More Client Enforcement in modals across the app

agent/ajax.php

@@ -49,6 +49,8 @@ if (isset($_POST['client_set_notes'])) {
     $client_id = intval($_POST['client_id']);
     $notes = escapeSql($_POST['notes']);
 
+    enforceClientAccess();
+
     // Update notes
     mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id");
 
@@ -74,6 +76,8 @@ if (isset($_POST['contact_set_notes'])) {
     $contact_name = escapeSql($row['contact_name']);
     $client_id = intval($row['contact_client_id']);
 
+    enforceClientAccess();
+
     // Update notes
     mysqli_query($mysqli, "UPDATE contacts SET contact_notes = '$notes' WHERE contact_id = $contact_id");
 
@@ -99,6 +103,8 @@ if (isset($_POST['asset_set_notes'])) {
     $asset_name = escapeSql($row['asset_name']);
     $client_id = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     // Update notes
     mysqli_query($mysqli, "UPDATE assets SET asset_notes = '$notes' WHERE asset_id = $asset_id");
 

agent/modals/asset/asset_link_credential.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_credential', 2);
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -13,7 +15,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -66,5 +69,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
-?>

agent/modals/asset/asset_link_document.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -67,4 +68,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';

agent/modals/asset/asset_link_file.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_credential', 2);
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -13,7 +15,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -70,4 +73,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';

agent/modals/asset/asset_link_service.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -66,4 +67,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';

agent/modals/asset/asset_link_software.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -71,4 +72,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';

agent/modals/calendar/calendar_event_edit.php

@@ -18,9 +18,14 @@ $calendar_name = escapeHtml($row['calendar_name']);
 $calendar_color = escapeHtml($row['calendar_color']);
 $client_id = intval($row['event_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-calendar-check mr-2" style="color:<?php echo $calendar_color; ?>"></i>Editing: <strong><?php echo $event_title; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/contact/contact_link_credential.php

@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -64,5 +65,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
-?>

agent/modals/contact/contact_note_add.php

@@ -7,6 +7,9 @@ $contact_id = intval($_GET['id']);
 $sql = mysqli_query($mysqli, "SELECT contact_name FROM contacts WHERE contact_id = $contact_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
+$client_id = intval($row['contact_client_id']);
+
+enforceClientAccess();
 
 ob_start();
 
@@ -61,4 +64,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';

agent/modals/expense/expense_copy.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $expense_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
@@ -17,10 +19,14 @@ $expense_created_at = escapeHtml($row['expense_created_at']);
 $expense_vendor_id = intval($row['expense_vendor_id']);
 $expense_category_id = intval($row['expense_category_id']);
 $expense_account_id = intval($row['expense_account_id']);
-$expense_client_id = intval($row['expense_client_id']);
+$client_id = intval($row['expense_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
@@ -181,7 +187,7 @@ ob_start();
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = escapeHtml($row['client_name']);
                                 ?>
-                                <option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
+                                <option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
 
                                 <?php
                             }

agent/modals/expense/expense_refund.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $expense_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
@@ -17,10 +19,14 @@ $expense_created_at = escapeHtml($row['expense_created_at']);
 $expense_vendor_id = intval($row['expense_vendor_id']);
 $expense_category_id = intval($row['expense_category_id']);
 $expense_account_id = intval($row['expense_account_id']);
-$expense_client_id = intval($row['expense_client_id']);
+$client_id = intval($row['expense_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/quote/quote_edit.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_sales', 2);
+
 $quote_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");
@@ -17,9 +19,12 @@ $quote_discount = floatval($row['quote_discount_amount']);
 $quote_created_at = escapeHtml($row['quote_created_at']);
 $quote_category_id = intval($row['quote_category_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['quote_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/revenue/revenue_edit.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $revenue_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM revenues WHERE revenue_id = $revenue_id LIMIT 1");
@@ -17,8 +19,8 @@ $revenue_created_at = escapeHtml($row['revenue_created_at']);
 $account_id = intval($row['revenue_account_id']);
 $category_id = intval($row['revenue_category_id']);
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/ticket/ticket_add.php

@@ -7,6 +7,10 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $asset_id = intval($_GET['asset_id'] ?? 0);
 $project_id = intval($_GET['project_id'] ?? 0);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>

agent/modals/ticket/ticket_add_v2.php

@@ -6,6 +6,10 @@ $client_id = intval($_GET['client_id'] ?? 0);
 $contact_id = intval($_GET['contact_id'] ?? 0);
 $project_id = intval($_GET['project_id'] ?? 0);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>

agent/modals/ticket/ticket_assign.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -17,8 +19,12 @@ $ticket_assigned_to = intval($row['ticket_assigned_to']);
 $ticket_status = intval($row['ticket_status']);
 $ticket_closed_at = escapeHtml($row['ticket_closed_at']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>

agent/modals/ticket/ticket_billable.php

@@ -10,8 +10,10 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_billable = intval($row['ticket_billable']);
+$client_id = intval($row['ticket_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>

agent/modals/ticket/ticket_change_client.php

@@ -1,6 +1,9 @@
 <?php
+
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
@@ -10,7 +13,10 @@ $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $client_id = intval($row['ticket_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>

agent/modals/ticket/ticket_contact.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -14,10 +16,11 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $contact_id = intval($row['ticket_contact_id']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>

agent/modals/ticket/ticket_edit.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 // Ticket client access overide - This is the only way to show tickets without a client to agents with restricted client access
 $access_permission_query_overide = '';
 if ($client_access_string) {
@@ -32,6 +34,10 @@ $location_id = intval($row['ticket_location_id']);
 $vendor_id = intval($row['ticket_vendor_id']);
 $project_id = intval($row['ticket_project_id']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 // Additional Assets Selected
 $additional_assets_array = array();
 $sql_additional_assets = mysqli_query($mysqli, "SELECT asset_id FROM ticket_assets WHERE ticket_id = $ticket_id");
@@ -40,9 +46,10 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
     $additional_assets_array[] = $additional_asset_id;
 }
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-life-ring mr-2"></i>Ticket: <strong><?= "$ticket_prefix$ticket_number" ?></strong> - <?= $client_name ?></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/ticket/ticket_edit_asset.php

@@ -2,16 +2,22 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $asset_id = intval($row['ticket_asset_id']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 // Additional Assets Selected
 $additional_assets_array = array();
@@ -21,8 +27,8 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
     $additional_assets_array[] = $additional_asset_id;
 }
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/ticket/ticket_edit_project.php

@@ -2,23 +2,28 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_project_id = intval($row['ticket_project_id']);
+$client_id = intval($row['ticket_client_id']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
 
 // Select box arrays
 $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE (project_client_id = $client_id OR project_client_id = 0) AND project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/ticket/ticket_edit_schedule.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -15,13 +17,17 @@ $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_scheduled_for = escapeHtml($row['ticket_schedule']);
 $ticket_onsite = intval($row['ticket_onsite']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title">
         <i class="fa fa-fw fa-calendar-check mr-2"></i>Scheduling Ticket: <strong><?php echo "$ticket_prefix$ticket_number"; ?></strong>

agent/modals/ticket/ticket_edit_vendor.php

@@ -1,6 +1,9 @@
 <?php
+
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
@@ -11,7 +14,10 @@ $ticket_number = intval($row['ticket_number']);
 $vendor_id = intval($row['ticket_vendor_id']);
 $client_id = intval($row['ticket_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>

agent/modals/ticket/ticket_invoice_add.php

@@ -71,6 +71,10 @@ $location_state = escapeHtml($row['location_state']);
 $location_zip = escapeHtml($row['location_zip']);
 $location_phone = formatPhoneNumber($row['location_phone']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 //Get Total Ticket Time
 $ticket_total_reply_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) AS ticket_total_reply_time FROM ticket_replies WHERE ticket_reply_archived_at IS NULL AND ticket_reply_ticket_id = $ticket_id");
 $row = mysqli_fetch_assoc($ticket_total_reply_time);

agent/modals/ticket/ticket_merge.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -16,7 +18,9 @@ $ticket_number = intval($row['ticket_number']);
 $client_name = escapeHtml($row['client_name']);
 $client_id = intval($row['ticket_client_id']);
 
-enforceClientAccess();
+if ($client_id) {
+    enforceClientAccess();
+}
 
 $sql_merge = mysqli_query($mysqli, "SELECT * FROM tickets
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id

agent/modals/ticket/ticket_priority.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -14,10 +16,13 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_priority = escapeHtml($row['ticket_priority']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
@@ -31,7 +36,6 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="ticket_id" value="<?php echo $ticket_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
 
     <div class="modal-body">
 

agent/modals/ticket/ticket_quote_add.php

@@ -61,7 +61,9 @@ $asset_id = intval($row['asset_id']);
 $asset_name = escapeHtml($row['asset_name']);
 $asset_type = escapeHtml($row['asset_type']);
 
-
+if ($client_id) {
+    enforceClientAccess();
+}
 
 ob_start();
 

agent/modals/transfer/transfer_edit.php

@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $transfer_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT transfer_created_at, expense_date AS transfer_date, expense_amount AS transfer_amount, expense_account_id AS transfer_account_from, revenue_account_id AS transfer_account_to, transfer_expense_id, transfer_revenue_id, transfer_id, transfer_method, transfer_notes FROM transfers, expenses, revenues
@@ -22,8 +24,8 @@ $transfer_created_at = escapeHtml($row['transfer_created_at']);
 $expense_id = intval($row['transfer_expense_id']);
 $revenue_id = intval($row['transfer_revenue_id']);
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/vendor/vendor_add.php

@@ -4,6 +4,10 @@ require_once '../../../includes/modal_header.php';
 
 $client_id = intval($_GET['client_id'] ?? 0);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>

agent/modals/vendor/vendor_details.php

@@ -19,6 +19,11 @@ $hours = escapeSql($row['vendor_hours']);
 $sla = escapeSql($row['vendor_sla']);
 $code = escapeSql($row['vendor_code']);
 $notes = escapeSql($row['vendor_notes']);
+$client_id = intval($row['vendor_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 ob_start();
 

agent/modals/vendor/vendor_edit.php

@@ -21,6 +21,11 @@ $vendor_sla = escapeHtml($row['vendor_sla']);
 $vendor_code = escapeHtml($row['vendor_code']);
 $vendor_notes = escapeHtml($row['vendor_notes']);
 $vendor_template_id = intval($row['vendor_template_id']);
+$client_id = intval($row['vendor_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 ob_start();
 

agent/post/ticket.php

@@ -322,7 +322,6 @@ if (isset($_POST['edit_ticket_priority'])) {
 
     $ticket_id = intval($_POST['ticket_id']);
     $priority = escapeSql($_POST['priority']);
-    $client_id = intval($_POST['client_id']);
 
     // Get ticket details before updating
     $sql = mysqli_query($mysqli, "SELECT

agent/recurring_invoice.php

@@ -7,6 +7,8 @@ if (isset($_GET['client_id'])) {
     require_once "includes/inc_all.php";
 }
 
+enforceUserPermission('module_sales');
+
 if (isset($_GET['recurring_invoice_id'])) {
 
     $recurring_invoice_id = intval($_GET['recurring_invoice_id']);
@@ -112,6 +114,8 @@ if (isset($_GET['recurring_invoice_id'])) {
         $json_products = json_encode($products);
     }
 
+    enforceClientAccess();
+
     ?>
 
     <ol class="breadcrumb d-print-none">