AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-02-28 02:44:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1064 from itflow-org/roles-enforce-2

Browse Source 
Permissions - clients and tickets
This commit is contained in:
Johnny
2024-09-20 16:16:59 -04:00
committed by GitHub
parent b658cf09dc 23f776efa3
commit 26e4dc5fb3
9 changed files with 121 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
post/client.php
View File

@@ -6,11 +6,11 @@
if (isset($_POST['add_client'])) {
validateCSRFToken($_POST['csrf_token']);
enforceUserPermission('module_client', 2);
require_once 'post/client_model.php';
validateAdminRole();
$location_phone = preg_replace("/[^0-9]/", '', $_POST['location_phone']);
$address = sanitizeInput($_POST['address']);
$city = sanitizeInput($_POST['city']);
@@ -117,9 +117,9 @@ if (isset($_POST['add_client'])) {
if (isset($_POST['edit_client'])) {
require_once 'post/client_model.php';
enforceUserPermission('module_client', 2);
validateAdminRole();
require_once 'post/client_model.php';
$client_id = intval($_POST['client_id']);
@@ -153,7 +153,8 @@ if (isset($_POST['edit_client'])) {
if (isset($_GET['archive_client'])) {
validateAdminRole();
validateCSRFToken($_GET['csrf_token']);
enforceUserPermission('module_client', 2);
$client_id = intval($_GET['archive_client']);
@@ -175,6 +176,8 @@ if (isset($_GET['archive_client'])) {
if (isset($_GET['undo_archive_client'])) {
enforceUserPermission('module_client', 2);
$client_id = intval($_GET['undo_archive_client']);
// Get Client Name
@@ -194,10 +197,8 @@ if (isset($_GET['undo_archive_client'])) {
if (isset($_GET['delete_client'])) {
validateAdminRole();
// CSRF Check
validateCSRFToken($_GET['csrf_token']);
enforceUserPermission('module_client', 3);
$client_id = intval($_GET['delete_client']);
@@ -337,6 +338,8 @@ if (isset($_GET['delete_client'])) {
if (isset($_POST['export_clients_csv'])) {
enforceUserPermission('module_client', 1);
//get records from database
$sql = mysqli_query($mysqli, "SELECT * FROM clients
LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
@@ -377,7 +380,7 @@ if (isset($_POST['export_clients_csv'])) {
if (isset($_POST["import_clients_csv"])) {
validateTechRole();
enforceUserPermission('module_client', 2);
$file_name = $_FILES["file"]["tmp_name"];
$error = false;
@@ -604,14 +607,21 @@ if (isset($_GET['download_clients_csv_template'])) {
if (isset($_POST['export_client_pdf'])) {
validateAdminRole();
// TODO: Enforce perms based on which individual boxes are ticked
enforceUserPermission('module_client', 3);
enforceUserPermission('module_support', 1);
enforceUserPermission('module_sales', 1);
enforceUserPermission('module_financial', 1);
$client_id = intval($_POST['client_id']);
$export_contacts = intval($_POST['export_contacts']);
$export_locations = intval($_POST['export_locations']);
$export_assets = intval($_POST['export_assets']);
$export_software = intval($_POST['export_software']);
$export_logins = intval($_POST['export_logins']);
$export_logins = 0;
if (lookupUserPermission("module_credential") >= 1) {
$export_logins = intval($_POST['export_logins']);
}
$export_networks = intval($_POST['export_networks']);
$export_certificates = intval($_POST['export_certificates']);
$export_domains = intval($_POST['export_domains']);

80
post/ticket.php
View File

@@ -6,7 +6,7 @@
if (isset($_POST['add_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client']);
$assigned_to = intval($_POST['assigned_to']);
@@ -186,7 +186,7 @@ if (isset($_POST['add_ticket'])) {
if (isset($_POST['edit_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$contact_id = intval($_POST['contact']);
@@ -269,7 +269,7 @@ if (isset($_POST['edit_ticket'])) {
if (isset($_POST['edit_ticket_priority'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$priority = sanitizeInput($_POST['priority']);
@@ -287,7 +287,7 @@ if (isset($_POST['edit_ticket_priority'])) {
if (isset($_POST['edit_ticket_contact'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$contact_id = intval($_POST['contact']);
@@ -360,7 +360,7 @@ if (isset($_POST['edit_ticket_contact'])) {
if (isset($_POST['add_ticket_watcher'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$client_id = intval($_POST['client_id']);
@@ -431,7 +431,7 @@ if (isset($_POST['add_ticket_watcher'])) {
if (isset($_POST['edit_ticket_watchers'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$client_id = intval($_POST['client_id']);
@@ -460,7 +460,7 @@ if (isset($_POST['edit_ticket_watchers'])) {
if (isset($_GET['delete_ticket_watcher'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$watcher_id = intval($_GET['delete_ticket_watcher']);
@@ -474,7 +474,7 @@ if (isset($_GET['delete_ticket_watcher'])) {
if (isset($_POST['edit_ticket_asset'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$asset_id = intval($_POST['asset']);
@@ -493,7 +493,7 @@ if (isset($_POST['edit_ticket_asset'])) {
if (isset($_POST['edit_ticket_vendor'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$vendor_id = intval($_POST['vendor']);
@@ -512,7 +512,7 @@ if (isset($_POST['edit_ticket_vendor'])) {
if (isset($_POST['edit_ticket_priority'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$priority = sanitizeInput($_POST['priority']);
@@ -530,8 +530,7 @@ if (isset($_POST['edit_ticket_priority'])) {
if (isset($_POST['assign_ticket'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
// POST variables
$ticket_id = intval($_POST['ticket_id']);
@@ -630,7 +629,7 @@ if (isset($_POST['assign_ticket'])) {
if (isset($_GET['delete_ticket'])) {
validateAdminRole();
enforceUserPermission('module_support', 3);
// CSRF Check
validateCSRFToken($_GET['csrf_token']);
@@ -668,8 +667,7 @@ if (isset($_GET['delete_ticket'])) {
if (isset($_POST['bulk_assign_ticket'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
// POST variables
$assign_to = intval($_POST['assign_to']);
@@ -769,8 +767,7 @@ if (isset($_POST['bulk_assign_ticket'])) {
if (isset($_POST['bulk_edit_ticket_priority'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
// POST variables
$priority = sanitizeInput($_POST['bulk_priority']);
@@ -809,8 +806,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) {
if (isset($_POST['bulk_merge_tickets'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_count = count($_POST['ticket_ids']); // Get a ticket count
$merge_into_ticket_number = intval($_POST['merge_into_ticket_number']); // Parent ticket *number*
@@ -868,8 +864,7 @@ if (isset($_POST['bulk_merge_tickets'])) {
if (isset($_POST['bulk_resolve_tickets'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
// POST variables
$details = mysqli_escape_string($mysqli, $_POST['bulk_details']);
@@ -979,8 +974,7 @@ if (isset($_POST['bulk_resolve_tickets'])) {
if (isset($_POST['bulk_ticket_reply'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
// POST variables
$ticket_reply = mysqli_escape_string($mysqli, $_POST['bulk_reply_details']);
@@ -1117,8 +1111,7 @@ if (isset($_POST['bulk_ticket_reply'])) {
// Currenly not UI Frontend for this
if (isset($_POST['bulk_add_ticket_project'])) {
// Role check
validateTechRole();
enforceUserPermission('module_support', 2);
// POST variables
$project_id = intval($_POST['project_id']);
@@ -1161,7 +1154,7 @@ if (isset($_POST['bulk_add_ticket_project'])) {
if (isset($_POST['add_ticket_reply'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']);
@@ -1306,7 +1299,7 @@ if (isset($_POST['add_ticket_reply'])) {
if (isset($_POST['edit_ticket_reply'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_reply_id = intval($_POST['ticket_reply_id']);
$ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']);
@@ -1327,7 +1320,7 @@ if (isset($_POST['edit_ticket_reply'])) {
if (isset($_GET['archive_ticket_reply'])) {
validateAdminRole();
enforceUserPermission('module_support', 2);
$ticket_reply_id = intval($_GET['archive_ticket_reply']);
@@ -1344,7 +1337,7 @@ if (isset($_GET['archive_ticket_reply'])) {
if (isset($_POST['merge_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']); // Child ticket ID to be closed
$merge_into_ticket_number = intval($_POST['merge_into_ticket_number']); // Parent ticket *number*
@@ -1407,7 +1400,7 @@ if (isset($_POST['merge_ticket'])) {
if (isset($_POST['change_client_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$client_id = intval($_POST['new_client_id']);
@@ -1429,7 +1422,7 @@ if (isset($_POST['change_client_ticket'])) {
if (isset($_GET['resolve_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
// CSRF Check
validateCSRFToken($_GET['csrf_token']);
@@ -1521,7 +1514,7 @@ if (isset($_GET['resolve_ticket'])) {
if (isset($_GET['close_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
// CSRF Check
validateCSRFToken($_GET['csrf_token']);
@@ -1612,7 +1605,7 @@ if (isset($_GET['close_ticket'])) {
if (isset($_GET['reopen_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_GET['reopen_ticket']);
@@ -1627,6 +1620,9 @@ if (isset($_GET['reopen_ticket'])) {
if (isset($_POST['add_invoice_from_ticket'])) {
enforceUserPermission('module_support', 2);
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']);
$ticket_id = intval($_POST['ticket_id']);
$date = sanitizeInput($_POST['date']);
@@ -1727,7 +1723,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
if (isset($_POST['export_client_tickets_csv'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
@@ -1776,7 +1772,7 @@ if (isset($_POST['export_client_tickets_csv'])) {
if (isset($_POST['add_recurring_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
require_once 'post/recurring_ticket_model.php';
@@ -1804,7 +1800,7 @@ if (isset($_POST['add_recurring_ticket'])) {
if (isset($_POST['edit_recurring_ticket'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
require_once 'post/recurring_ticket_model.php';
@@ -1831,7 +1827,7 @@ if (isset($_POST['edit_recurring_ticket'])) {
if (isset($_GET['delete_recurring_ticket'])) {
validateAdminRole();
enforceUserPermission('module_support', 3);
$scheduled_ticket_id = intval($_GET['delete_recurring_ticket']);
@@ -1855,7 +1851,8 @@ if (isset($_GET['delete_recurring_ticket'])) {
}
if (isset($_POST['bulk_delete_scheduled_tickets']) || isset($_POST['bulk_delete_recurring_tickets'])) {
validateAdminRole();
enforceUserPermission('module_support', 3);
validateCSRFToken($_POST['csrf_token']);
$count = 0; // Default 0
@@ -1884,7 +1881,8 @@ if (isset($_POST['bulk_delete_scheduled_tickets']) || isset($_POST['bulk_delete_
if (isset($_POST['set_billable_status'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
enforceUserPermission('module_sales', 2);
$ticket_id = intval($_POST['ticket_id']);
$billable_status = sanitizeInput($_POST['billable_status']);
@@ -1916,7 +1914,7 @@ if (isset($_POST['set_billable_status'])) {
if (isset($_POST['edit_ticket_schedule'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$onsite = intval($_POST['onsite']);
@@ -2094,7 +2092,7 @@ if (isset($_POST['edit_ticket_schedule'])) {
if (isset($_GET['cancel_ticket_schedule'])) {
validateTechRole();
enforceUserPermission('module_support', 2);
$ticket_id = intval($_GET['cancel_ticket_schedule']);