From 18e180eca593ac29bc2fa1f5d723612bd73b073c Mon Sep 17 00:00:00 2001 From: johnnyq Date: Mon, 2 Mar 2026 18:40:07 -0500 Subject: [PATCH] Vendors: Check if client_id is set to enforce the right permission check. If client vendor then check client module otherwise check financial module --- agent/post/vendor.php | 73 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 71 insertions(+), 2 deletions(-) diff --git a/agent/post/vendor.php b/agent/post/vendor.php index c8dbc3ec..7fc01309 100644 --- a/agent/post/vendor.php +++ b/agent/post/vendor.php @@ -14,6 +14,14 @@ if (isset($_POST['add_vendor_from_template'])) { // GET POST Data $client_id = intval($_POST['client_id']); //Used if this vendor is under a contact otherwise its 0 for under company and or template + + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + $vendor_template_id = intval($_POST['vendor_template_id']); //GET Vendor Info @@ -58,6 +66,13 @@ if (isset($_POST['add_vendor'])) { $client_id = intval($_POST['client_id']); // Used if this vendor is under a contact otherwise its 0 for under company + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + mysqli_query($mysqli,"INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id"); $vendor_id = mysqli_insert_id($mysqli); @@ -82,6 +97,13 @@ if (isset($_POST['edit_vendor'])) { // Get Client ID $client_id = intval(getFieldById('vendors', $vendor_id, 'vendor_client_id')); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + mysqli_query($mysqli,"UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code',vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_template_id = $vendor_template_id WHERE vendor_id = $vendor_id"); logAction("Vendor", "Edit", "$session_name edited vendor $name", $client_id, $vendor_id); @@ -104,6 +126,13 @@ if (isset($_GET['archive_vendor'])) { $vendor_name = sanitizeInput($row['vendor_name']); $client_id = intval($row['vendor_client_id']); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); logAction("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id); @@ -126,6 +155,13 @@ if(isset($_GET['restore_vendor'])){ $vendor_name = sanitizeInput($row['vendor_name']); $client_id = intval($row['vendor_client_id']); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); logAction("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id); @@ -140,8 +176,6 @@ if (isset($_GET['delete_vendor'])) { validateCSRFToken($_GET['csrf_token']); - validateAdminRole(); - $vendor_id = intval($_GET['delete_vendor']); //Get Vendor Name @@ -151,6 +185,13 @@ if (isset($_GET['delete_vendor'])) { $client_id = intval($row['vendor_client_id']); $vendor_template_id = intval($row['vendor_template_id']); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 3); + } else { + enforceUserPermission('module_financial', 3); + } + // If its a template reset all vendors based off this template to no template base if ($vendor_template_id > 0) { mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id"); @@ -186,6 +227,13 @@ if (isset($_POST['bulk_archive_vendors'])) { $vendor_name = sanitizeInput($row['vendor_name']); $client_id = intval($row['vendor_client_id']); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); logAction("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id); @@ -221,6 +269,13 @@ if (isset($_POST['bulk_restore_vendors'])) { $vendor_name = sanitizeInput($row['vendor_name']); $client_id = intval($row['vendor_client_id']); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 2); + } else { + enforceUserPermission('module_financial', 2); + } + mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); logAction("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id); @@ -260,6 +315,13 @@ if (isset($_POST['bulk_delete_vendors'])) { $client_id = intval($row['vendor_client_id']); $vendor_template_id = intval($row['vendor_template_id']); + // Permission check + if ($client_id) { + enforceUserPermission('module_client', 3); + } else { + enforceUserPermission('module_financial', 3); + } + // If its a template reset all vendors based off this template to no template base if ($vendor_template_id > 0) { mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id"); @@ -296,6 +358,13 @@ if (isset($_POST['export_vendors_csv'])) { $file_name_prepend = "$session_company_name-"; } + // Permission check + if ($client_id) { + enforceUserPermission('module_client'); + } else { + enforceUserPermission('module_financial'); + } + $sql = mysqli_query($mysqli,"SELECT * FROM vendors $client_query ORDER BY vendor_name ASC"); $count = mysqli_num_rows($sql);