osTicket/osTicket-1.8 — pull request #623 by protich (2014-02-27 16:01:10+00:00)
Title: Restrict access to closed tickets based on staff's access control.

Background: osTicket allows access to assigned open tickets (both personal and team assignments) regardless of the assigned department or group. This is necessary to allow staff to work on tickets in an otherwise restricted department.

When a staff member closes a ticket, they're credited (ticket.staff_id is set to staff's id) for the purpose of showing who closed the ticket. osTicket mistakenly allowed continued access to closed tickets even when the
staff doesn't have access to the ticket based on departmental access.