sr2/link-stack
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix phone sanitization and signal group lookup

Browse source
This commit is contained in:
Darren Clarke 2025-11-20 13:12:56 +01:00
parent d83c1af258
commit 31a3b505af
3 changed files with 81 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

10
packages/zammad-addon-bridge/src/app/controllers/channels_cdr_signal_controller.rb
View file

@ -222,11 +222,11 @@ class ChannelsCdrSignalController < ApplicationController
Rails.logger.info "Channel ID: #{channel.id}"
begin
# Use PostgreSQL JSONB queries to efficiently search preferences without loading all tickets into memory
# Use text search on preferences YAML to efficiently find tickets without loading all into memory
# This prevents DoS attacks from memory exhaustion
ticket = Ticket.where.not(state_id: state_ids)
.where("preferences->>'channel_id' = ?", channel.id.to_s)
.where("preferences->'cdr_signal'->>'chat_id' = ?", receiver_phone_number)
.where("preferences LIKE ?", "%channel_id: #{channel.id}%")
.where("preferences LIKE ?", "%chat_id: #{receiver_phone_number}%")
.order(updated_at: :desc)
.first
@ -420,11 +420,11 @@ class ChannelsCdrSignalController < ApplicationController
end
# Find ticket(s) with this group_id in preferences
# Use PostgreSQL JSONB queries for efficient lookup (prevents DoS from loading all tickets)
# Use text search on preferences YAML for efficient lookup (prevents DoS from loading all tickets)
state_ids = Ticket::State.where(name: %w[closed merged removed]).pluck(:id)
ticket = Ticket.where.not(state_id: state_ids)
.where("preferences->'cdr_signal'->>'chat_id' = ?", params[:group_id])
.where("preferences LIKE ?", "%chat_id: #{params[:group_id]}%")
.order(updated_at: :desc)
.first