Add/dashboard report tickets by group and status

[Herafia]

Checklist before requesting a review

Please delete options that are not relevant.

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.
• I have added tests that prove my fix is effective or that my feature works.
• This change requires a documentation update.

Description

• It fixes https://github.com/glpi-project/Professional-Services/issues/82
• Add a new dashboard card titled “Number of tickets by group and status”, migrated from the mreporting plugin

plugins/mreporting/inc/helpdesk.class.php
reportHgbarTicketNumberByService l.475

Screenshots (if appropriate):

[semgrep-code-glpi-alex-test]

Semgrep found 1 tainted-user-input-in-php-script finding:

• src/Glpi/Security/SessionTracker.php
  • L645 - Triage

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with htmlspecialchars or use automatic context-aware escaping with a template engine such as Latte.

View Dataflow Graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>src/Glpi/Security/SessionTracker.php</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L697 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 697] $_GET</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L697 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 697] $start</a>"]

            v3["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L707 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 707] $this-&gt;getSessions</a>"]

            v4["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L533 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 533] $start</a>"]

            v5["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L543 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 543] $it</a>"]

            v6["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L571 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 571] as</a>"]

            v7["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L571 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 571] $data</a>"]
        end
            v2 --> v3
            v3 --> v4
            v4 --> v5
            v5 --> v6
            v6 --> v7
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/glpi-project/glpi/blob/7f742b2c8429cd964a1654529334ab1fbf0efe88/src/Glpi/Security/SessionTracker.php#L645 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 645] htmlescape(sprintf(__(&apos;Expires at %s&apos;), $data[&apos;date_expiration&apos;]))</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

[AdrienClairembault]

Suggested change

	'label' => __("Number of opened and closed tickets by group"),
	'label' => __("Number of opened and solved tickets by group"),

From the code, the "closed tickets" part is actually solved + closed tickets: $closed_statuses = implode(',', [Ticket::SOLVED, Ticket::CLOSED]);.

With that in mind, I think "solved" would be a more precise label here.

[AdrienClairembault]

Suggested change

	new QueryExpression("COUNT(CASE WHEN $ticket_table.status IN ($opened_statuses) THEN $ticket_table.id END) AS opened"),
	new QueryExpression("COUNT(CASE WHEN $ticket_table.status IN ($closed_statuses) THEN $ticket_table.id END) AS closed"),
	new QueryExpression("COUNT(DISTINCT CASE WHEN $ticket_table.status IN ($opened_statuses) THEN $ticket_table.id END) AS opened"),
	new QueryExpression("COUNT(DISTINCT CASE WHEN $ticket_table.status IN ($closed_statuses) THEN $ticket_table.id END) AS closed"),

I have some duplicated results when testing, adding UNIQUE seems to fix them.

For example, in a database with only one ticket attached to two groups and using these groups as a filter I would get 2 results:

[AdrienClairembault]

Maybe we need something to keep only the groups requested by the filters?

If I filter for "Group A", all groups still shows:

[AdrienClairembault]

Not sure how to fix it but if you only have one type of tickets, the numbers overlap and become unreadable:

[AdrienClairembault]

Suggested change

	$opened_statuses = implode(',', [Ticket::INCOMING, Ticket::ASSIGNED, Ticket::PLANNED, Ticket::WAITING]);
	$opened_statuses = implode(',', [Ticket::getNotSolvedStatusArray()]);

I think you forget Ticket::APPROVAL (unless it is missing on purpose?), if that is the case you can use getNotSolvedStatusArray() so you are sure to not miss anything ;)

[AdrienClairembault]

Here I have two groups:

If I limit the widget to one result, it show the one with the least tickets:

I would expect the opposite, on a big instance with many groups the users is more likely interested in the groups with many tickets.