jenskettler

this looks really good now, thanks a lot!

Hi lorro!
You are a genius, this is it!
Thanks a lot for your help!
Jens

yes, but could depend on php version and server configuration.
I can put you in touch with the consultant, send me your contact details if you are interested. You would have to pay him.

Hi,
the consultant changed 1 line:

in class-file-uploader.php line

readfile( $attachment->guid );

replaced with

echo readfile( $_SERVER[‘DOCUMENT_ROOT’] . parse_url($attachment->guid, PHP_URL_PATH) );

not really fixed this. A consultant fixed it (both issues, downloads and adding multiple attachments), but the change will be lost when we do an upgrade of the plugin. Now considering what our options are.

Hi,
I did try to deactivate other plugins but did not help. Our site is hosted here:
https://www.hetzner.de/ot/
Our website is remedyne.help

I can download the files with ftp or with the correct link,
https://<my domain>/wp-content/uploads/awesome-support/ticket_659/RO-with-star.jpg
The link in the support ticket goes to e.g.
https://<my domain>/?wpas-attachment=660

I also noted that uploading more than 1 attachment to a ticket does not work properly:
when a user adds a 2nd file, only the last filename is shown and then attached to the ticket. the first upload file is “replaced” by the second.

Hi,
thank you for the quick reply. The files are actually available in uploads/awesome-support/ticket_nnnn
and I can download them with ftp or with the correct link,
https://<my domain>/wp-content/uploads/awesome-support/ticket_659/RO-with-star.jpg
The link in the support ticket goes to e.g.
https://<my domain>/?wpas-attachment=660
where 660 is _not_ the ticket number but ticket number + 1.
When I manually change the number to the ticket number (in the example above:659) I get a message: “The file you requested is not a valid attachment”
So I think the URL in the ticket is wrong.
I have not seen where I can change that URL.
Best regards
Jens
The files in the upload directory look like this:
https://www.dropbox.com/s/bo5nztidne1s6bj/Bildschirmfoto%202017-05-05%20um%2012.46.35.png?dl=0

I will work with that and test it. Seems to work but I need to have a closer look.

Thanks a lot for your help, I really appreciate it!
Great support!!!

All the best
Jens

Thank you for the explanation.
OK, it is not a plugin (I deactivated all and checked), and I cannot (or don’t want to) change my theme. I am using Support Desk (https://themeforest.net/item/support-desk-a-responsive-helpdesk-theme/4321280). Any way I can suppress the list, or do you say it is caused by the theme?

I think you are right. It seems the other plugins have a security issue, the data can be viewed when I disable the awesome support plugin.

Great, so I know now where to look, thanks a lot!

One little issue:
when users create tickets, they see a list f supported file types for upload,
I don’t think the list is supposed to look like this:
https://www.dropbox.com/s/o80xkamru23klsr/Bildschirmfoto%202017-04-06%20um%2020.39.19.png?dl=0
I use a Mac and have tested with Chrome and Safari, both looks the same.
Can I get rid of the list?

Jens

Hi,
thank you for the quick response:
1. any user that enters /wp-admin sees all media: I think this must not be available. Media can contain files that are not published on the website.
2. they see data from other plugins, such as posts and can re-order them, entries in a knowledge base, and some other elements.
They can even update data.
You can see a screenshot here: https://www.dropbox.com/s/5juun9x4g0iz3jw/Bildschirmfoto%202017-04-06%20um%2020.31.11.png?dl=0
It could be the data they see is from other plugins(?) – re-order and knowledge base. Maybe I just don’t understand the WordPress security model well enough.
Best regards
Jens