Help Desk & Support Tickets for OpenCart

Overview

A help desk inside your OpenCart 4.1 store. Customers open tickets from their account, from an order page or without an account; your team answers from the admin panel. Departments, priorities, statuses, canned replies, staff assignment, order linking, SLA timers in your shop time zone and a satisfaction rating are included. Everything stays in your own database.

• Tickets in the account: a "Support tickets" entry in My Account, a "Get help with this order" button on every order page and an optional "Support" link in the footer
• Guests too: no account needed. A private link, signed on the server, opens exactly one ticket. A lost link is renewed by e-mail to the address on the ticket; the old link stops working
• Departments, priorities, statuses: five statuses (open, answered, on hold, solved, closed), four priorities, departments with their own notice e-mail
• Staff tools: queue with status tabs and filters, assignment, internal notes the customer never sees, canned replies with the customer's name and the ticket number filled in, other tickets of the same customer one click away
• Order linking: customers pick one of their own orders; the order page in the admin lists its tickets
• SLA timers: hours for the first response and for the resolution per priority, counted in the shop time zone, optionally only in business hours. Overdue tickets stand out in the queue
• Satisfaction rating: 1 to 5 stars and a comment after a ticket is solved, one rating per ticket, average in the queue
• Safe attachments: file type allow-list, size limit and a content check; files are stored in OpenCart's storage folder under random names and served only to people who may see the ticket
• Spam protection: form token, honeypot, minimum fill-in time, limits per IP address and hour, open ticket limit
• E-mail notices through the store's mail settings: confirmation, staff notice, replies, solved
• Privacy: tickets are deleted with the customer account; export or erase everything about one e-mail address; optional automatic deletion of old closed tickets
• No OCMOD and no core file changes: OpenCart events and an hourly cron entry
• OpenCart 4.1.0.x

Installation

Requirements: OpenCart 4.1.0.x, PHP 7.4 or newer with the mbstring and fileinfo extensions, a working mail setting (System > Settings > Mail) if you want e-mail notices.

1. In the OpenCart admin open Extensions > Installer, upload kv_support_tickets.ocmod.zip and click Install.
2. Open Extensions > Extensions, choose Modules, find Help Desk & Support Tickets, click the green Install button, then the blue pencil.
3. Installing creates the tables, registers the events and the hourly cron entry, gives your admin group access to the ticket pages and adds a Support menu to the admin panel. Three departments (Sales, Orders and shipping, Technical support) and one canned reply are created the first time; you can change or delete them.
4. Open the settings and check the tabs: General (guest tickets, order link, notice address), Attachments, Spam protection, SLA timers and Life cycle. Switch Status on.
5. Give other admin user groups access in System > Users > User Groups: extension/kv_support_tickets/support/tickets for agents, extension/kv_support_tickets/support/setup for departments and canned replies, extension/kv_support_tickets/module/kv_support_tickets for the settings.
6. Check System > Settings > Local > Time zone: SLA clocks and all dates follow it.
7. Make sure the OpenCart cron job runs (php /path/to/cron.php), or call the address shown on the Life cycle tab every hour. It closes old solved tickets and applies the retention. Without a cron job the admin panel does this once an hour while somebody is signed in.

The storage folder of OpenCart holds the attachments in storage/kv_support_tickets/. OpenCart's web installer puts that folder inside the web root until you move it, so move it outside the web root as OpenCart recommends (see the OpenCart installation guide). The extension writes an .htaccess lock there for Apache and uses random file names; on nginx close the folder in the server configuration.

Uninstall: Extensions > Modules > Uninstall removes the events, the cron entry and the permissions. It keeps tickets, messages, files and your settings, because OpenCart 4 updates an extension by uninstalling and installing it again. To remove everything, use Data and privacy > Delete all data first.

Update (OpenCart 4.1): Extensions > Modules > Uninstall, then Extensions > Installer: Uninstall and Delete the old entry, upload the new zip, Install, and Extensions > Modules > Install. Tickets and settings are restored; open the settings page once so database changes of the new version run.

Configuration

Extensions > Extensions > Modules > Help Desk & Support Tickets

General

• Status: switches the storefront part on or off. The admin pages stay available
• Tickets without an account: guests get a private link by e-mail. Off = guests are sent to sign in
• Link an order: signed-in customers may link one of their own orders
• Footer link: adds "Support" to the information links in the footer
• E-mail the customer / the assigned staff member: notice switches
• Satisfaction rating: the stars on solved tickets
• Notice address: receives new-ticket notices when a department has no address of its own. Empty = the store e-mail. The extension never sends to any other fixed address: recipients are the customer's address on the ticket, the department address, this address, the store e-mail and the e-mail of the staff member a ticket is assigned to

Attachments

Files per message (1 to 10), largest file (1 to 25 MB) and the allowed types. The list can only be narrowed: jpg, jpeg, png, gif, webp, pdf, txt, csv, log, zip, doc, docx, xls, xlsx. SVG, HTML and scripts can never be uploaded. Every file is checked for its name, size and real content type.

Spam protection

• Honeypot and timing check: a hidden field and a minimum fill-in time (default 3 seconds)
• New tickets per IP and hour, replies per IP and hour, open tickets per customer or e-mail address, lost-link requests per IP and hour. No raw IP address is stored: limits use a salted hash

SLA timers

Hours for low, normal, high and urgent priority, for the first response and for the resolution. 48,24,8,2 means 48 hours for low, 24 for normal, 8 for high and 2 for urgent. 0 = no target. Business hours only counts only the chosen weekdays (1 = Monday to 7 = Sunday) between the From and To time. All of it runs in the shop time zone. The first staff reply stops the first-response clock; solving the ticket stops the resolution clock. Changing the priority of a ticket recalculates its targets from the day it was opened.

Life cycle

• Close solved tickets after (days): 7 by default, 0 = never
• Customer may answer a solved ticket for (days): a reply reopens it; after this time the customer opens a new ticket
• Delete closed tickets after (days): 0 = keep
• Scheduled task URL: for a cron service when OpenCart's own cron is not used

Data and privacy

Download a JSON export of everything stored for an e-mail address, erase it, or delete all data of the extension (type DELETE). Deleting a customer account in the admin or by the customer deletes the customer's tickets, messages and files, and guest tickets of the same e-mail address.

Departments and canned replies

Support > Departments & canned replies. A department has a name, a description, an optional notice e-mail, a sort order and a status. Canned replies are ready answers for all departments or one; {customer_name}, {ticket_id} and {agent_name} are filled in when the reply is inserted.

Usage

Customers

• My Account > Support tickets lists the customer's tickets. New ticket asks for a department, priority (low to high), an optional order, subject, message and optional files. The customer's own name and e-mail address are used
• Get help with this order on an order page opens the form with that order selected
• A ticket page shows the conversation, the files, the status and a reply box. Mark as solved closes the question from the customer's side; a reply to a solved ticket reopens it inside the reopen window
• Solved tickets show a star rating with an optional comment, once
• A signed-in customer sees only their own tickets. Any other ticket number gives the same "not found" page as a number that does not exist

Guests

• Support (footer) > New ticket: name, e-mail, department, message. The confirmation e-mail holds a private link; the page after sending carries it too
• The link opens one ticket, shows the conversation and takes replies and the rating. Whoever has the link can read the ticket: tell customers not to forward the e-mail
• Lost the link? The guest enters the ticket number and the e-mail address. If they match, a new link goes to that address and the old one stops working. The answer on the page is the same either way

Staff

• Support > Tickets shows the active tickets, oldest waiting first. Tabs per status, filters for text (#123, e-mail, subject), department, assignee, priority and overdue. A coloured edge marks tickets that wait for staff. The SLA columns show the time left, or the overdue time in red
• A ticket page has the conversation, a reply box, a status select and the details column: customer, linked order, due times, rating, status, priority, department and assignee. The first reply assigns an unassigned ticket to the person who answered
• Internal note keeps the text and its files hidden from the customer; no e-mail goes out
• Insert a canned reply adds the text to the box so you can edit it before sending
• Set status after sending: answered by default; choose solved to ask the customer for a rating
• Staff open a customer's other tickets, their order and their customer record from the details column
• The order page in the admin lists the tickets linked to that order
• Deleting a ticket removes its messages and files

E-mails

Confirmation to the customer, a notice to staff for each new ticket and each customer reply, the staff reply to the customer, "solved" with a rating link and the lost-link mail. All go through the mail settings of the store. Replies to tickets from signed-in customers link to the ticket page in the account (the customer signs in first); guests get their private link.

FAQ

Can a customer see another customer's ticket?

No. Account tickets open only for the signed-in owner. Guest tickets open only through their private link, which is computed on the server (HMAC with secrets that are not in the database) and cannot be guessed. A wrong number, a wrong link and somebody else's ticket all give the same "not found" page. Wrong guesses are limited per IP address.

What happens to files?

They are stored in OpenCart's storage folder under random, unguessable names (move the storage folder outside the web root as OpenCart recommends; an .htaccess lock is added for Apache, other web servers need the folder closed in their own configuration). An upload must have an allowed extension, be inside the size limit and really be what its extension says. SVG, HTML and scripts are refused, and a name like shell.php.jpg is refused too. Downloads go through the extension after the ticket was checked, with X-Content-Type-Options: nosniff; only images may display inside the page (with a sandbox policy), everything else is a download.

Is customer text safe in the admin panel?

Everything a customer writes is stripped of tags when it is stored and escaped again whenever it is shown, in the shop and in the admin panel.

Which e-mail addresses does the extension write to?

The address on the ticket, the department's address, the notice address from the settings, the store e-mail and the e-mail of the assigned staff member. Nothing else. E-mail uses the mail settings of your store; with no mail engine configured, tickets still work and nothing is sent.

Do SLA timers pause?

The first-response clock stops at the first staff reply, the resolution clock when the ticket is solved or closed. "On hold" does not pause the clock in this version.

Which time zone?

The one in System > Settings > Local. Business hours, due times and all dates use it.

Can customers write in any language?

Yes. Messages and replies are stored as typed (utf8mb4, emoji included) and cut by characters, never in the middle of a character.

What happens when I update the extension?

Uninstall keeps all tickets and your settings. Follow the update steps in the installation page; data and settings come back at the next install.

What happens when a customer deletes their account?

Their tickets, messages and files are deleted, and so are guest tickets with the same e-mail address.

Does it work with the order editor, other themes, other extensions?

It adds pages and events only; it changes no core file and no order data. It uses the default OpenCart 4 account and footer templates (it inserts a link into them through events); a theme that renders those pages very differently may need the link added by hand: the pages are index.php?route=extension/kv_support_tickets/support/desk.

What does it not do?

It does not read e-mails from an inbox, it has no live chat and no knowledge base, no merging of tickets and no automatic assignment rules. Tickets are answered in the admin panel.