id, 'sst_' ) === false ) { return; } // FIX: Cast to int to prevent XSS via JS injection $ticket_id = isset( $_REQUEST['tid'] ) ? absint( $_REQUEST['tid'] ) : 0; ?> insert( $wpdb->prefix . 'support_ticket_message', array( 'message' => $message, 'ticket_id' => $ticket_id, 'user_id' => $user_id, ), array( '%s', '%d', '%d' ) ); wp_die(); } // Retrieve chat messages (admin live chat) add_action( 'wp_ajax_sst_get_chat_messages', 'sst_get_chat_messages' ); function sst_get_chat_messages() { // FIX: Capability check so only admins can read any ticket's messages if ( ! current_user_can( 'manage_options' ) ) { wp_die( esc_html__( 'Permission denied.', 'sst' ) ); } global $wpdb; $ticket_id = absint( $_REQUEST['ticket_id'] ); if ( $ticket_id < 1 ) { echo json_encode( array() ); wp_die(); } // FIX: Corrected u.ID (uppercase) to match WordPress users table primary key $results = $wpdb->get_results( $wpdb->prepare( "SELECT m.*, u.user_email FROM {$wpdb->prefix}support_ticket_message m JOIN {$wpdb->users} u ON m.user_id = u.ID WHERE m.ticket_id = %d ORDER BY m.id DESC LIMIT 50", $ticket_id ) ); echo json_encode( $results ); wp_die(); }