From 1251944dccef09a206f785d29d0a96f935257591 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 16 Jul 2026 13:33:17 -0400 Subject: [PATCH] More Client Enforcement in modals across the app --- agent/modals/contact/contact_link_asset.php | 2 + .../modals/contact/contact_link_document.php | 3 +- agent/modals/contact/contact_link_file.php | 3 +- agent/modals/contact/contact_link_service.php | 3 +- .../modals/contact/contact_link_software.php | 3 +- agent/modals/ticket/ticket_add_watcher.php | 8 ++ agent/modals/ticket/ticket_reply_redact.php | 8 +- .../ticket/ticket_task_approver_add.php | 125 +++++++++--------- agent/modals/ticket/ticket_task_edit.php | 10 +- agent/post/ticket.php | 9 +- 10 files changed, 106 insertions(+), 68 deletions(-) diff --git a/agent/modals/contact/contact_link_asset.php b/agent/modals/contact/contact_link_asset.php index 6f7fe2a4..0d90e7e9 100644 --- a/agent/modals/contact/contact_link_asset.php +++ b/agent/modals/contact/contact_link_asset.php @@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql); $contact_name = escapeHtml($row['contact_name']); $client_id = intval($row['contact_client_id']); +enforceClientAccess(); + ob_start(); ?> diff --git a/agent/modals/contact/contact_link_document.php b/agent/modals/contact/contact_link_document.php index ffef32cf..3543066d 100644 --- a/agent/modals/contact/contact_link_document.php +++ b/agent/modals/contact/contact_link_document.php @@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql); $contact_name = escapeHtml($row['contact_name']); $client_id = intval($row['contact_client_id']); -// Generate the HTML form content using output buffering. +enforceClientAccess(); + ob_start(); ?> diff --git a/agent/modals/contact/contact_link_file.php b/agent/modals/contact/contact_link_file.php index 981e93ce..6cbef2d3 100644 --- a/agent/modals/contact/contact_link_file.php +++ b/agent/modals/contact/contact_link_file.php @@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql); $contact_name = escapeHtml($row['contact_name']); $client_id = intval($row['contact_client_id']); -// Generate the HTML form content using output buffering. +enforceClientAccess(); + ob_start(); ?> diff --git a/agent/modals/contact/contact_link_service.php b/agent/modals/contact/contact_link_service.php index 74705537..d2170482 100644 --- a/agent/modals/contact/contact_link_service.php +++ b/agent/modals/contact/contact_link_service.php @@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql); $contact_name = escapeHtml($row['contact_name']); $client_id = intval($row['contact_client_id']); -// Generate the HTML form content using output buffering. +enforceClientAccess(); + ob_start(); ?> diff --git a/agent/modals/contact/contact_link_software.php b/agent/modals/contact/contact_link_software.php index bb723509..16773130 100644 --- a/agent/modals/contact/contact_link_software.php +++ b/agent/modals/contact/contact_link_software.php @@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql); $contact_name = escapeHtml($row['contact_name']); $client_id = intval($row['contact_client_id']); -// Generate the HTML form content using output buffering. +enforceClientAccess(); + ob_start(); ?> diff --git a/agent/modals/ticket/ticket_add_watcher.php b/agent/modals/ticket/ticket_add_watcher.php index 569b1bdb..9c1ddf9d 100644 --- a/agent/modals/ticket/ticket_add_watcher.php +++ b/agent/modals/ticket/ticket_add_watcher.php @@ -2,12 +2,19 @@ require_once '../../../includes/modal_header.php'; +enforceUserPermission('module_support', 2); + $ticket_id = intval($_GET['ticket_id']); $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id')); +if ($client_id) { + enforceClientAccess(); +} + ob_start(); ?> +
Adding a ticket Watcher
+
+
New approver for task
+ +
+ + + + +
+ +
+ +
+
+ +
+ +
+
+ + +
+ +
+
+ +
+ +
+
+ + +
+ +
+
+ +
+ +
+
+ +
- - - -
+
+ + +
-
- -
-
- -
- -
-
- - -
- -
-
- -
- -
-
- - -
- -
-
- -
- -
-
- - -
- -
- - -
- - + diff --git a/agent/modals/ticket/ticket_task_edit.php b/agent/modals/ticket/ticket_task_edit.php index 2f446c92..0aef5c26 100644 --- a/agent/modals/ticket/ticket_task_edit.php +++ b/agent/modals/ticket/ticket_task_edit.php @@ -2,9 +2,11 @@ require_once '../../../includes/modal_header.php'; +enforceUserPermission('module_support', 2); + $task_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tasks +$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON task_ticket_id = ticket_id WHERE task_id = $task_id LIMIT 1" ); @@ -13,6 +15,11 @@ $row = mysqli_fetch_assoc($sql); $task_name = escapeHtml($row['task_name']); $task_completion_estimate = intval($row['task_completion_estimate']); $task_completed_at = escapeHtml($row['task_completed_at']); +$client_id = intval($row['ticket_client_id']); + +if ($client_id) { + enforceClientAccess(); +} // Approvals $sql_task_approvals = mysqli_query($mysqli, " @@ -22,7 +29,6 @@ $sql_task_approvals = mysqli_query($mysqli, " ORDER BY approval_approved_by" ); -// Generate the HTML form content using output buffering. ob_start(); ?> diff --git a/agent/post/ticket.php b/agent/post/ticket.php index 1549adf5..28ce77af 100644 --- a/agent/post/ticket.php +++ b/agent/post/ticket.php @@ -1943,7 +1943,14 @@ if (isset($_POST['redact_ticket_reply'])) { $ticket_reply_id = intval($_POST['ticket_reply_id']); $ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']); - $client_id = intval($_POST['client_id']); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM ticket_replies + LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id + WHERE ticket_reply_id = $ticket_reply_id + LIMIT 1" + ); + + $row = mysqli_fetch_assoc($sql); + $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client if ($client_id) {