From aef060e166aa77702595de082fb1dba252b2c6e3 Mon Sep 17 00:00:00 2001
From: Erki <skull132@users.noreply.github.com>
Date: Sat, 10 Mar 2018 23:08:33 +0200
Subject: [PATCH] Fixes ticket access (#4374)

---
 code/modules/admin/ticket.dm | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/code/modules/admin/ticket.dm b/code/modules/admin/ticket.dm
index 03a68c8b458..3358ab958b2 100644
--- a/code/modules/admin/ticket.dm
+++ b/code/modules/admin/ticket.dm
@@ -106,10 +106,12 @@ proc/get_open_ticket_by_ckey(var/owner)
 
 	var/list/dat = list()
 
+	var/valid_holder = check_rights(R_MOD|R_ADMIN, FALSE)
+
 	var/list/ticket_dat = list()
 	for(var/id = tickets.len, id >= 1, id--)
 		var/datum/ticket/ticket = tickets[id]
-		if(C.holder || ticket.owner == C.ckey)
+		if(valid_holder || ticket.owner == C.ckey)
 			var/client/owner_client = client_by_ckey(ticket.owner)
 			var/status = "Unknown status"
 			var/color = "#6aa84f"
@@ -128,11 +130,11 @@ proc/get_open_ticket_by_ckey(var/owner)
 			ticket_dat += "Ticket #[id] - [ticket.owner] [owner_client ? "" : "(DC)"] - [status]<br /><a href='byond://?src=\ref[src];action=view;ticket=\ref[ticket]'>VIEW</a>"
 			if(ticket.status)
 				ticket_dat += " - <a href='byond://?src=\ref[src];action=pm;ticket=\ref[ticket]'>PM</a>"
-				if(C.holder)
+				if(valid_holder)
 					ticket_dat += " - <a href='byond://?src=\ref[src];action=take;ticket=\ref[ticket]'>[(ticket.status == TICKET_OPEN) ? "TAKE" : "JOIN"]</a>"
-				if(ticket.status != TICKET_CLOSED && (C.holder || ticket.status == TICKET_OPEN))
+				if(ticket.status != TICKET_CLOSED && (valid_holder || ticket.status == TICKET_OPEN))
 					ticket_dat += " - <a href='byond://?src=\ref[src];action=close;ticket=\ref[ticket]'>CLOSE</a>"
-			if(C.holder)
+			if(valid_holder)
 				var/ref_mob = ""
 				if(owner_client)
 					ref_mob = "\ref[owner_client.mob]"
@@ -188,7 +190,7 @@ proc/get_open_ticket_by_ckey(var/owner)
 		if("close")
 			ticket.close(usr.client)
 		if("pm")
-			if(usr.client.holder && ticket.owner != usr.ckey)
+			if(check_rights(R_MOD|R_ADMIN) && ticket.owner != usr.ckey)
 				usr.client.cmd_admin_pm(client_by_ckey(ticket.owner), ticket = ticket)
 			else if(ticket.status == TICKET_ASSIGNED)
 				// manually check that the target client exists here as to not spam the usr for each logged out admin on the ticket
@@ -222,4 +224,4 @@ proc/get_open_ticket_by_ckey(var/owner)
 			C.view_tickets()
 		else
 			ticket_panel.ticket_panel_window.set_content(ticket_panel.get_dat())
-			ticket_panel.ticket_panel_window.update()
\ No newline at end of file
+			ticket_panel.ticket_panel_window.update()