More Client Enforcement in modals across the app

2026-08-18 05:25:12 +00:00 · 2026-07-16 13:10:02 -04:00
parent 9e84ce4c07
commit 2c09ce097c
34 changed files with 172 additions and 36 deletions
--- a/agent/modals/ticket/ticket_add.php
+++ b/agent/modals/ticket/ticket_add.php
@@ -7,6 +7,10 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $asset_id = intval($_GET['asset_id'] ?? 0);
 $project_id = intval($_GET['project_id'] ?? 0);

+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_add_v2.php
+++ b/agent/modals/ticket/ticket_add_v2.php
@@ -6,6 +6,10 @@ $client_id = intval($_GET['client_id'] ?? 0);
 $contact_id = intval($_GET['contact_id'] ?? 0);
 $project_id = intval($_GET['project_id'] ?? 0);

+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_assign.php
+++ b/agent/modals/ticket/ticket_assign.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -17,8 +19,12 @@ $ticket_assigned_to = intval($row['ticket_assigned_to']);
 $ticket_status = intval($row['ticket_status']);
 $ticket_closed_at = escapeHtml($row['ticket_closed_at']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_billable.php
+++ b/agent/modals/ticket/ticket_billable.php
@@ -10,8 +10,10 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_billable = intval($row['ticket_billable']);
+$client_id = intval($row['ticket_client_id']);
+
+enforceClientAccess();

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_change_client.php
+++ b/agent/modals/ticket/ticket_change_client.php
@@ -1,6 +1,9 @@
 <?php
+
 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
@@ -10,7 +13,10 @@ $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $client_id = intval($row['ticket_client_id']);

-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_contact.php
+++ b/agent/modals/ticket/ticket_contact.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -14,10 +16,11 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $contact_id = intval($row['ticket_contact_id']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+enforceClientAccess();

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_edit.php
+++ b/agent/modals/ticket/ticket_edit.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 // Ticket client access overide - This is the only way to show tickets without a client to agents with restricted client access
 $access_permission_query_overide = '';
 if ($client_access_string) {
@@ -32,6 +34,10 @@ $location_id = intval($row['ticket_location_id']);
 $vendor_id = intval($row['ticket_vendor_id']);
 $project_id = intval($row['ticket_project_id']);

+if ($client_id) {
+    enforceClientAccess();
+}
+
 // Additional Assets Selected
 $additional_assets_array = array();
 $sql_additional_assets = mysqli_query($mysqli, "SELECT asset_id FROM ticket_assets WHERE ticket_id = $ticket_id");
@@ -40,9 +46,10 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
    $additional_assets_array[] = $additional_asset_id;
 }

-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
    <h5 class="modal-title"><i class="fa fa-fw fa-life-ring mr-2"></i>Ticket: <strong><?= "$ticket_prefix$ticket_number" ?></strong> - <?= $client_name ?></h5>
    <button type="button" class="close text-white" data-dismiss="modal">
--- a/agent/modals/ticket/ticket_edit_asset.php
+++ b/agent/modals/ticket/ticket_edit_asset.php
@@ -2,16 +2,22 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");

 $row = mysqli_fetch_assoc($sql);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $asset_id = intval($row['ticket_asset_id']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}

 // Additional Assets Selected
 $additional_assets_array = array();
@@ -21,8 +27,8 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
    $additional_assets_array[] = $additional_asset_id;
 }

-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>

 <div class="modal-header bg-dark">
--- a/agent/modals/ticket/ticket_edit_project.php
+++ b/agent/modals/ticket/ticket_edit_project.php
@@ -2,23 +2,28 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");

 $row = mysqli_fetch_assoc($sql);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_project_id = intval($row['ticket_project_id']);
+$client_id = intval($row['ticket_client_id']);

+if ($client_id) {
+    enforceClientAccess();
+}

 // Select box arrays
 $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE (project_client_id = $client_id OR project_client_id = 0) AND project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");

-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>

 <div class="modal-header bg-dark">
--- a/agent/modals/ticket/ticket_edit_schedule.php
+++ b/agent/modals/ticket/ticket_edit_schedule.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -15,13 +17,17 @@ $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_scheduled_for = escapeHtml($row['ticket_schedule']);
 $ticket_onsite = intval($row['ticket_onsite']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>
+
 <div class="modal-header bg-dark">
    <h5 class="modal-title">
        <i class="fa fa-fw fa-calendar-check mr-2"></i>Scheduling Ticket: <strong><?php echo "$ticket_prefix$ticket_number"; ?></strong>
--- a/agent/modals/ticket/ticket_edit_vendor.php
+++ b/agent/modals/ticket/ticket_edit_vendor.php
@@ -1,6 +1,9 @@
 <?php
+
 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
@@ -11,7 +14,10 @@ $ticket_number = intval($row['ticket_number']);
 $vendor_id = intval($row['ticket_vendor_id']);
 $client_id = intval($row['ticket_client_id']);

-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();

 ?>
--- a/agent/modals/ticket/ticket_invoice_add.php
+++ b/agent/modals/ticket/ticket_invoice_add.php
@@ -71,6 +71,10 @@ $location_state = escapeHtml($row['location_state']);
 $location_zip = escapeHtml($row['location_zip']);
 $location_phone = formatPhoneNumber($row['location_phone']);

+if ($client_id) {
+    enforceClientAccess();
+}
+
 //Get Total Ticket Time
 $ticket_total_reply_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) AS ticket_total_reply_time FROM ticket_replies WHERE ticket_reply_archived_at IS NULL AND ticket_reply_ticket_id = $ticket_id");
 $row = mysqli_fetch_assoc($ticket_total_reply_time);
--- a/agent/modals/ticket/ticket_merge.php
+++ b/agent/modals/ticket/ticket_merge.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['ticket_id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -16,7 +18,9 @@ $ticket_number = intval($row['ticket_number']);
 $client_name = escapeHtml($row['client_name']);
 $client_id = intval($row['ticket_client_id']);

-enforceClientAccess();
+if ($client_id) {
+    enforceClientAccess();
+}

 $sql_merge = mysqli_query($mysqli, "SELECT * FROM tickets
    LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
--- a/agent/modals/ticket/ticket_priority.php
+++ b/agent/modals/ticket/ticket_priority.php
@@ -2,6 +2,8 @@

 require_once '../../../includes/modal_header.php';

+enforceUserPermission('module_support', 2);
+
 $ticket_id = intval($_GET['id']);

 $sql = mysqli_query($mysqli, "SELECT * FROM tickets
@@ -14,10 +16,13 @@ $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
 $ticket_number = intval($row['ticket_number']);
 $ticket_priority = escapeHtml($row['ticket_priority']);
-$client_id = intval($row['ticket_client_id']);
 $client_name = escapeHtml($row['client_name']);
+$client_id = intval($row['ticket_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}

-// Generate the HTML form content using output buffering.
 ob_start();

 ?>
@@ -31,7 +36,6 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
    <input type="hidden" name="ticket_id" value="<?php echo $ticket_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">

    <div class="modal-body">

--- a/agent/modals/ticket/ticket_quote_add.php
+++ b/agent/modals/ticket/ticket_quote_add.php
@@ -61,7 +61,9 @@ $asset_id = intval($row['asset_id']);
 $asset_name = escapeHtml($row['asset_name']);
 $asset_type = escapeHtml($row['asset_type']);

-
+if ($client_id) {
+    enforceClientAccess();
+}

 ob_start();