From 26d673746893977f6ec3ef569d52d48249d776e9 Mon Sep 17 00:00:00 2001
From: wrongecho <marcus@itflow.org>
Date: Wed, 28 Aug 2024 20:17:41 +0100
Subject: [PATCH] Bugfix: Client Access Permissions

Fix bug that allows users to view recurring tickets and projects they shouldn't have access to
---
 project_add_modal.php              | 2 +-
 projects.php                       | 6 ++++++
 recurring_ticket_add_modal.php     | 2 +-
 recurring_tickets.php              | 6 ++++++
 ticket_add_from_template_modal.php | 2 +-
 ticket_add_modal.php               | 2 +-
 6 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/project_add_modal.php b/project_add_modal.php
index 4f14e05c..a9d06f41 100644
--- a/project_add_modal.php
+++ b/project_add_modal.php
@@ -98,7 +98,7 @@
                             <select class="form-control select2" name="client_id" required>
                                 <option value="">- Client -</option>
                                 <?php
-                                $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_array($sql)) {
                                     $client_id = intval($row['client_id']);
                                     $client_name = nullable_htmlentities($row['client_name']);
diff --git a/projects.php b/projects.php
index e7f6f3b6..523fbb88 100644
--- a/projects.php
+++ b/projects.php
@@ -20,6 +20,11 @@ if($status == 1) {
     $status_query = "IS NULL";
 }
 
+// Ticket client access snippet
+$project_permission_snippet = '';
+if (!empty($client_access_string)) {
+    $project_permission_snippet = "AND project_client_id IN ($client_access_string)";
+}
 
 //Rebuild URL
 $url_query_strings_sort = http_build_query($get_copy);
@@ -33,6 +38,7 @@ $sql_projects = mysqli_query(
     AND (project_name LIKE '%$q%' OR project_description LIKE '%$q%' OR user_name LIKE '%$q%')
     AND project_archived_at IS NULL
     AND project_completed_at $status_query
+    $project_permission_snippet
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/recurring_ticket_add_modal.php b/recurring_ticket_add_modal.php
index bac39608..5605b1be 100644
--- a/recurring_ticket_add_modal.php
+++ b/recurring_ticket_add_modal.php
@@ -111,7 +111,7 @@
                                         <option value="">- Client -</option>
                                         <?php
 
-                                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                                         while ($row = mysqli_fetch_array($sql)) {
                                             $selectable_client_id = intval($row['client_id']);
                                             $client_name = nullable_htmlentities($row['client_name']); ?>
diff --git a/recurring_tickets.php b/recurring_tickets.php
index 657014c8..e0d7fb85 100644
--- a/recurring_tickets.php
+++ b/recurring_tickets.php
@@ -6,6 +6,11 @@ $order = "ASC";
 
 require_once "inc_all.php";
 
+// Ticket client access snippet
+$rec_ticket_permission_snippet = '';
+if (!empty($client_access_string)) {
+    $rec_ticket_permission_snippet = "AND scheduled_ticket_client_id IN ($client_access_string)";
+}
 
 //Rebuild URL
 $url_query_strings_sort = http_build_query($get_copy);
@@ -16,6 +21,7 @@ $sql = mysqli_query(
     "SELECT SQL_CALC_FOUND_ROWS * FROM scheduled_tickets
     LEFT JOIN clients on scheduled_ticket_client_id = client_id
     WHERE scheduled_tickets.scheduled_ticket_subject LIKE '%$q%'
+    $rec_ticket_permission_snippet
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/ticket_add_from_template_modal.php b/ticket_add_from_template_modal.php
index ef46c7f4..c80fa21a 100644
--- a/ticket_add_from_template_modal.php
+++ b/ticket_add_from_template_modal.php
@@ -87,7 +87,7 @@
                                             <option value="">- Client -</option>
                                             <?php
 
-                                            $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                                            $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                                             while ($row = mysqli_fetch_array($sql)) {
                                                 $client_id = intval($row['client_id']);
                                                 $client_name = nullable_htmlentities($row['client_name']); ?>
diff --git a/ticket_add_modal.php b/ticket_add_modal.php
index aeede733..1ecbac7b 100644
--- a/ticket_add_modal.php
+++ b/ticket_add_modal.php
@@ -81,7 +81,7 @@
                                             <option value="">- Client -</option>
                                             <?php
 
-                                            $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                                            $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                                             while ($row = mysqli_fetch_array($sql)) {
                                                 $client_id = intval($row['client_id']);
                                                 $client_name = nullable_htmlentities($row['client_name']); ?>