diff --git a/plugins/endpoints/api/routes.py b/plugins/endpoints/api/routes.py index 1e200664..6ae60d63 100644 --- a/plugins/endpoints/api/routes.py +++ b/plugins/endpoints/api/routes.py @@ -3000,7 +3000,19 @@ def _send_operator_report_alert(report, asset_id, hostname): except Exception as e: current_app.logger.warning('Failed to generate screenshot URL: %s', e) + # Get PC access domain to build FQDN + from shopdb.core.models import Setting + pc_access_domain_setting = Setting.query.filter_by(key='pc_access_domain').first() + pc_access_domain = pc_access_domain_setting.value if pc_access_domain_setting else '' + + # Build full FQDN + if pc_access_domain and not hostname.endswith(pc_access_domain): + fqdn = f'{hostname}.{pc_access_domain}' + else: + fqdn = hostname + # HTML-escape all user-controlled values to prevent XSS + safe_fqdn = escape(fqdn) safe_hostname = escape(hostname) safe_name = escape(asset.name or hostname) safe_assetnumber = escape(asset.assetnumber or 'N/A') @@ -3012,12 +3024,9 @@ def _send_operator_report_alert(report, asset_id, hostname): machine_body_line = '' if machine_info: safe_machine_number = escape(machine_info['assetnumber'] or 'N/A') - try: - scheme = request.scheme if request else 'https' - host = request.host if request else 'localhost' - machine_url = f'{scheme}://{host}/shopdb/machines/{machine_info["assetid"]}' - except Exception: - machine_url = f'https://localhost/shopdb/machines/{machine_info["assetid"]}' + scheme = request.scheme if request else 'https' + host = request.host if request else 'localhost' + machine_url = f'{scheme}://{host}/shopdb/machines/{machine_info["assetid"]}' machine_subject_part = f' (Machine #{safe_machine_number})' machine_body_line = f'

Machine#: {safe_machine_number}

' @@ -3028,7 +3037,7 @@ def _send_operator_report_alert(report, asset_id, hostname):

Operator Issue Report

New Issue Report from Shop Floor

-

Device: {safe_hostname}

+

Device: {safe_fqdn}

{machine_body_line}

Reason: {safe_reason}

Reported: {escape(reported_at)}

@@ -3042,7 +3051,7 @@ def _send_operator_report_alert(report, asset_id, hostname):
''' - subject = f'Operator Issue Report: {safe_hostname}{machine_subject_part}' + subject = f'Operator Issue Report: {safe_fqdn}{machine_subject_part}' current_app.logger.info('Sending operator report alert for %s (report %d)', hostname, report.operatorreportid)