More Client Enforcement in modals across the app

agent/modals/contact/contact_link_asset.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/contact/contact_link_document.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/contact/contact_link_file.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/contact/contact_link_service.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/contact/contact_link_software.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/ticket/ticket_add_watcher.php

@@ -2,12 +2,19 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-eye mr-2"></i>Adding a ticket Watcher</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
@@ -65,4 +72,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';

agent/modals/ticket/ticket_reply_redact.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_reply_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies
@@ -14,7 +16,10 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_reply = escapeHtml($row['ticket_reply']);
 $client_id = intval($row['ticket_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
@@ -28,7 +33,6 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="ticket_reply_id" value="<?php echo $ticket_reply_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
 
     <div class="modal-body">
 

agent/modals/ticket/ticket_task_approver_add.php

@@ -2,17 +2,24 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $task_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tasks
+    LEFT JOIN tickets ON task_ticket_id = ticket_id
     WHERE task_id = $task_id
     LIMIT 1"
 );
 
 $row = mysqli_fetch_assoc($sql);
 $task_name = escapeHtml($row['task_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>

agent/modals/ticket/ticket_task_edit.php

@@ -2,9 +2,11 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $task_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tasks
+$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON task_ticket_id = ticket_id
     WHERE task_id = $task_id
     LIMIT 1"
 );
@@ -13,6 +15,11 @@ $row = mysqli_fetch_assoc($sql);
 $task_name = escapeHtml($row['task_name']);
 $task_completion_estimate = intval($row['task_completion_estimate']);
 $task_completed_at = escapeHtml($row['task_completed_at']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 // Approvals
 $sql_task_approvals = mysqli_query($mysqli, "
@@ -22,7 +29,6 @@ $sql_task_approvals = mysqli_query($mysqli, "
     ORDER BY approval_approved_by"
 );
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>

agent/post/ticket.php

@@ -1943,7 +1943,14 @@ if (isset($_POST['redact_ticket_reply'])) {
     $ticket_reply_id = intval($_POST['ticket_reply_id']);
     $ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']);
 
-    $client_id = intval($_POST['client_id']);
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM ticket_replies
+        LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id
+        WHERE ticket_reply_id = $ticket_reply_id
+        LIMIT 1"
+    );
+
+    $row = mysqli_fetch_assoc($sql);
+    $client_id = intval($row['ticket_client_id']);
 
     // Don't Enforce Client Access if Ticket doesn't have an assigned client
     if ($client_id) {