From 2c09ce097c257412b50514662d2d35f59a40c46f Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 16 Jul 2026 13:10:02 -0400
Subject: [PATCH] More Client Enforcement in modals across the app

---
 agent/ajax.php                                   |  6 ++++++
 agent/modals/asset/asset_link_credential.php     |  7 +++++--
 agent/modals/asset/asset_link_document.php       |  4 +++-
 agent/modals/asset/asset_link_file.php           |  6 +++++-
 agent/modals/asset/asset_link_service.php        |  4 +++-
 agent/modals/asset/asset_link_software.php       |  4 +++-
 agent/modals/calendar/calendar_event_edit.php    |  7 ++++++-
 agent/modals/contact/contact_link_credential.php |  5 +++--
 agent/modals/contact/contact_note_add.php        |  4 ++++
 agent/modals/expense/expense_copy.php            | 12 +++++++++---
 agent/modals/expense/expense_refund.php          | 10 ++++++++--
 agent/modals/quote/quote_edit.php                |  7 ++++++-
 agent/modals/revenue/revenue_edit.php            |  4 +++-
 agent/modals/ticket/ticket_add.php               |  4 ++++
 agent/modals/ticket/ticket_add_v2.php            |  4 ++++
 agent/modals/ticket/ticket_assign.php            |  8 +++++++-
 agent/modals/ticket/ticket_billable.php          |  4 +++-
 agent/modals/ticket/ticket_change_client.php     |  8 +++++++-
 agent/modals/ticket/ticket_contact.php           |  7 +++++--
 agent/modals/ticket/ticket_edit.php              |  9 ++++++++-
 agent/modals/ticket/ticket_edit_asset.php        | 10 ++++++++--
 agent/modals/ticket/ticket_edit_project.php      |  9 +++++++--
 agent/modals/ticket/ticket_edit_schedule.php     | 10 ++++++++--
 agent/modals/ticket/ticket_edit_vendor.php       |  8 +++++++-
 agent/modals/ticket/ticket_invoice_add.php       |  4 ++++
 agent/modals/ticket/ticket_merge.php             |  6 +++++-
 agent/modals/ticket/ticket_priority.php          | 10 +++++++---
 agent/modals/ticket/ticket_quote_add.php         |  4 +++-
 agent/modals/transfer/transfer_edit.php          |  4 +++-
 agent/modals/vendor/vendor_add.php               |  4 ++++
 agent/modals/vendor/vendor_details.php           |  5 +++++
 agent/modals/vendor/vendor_edit.php              |  5 +++++
 agent/post/ticket.php                            |  1 -
 agent/recurring_invoice.php                      |  4 ++++
 34 files changed, 172 insertions(+), 36 deletions(-)

diff --git a/agent/ajax.php b/agent/ajax.php
index 4bf9cfdf..a7c8207a 100644
--- a/agent/ajax.php
+++ b/agent/ajax.php
@@ -49,6 +49,8 @@ if (isset($_POST['client_set_notes'])) {
     $client_id = intval($_POST['client_id']);
     $notes = escapeSql($_POST['notes']);
 
+    enforceClientAccess();
+
     // Update notes
     mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id");
 
@@ -74,6 +76,8 @@ if (isset($_POST['contact_set_notes'])) {
     $contact_name = escapeSql($row['contact_name']);
     $client_id = intval($row['contact_client_id']);
 
+    enforceClientAccess();
+
     // Update notes
     mysqli_query($mysqli, "UPDATE contacts SET contact_notes = '$notes' WHERE contact_id = $contact_id");
 
@@ -99,6 +103,8 @@ if (isset($_POST['asset_set_notes'])) {
     $asset_name = escapeSql($row['asset_name']);
     $client_id = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     // Update notes
     mysqli_query($mysqli, "UPDATE assets SET asset_notes = '$notes' WHERE asset_id = $asset_id");
 
diff --git a/agent/modals/asset/asset_link_credential.php b/agent/modals/asset/asset_link_credential.php
index caca3882..eace6a39 100644
--- a/agent/modals/asset/asset_link_credential.php
+++ b/agent/modals/asset/asset_link_credential.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_credential', 2);
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -13,7 +15,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -66,5 +69,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
-?>
diff --git a/agent/modals/asset/asset_link_document.php b/agent/modals/asset/asset_link_document.php
index b8c3f35e..59b3ab43 100644
--- a/agent/modals/asset/asset_link_document.php
+++ b/agent/modals/asset/asset_link_document.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -67,4 +68,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
diff --git a/agent/modals/asset/asset_link_file.php b/agent/modals/asset/asset_link_file.php
index 7e2c1c7f..ddf19cc2 100644
--- a/agent/modals/asset/asset_link_file.php
+++ b/agent/modals/asset/asset_link_file.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_credential', 2);
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -13,7 +15,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -70,4 +73,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
diff --git a/agent/modals/asset/asset_link_service.php b/agent/modals/asset/asset_link_service.php
index 716a522f..a2e07d8b 100644
--- a/agent/modals/asset/asset_link_service.php
+++ b/agent/modals/asset/asset_link_service.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -66,4 +67,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
diff --git a/agent/modals/asset/asset_link_software.php b/agent/modals/asset/asset_link_software.php
index d1d2a2ae..308df6cb 100644
--- a/agent/modals/asset/asset_link_software.php
+++ b/agent/modals/asset/asset_link_software.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $asset_name = escapeHtml($row['asset_name']);
 $client_id = intval($row['asset_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -71,4 +72,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
diff --git a/agent/modals/calendar/calendar_event_edit.php b/agent/modals/calendar/calendar_event_edit.php
index 6b3723a3..5bae08ba 100644
--- a/agent/modals/calendar/calendar_event_edit.php
+++ b/agent/modals/calendar/calendar_event_edit.php
@@ -18,9 +18,14 @@ $calendar_name = escapeHtml($row['calendar_name']);
 $calendar_color = escapeHtml($row['calendar_color']);
 $client_id = intval($row['event_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-calendar-check mr-2" style="color:<?php echo $calendar_color; ?>"></i>Editing: <strong><?php echo $event_title; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
diff --git a/agent/modals/contact/contact_link_credential.php b/agent/modals/contact/contact_link_credential.php
index 2f0f6134..c3ea5aa5 100644
--- a/agent/modals/contact/contact_link_credential.php
+++ b/agent/modals/contact/contact_link_credential.php
@@ -13,7 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
 $client_id = intval($row['contact_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
 
 ?>
@@ -64,5 +65,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
-?>
diff --git a/agent/modals/contact/contact_note_add.php b/agent/modals/contact/contact_note_add.php
index 0365c58e..f91ae687 100644
--- a/agent/modals/contact/contact_note_add.php
+++ b/agent/modals/contact/contact_note_add.php
@@ -7,6 +7,9 @@ $contact_id = intval($_GET['id']);
 $sql = mysqli_query($mysqli, "SELECT contact_name FROM contacts WHERE contact_id = $contact_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $contact_name = escapeHtml($row['contact_name']);
+$client_id = intval($row['contact_client_id']);
+
+enforceClientAccess();
 
 ob_start();
 
@@ -61,4 +64,5 @@ ob_start();
 </form>
 
 <?php
+
 require_once '../../../includes/modal_footer.php';
diff --git a/agent/modals/expense/expense_copy.php b/agent/modals/expense/expense_copy.php
index d5e9e1ff..62571cb1 100644
--- a/agent/modals/expense/expense_copy.php
+++ b/agent/modals/expense/expense_copy.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $expense_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
@@ -17,10 +19,14 @@ $expense_created_at = escapeHtml($row['expense_created_at']);
 $expense_vendor_id = intval($row['expense_vendor_id']);
 $expense_category_id = intval($row['expense_category_id']);
 $expense_account_id = intval($row['expense_account_id']);
-$expense_client_id = intval($row['expense_client_id']);
+$client_id = intval($row['expense_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
@@ -181,7 +187,7 @@ ob_start();
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = escapeHtml($row['client_name']);
                                 ?>
-                                <option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
+                                <option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
 
                                 <?php
                             }
diff --git a/agent/modals/expense/expense_refund.php b/agent/modals/expense/expense_refund.php
index 55c55258..eb81a0a0 100644
--- a/agent/modals/expense/expense_refund.php
+++ b/agent/modals/expense/expense_refund.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $expense_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
@@ -17,10 +19,14 @@ $expense_created_at = escapeHtml($row['expense_created_at']);
 $expense_vendor_id = intval($row['expense_vendor_id']);
 $expense_category_id = intval($row['expense_category_id']);
 $expense_account_id = intval($row['expense_account_id']);
-$expense_client_id = intval($row['expense_client_id']);
+$client_id = intval($row['expense_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/quote/quote_edit.php b/agent/modals/quote/quote_edit.php
index 57b9872b..760da424 100644
--- a/agent/modals/quote/quote_edit.php
+++ b/agent/modals/quote/quote_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_sales', 2);
+
 $quote_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");
@@ -17,9 +19,12 @@ $quote_discount = floatval($row['quote_discount_amount']);
 $quote_created_at = escapeHtml($row['quote_created_at']);
 $quote_category_id = intval($row['quote_category_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['quote_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/revenue/revenue_edit.php b/agent/modals/revenue/revenue_edit.php
index 69b8a322..dc35366d 100644
--- a/agent/modals/revenue/revenue_edit.php
+++ b/agent/modals/revenue/revenue_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $revenue_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM revenues WHERE revenue_id = $revenue_id LIMIT 1");
@@ -17,8 +19,8 @@ $revenue_created_at = escapeHtml($row['revenue_created_at']);
 $account_id = intval($row['revenue_account_id']);
 $category_id = intval($row['revenue_category_id']);
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/ticket/ticket_add.php b/agent/modals/ticket/ticket_add.php
index 3eff9a56..1712cfcc 100644
--- a/agent/modals/ticket/ticket_add.php
+++ b/agent/modals/ticket/ticket_add.php
@@ -7,6 +7,10 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $asset_id = intval($_GET['asset_id'] ?? 0);
 $project_id = intval($_GET['project_id'] ?? 0);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_add_v2.php b/agent/modals/ticket/ticket_add_v2.php
index b84136e0..52df88fb 100644
--- a/agent/modals/ticket/ticket_add_v2.php
+++ b/agent/modals/ticket/ticket_add_v2.php
@@ -6,6 +6,10 @@ $client_id = intval($_GET['client_id'] ?? 0);
 $contact_id = intval($_GET['contact_id'] ?? 0);
 $project_id = intval($_GET['project_id'] ?? 0);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_assign.php b/agent/modals/ticket/ticket_assign.php
index 06d166aa..a724c17f 100644
--- a/agent/modals/ticket/ticket_assign.php
+++ b/agent/modals/ticket/ticket_assign.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -17,8 +19,12 @@ $ticket_assigned_to = intval($row['ticket_assigned_to']);
 $ticket_status = intval($row['ticket_status']);
 $ticket_closed_at = escapeHtml($row['ticket_closed_at']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_billable.php b/agent/modals/ticket/ticket_billable.php
index 601ffcae..1ae4126f 100644
--- a/agent/modals/ticket/ticket_billable.php
+++ b/agent/modals/ticket/ticket_billable.php
@@ -10,8 +10,10 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_billable = intval($row['ticket_billable']);
+$client_id = intval($row['ticket_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_change_client.php b/agent/modals/ticket/ticket_change_client.php
index b8cbbfc9..43323a8b 100644
--- a/agent/modals/ticket/ticket_change_client.php
+++ b/agent/modals/ticket/ticket_change_client.php
@@ -1,6 +1,9 @@
 <?php
+
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
@@ -10,7 +13,10 @@ $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $client_id = intval($row['ticket_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_contact.php b/agent/modals/ticket/ticket_contact.php
index a65869bb..2ef814ed 100644
--- a/agent/modals/ticket/ticket_contact.php
+++ b/agent/modals/ticket/ticket_contact.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -14,10 +16,11 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $contact_id = intval($row['ticket_contact_id']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_edit.php b/agent/modals/ticket/ticket_edit.php
index c20118d0..3c40dbbd 100644
--- a/agent/modals/ticket/ticket_edit.php
+++ b/agent/modals/ticket/ticket_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 // Ticket client access overide - This is the only way to show tickets without a client to agents with restricted client access
 $access_permission_query_overide = '';
 if ($client_access_string) {
@@ -32,6 +34,10 @@ $location_id = intval($row['ticket_location_id']);
 $vendor_id = intval($row['ticket_vendor_id']);
 $project_id = intval($row['ticket_project_id']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 // Additional Assets Selected
 $additional_assets_array = array();
 $sql_additional_assets = mysqli_query($mysqli, "SELECT asset_id FROM ticket_assets WHERE ticket_id = $ticket_id");
@@ -40,9 +46,10 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
     $additional_assets_array[] = $additional_asset_id;
 }
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-life-ring mr-2"></i>Ticket: <strong><?= "$ticket_prefix$ticket_number" ?></strong> - <?= $client_name ?></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
diff --git a/agent/modals/ticket/ticket_edit_asset.php b/agent/modals/ticket/ticket_edit_asset.php
index 980fb6d6..5078a25a 100644
--- a/agent/modals/ticket/ticket_edit_asset.php
+++ b/agent/modals/ticket/ticket_edit_asset.php
@@ -2,16 +2,22 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $asset_id = intval($row['ticket_asset_id']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 // Additional Assets Selected
 $additional_assets_array = array();
@@ -21,8 +27,8 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
     $additional_assets_array[] = $additional_asset_id;
 }
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/ticket/ticket_edit_project.php b/agent/modals/ticket/ticket_edit_project.php
index 74d55d70..3683d0fe 100644
--- a/agent/modals/ticket/ticket_edit_project.php
+++ b/agent/modals/ticket/ticket_edit_project.php
@@ -2,23 +2,28 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_project_id = intval($row['ticket_project_id']);
+$client_id = intval($row['ticket_client_id']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
 
 // Select box arrays
 $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE (project_client_id = $client_id OR project_client_id = 0) AND project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/ticket/ticket_edit_schedule.php b/agent/modals/ticket/ticket_edit_schedule.php
index 28cdb9c4..5b97d062 100644
--- a/agent/modals/ticket/ticket_edit_schedule.php
+++ b/agent/modals/ticket/ticket_edit_schedule.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -15,13 +17,17 @@ $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_scheduled_for = escapeHtml($row['ticket_schedule']);
 $ticket_onsite = intval($row['ticket_onsite']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title">
         <i class="fa fa-fw fa-calendar-check mr-2"></i>Scheduling Ticket: <strong><?php echo "$ticket_prefix$ticket_number"; ?></strong>
diff --git a/agent/modals/ticket/ticket_edit_vendor.php b/agent/modals/ticket/ticket_edit_vendor.php
index 73c0b991..df44edad 100644
--- a/agent/modals/ticket/ticket_edit_vendor.php
+++ b/agent/modals/ticket/ticket_edit_vendor.php
@@ -1,6 +1,9 @@
 <?php
+
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
@@ -11,7 +14,10 @@ $ticket_number = intval($row['ticket_number']);
 $vendor_id = intval($row['ticket_vendor_id']);
 $client_id = intval($row['ticket_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
diff --git a/agent/modals/ticket/ticket_invoice_add.php b/agent/modals/ticket/ticket_invoice_add.php
index 46cb3fec..69c6f346 100644
--- a/agent/modals/ticket/ticket_invoice_add.php
+++ b/agent/modals/ticket/ticket_invoice_add.php
@@ -71,6 +71,10 @@ $location_state = escapeHtml($row['location_state']);
 $location_zip = escapeHtml($row['location_zip']);
 $location_phone = formatPhoneNumber($row['location_phone']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 //Get Total Ticket Time
 $ticket_total_reply_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) AS ticket_total_reply_time FROM ticket_replies WHERE ticket_reply_archived_at IS NULL AND ticket_reply_ticket_id = $ticket_id");
 $row = mysqli_fetch_assoc($ticket_total_reply_time);
diff --git a/agent/modals/ticket/ticket_merge.php b/agent/modals/ticket/ticket_merge.php
index 298bb1d8..36d06466 100644
--- a/agent/modals/ticket/ticket_merge.php
+++ b/agent/modals/ticket/ticket_merge.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -16,7 +18,9 @@ $ticket_number = intval($row['ticket_number']);
 $client_name = escapeHtml($row['client_name']);
 $client_id = intval($row['ticket_client_id']);
 
-enforceClientAccess();
+if ($client_id) {
+    enforceClientAccess();
+}
 
 $sql_merge = mysqli_query($mysqli, "SELECT * FROM tickets
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
diff --git a/agent/modals/ticket/ticket_priority.php b/agent/modals/ticket/ticket_priority.php
index 3437ef7f..e494e316 100644
--- a/agent/modals/ticket/ticket_priority.php
+++ b/agent/modals/ticket/ticket_priority.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -14,10 +16,13 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_priority = escapeHtml($row['ticket_priority']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
-// Generate the HTML form content using output buffering.
 ob_start();
 
 ?>
@@ -31,7 +36,6 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="ticket_id" value="<?php echo $ticket_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
 
     <div class="modal-body">
 
diff --git a/agent/modals/ticket/ticket_quote_add.php b/agent/modals/ticket/ticket_quote_add.php
index 8cd0de3d..c79fcb5a 100644
--- a/agent/modals/ticket/ticket_quote_add.php
+++ b/agent/modals/ticket/ticket_quote_add.php
@@ -61,7 +61,9 @@ $asset_id = intval($row['asset_id']);
 $asset_name = escapeHtml($row['asset_name']);
 $asset_type = escapeHtml($row['asset_type']);
 
-
+if ($client_id) {
+    enforceClientAccess();
+}
 
 ob_start();
 
diff --git a/agent/modals/transfer/transfer_edit.php b/agent/modals/transfer/transfer_edit.php
index 4aba2507..d54e969f 100644
--- a/agent/modals/transfer/transfer_edit.php
+++ b/agent/modals/transfer/transfer_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_financial', 2);
+
 $transfer_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT transfer_created_at, expense_date AS transfer_date, expense_amount AS transfer_amount, expense_account_id AS transfer_account_from, revenue_account_id AS transfer_account_to, transfer_expense_id, transfer_revenue_id, transfer_id, transfer_method, transfer_notes FROM transfers, expenses, revenues
@@ -22,8 +24,8 @@ $transfer_created_at = escapeHtml($row['transfer_created_at']);
 $expense_id = intval($row['transfer_expense_id']);
 $revenue_id = intval($row['transfer_revenue_id']);
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/vendor/vendor_add.php b/agent/modals/vendor/vendor_add.php
index b2109b77..adb82e46 100644
--- a/agent/modals/vendor/vendor_add.php
+++ b/agent/modals/vendor/vendor_add.php
@@ -4,6 +4,10 @@ require_once '../../../includes/modal_header.php';
 
 $client_id = intval($_GET['client_id'] ?? 0);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
 
 ?>
diff --git a/agent/modals/vendor/vendor_details.php b/agent/modals/vendor/vendor_details.php
index 93d4f128..1f0a86a0 100644
--- a/agent/modals/vendor/vendor_details.php
+++ b/agent/modals/vendor/vendor_details.php
@@ -19,6 +19,11 @@ $hours = escapeSql($row['vendor_hours']);
 $sla = escapeSql($row['vendor_sla']);
 $code = escapeSql($row['vendor_code']);
 $notes = escapeSql($row['vendor_notes']);
+$client_id = intval($row['vendor_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 ob_start();
 
diff --git a/agent/modals/vendor/vendor_edit.php b/agent/modals/vendor/vendor_edit.php
index e457066e..5fa7c453 100644
--- a/agent/modals/vendor/vendor_edit.php
+++ b/agent/modals/vendor/vendor_edit.php
@@ -21,6 +21,11 @@ $vendor_sla = escapeHtml($row['vendor_sla']);
 $vendor_code = escapeHtml($row['vendor_code']);
 $vendor_notes = escapeHtml($row['vendor_notes']);
 $vendor_template_id = intval($row['vendor_template_id']);
+$client_id = intval($row['vendor_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 ob_start();
 
diff --git a/agent/post/ticket.php b/agent/post/ticket.php
index 7a962b6b..1549adf5 100644
--- a/agent/post/ticket.php
+++ b/agent/post/ticket.php
@@ -322,7 +322,6 @@ if (isset($_POST['edit_ticket_priority'])) {
 
     $ticket_id = intval($_POST['ticket_id']);
     $priority = escapeSql($_POST['priority']);
-    $client_id = intval($_POST['client_id']);
 
     // Get ticket details before updating
     $sql = mysqli_query($mysqli, "SELECT
diff --git a/agent/recurring_invoice.php b/agent/recurring_invoice.php
index eb4bdc75..d8af9883 100644
--- a/agent/recurring_invoice.php
+++ b/agent/recurring_invoice.php
@@ -7,6 +7,8 @@ if (isset($_GET['client_id'])) {
     require_once "includes/inc_all.php";
 }
 
+enforceUserPermission('module_sales');
+
 if (isset($_GET['recurring_invoice_id'])) {
 
     $recurring_invoice_id = intval($_GET['recurring_invoice_id']);
@@ -112,6 +114,8 @@ if (isset($_GET['recurring_invoice_id'])) {
         $json_products = json_encode($products);
     }
 
+    enforceClientAccess();
+
     ?>
 
     <ol class="breadcrumb d-print-none">