Edit permission only for admin
.. but I don't understand the permissions enough (and at this point don't care) to say it's absolutely positively as secure as can be.
Try this MOD below to give edit permission only for user/staff with Admin level.
FIND:
<td width=50% valign="top">
<table align="center" class="ticketinfo" cellspacing="1" cellpadding="3" width="100%" border=0>
<tr>
<th>Name:</th>
<td><input type="text" name="name" size="30" value="<?=Format:($ticket->getName())?>" id="name" /><a href="javascript(<?=$id?>,'name')"><img src="../images/icons/ticket_edit.gif" /></a></td>
</tr>
<tr>
<th>Email:</th>
<td><input type="text" name="email" size="30" value="<?=$ticket->getEmail()?>" id="email" /><a href="javascript(<?=$id?>,'email')"><img src="../images/icons/ticket_edit.gif" /></a></td>
</tr>
<tr>
<th>Phone:</th>
<td><input type="text" name="phone" size="30" value="<?=$ticket->getPhone()?>" id="phone" /><a href="javascript(<?=$id?>,'phone')"><img src="../images/icons/ticket_edit.gif" /></a></td>
</tr>
REPLACE WITH:
<td width=50% valign="top">
<table align="center" class="ticketinfo" cellspacing="1" cellpadding="3" width="100%" border=0>
<tr>
<th>Name:</th>
<?php if ($thisuser->isadmin()) { ?>
<td><input type="text" name="name" size="35" value="<?php echo Format:($ticket->getName())?>" id="name" /><a href="javascript(<?php echo $id; ?>,'name')"><img src="../images/icons/ticket_edit.gif" /></a></td>
<?php } else { ?>
<td><?php echo Format:($ticket->getName()); ?></td>
<?php } ?>
</tr>
<tr>
<th>Email:</th>
<?php if ($thisuser->isadmin()) { ?>
<td><input type="text" name="email" size="35" value="<?php echo $ticket->getEmail()?>" id="email" /><a href="javascript(<?php echo $id; ?>,'email')"><img src="../images/icons/ticket_edit.gif" /></a></td>
<?php } else { ?>
<td><?php echo Format:($ticket->getEmail()); ?></td>
<?php } ?>
</tr>
<tr>
<th>Phone:</th>
<?php if ($thisuser->isadmin()) { ?>
<td><input type="text" name="phone" size="30" value="<?php echo $ticket->getPhone()?>" id="phone" /><a href="javascript(<?php echo $id; ?>,'phone')"><img src="../images/icons/ticket_edit.gif" /></a></td>
<?php } else { ?>
<td><?php echo Format:($ticket->getPhone()); ?></td>
<?php } ?>
</tr>
Hope this is helpful.
Best regards,
Masino Sinaga