Hidden + staff only custom fields cannot be populated with GET or POST

[Heppa]

Script URL:
Version of script: 3.1.0
Hosting company:
URL of phpinfo.php:
URL of session_test.php:
What terms did you try when SEARCHING for a solution:
custom field hidden staff only

Write your message below:
This issue is linked to article https://www.hesk.com/knowledgebase/index.php?article=83
The problem is that it is not possible to populate custom fields with HTTP GET or POST request if they are marked "hidden" and "staff only".
Our customers will be entering HESK from our software, which could send its environmental variables to the "Submit a ticket" form - we do not want to confuse customers with these.

At the moment, hidden + public works for collecting this data, but customers will see the variables when viewing the ticket later on. When custom field is set to hidden and staff only, the field does not appear in the "Submit a ticket" form code at all and thus cannot take in data. It would be useful if a hidden + staff only field could also be populated.

[Klemen]

I see what you mean, but "staff only" fields are completely separated from the public interface because they may contain data that should in no way available to the customer.

A PHP programmer should be able to help you exclude display of the hidden custom fields from the customer-side display with a few tweaks of the code.

[Heppa]

I might be able do that myself, but I was thinking about a different approach (if my modest php skill level is sufficient for the task):

not hiding [hidden + public] fields for customers in 'existing ticket' view but instead making [hidden + staff only] fields available for populating new hidden data in the 'Submit a ticket' form.

Doesn't it still make it "staff only" - [hidden + public] data will not be shown anywhere to the customers except if they decide to see the 'Submit a ticket' form html source code where the data is being submitted covertly? And this of course is something that the help desk company can take into account when populating these hidden fields: is the populated data something that must not go through the form, not even hidden? In our case, there is nothing really sneeky or secret about it - if the users see it by checking the source code, it is ok. It is worse if they see it afterwards in the ticket view since it just makes it all seem a bit gibberish.

I am still more or less a newbie HESK user, so my apologies if I am not on a right track with this. Have not yet dived into the code, so it shall be seen if this approach even makes sense. Would not really want to fork it too much.

[Klemen]

In my opinion, you will have less work and less code to edit if you simply hide the display of HIDDEN + PUBLIC fields from showing up when a customer views a ticket.

However, feel free to try your approach and see what works best for you.

[Heppa]

You were right: the easiest way was to add two lines of code to the file /theme/hesk3/customer/util/custom-fields.php

In case someone else might be interested, this solution hides hidden fields from the customer in the ticket view and makes it possible to use them in order to populate "Submit a ticket" form fields in a concealed way. Thus, in practice the public hidden fields will now become staff only hidden fields AFTER the ticket has been created.

Code: Select all

function hesk3_output_custom_fields_for_display($customFields) {
    foreach ($customFields as $customField)
    {
        switch ($customField['type'])
        {
            case 'email':
                $customField['value'] = '<a href="mailto:'.$customField['value'].'">'.$customField['value'].'</a>';
                break;
            case 'date':
                $customField['value'] = hesk_custom_date_display_format($customField['value'], $customField['date_format']);
                break;
        }

		if ( ( $customField['type'] != 'hidden' ) ) { // **ADD THIS LINE TO EXCLUDE HIDDEN FIELDS FROM BEING DISPLAYED TO CUSTOMER**
        echo '
            <div>
                <span style="color: #959eb0">'.$customField['name:'].'</span>
                <span>'.$customField['value'].'</span>
            </div>
            ';
			
		} // **ADD THIS LINE TO EXCLUDE HIDDEN FIELDS FROM BEING DISPLAYED TO CUSTOMER**
    }
}  

[Klemen]

Thanks for sharing!