From 107ba106892385bbb70e614fe51f2761cc5a6a50 Mon Sep 17 00:00:00 2001
From: Gabriele Cimaschi <gabriele.cimaschi@pharmaidea.com>
Date: Fri, 18 Sep 2026 18:00:20 +0200
Subject: [PATCH] fix: corretta chiamata che provocava un errore su postgres.

---
 routes/tickets.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/routes/tickets.js b/routes/tickets.js
index 24745ad..b9b0c71 100644
--- a/routes/tickets.js
+++ b/routes/tickets.js
@@ -1915,6 +1915,9 @@ router.delete('/articles/:articleId', async (req, res) => {
 router.get('/attachments/:id', async (req, res) => {
   try {
     const { id } = req.params;
+    if (!/^\d+$/.test(id)) {
+      return res.status(404).send('Allegato non trovato.');
+    }
     const result = await pool.query(
       `SELECT filename, content_type, content
        FROM article_data_mime_attachment
@@ -1987,6 +1990,9 @@ router.get('/attachments/:id', async (req, res) => {
 router.put('/attachments/:id', async (req, res) => {
   try {
     const { id } = req.params;
+    if (!/^\d+$/.test(id)) {
+      return res.status(404).json({ error: 'Allegato non trovato' });
+    }
     const { content } = req.body;
     if (typeof content !== 'string') {
       return res.status(400).json({ error: 'Contenuto non valido' });
@@ -2016,6 +2022,9 @@ router.put('/attachments/:id', async (req, res) => {
 router.post('/attachments/:id/open', async (req, res) => {
   try {
     const { id } = req.params;
+    if (!/^\d+$/.test(id)) {
+      return res.status(404).json({ error: 'Allegato non trovato' });
+    }
     const result = await pool.query(
       `SELECT filename, content_type, content FROM article_data_mime_attachment WHERE id = $1`,
       [id]