ticketService = $ticketService; } /** * Persists the outcome narrative. patchTicket() authorizes editor+ against the * milestone's own project, so a smuggled milestone id can't cross projects. */ public function save(): void { $milestoneId = (int) ($_POST['milestoneId'] ?? 0); $outcomeImpact = trim((string) ($_POST['outcomeImpact'] ?? '')); $this->ticketService->patchTicket($milestoneId, ['outcomeImpact' => $outcomeImpact]); $milestone = $this->ticketService->getTicket($milestoneId); $this->tpl->assign('milestone', $milestone); $this->tpl->assign('canEdit', true); $this->tpl->setNotification($this->language->__('notifications.outcome_saved'), 'success'); } }