Repository navigation
Teams Buttons Did Nothing
Fixed in 3.9.0 Β· Reported in #186 by @Dr4inder Β· Present in 3.7.0 to 3.8.1 Β· Module: System β Teams
On System β Teams, the list of teams never loaded - it said Loadingβ¦ for ever - and pressing Add did nothing. The browser's console said:
SyntaxError: Unexpected identifier 'ticket'
ReferenceError: openTeamModal is not defined
It was reported with the interface in German, but it was broken in every language, English included, on every install from 3.7.0 onwards. Nothing was ever saved wrongly and no data was affected: the page simply could not do anything, so no team could be created or changed.
One apostrophe did it. It is fixed, and the wording around it now comes from the translation files, where an apostrophe can no longer reach the code.
- The heading, the Add button and the table's column headings appeared as usual - the server draws those.
- The table itself said Loading⦠and never changed. The list of teams is fetched by the same script, so it never ran either.
- Add did nothing. No dialog, no message.
- The console showed the two errors above - the first one as the page loaded, before anything was clicked.
The reporter's own diagnosis was exactly right: "The initial parse error may explain why the handler is unavailable." It does, completely.
A web page's buttons are wired up by a script - a program the browser reads from top to bottom before running any of it. If the browser finds a single sentence it cannot understand anywhere in that script, it refuses to run any of it. Every function the page defines, including openTeamModal, the one behind Add, simply never comes into existence. That is the second error: the button asks for a function that was never made.
The sentence the browser could not understand was a piece of English text inside the script.
In 3.7.0, Teams gained a small Check badge on any team with members but no departments (A team with no departments showed 0 tickets). Its tooltip read:
Members' ticket folders only count tickets with no department, plus their own
and it was written inside a JavaScript string that was itself wrapped in apostrophes. JavaScript uses ' to mean "text starts here" and "text ends here". So it read:
' <span class="status-badge" ... title="Members'as a complete piece of text ending after Members, and then met the word ticket sitting loose in the code where a + or a , should have been - "Unexpected identifier 'ticket'".
Before (system/teams/index.php, 3.7.0):
<td>${team.deptCount} department(s)${team.deptCount === 0 && team.analystCount > 0 ? ' <span class="status-badge" style="..." title="Members' ticket folders only count tickets with no department, plus their own">Check</span>' : ''}</td>After (3.9.0):
<td>${escapeHtml(t('tickets.settings.team_counts.departments', { count: team.deptCount }))}${team.deptCount === 0 && team.analystCount > 0 ? ` <span class="status-badge" style="..." title="${escapeHtml(t('tickets.settings.team_counts.check_title'))}">${escapeHtml(t('tickets.settings.team_counts.check'))}</span>` : ''}</td>Two changes, and each one alone would have fixed the crash:
-
The words came out of the code. The tooltip, the word Check, and the "N department(s)" and "N analyst(s)" counts are now in
lang/en/tickets.phpunderteam_counts, read witht(). A translation file is a PHP string, not code the browser parses, so its apostrophes are just apostrophes. -
The wrapper became a backtick. The inner piece is now a template string (
`), like the line around it - so even if somebody puts English back in, an apostrophe inside it is just a character.
escapeHtml() on each piece means a translation containing " or < can no longer break the HTML either.
The same commit added another piece of English to the same function - the warning banner above the table - and that one was written correctly:
+ 'Someone in a team only gets ticket folders and counts for that team\'s departments, so these members\' folders only count tickets with no department, plus their own. 'Every apostrophe there is escaped with a backslash (\'). The badge, written a few lines further down, was not. So the commit looked careful - the long, obviously risky sentence had been handled - and the short tooltip, which nobody thought of as risky, was the one that broke the page.
The lesson is not "remember the backslash". It is don't put words in the code at all. A translation key cannot contain the bug, and it was needed anyway: the banner and the badge were English on every install, including German ones, so the fix moved the banner's text into the translation files too.
The 3.7.0 fix was verified carefully - but where the change was: the ticket counts were compared byte for byte before and after, and against an independent database count. What was never done was open System β Teams in a browser and press a button. The page still returned HTTP 200, PHP's own syntax check (php -l) passed, and the HTML it produced was perfectly valid. All of that is true of a page whose script will not run, because the broken thing is JavaScript, and nothing in that list reads JavaScript.
This is the gap the project's notes call rendered markup is not working JavaScript: the only check that catches it is a real browser loading the page and reporting what its console says.
Yes - and that was checked rather than assumed, because the earlier write-ups in this list (#70, #78) both turned out to be several places, not one.
-
Every page, in a real browser. All 84 analyst pages that a module or System opens on - every System area, and each module's main page and settings page - were loaded in headless Chrome after the fix, and the console was read for
SyntaxErrorandReferenceError. None had one. (Knowledge hung the test browser during the sweep and was stopped, so its clean result comes from the same check run earlier the same day.) -
The same pattern in the code. A search for an apostrophe inside a
title="β¦"that is built inside a script found two other candidates (Projects' budget table, the Forms list); both build the text from translations through an escaping function, so neither can break this way.
Why only English was swept: the translation files reach a page's script as JSON (window.translations), which is encoded safely whatever the language. Words written straight into the script are the same in every language - so a page that parses in English parses in German.
| File | Change | |
|---|---|---|
| π¦ | system/teams/index.php |
The badge, the warning banner and the counts read their words with t(), escaped; the badge is a template string |
| π© | lang/en/tickets.php |
New settings.team_counts block - the counts, the badge and its tooltip, and the warning's sentences |
Other languages fall back to the English wording until they are translated, which is how every new string arrives.
-
Reproduced first, on the dev install, in German and in English: the console showed
Unexpected identifier 'ticket'on page load. The German run used an administrator with no saved language and the browser set to German, so the page really rendered in German. -
After the fix, in a real browser (headless Chrome), as an English administrator and a German one: no console error,
openTeamModalexists, and Add opens the team dialog. -
The warning text was built from the new strings with a hostile team name -
O'Brien <b>Team</b>- and the name came out as plain text, with the link still a link. -
Control: the same console check reports a deliberate
ReferenceErroron a test page, so a clean result means the page really is clean.
- Upgrade to 3.9.0 and System β Teams works again.
- On 3.7.0 to 3.8.1 there is no workaround: teams are only managed on this page, and the REST API has no teams resource.
- Nothing needs repairing afterwards: no team was ever saved wrongly.
- A team with no departments showed 0 tickets - the 3.7.0 fix whose warning badge caused this
- Bugs resolved
-
Internationalisation - why words belong in
lang/, not in the code
FreeITSM β an open-source IT Service Management platform Β· github.com/edmozley/freeitsm Β· MIT licence
- Installation
- β° Scheduled tasks (cron jobs)
-
Architecture
- β³ π§Ή Root folder tidy (URL routing)
- β³ π Database Integrity (FKs & constraints)
- β³ π οΈ Database Verification β Developer Guide
- β³ π§© Service Layer (UI + API share code)
- β³ πͺ€ Code traps (the TRAP: comments)
- β³ π Commenting for the Engineering wiki
- β³ π οΈ Engineering wiki scanner - Developer Guide
- β³ π Service-Layer progress
- π§ͺ Developer tests
- AI Providers
- Internationalisation (i18n)
- Timezones & Time Handling
- π Date & Time Formats
- π± Currencies
- π§ The sidebar (optional module rail)
- π Display order (modules, Watchtower cards) β Developer Guide
- Theming & Dark Mode
- ποΈ Recent β getting back to what you were doing
- β¨οΈ Command palette (βK)
- π Searching inside tickets
- π Attached documents
-
MobileβFriendly
- β³ π« Mobile: Tickets
- β³ π» Mobile: Assets
- β³ π Mobile: Calendar
- β³ π Mobile: Knowledge
- β³ π¦ Mobile: Service Status
- β³ πΌ Mobile: Watchtower
- β³ π§© Mobile: Problem Management
- β³ π Mobile: Change Management
- β³ πΏ Mobile: Software
- β³ β Mobile: Tasks
- β³ π Mobile: Forms
- β³ π Mobile: Contracts
- β³ π Mobile: Domains
- β³ π Mobile: People
- β³ π Mobile: Projects
- β³ ποΈ Mobile: Files
- β³ π Mobile: LMS
- β³ πΊοΈ Mobile: CMDB
- β³ πΊοΈ Mobile: Network Mapper
- β³ π§ Mobile: Process Mapper
- β³ βοΈ Mobile: Workflow
- β³ π₯οΈ Mobile: System
- β³ π Mobile: Reporting
- β³ π Mobile: System Wiki
- β³ π Mobile: Self-Service Portal
- β³ π§° Mobile: Techniques & Tricks
-
Security
- Layer 1 β which modules you can enter
- β³ π§© Module Access Control
- β³ π οΈ Module Access β Developer Guide
- Layer 2 β what you can administer
- β³ π Roles & Permissions
- β³ π οΈ Roles β Developer Guide
- β³ π€ Why capabilities are constants
- Layer 3 β the System module
- β³ π Admin Access Control
- Hardening
- β³ π Security review response 2026-08
- β³ π‘οΈ Security hardening 2026-08
- β³ π οΈ Security hardening 2026-08 β Developer Guide
- β³ π‘οΈ Round three β plain English
- β³ π οΈ Round three β Developer Guide
- β³ π‘οΈ CSRF protection (S4) β Developer Guide
- Single Sign-On (SSO)
- ποΈ LDAP & Active Directory
- π CardDAV contact sync
- Browser Extension
- API Reference
-
π REST API β how it works
- β³ π« REST API: Tickets
- β³ π» REST API: Assets
- β³ π΄ REST API: Problems
- β³ π REST API: Changes
- β³ π REST API: Knowledge
- β³ β REST API: Tasks
- β³ ποΈ REST API: CMDB
- β³ π REST API: Contracts
- β³ ποΈ REST API: Calendar
- β³ πΏ REST API: Software
- β³ π REST API: Domains
- β³ π¦ REST API: Service Status
- β³ βοΈ REST API: Morning Checks
- β³ π REST API: Forms
- β³ βοΈ REST API: Workflow
- β³ π·οΈ REST API: Cost centres
- β³ π§βπΌ REST API: Analysts
- β³ πΊοΈ REST API: Network Mapper
- β³ π§ Using the API docs page
- β³ π OpenAPI specification
- β³ β OpenAPI: kept correct
- β³ π οΈ Maintaining the catalogue
- Watchtower
-
Tickets
- β³ π Rota copy and paste β Developer Deep Dive
- β³ β Checklists & SOPs
- β³ βοΈ Mandatory fields
- β³ π§Ύ Custom ticket fields
- β³ π·οΈ Ticket categories
- β³ π₯ Assigning tickets to a team, and escalation
- β³ π’ One board across every company
- β³ Mailbox Authentication
- β³ π€ Email send log
- β³ π Attachment size limits and large emails
- β³ Basic IMAP mailboxes
- β³ Email rendering & images
- β³ SLA Management
- β³ WhatsApp channel
-
β³
βοΈ Telegram channel - β³ β CSAT company scope and filters β Developer Guide
- β³ π₯ Microsoft Teams channel
- β³ π¨οΈ Mattermost channel
- β³ π¬ Web chat channel
- β³ π£ Slack channel
- β³ π Linking tickets
- β³ β Record previews
- β³ π Ticket notes: internal or shared
- β³ ποΈ Canned responses
- β³ βοΈ Limiting replies to particular senders
- β³ π¨ Telling the analyst a ticket is theirs
- β³ βοΈ Email signatures
- β³ π The public web address
- β³ π’ Ticket numbering
- β³ π Raising a ticket for someone else
- β³ π Merging tickets
- β³ π Confidential tickets
- β³ π₯ Portal managers
- β³ π Who has seen a ticket
- β³ π Reading long tickets
- β³ β Splitting tickets
- β³ β Selecting several tickets
- β³ ποΈ The folder pane
- β³ π½ Just my tickets, or no closed ones
- β³ π οΈ Snoozing tickets β Developer Guide
- β³ π₯ Collision detection
- β³ β±οΈ Time tracking
- β³ π Scheduled work in your own calendar
- Problem Management
- Tasks
- π Projects
-
Assets
- β³ π’ Moving an asset between companies
- β³ π Shared asset locations
- β³ π§βπΌ Assigning assets to analysts
- β³ π Warranty and lease alerts
- β³ π Leases
- β³ π Saved table views
- β³ π¨οΈ Recording anything, and importing it
- β³ π·οΈ QR asset labels
- β³ π Who holds what, and handover documents
- β³ π₯οΈ The inventory agent (PowerShell)
- β³ ποΈ Proxmox VE servers
- β³ βοΈ VMware Cloud Director servers
- β³ π Linking equipment to tickets
- β³ βοΈ Follow-up tasks on a ticket
- Knowledge
- Change Management
- Calendar
- Morning Checks
- Reporting
- Software
-
Forms
- β³ π¨ The form designer β Developer Guide
- β³ π Layout & the grid β Developer Guide
- β³ ποΈ Collections β grouping submissions
- β³ π Submissions as PDFs
- β³ β‘ What happens next β a form's own actions
- β³ π οΈ Sections & conditional logic β Developer Guide
- β³ π οΈ Lookup fields β Developer Guide
- β³ π‘οΈ Catalogue request approvals
- People
- Domains
- ποΈ Files
- Contracts
- Service Status
- π Notifications
- π¨ War Room
- Self-Service Portal
- LMS
- Process Mapper
- CMDB
- Network Mapper
- Workflows
- Issue trackers (Jira, Azure DevOps)
- System
-
Overview
- β³ π Progress tracker
- β³ Concepts & vocabulary
- β³ Email routing & mailboxes
- β³ Settings: global vs per-company
- β³ Users & self-service
- β³ Staff cross-company access
- β³ π’ One board across every company
- β³ Worked examples
- β³ Pitfalls & gotchas
- β³ Scope: what it's for
- β³ π οΈ Developer Guide (make a module multi-company)
- β³ ποΈ Case study: CMDB (a linked graph)
- β³ π§ͺ Test harness (prove it's isolated)
- What this is
-
π Bugs resolved
- β³ π Repeating tasks ignored company scope
- β³ π¬ #183 Mailbox checks overlapped
- β³ π #188 Transfer lock shown off when unknown
- β³ β #184 Subtask names and Overdue
- β³ π§© #186 Teams: the buttons did nothing
- β³ π Text in a change could run script
- β³ π AI settings changed without the AI permission
- β³ πͺ #178 Deleting an analyst failed
- β³ π« A team with no departments showed 0 tickets
- β³ π Projects: adding a phase did nothing on Save
- β³ π Leavers could still sign in
- β³ πΌοΈ Logo and courses broke on Apache with PHP-FPM
- β³ π’ Chat tickets ignored your ticket numbering
- β³ π Dates shown as a dash, or in server time
- β³ π Assets β Users showed people from other companies
- β³ π Restricted analysts could read other modules' data
- β³ πΌοΈ Replies with a picture in the thread failed to send
- β³ π Reply attachments never reached the customer
- β³ π οΈ Outbound email attachments β Developer Guide
- β³ π A global SSO provider was missing from the portal
- β³ π Behind a proxy, the SSO redirect said http
- β³ βοΈ The portal tagline moved when you saved it
- β³ π¨ The portal settings screen forgot what you saved
- β³ π‘οΈ The approvals inbox said "Error" and nothing else
- β³ π A table's answers were missing from the PDF
- β³ β A single-select column let you tick every option
- β³ π The portal ignored a form's field widths
- β³ π The tasks board stopped taking clicks
- β³ ποΈ #121 The index list is out of date after upgrading
- β³ π #133 The calendar subscription was empty
- β³ π #131 Tasks always reopened on the board
- β³ π₯ #129 Every page returned HTTP 500 after upgrading
- β³ π³ #127 A PHP warning above the System page
- β³ π #126 Notes stamped with the server's clock
- β³ π Storing every date in UTC
- β³ πͺ The portal was down for everyone signed in
- β³ βοΈ #120 Workflow notes could never be written
- β³ βοΈ #123 Three errors when running Database Verification
- β³ π #122 The description box was a stub in the corner
- β³ π£ Demo data deleted real accounts
- β³ π #117 Sign-in redirected to the wrong address
- β³ π¨ #108 The priority dot was invisible
- β³ β±οΈ #116 Time logged from the right-click menu
- β³ π #114 API keys refused by our own guard
- β³ ποΈ #110 Assigning a task told nobody
- β³ πͺ #107 Signed out while still working
- β³ π #103 "Share with Requester" reached nobody
- β³ π #102 Search found nothing for hyphens
- β³ πͺ #101 Source code editor opened behind
- β³ βοΈ #88 Subtasks could not be ticked off
- β³ π» #84 Asset deep link selected nothing
- β³ π« #79 A new ticket arrived with no status
- β³ π§ #79 A ticket from email did not say so
- β³ π #78 Bell opened to nothing
- β³ π¬ #77 Mail only collected from Inbox
- β³ π #74 The default password could not be changed
- β³ π¦ #70 Renaming an impact level
- β³ π€ #67 App-only mailboxes could not send
- β³ π #45 Verify only ever worked for Microsoft
- β³ π #45 IMAP reported as not authenticated
- β³ βοΈ An email template stopped escaping itself
- β³ π The portal dashboard showed the wrong time
- β³ π’ The folder said 99 and the list showed 96