feat(ZMS-3507): redirect without appointment #775
Conversation
WalkthroughThe pull request introduces changes to a Twig template and a PHP class related to process redirection. In the template, the "Weiterleiten" button is now always rendered, removing the previous conditional display. In the PHP class, the process redirection method now uses a more flexible approach to determine the identifier for redirection, checking for a queue number before falling back to the process ID. Changes
Sequence DiagramsequenceDiagram
participant User
participant Template
participant ProcessRedirect
User->>Template: View process info
Template->>User: Always show "Weiterleiten" button
User->>ProcessRedirect: Redirect process
alt Queue number exists
ProcessRedirect->>ProcessRedirect: Use queue number
else
ProcessRedirect->>ProcessRedirect: Use process ID
end
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
zmsapi/src/Zmsapi/ProcessRedirect.php (1)
57-57: Add a comment explaining the fallback logic.Consider adding a comment to explain why we prefer queue numbers over process IDs and when the fallback occurs.
+ // Prefer queue numbers for better user experience, fallback to process ID for legacy cases $process->queue['number'] ?? $process->id,
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
zmsadmin/templates/block/process/info.twig(1 hunks)zmsapi/src/Zmsapi/ProcessRedirect.php(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: call-unit-tests / zmsapi-test
- GitHub Check: call-unit-tests / zmsdb-test
🔇 Additional comments (2)
zmsadmin/templates/block/process/info.twig (1)
63-64: LGTM! Changes align with feature requirements.The unconditional rendering of the "Weiterleiten" button now enables process redirection regardless of appointment status, which directly implements the PR objective. Button styling and placement are consistent with the UI pattern.
zmsapi/src/Zmsapi/ProcessRedirect.php (1)
57-57: Verify security implications of using queue numbers.While the implementation correctly handles both appointment and non-appointment cases, using queue numbers (which are typically sequential) instead of process IDs could potentially expose the system to enumeration attacks.
Run this script to analyze the usage of queue numbers in redirection:
✅ Verification successful
Queue number usage is secure in this context
The implementation is safe because:
- Queue numbers are scoped to specific workstations/scopes
- Access requires proper authentication via X-Authkey
- Route validation prevents malformed input
- Direct enumeration is not possible without authentication
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check for potential security measures around queue number usage # Look for queue number validation or rate limiting rg -A 5 "queue.*number" --type php # Check for existing security measures in process redirection ast-grep --pattern 'class ProcessRedirect { $$$ protected function test$_($_) { $$$ } $$$ }'Length of output: 18884
Description
Short description or comments
Reference
Issues #XXX
Summary by CodeRabbit
UI Changes
Backend Improvements