
$origin_email = GETPOST('email', 'email');
if (empty($origin_email)) {
diff --git a/htdocs/public/ticket/list.php b/htdocs/public/ticket/list.php
index 973dc537a610d..352aae3e68897 100644
--- a/htdocs/public/ticket/list.php
+++ b/htdocs/public/ticket/list.php
@@ -99,6 +99,28 @@
exit;
}
+
+/*
+ * View
+ */
+
+$form = new Form($db);
+$user_assign = new User($db);
+$user_create = new User($db);
+$formTicket = new FormTicket($db);
+
+if (!getDolGlobalString('TICKET_ENABLE_PUBLIC_INTERFACE')) {
+ print '
'.$langs->trans('TicketPublicInterfaceForbidden').'
';
+ $db->close();
+ exit();
+}
+
+$arrayofjs = array();
+$arrayofcss = array(getDolGlobalString('TICKET_URL_PUBLIC_INTERFACE', '/public/ticket/').'css/styles.css.php');
+
+llxHeaderTicket($langs->trans("Tickets"), "", 0, 0, $arrayofjs, $arrayofcss);
+
+// Load the ticket from track_id
if ($action == "view_ticketlist") {
$error = 0;
$display_ticket_list = false;
@@ -167,32 +189,12 @@
}
}
- if ($error || $errors) {
+ if ($error) {
setEventMessages($object->error, $object->errors, 'errors');
$action = '';
}
}
-/*
- * View
- */
-
-$form = new Form($db);
-$user_assign = new User($db);
-$user_create = new User($db);
-$formTicket = new FormTicket($db);
-
-if (!getDolGlobalString('TICKET_ENABLE_PUBLIC_INTERFACE')) {
- print '
'.$langs->trans('TicketPublicInterfaceForbidden').'
';
- $db->close();
- exit();
-}
-
-$arrayofjs = array();
-$arrayofcss = array(getDolGlobalString('TICKET_URL_PUBLIC_INTERFACE', '/public/ticket/').'css/styles.css.php');
-
-llxHeaderTicket($langs->trans("Tickets"), "", 0, 0, $arrayofjs, $arrayofcss);
-
if ($action == "view_ticketlist") {
print '
';
diff --git a/test/phpunit/CodingPhpTest.php b/test/phpunit/CodingPhpTest.php
index 4a2a4067e9969..3a69b98246883 100644
--- a/test/phpunit/CodingPhpTest.php
+++ b/test/phpunit/CodingPhpTest.php
@@ -662,7 +662,7 @@ public function testPHP($file)
$filecontentaction = $filecontent;
}
- preg_match_all('/if.*\$action\s*==\s*[\'"][a-z\-]+[\'"].*$/si', $filecontentaction, $matches, PREG_SET_ORDER);
+ preg_match_all('/if.*\$action\s*==\s*[\'"][a-z\-_]+[\'"].*$/si', $filecontentaction, $matches, PREG_SET_ORDER);
foreach ($matches as $key => $val) {
if (!preg_match('/\$user->hasR/', $val[0])