Staff is able to transfer ticket

brainboxnetwork

I have disable transfer ticket facility for staff from admin panel>user group.

Even though staff is able to transfer ticket to another staff of another department.

dolmax

Sorry to bring up an old message. It looks like this is the only message in the forum that realized this issue.

When working on the user groups you can disable/enable transfer of tickets - which would limit the transfer to only departments, not to another staff. In my current configuration, I have 3 groups of staff and 3 groups of managers. I also have about 30 staff registered to those staff groups. Each manager runs each staff group. Even though a staff in Group A can not see or act for other departments, they can transfer tickets to other staff.

Is there a way to limit such behavior?

Thanks,

DolmaX

othermatt

Same issue here... I need a few folks really locked down. Ideally, they couldn't transfer tickets to other departments or assign tickets to staff outside of theirs. There's a setting under User Groups, I believe, that's suppose to limit the ability to transfer tickets, but even disabled the users are able to do so.

Any ideas?

pconfortini

I have the same problem!

I have the same problem! Someone found a solution?

Vapes

It looks like there might be a couple different requests in here, so I'm just going to tackle the problem I think is the most shared.

A User Group has been set to not be able to transfer tickets to other departments from the User Group panel. This results in the 'Dept. Transfer' tab being removed from the ticket page correctly.

However, an assignee of a ticket has the ability (there is no option for this) to 'Reassign' the ticket to -any- active staff member who is not on vacation.

(If you're still having the Department Transfer section show up for these users, and they're actually transferring, and not just re-assigning, you have a different problem, let me know if that's the case)

So basically, these guys that can't transfer, are getting around it by assigning it to someone in the other department. Neat.

This can be fixed in the php. The following is from somewhere around line 450 in /include/staff/viewticket.inc.php:

$sql=' SELECT staff_id,CONCAT_WS(", ",lastname,firstname) as name FROM '.STAFF_TABLE.

' WHERE isactive=1 AND onvacation=0 ';

if($ticket->isAssigned())

$sql.=' AND staff_id!='.db_input($ticket->getStaffId());

Add the couple lines in the middle:

$sql=' SELECT staff_id,CONCAT_WS(", ",lastname,firstname) as name FROM '.STAFF_TABLE.

' WHERE isactive=1 AND onvacation=0 ';

if(!$thisuser->canTransferTickets())

$sql .= ' AND dept_id = '.$ticket->getDeptId();

if($ticket->isAssigned())

$sql.=' AND staff_id!='.db_input($ticket->getStaffId());

After that you should be all set, the list of users in the 'Reassign' tab should no longer contain users from other departments if the user is in a group that has ticket transfering turned off. Admins/Managers will still be fine, since that override is within the 'canTransferTickets' function.

**As a side note, this is just a quick fix, and a particularly savvy staff member could get around it if you don't add checks in the actual assignStaff function in class.ticket.php by hacking your form, but they won't be able to do it straight from the UI anymore.