A 1 App Builders - Ticket System

The A 1 App Builders - Ticket System is a self-hosted, single-file-per-page PHP support ticketing application. It uses SQLite3 (no database server required), PHPMailer for transactional email, and a shared config.php that defines all constants, helpers, and the Database class.

There are three user roles — admin, agent, and user — each with their own auth guard and dashboard. Users register via email verification. Admins and agents are created by an admin.

Requirements

Step-by-Step

Directory Permissions

chmod 755 admin/database/
chmod 755 admin/uploads/
chmod 755 assets/uploads/
chmod 755 logs/

File: admin/includes/config.php — included by every PHP file in the system via require_once __DIR__ . '/../admin/includes/config.php' (or the equivalent relative path).

Identity

Path Constants (server filesystem)

Web Path Constants

Other Constants

$db = new Database();
$stmt = $db->conn->prepare("SELECT * FROM tickets WHERE id=:id");
$stmt->bindValue(':id', $id, SQLITE3_INTEGER);
$row = $stmt->execute()->fetchArray(SQLITE3_ASSOC);

Tables

Ticket Status Values

Default Categories

Seeded by setup.php: General · Billing · Technical · Account · Feature Request · Other

Default Priorities

Session Keys (after login)

Session Timeout — Two-Layer Enforcement

if (isset($_SESSION['ts_last_activity'])
    && (time() - $_SESSION['ts_last_activity']) > SESSION_TIMEOUT) {
    session_unset();
    session_destroy();
    if (session_status() === PHP_SESSION_NONE) session_start();
}
if (isset($_SESSION['ts_user_id'])) {
    $_SESSION['ts_last_activity'] = time();
}

Email Verification Flow

Password Reset Flow

Auth Guard Functions

// Top of every admin page:
require_once __DIR__ . '/includes/config.php';
require_ts_admin();   // or require_ts_agent() for agent+admin pages

// Top of every user page:
require_once __DIR__ . '/../../admin/includes/config.php';  // adjust depth
require_ts_user();

Submit Flow

Status Transitions

Any admin or agent can change status from admin_ticket_view.php (update panel) or the quick-modal on admin_tickets.php. A status change triggers a 'status_change' email to the user if that toggle is on.

When a user replies to a resolved ticket, the status automatically reverts to open.

User Restrictions

Internal notes are excluded from the user's thread query via AND r.is_internal=0. They appear in the admin view with a dashed amber border and an "Internal" badge. They do not trigger user notification emails.

-- User-facing query (user_ticket_view.php)
SELECT r.*, u.name, u.role
  FROM ticket_replies r
  JOIN users u ON u.id = r.user_id
 WHERE r.ticket_id = :tid AND r.is_internal = 0
 ORDER BY r.created_at ASC;

All email goes through send_ticket_email($db, $event, $data) in config.php, which checks the master toggle and per-event toggle before calling _dispatch_email() → send_mail() (PHPMailer SMTP).

Event Map

Master Toggle

Setting key: email_notifications. If '0', no emails are sent regardless of per-event toggles. All toggles are managed in Admin → Settings.

Email Template

If SITE_ROOT/assets/postoffice/email-template.html exists, it is used with placeholder substitution:

If the template file does not exist, the raw HTML body is sent directly.

Storage Paths

Filename Sanitization

$ext       = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
$safe_name = 'u' . $me_id . '_' . time() . '_' . bin2hex(random_bytes(4)) . '.' . $ext;

Original filenames are never used. Stored filename is saved in ticket_replies.attachment.

Pages

Quick Actions on admin_tickets.php

Both the Status and Assign buttons open Bootstrap modals with pre-filled selects. POST to the same page, process, then redirect with header('Location: …' . $_SERVER['QUERY_STRING']) to preserve filters.

Update Panel on admin_ticket_view.php

Visible to admins only (agents can only reply). Updates status, priority, category, and assigned agent in a single POST. Triggers status-change email if status differs from current, and assignment email if agent changed.

Ownership Guard

user_ticket_view.php queries with WHERE t.id=:id AND t.user_id=:uid — if the ticket doesn't belong to the logged-in user, they are redirected to user_dashboard.php. Users can never access other users' tickets.

All settings are stored in the settings table as key/value pairs. Read via get_setting($db, $key, $default). Written via set_setting($db, $key, $value) (upsert).

File: admin/database/setup.php — protected by a key param: ?key=ticketsystem_setup_2025. Returns 403 without it.

A recent-users table (last 20) is shown at the bottom of the page for quick verification.

All functions live in admin/includes/config.php and are available everywhere config.php is included.

CSRF Protection

Every POST form includes <input type="hidden" name="csrf_token" value="<?= csrf_token() ?>">. Every POST handler starts with if (!verify_csrf(post('csrf_token'))) { ... }. Token is stored in $_SESSION['ts_csrf'] and uses hash_equals() for constant-time comparison.

Security Headers

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin

Password Storage

password_hash($pw, PASSWORD_DEFAULT) on register and admin create. Verified with password_verify() on login. Never stored in plain text.

.htaccess Protection

SQL Injection Prevention

All queries use $db->conn->prepare() with bindValue() — never string interpolation of user input into queries. The only exception is integer IDs used directly in a small number of admin queries, which are always cast with (int) first.

Session Cookie Security

session_set_cookie_params([
    'lifetime' => SESSION_TIMEOUT,
    'path'     => '/',
    'secure'   => isset($_SERVER['HTTPS']),  // HTTPS-only when on HTTPS
    'httponly' => true,                        // Not accessible to JS
    'samesite' => 'Lax',
]);

session_regenerate_id(true) is called on every successful login to prevent session fixation.

Coding Style