More Client Enforcement in modals across the app

2026-07-23 00:40:45 +00:00 · 2026-07-16 13:33:17 -04:00
parent 2c09ce097c
commit 1251944dcc
10 changed files with 106 additions and 68 deletions
--- a/agent/modals/contact/contact_link_asset.php
+++ b/agent/modals/contact/contact_link_asset.php
@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);

+enforceClientAccess();
+
 ob_start();

 ?>
--- a/agent/modals/contact/contact_link_document.php
+++ b/agent/modals/contact/contact_link_document.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);

-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();

 ?>
--- a/agent/modals/contact/contact_link_file.php
+++ b/agent/modals/contact/contact_link_file.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);

-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();

 ?>
--- a/agent/modals/contact/contact_link_service.php
+++ b/agent/modals/contact/contact_link_service.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);

-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();

 ?>
--- a/agent/modals/contact/contact_link_software.php
+++ b/agent/modals/contact/contact_link_software.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);

-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_add_watcher.php
+++ b/agent/modals/ticket/ticket_add_watcher.php
@@ -2,12 +2,19 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));

+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();

 ?>
+
 <div class="modal-header bg-dark">
    <h5 class="modal-title"><i class="fa fa-fw fa-eye mr-2"></i>Adding a ticket Watcher</h5>
    <button type="button" class="close text-white" data-dismiss="modal">
@@ -65,4 +72,5 @@ ob_start();
 </form>

 <?php
+
 require_once '../../../includes/modal_footer.php';
--- a/agent/modals/ticket/ticket_reply_redact.php
+++ b/agent/modals/ticket/ticket_reply_redact.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_reply_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies
@@ -14,7 +16,10 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_reply = escapeHtml($row['ticket_reply']);
 $client_id = intval($row['ticket_client_id']);

-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();

 ?>
@@ -28,7 +33,6 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
    <input type="hidden" name="ticket_reply_id" value="<?php echo $ticket_reply_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">

    <div class="modal-body">

--- a/agent/modals/ticket/ticket_task_approver_add.php
+++ b/agent/modals/ticket/ticket_task_approver_add.php
@@ -2,82 +2,89 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $task_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tasks
+    LEFT JOIN tickets ON task_ticket_id = ticket_id
    WHERE task_id = $task_id
    LIMIT 1"
 );

 $row = mysqli_fetch_assoc($sql);
 $task_name = escapeHtml($row['task_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>

-    <div class="modal-header bg-dark">
-        <h5 class="modal-title"><i class="fa fa-fw fa-shield-alt mr-2"></i>New approver for task <?=$task_name?></h5>
-        <button type="button" class="close text-white" data-dismiss="modal">
-            <span>&times;</span>
-        </button>
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fa fa-fw fa-shield-alt mr-2"></i>New approver for task <?=$task_name?></h5>
+    <button type="button" class="close text-white" data-dismiss="modal">
+        <span>&times;</span>
+    </button>
+</div>
+<form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
+    <input type="hidden" name="task_id" value="<?php echo $task_id; ?>">
+
+    <div class="modal-body">
+
+        <div class="form-group">
+            <label>Approval scope <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-layer-group"></i></span>
+                </div>
+                <select class="form-control" name="approval_scope" id="approval_scope" required>
+                    <option value="">Select scope...</option>
+                    <option value="internal">Internal</option>
+                    <option value="client">Client</option>
+                </select>
+            </div>
+        </div>
+
+
+        <div class="form-group d-none" id="approval_type_wrapper">
+            <label>Who can approve? <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-user-check"></i></span>
+                </div>
+                <select class="form-control" name="approval_type" id="approval_type" required>
+                    <!-- JS -->
+                </select>
+            </div>
+        </div>
+
+
+        <div class="form-group d-none" id="specific_user_wrapper">
+            <label>Select specific internal approver <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-user-circle"></i></span>
+                </div>
+                <select class="form-control select2" name="approval_required_user_id" id="specific_user_select">
+                    <option value="">Select user...</option>
+                </select>
+            </div>
+        </div>
+
+
    </div>
-    <form action="post.php" method="post" autocomplete="off">
-        <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
-        <input type="hidden" name="task_id" value="<?php echo $task_id; ?>">

-        <div class="modal-body">
+    <div class="modal-footer">
+        <button type="submit" name="add_ticket_task_approver" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Save</button>
+        <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
+    </div>

-            <div class="form-group">
-                <label>Approval scope <strong class="text-danger">*</strong></label>
-                <div class="input-group">
-                    <div class="input-group-prepend">
-                        <span class="input-group-text"><i class="fa fa-fw fa-layer-group"></i></span>
-                    </div>
-                    <select class="form-control" name="approval_scope" id="approval_scope" required>
-                        <option value="">Select scope...</option>
-                        <option value="internal">Internal</option>
-                        <option value="client">Client</option>
-                    </select>
-                </div>
-            </div>
-
-
-            <div class="form-group d-none" id="approval_type_wrapper">
-                <label>Who can approve? <strong class="text-danger">*</strong></label>
-                <div class="input-group">
-                    <div class="input-group-prepend">
-                        <span class="input-group-text"><i class="fa fa-fw fa-user-check"></i></span>
-                    </div>
-                    <select class="form-control" name="approval_type" id="approval_type" required>
-                        <!-- JS -->
-                    </select>
-                </div>
-            </div>
-
-
-            <div class="form-group d-none" id="specific_user_wrapper">
-                <label>Select specific internal approver <strong class="text-danger">*</strong></label>
-                <div class="input-group">
-                    <div class="input-group-prepend">
-                        <span class="input-group-text"><i class="fa fa-fw fa-user-circle"></i></span>
-                    </div>
-                    <select class="form-control select2" name="approval_required_user_id" id="specific_user_select">
-                        <option value="">Select user...</option>
-                    </select>
-                </div>
-            </div>
-
-
-        </div>
-
-        <div class="modal-footer">
-            <button type="submit" name="add_ticket_task_approver" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Save</button>
-            <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
-        </div>
-
-    </form>
+</form>


 <!-- JS to make the correct boxes appear depending on if internal/client approval) -->
--- a/agent/modals/ticket/ticket_task_edit.php
+++ b/agent/modals/ticket/ticket_task_edit.php
@@ -2,9 +2,11 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $task_id = intval($_GET['id']);

-$sql = mysqli_query($mysqli, "SELECT * FROM tasks
+$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON task_ticket_id = ticket_id
    WHERE task_id = $task_id
    LIMIT 1"
 );
@@ -13,6 +15,11 @@ $row = mysqli_fetch_assoc($sql);
 $task_name = escapeHtml($row['task_name']);
 $task_completion_estimate = intval($row['task_completion_estimate']);
 $task_completed_at = escapeHtml($row['task_completed_at']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}

 // Approvals
 $sql_task_approvals = mysqli_query($mysqli, "
@@ -22,7 +29,6 @@ $sql_task_approvals = mysqli_query($mysqli, "
    ORDER BY approval_approved_by"
 );

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>
--- a/agent/post/ticket.php
+++ b/agent/post/ticket.php
@@ -1943,7 +1943,14 @@ if (isset($_POST['redact_ticket_reply'])) {
    $ticket_reply_id = intval($_POST['ticket_reply_id']);
    $ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']);

-    $client_id = intval($_POST['client_id']);
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM ticket_replies
+        LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id
+        WHERE ticket_reply_id = $ticket_reply_id
+        LIMIT 1"
+    );
+
+    $row = mysqli_fetch_assoc($sql);
+    $client_id = intval($row['ticket_client_id']);

    // Don't Enforce Client Access if Ticket doesn't have an assigned client
    if ($client_id) {