Adding Teams

[Chris Byrd]

two things.   One maybe something I have not entered yet.

When creating a new team the Type pull down is blank

When trying to save I get

Just for my reference.   Do you want me to enter these here or do a git hub error report ?

Thanks

Chris

[mike]

Just for reference:

An HTTP 403 Forbidden error means the web server understands your request but refuses to give you access. Unlike a 404 error (page not found) or a 401 error (needs login), the server knows the page exists but your credentials or network are blocked from seeing it, and logging in again will not fix it

Sent from my iPhone

--
You received this message because you are subscribed to the Google Groups "Open Source CAD" group.
To unsubscribe from this group and stop receiving emails from it, send an email to open-source-c...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/open-source-cad/03cf58f7-d97d-4d14-8fb2-4039d3712da0n%40googlegroups.com.

[mike]

So make sure your file permissions are good and the files are in the correct place they should be. Tickets v4 is seems to be more picky about security

Sent from my iPhone

[mike]

And to diagnose things a bit easier it would help to know what you are running tickets on if you haven’t stayed before. Windows/linux distribution/mac. Are you using docker, shared hosting dedicated vps. It give the person an area to help you with your issue especially if the problem is environment specific or not. 

Sent from my iPhone

[Chris Byrd]

I am running on windows 11 with XAMPP.    Using Git for installation and Pulls.  This install is a fresh pull from the start.   

Thanks

Chris

[Chris Byrd]

I just check the security and it is the same as all the other files in the C:\xampp\htdocs\TicketsCAD directory

Chris

[mike]

Just a quick search and this is just some general guides so maybe someone else can help since I don’t have xampp. 

The blank "Type" pull-down menu and the HTTP 403 Forbidden error are tied together, caused by XAMPP's Apache server blocking TicketsCAD from dynamically pulling the type categories from its backend PHP/SQL scripts.

Because Apache blocks the background request (403), the dropdown menu cannot load any options. When you force a save with an empty dropdown value, the application throws a submission failure.

Step 1: Fix XAMPP Directory Permissions (Primary Fix)

XAMPP on Windows 11 heavily restricts directory routing by default. You need to allow Apache to access and execute scripts within your TicketsCAD folder.

1. Open the XAMPP Control Panel and click Stop next to Apache.
2. Click the Config button next to Apache and open httpd.conf (or httpd-xampp.conf).
3. Use Ctrl + F to search for your document root directory entry (usually <Directory "C:/xampp/htdocs">).
4. Ensure the permission rule allows local access. Look for the Require line and change it to grant permission:

   # Change "Require local" or "Require all denied" to:
   Require all granted
   

5. Save the file and Restart Apache in XAMPP. [1, 2, 3, 4, 5] 

Step 2: Clear .htaccess Restrictions

TicketsCAD v4 uses routing files that can clash with Windows pathing inside XAMPP, triggering 403 errors. [6] 

1. Navigate to your TicketsCAD project folder inside C:\xampp\htdocs\.
2. Look for a file named .htaccess (you may need to check "Hidden items" in Windows 11 File Explorer view settings).
3. Open it with Notepad and look for any lines reading Deny from all or strict RewriteRule flags.
4. Temporarily comment them out by adding a # at the start of the line (e.g., # Deny from all) to see if XAMPP stops blocking the script execution. [7] 

Step 3: Populate Dropdowns via phpMyAdmin

If the pull-down remains empty after fixing permissions, the TicketsCAD database migration likely failed to populate the lookup tables during installation. [8] 

1. Open your browser and go to http://localhost/phpmyadmin.
2. Select your TicketsCAD database from the left sidebar.
3. Look for a table named team_types, lookup_values, or system_properties.
4. If this table is completely empty (0 rows), click the Insert tab at the top of phpMyAdmin and manually add at least one default type ID and name (e.g., ID: 1, Name: Fire / EMS) so the dropdown has data to fetch. [9, 10] 

If the dropdown is still blank after these steps, check your Apache error log via the XAMPP Control Panel (click the Logs button next to Apache) and let me know the exact file path or PHP warning listed next to that 403 error. [11] 

[1] https://kinsta.com

[2] https://kinsta.com

[3] https://stackoverflow.com

[4] https://phoenixnap.com

[5] https://stackoverflow.com

[6] https://www.networksolutions.com

[7] https://superuser.com

[8] https://groups.google.com

[9] https://support.teamsupport.com

[10] https://kinsta.com

[11] https://www.youtube.com

Sent from my iPhone

To view this discussion visit https://groups.google.com/d/msgid/open-source-cad/5b6aee21-c0c9-439c-a672-47a701028082n%40googlegroups.com.

[mike]

Now possible security related as I’m unsure your intentions of ticketscad. Local use only not opened to the internets or reverse proxy.   doing this can be a security issue, but whether it puts you at immediate risk depends entirely on whether your computer is isolated or exposed to the internet. [1, 2, 3] 

The directive Require all granted instructs Apache to completely bypass its built-in access restrictions for that folder. Because XAMPP is fundamentally built for local development and lacks default security hardening, modifying these settings changes your security posture based on how your system is connected. [4, 5, 6] 

When it is SAFE

If you are running XAMPP on a home computer or private local machine that sits behind a router using Network Address Translation (NAT), you are generally safe. [7] 

• Nobody on the public internet can see or connect to your local XAMPP server unless you explicitly configure port forwarding on your router. [7] 
• To ensure it stays secure, open your httpd-xampp.conf file and verify that the core application restrictions (especially for phpMyAdmin) are tightly bound to Require local. This keeps strangers from accessing your database even if your web files are accessible. [8] 

When it becomes a SEVERE Risk

If your computer is directly connected to the internet with a public IP address, or if you are using a public, untrusted Wi-Fi network (like at a coffee shop), this is a major security vulnerability. [7, 9, 10, 11] 

• Unrestricted Access: Anyone on that same network or internet space can type your computer's IP address into their browser and completely access or modify your TicketsCAD installation. [12, 13] 
• Database Exposure: By default, XAMPP installations leave the database administration (root) user account with no password. If a bad actor gains access via the open directory permissions, they can easily wipe, steal, or corrupt your entire database. [13, 14] 

How to Stay Secure While Fixing the Issue

If you want to allow TicketsCAD to work correctly without opening up blanket permissions to the world, use a strict IP-binding rule instead of Require all granted.

Replace the permission block in your httpd.conf with a rule that explicitly restricts access to your own computer (the loopback address):

<Directory "C:/xampp/htdocs/TicketsCAD">
    # Only allow connections originating from your local machine
    Require local
</Directory>

Note: If Require local is what threw the 403 error initially, it means TicketsCAD's background scripts are trying to route requests through your machine's actual local IP address rather than 127.0.0.1. In that case, you can manually whitelist your exact local IP like this:

<Directory "C:/xampp/htdocs/TicketsCAD">
    Require ip 127.0.0.1
    Require ip ::1
    Require ip 192.168.1.X  # Replace with your actual internal IPv4 address
</Directory>

Would you like help finding your exact internal IP address to lock this down, or do you want to look at setting a secure root password for your database so it isn't left open?

[1] https://www.liquidweb.com

[2] https://www.youtube.com

[3] https://www.nescient.co.uk

[4] https://serverfault.com

[5] https://superuser.com

[6] https://www.reddit.com

[7] https://teamtreehouse.com

[8] https://www.apachefriends.org

[9] https://www.proofpoint.com

[10] https://www.youtube.com

[11] https://proxidize.com

[12] https://stackoverflow.com

[13] https://www.makeuseof.com

[14] https://medium.com

Sent from my iPhone

[Chris Byrd]

Eric,  After the update to 4.2.8 it did fix the teams issue but as an FYI It duplicated all the teams in the list.

Chris

[Eric Osterberg]

I wonder if this is another pattern where you may have deleted teams and deleted items are still showing when you view the data.??

I'll dig in and research.

Eric Osterberg
Lead Maintainer, TicketsCAD - github.com/openises/TicketsCAD
Open-source dispatch software for volunteer fire, EMS, CERT & ARES/RACES teams

To view this discussion visit https://groups.google.com/d/msgid/open-source-cad/8a4f13cf-55ea-4026-857d-ed9a4554209dn%40googlegroups.com.

[Eric Osterberg]

Chris,

Found it, and it's not the soft-delete pattern I guessed at. It's a bug in the update script itself.

The 4.2.8 startup migration re-imports a set of default starter teams (Command, Operations, Logistics, etc). That import used INSERT IGNORE, which is only supposed to skip a row if it collides with something already in the database. Turns out there was never actually a rule in the database saying team names have to be unique, so INSERT IGNORE had nothing to collide with and just inserted a second copy of every team you already had. That's the duplication you saw.

4.2.9 is out now and fixes both sides of it:

1. On update, it automatically finds any teams that got duplicated and merges them back into one, keeping whichever copy has more members already assigned, and moving over any members from the extra copy first so nobody gets dropped in the process.
2. It adds a real uniqueness rule to the database so this can't happen again.

To pick it up: git pull, then run php sql/run_migrations.php like you did for 4.2.8. It's safe to run more than once and will clean up the duplicates automatically, no manual deleting needed.

Sorry for the extra round trip on this one, and thanks for reporting back so fast so we could catch it.

Eric Osterberg
Lead Maintainer, TicketsCAD - github.com/openises/TicketsCAD
Open-source dispatch software for volunteer fire, EMS, CERT & ARES/RACES teams