Issue #3014: Prevent usage of created ticket data for ACLs.

RotherOSS · Feb 22, 2024 · 488b16b · 488b16b
1 parent cf6f0d1
commit 488b16b
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/Kernel/Modules/AgentTicketPhone.pm b/Kernel/Modules/AgentTicketPhone.pm
@@ -915,13 +915,16 @@ sub Run {
                     TicketObject              => $TicketObject,
                     DynamicFields             => $Self->{DynamicField},
                     DynamicFieldBackendObject => $DynamicFieldBackendObject,
-                    ChangedElements           => \%ChangedElements,                        # optional to reduce ACL evaluation
+                    ChangedElements           => \%ChangedElements,            # optional to reduce ACL evaluation
                     Action                    => $Self->{Action},
                     UserID                    => $Self->{UserID},
-                    TicketID                  => $Self->{TicketID},
-                    FormID                    => $Self->{FormID},
-                    CustomerUser              => $SplitTicketData{CustomerUserID} || '',
-                    GetParam                  => {
+
+                    # in split ticket case, article id is present
+                    #   else, we do not want to falsely use data from created ticket
+                    TicketID     => $Article{ArticleID} ? $Self->{TicketID} : '',
+                    FormID       => $Self->{FormID},
+                    CustomerUser => $SplitTicketData{CustomerUserID} || '',
+                    GetParam     => {
                         %GetParam,
                         OwnerID => $GetParam{NewUserID},
                     },