Repository navigation
Ticket Dashboard Developer Guide
How Tickets β Dashboard and its Widget Library work underneath: the pages, the shared widget editor, the endpoints and the two tables. For what an analyst sees, see Tickets β Dashboard.
Read this first if you touch
assets/js/widget-editor.js. One script drives every way of making or changing a widget - the cog on the dashboard, and New widget and Edit in the library. An error anywhere in it stops all three at once. That is what happened between 2.5.0 and 4.10.0 (#260).
There are two kinds of thing:
- A widget - one chart definition: what to count, how to draw it, which dates and departments. Widgets live in one shared library for the whole install.
- A dashboard - one analyst's choice of library widgets, in their own order.
So adding, removing and reordering are personal. Editing a widget's definition is not: it changes the library row, and every analyst who has that widget sees the change.
ticket_dashboard_widgets (the library - one row per widget, shared)
β² widget_id
analyst_ticket_dashboard_widgets (who has which widget, in what order)
| File | What it does |
|---|---|
tickets/dashboard/index.php |
The dashboard. It draws each card with Chart.js, handles drag and drop, the status dropdown on a card, and the cog that opens the edit modal |
tickets/dashboard/library.php |
The Widget Library: table of every widget, New widget, Edit, Duplicate, Delete, Add to dashboard |
tickets/dashboard/includes/widget_edit_form.php |
The edit form's markup. It is included by both pages, so the fields are written once |
assets/js/widget-editor.js |
The form's behaviour, shared by both pages as window.WidgetEditor (below) |
assets/js/chart.min.js |
Chart.js, loaded by the dashboard only |
lang/en/tickets.php β tickets.dashboard.*
|
Every string, including the auto-written description's sentence parts (auto_desc.*) |
Both pages load the editor as widget-editor.js?v=N. Bump N on both pages whenever the script changes, or browsers keep the old copy.
One IIFE that exposes window.WidgetEditor:
| Function | Called by | What it does |
|---|---|---|
init(apiBase) |
both pages, once on load | Loads departments and wires the form's change handlers |
populateForm(widget) |
the cog, library Edit | Fills the form from a widget, then calls onPropertyChange()
|
resetForm() |
library New widget | Clears the form, then calls onPropertyChange()
|
onPropertyChange() |
the two above, and the What to count dropdown | Rebuilds the Series and Chart type options and shows or hides Time grouping to suit the property |
collectFormData() / validateForm()
|
saveWidget() |
Reads the form into the save payload; a time property must have a grouping |
saveWidget() |
the modal's and the library's Save | Posts to save_ticket_dashboard_widget.php, returns {success, widget} or {success:false, error}
|
generateDescription() |
as the form changes | Writes the automatic description as one translated sentence, until the analyst types their own |
The rules that decide what the form offers:
-
TIME_AGGREGATES=created,closed,created_vs_closed- these need a Time grouping (day,month,year). -
SERIES_RULES- which breakdown each property allows.statuscannot be broken down by status;first_time_fix,training_providedandcreated_vs_closedtake no series. -
getValidChartTypes()- with a series or a time property, bar or line; otherwise bar, doughnut or pie.
The server repeats these lists in save_ticket_dashboard_widget.php ($allowed_properties, $allowed_chart_types, $allowed_series, $allowed_date_ranges, $allowed_groupings). Adding a property, range or grouping means changing both, plus get_ticket_widget_data.php which has to know how to count it.
TRAP: the escape helper in this file is
escapeHtml(), notesc(). Many FreeITSM scripts callesc(), so it is the name your fingers type. Here it does not exist, andonPropertyChange()- which every open-the-form path calls - threwesc is not definedand stopped the modal opening (#260).tests/escape-helpers-quotes.phpnow fails any script inassets/js/that callsesc()without defining or importing it.
cog button onclick="openWidgetEditModal(id)" tickets/dashboard/index.php
ββ WidgetEditor.populateForm(widget) assets/js/widget-editor.js
ββ onPropertyChange() rebuilds Series / Chart type
ββ #widgetEditModal.classList.add('active') the modal appears
The modal is added after populateForm() returns. So any exception inside populateForm() or onPropertyChange() leaves the page looking as if the click did nothing. The only sign is in the browser console. When the cog "does nothing", open the console first.
On Save, handleWidgetSave() copies the saved fields onto the card's in-memory widget and redraws that one card. It does not reload the page.
Every one starts with requireModuleAccessJson('tickets'). There is no admin check: any analyst with Tickets access can create, edit or delete library widgets.
| Endpoint | Table touched | Scope |
|---|---|---|
get_ticket_dashboard.php |
reads both, WHERE analyst_id = ? AND is_active = 1
|
personal |
add_ticket_dashboard_widget.php |
INSERT IGNORE into analyst_ticket_dashboard_widgets
|
personal |
remove_ticket_dashboard_widget.php |
DELETE ... WHERE analyst_id = ? AND widget_id = ? |
personal |
reorder_ticket_dashboard_widgets.php |
UPDATE sort_order ... WHERE analyst_id = ? |
personal |
get_ticket_widget_library.php |
reads ticket_dashboard_widgets WHERE is_active = 1
|
shared |
save_ticket_dashboard_widget.php |
UPDATE or INSERT on ticket_dashboard_widgets
|
shared - the cog edits everyone's copy |
delete_ticket_dashboard_widget.php |
removes it from every dashboard, then is_active = 0
|
shared, soft delete |
get_ticket_widget_data.php |
reads tickets
|
the numbers for one card |
It takes widget_id and an optional status, reads the widget's definition, then builds one WHERE that every chart path shares:
- the date range (
buildDateRangeWhere()), on the created or closed date as the property needs; - the department filter (
buildDepartmentWhere(), the widget's JSON list of ids); - the status, if the widget allows it, otherwise its
default_status; -
the company scope -
ticketTenantFilter()for the analyst's active company. It is a no-op with one company; -
t.deleted_datetime IS NULL, so trashed tickets never count.
Then one of three paths: categorical (getCategoricalData()), categorical with a series (getCategoricalWithSeries()), or time-based, which fills in every day, month or year in the range with getTimeLabels() so empty periods draw as zero rather than vanishing. Time labels are formatted with DateFmt, so they follow the analyst's date format.
ticket_dashboard_widgets - the library. title (100), description (255), chart_type, aggregate_property, series_property, is_status_filterable, default_status, date_range, department_filter (JSON array of department ids), time_grouping, display_order, is_active (soft delete), is_demo. Seeded with the stock widgets in database/freeitsm.sql.
analyst_ticket_dashboard_widgets - one row per analyst per widget. UNIQUE (analyst_id, widget_id), so adding twice is harmless. sort_order, status_filter, is_demo. It is in the analyst lifecycle map as personal, so the rows go with the analyst.
- Editing is shared, not personal. The help says the cog lets you "customise" a widget, but saving changes the library row for everyone who uses it. To change a widget just for yourself, Duplicate it in the library and add the copy.
-
The status dropdown on a card is not remembered. It reloads that card's numbers, but nothing writes
analyst_ticket_dashboard_widgets.status_filter, so after a refresh the card is back to All statuses. The column is read but never written.
-
php tests/escape-helpers-quotes.php- includes theesc()check. - In a browser, with the console open: click a cog, then in the library click New widget and Edit. All three go through
onPropertyChange(). Change What to count to a time property and back, and Save. - Bump
widget-editor.js?v=on both pages.
- Tickets β Dashboard
- #260 The dashboard cog did nothing
- Escaped text could leave its attribute - why every helper escapes quotes
- Code traps
FreeITSM β an open-source IT Service Management platform Β· github.com/edmozley/freeitsm Β· MIT licence
- Installation
- β° Scheduled tasks (cron jobs)
-
Architecture
- β³ π§Ή Root folder tidy (URL routing)
- β³ π Database Integrity (FKs & constraints)
- β³ π οΈ Database Verification β Developer Guide
- β³ π§© Service Layer (UI + API share code)
- β³ πͺ€ Code traps (the TRAP: comments)
- β³ π Commenting for the Engineering wiki
- β³ π οΈ Engineering wiki scanner - Developer Guide
- β³ π Service-Layer progress
- π€ Contributing (read before a pull request)
- π§ͺ Developer tests
- π PDF exports moved to PDFKit (#254)
- AI Providers
- Internationalisation (i18n)
- Timezones & Time Handling
- π Date & Time Formats
- π± Currencies
- π§ The sidebar (optional module rail)
- π§© Preference templates
- π Display order (modules, Watchtower cards) β Developer Guide
- Theming & Dark Mode
- ποΈ Recent β getting back to what you were doing
- β¨οΈ Command palette (βK)
- π Searching inside tickets
- π Attached documents
-
MobileβFriendly
- β³ π« Mobile: Tickets
- β³ π» Mobile: Assets
- β³ π Mobile: Calendar
- β³ π Mobile: Knowledge
- β³ π¦ Mobile: Service Status
- β³ πΌ Mobile: Watchtower
- β³ π§© Mobile: Problem Management
- β³ π Mobile: Change Management
- β³ πΏ Mobile: Software
- β³ β Mobile: Tasks
- β³ π Mobile: Forms
- β³ π Mobile: Contracts
- β³ π Mobile: Domains
- β³ π Mobile: People
- β³ π Mobile: Projects
- β³ ποΈ Mobile: Files
- β³ π Mobile: LMS
- β³ πΊοΈ Mobile: CMDB
- β³ πΊοΈ Mobile: Network Mapper
- β³ π§ Mobile: Process Mapper
- β³ βοΈ Mobile: Workflow
- β³ π₯οΈ Mobile: System
- β³ π Mobile: Reporting
- β³ π Mobile: System Wiki
- β³ π Mobile: Self-Service Portal
- β³ π§° Mobile: Techniques & Tricks
-
Security
- Layer 1 β which modules you can enter
- β³ π§© Module Access Control
- β³ π οΈ Module Access β Developer Guide
- β³ π Switching modules off
- β³ π οΈ Module availability β Developer Guide
- β³ π Module availability β design (#217)
- Layer 2 β what you can administer
- β³ π Roles & Permissions
- β³ π οΈ Roles β Developer Guide
- β³ π€ Why capabilities are constants
- Layer 3 β the System module
- β³ π Admin Access Control
- Hardening
- β³ π Security review response 2026-08
- β³ π‘οΈ Security hardening 2026-08
- β³ π οΈ Security hardening 2026-08 β Developer Guide
- β³ π‘οΈ Round three β plain English
- β³ π οΈ Round three β Developer Guide
- β³ π‘οΈ CSRF protection (S4) β Developer Guide
- Single Sign-On (SSO)
- ποΈ LDAP & Active Directory
-
π¦ Microsoft Entra ID
- β³ π₯ Importing people and groups
- β³ π» Intune: assets to their primary user
- β³ π’ Organisation chart
- β³ π οΈ Entra directory sync β Developer Guide
- β³ π οΈ Entra import - review (#235)
- β³ π οΈ Entra follow-ups - review (#237-#240)
- β³ π οΈ Intune primary user - review (#236)
- β³ π οΈ Organisation chart - review (#242)
- π CardDAV contact sync
- Browser Extension
- API Reference
-
π REST API β how it works
- β³ π Proposal: custom fields, inventory import and change evidence (#194)
- β³ π οΈ Custom fields, evidence + inventory - review (#195-#197)
- β³ π οΈ Long forms in a task's Work view - review (#198)
- β³ π οΈ Empty Procedures fold - review (#247)
- β³ π« REST API: Tickets
- β³ π» REST API: Assets
- β³ π΄ REST API: Problems
- β³ π REST API: Changes
- β³ π REST API: Knowledge
- β³ β REST API: Tasks
- β³ ποΈ REST API: CMDB
- β³ π REST API: Contracts
- β³ ποΈ REST API: Calendar
- β³ πΏ REST API: Software
- β³ π REST API: Domains
- β³ π¦ REST API: Service Status
- β³ βοΈ REST API: Morning Checks
- β³ π REST API: Forms
- β³ βοΈ REST API: Workflow
- β³ π·οΈ REST API: Cost centres
- β³ π§βπΌ REST API: Analysts
- β³ πΊοΈ REST API: Network Mapper
- β³ π§ Using the API docs page
- β³ π OpenAPI specification
- β³ β OpenAPI: kept correct
- β³ π οΈ Maintaining the catalogue
- Watchtower
-
Tickets
- β³ π οΈ Inbox.js map β Developer Guide
- β³ π οΈ Floating windows & the file viewer β Developer Guide
- β³ π οΈ Tickets settings β Developer Guide
- β³ π Simpler ticket and task forms - design (#218)
- β³ ποΈ The ticket workspace
- β³ π The ticket table
- β³ π Rota copy and paste β Developer Deep Dive
- β³ β Checklists & SOPs
- β³ βοΈ Mandatory fields
- β³ π§Ύ Custom ticket fields
- β³ π·οΈ Ticket categories
- β³ π§Ύ A type for every new ticket
- β³ π₯ Assigning tickets to a team, and escalation
- β³ π’ One board across every company
- β³ π Ticket dashboard β Developer Guide
- β³ Mailbox Authentication
- β³ π€ Email send log
- β³ π Attachment size limits and large emails
-
β³ Basic IMAP mailboxes
- β³ π Basic IMAP without the PHP extension (#257)
- β³ π οΈ Basic IMAP client β Developer Guide
- β³ π§ͺ Basic IMAP client β Testing and verifying
- β³ π οΈ Verifying a mail folder β Developer Guide
- β³ π οΈ Mailbox providers β Developer Guide
- β³ π οΈ How Gmail mail collection works β Developer Guide
- β³ Email rendering & images
- β³ SLA Management
- β³ WhatsApp channel
-
β³
βοΈ Telegram channel - β³ β CSAT company scope and filters β Developer Guide
- β³ π₯ Microsoft Teams channel
- β³ π¨οΈ Mattermost channel
- β³ π¬ Web chat channel
- β³ π£ Slack channel
- β³ π Linking tickets
- β³ β Record previews
- β³ π Ticket notes: internal or shared
- β³ ποΈ Canned responses
- β³ βοΈ Limiting replies to particular senders
- β³ π¨ Telling the analyst a ticket is theirs
- β³ βοΈ Email signatures
- β³ π The public web address
- β³ π’ Ticket numbering
- β³ π Raising a ticket for someone else
- β³ π Merging tickets
- β³ π Confidential tickets
- β³ π₯ Portal managers
- β³ π Who has seen a ticket
- β³ π Reading long tickets
- β³ β Splitting tickets
- β³ β Selecting several tickets
- β³ ποΈ The folder pane
- β³ π½ Just my tickets, or no closed ones
- β³ π οΈ Snoozing tickets β Developer Guide
- β³ π₯ Collision detection
- β³ β±οΈ Time tracking
- β³ π Case reports - a ticket and its work as one PDF
- β³ π Scheduled work in your own calendar
- Problem Management
-
Tasks
- β³ π οΈ Task board and subtasks β Developer Guide
- β³ π§βπ€βπ§ People on a task ("Involved")
- β³ π Repeating tasks
- β³ π’ Moving a task between companies
- π Projects
-
Assets
- β³ π’ Moving an asset between companies
- β³ π Shared asset locations
- β³ π§βπΌ Assigning assets to analysts
- β³ π Warranty and lease alerts
- β³ π Leases
- β³ π Saved table views
- β³ π¨οΈ Recording anything, and importing it
- β³ π§© Asset type layouts
- β³ π Inventory freshness
- β³ π Linked configuration item
- β³ π Connected assets
- β³ π Asset review
-
β³ π·οΈ QR asset labels
- β³ π οΈ QR asset labels β Developer Guide
- β³ π Asset label designer - design (#229)
- β³ π· Asset scanning β Developer Guide
- β³ π οΈ Asset tag numbering β Developer Guide
- β³ π οΈ Asset reconciliation β Developer Guide
- β³ π οΈ Reconciliation, tags + labels - review (#164)
- β³ π Who holds what, and handover documents
- β³ π₯οΈ The inventory agent (PowerShell)
- β³ ποΈ Proxmox VE servers
- β³ βοΈ VMware Cloud Director servers
- β³ πͺ Hyper-V and Failover Clusters
- β³ π Linking equipment to tickets
- β³ βοΈ Follow-up tasks on a ticket
- Knowledge
- Change Management
- Calendar
- Morning Checks
- Reporting
- Software
-
Forms
- β³ π¨ The form designer β Developer Guide
- β³ π Layout & the grid β Developer Guide
- β³ ποΈ Collections β grouping submissions
- β³ π Submissions as PDFs
- β³ β‘ What happens next β a form's own actions
- β³ π οΈ Sections & conditional logic β Developer Guide
- β³ π οΈ Lookup fields β Developer Guide
- β³ π‘οΈ Catalogue request approvals
- People
- Starters & leavers
- Domains
- ποΈ Files
- Contracts
- Service Status
- π Notifications
- π¨ War Room
- Self-Service Portal
- LMS
- Process Mapper
- CMDB
- Network Mapper
- Workflows
- Issue trackers (Jira, Azure DevOps)
- π‘ Zabbix (monitoring)
- π¬ Microsoft Teams alerts
- π 3CX (phone system)
-
System
- β³ π οΈ Preferences β Developer Guide
- β³ π Finding people in the Analysts list
- β³ πͺ When an analyst leaves
- β³ π οΈ System β Branding β Developer Guide
- β³ π©Ί Page health (D019) β Developer Guide
- β³ β Feature Bingo
- β³ π·οΈ Cost centres
- β³ π· Photo Album
- β³ Demo Data
- β³ π οΈ Demo Data β Developer Guide
-
Overview
- β³ π Progress tracker
- β³ Concepts & vocabulary
- β³ Email routing & mailboxes
- β³ Settings: global vs per-company
- β³ Users & self-service
- β³ Staff cross-company access
- β³ One company supporting another
- β³ π’ One board across every company
- β³ Worked examples
- β³ Pitfalls & gotchas
- β³ Scope: what it's for
- β³ π οΈ Developer Guide (make a module multi-company)
- β³ ποΈ Case study: CMDB (a linked graph)
- β³ π§ͺ Test harness (prove it's isolated)
- What this is
-
π Bugs resolved
- β³ π #254 PDFs could not print Polish
- β³ π #250 Clicking a folder left the open article on screen
- β³ π« #260 The dashboard cog did nothing
- β³ π« #248 A department rule never matched on four routes
- β³ π A directory account could be matched to someone else
- β³ π« #244 Reply went to the assigned analyst
- β³ π A lookup answer could name any record
- β³ π« #227 A mailbox could not be deleted
- β³ π« #226 A picture on a note could not be closed
- β³ π» #222 The Assets page never loaded in 4.3.0
- β³ βοΈ #214 A "contains" condition did not match capitals
- β³ βοΈ #216 A workflow email from a chosen mailbox always failed
- β³ π³ The Docker image was missing PHP extensions
- β³ π A failed DNS lookup read as a missing record
- β³ π A link could change data
- β³ π Access outlived its removal
- β³ π Knowledge articles could run scripts
- β³ π Knowledge writes ignored permissions
- β³ π Company boundaries (Oct 2026)
- β³ π Smaller gaps (Oct 2026)
- β³ π Escaped text could leave its attribute
- β³ π Task descriptions were not cleaned
- β³ π Task documents ignored company scope
- β³ π Repeating tasks ignored company scope
- β³ π¬ #183 Mailbox checks overlapped
- β³ π #188 Transfer lock shown off when unknown
- β³ β #184 Subtask names and Overdue
- β³ π§© #186 Teams: the buttons did nothing
- β³ π Text in a change could run script
- β³ π AI settings changed without the AI permission
- β³ πͺ #178 Deleting an analyst failed
- β³ π« A team with no departments showed 0 tickets
- β³ π Projects: adding a phase did nothing on Save
- β³ π Leavers could still sign in
- β³ πΌοΈ Logo and courses broke on Apache with PHP-FPM
- β³ π’ Chat tickets ignored your ticket numbering
- β³ π Dates shown as a dash, or in server time
- β³ π Assets β Users showed people from other companies
- β³ π Restricted analysts could read other modules' data
- β³ πΌοΈ Replies with a picture in the thread failed to send
- β³ π Reply attachments never reached the customer
- β³ π οΈ Outbound email attachments β Developer Guide
- β³ π A global SSO provider was missing from the portal
- β³ π Behind a proxy, the SSO redirect said http
- β³ βοΈ The portal tagline moved when you saved it
- β³ π¨ The portal settings screen forgot what you saved
- β³ π‘οΈ The approvals inbox said "Error" and nothing else
- β³ π A table's answers were missing from the PDF
- β³ β A single-select column let you tick every option
- β³ π The portal ignored a form's field widths
- β³ π The tasks board stopped taking clicks
- β³ ποΈ #121 The index list is out of date after upgrading
- β³ π #133 The calendar subscription was empty
- β³ π #131 Tasks always reopened on the board
- β³ π₯ #129 Every page returned HTTP 500 after upgrading
- β³ π³ #127 A PHP warning above the System page
- β³ π #126 Notes stamped with the server's clock
- β³ π Storing every date in UTC
- β³ πͺ The portal was down for everyone signed in
- β³ βοΈ #120 Workflow notes could never be written
- β³ βοΈ #123 Three errors when running Database Verification
- β³ π #122 The description box was a stub in the corner
- β³ π£ Demo data deleted real accounts
- β³ π #117 Sign-in redirected to the wrong address
- β³ π¨ #108 The priority dot was invisible
- β³ β±οΈ #116 Time logged from the right-click menu
- β³ π #114 API keys refused by our own guard
- β³ ποΈ #110 Assigning a task told nobody
- β³ πͺ #107 Signed out while still working
- β³ π #103 "Share with Requester" reached nobody
- β³ π #102 Search found nothing for hyphens
- β³ πͺ #101 Source code editor opened behind
- β³ βοΈ #88 Subtasks could not be ticked off
- β³ π» #84 Asset deep link selected nothing
- β³ π« #79 A new ticket arrived with no status
- β³ π§ #79 A ticket from email did not say so
- β³ π #78 Bell opened to nothing
- β³ π¬ #77 Mail only collected from Inbox
- β³ π #74 The default password could not be changed
- β³ π¦ #70 Renaming an impact level
- β³ π€ #67 App-only mailboxes could not send
- β³ π #45 Verify only ever worked for Microsoft
- β³ π #45 IMAP reported as not authenticated
- β³ βοΈ An email template stopped escaping itself
- β³ π The portal dashboard showed the wrong time
- β³ π’ The folder said 99 and the list showed 96