AS1024
/
itflow
mirror of https://github.com/itflow-org/itflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1173 from itflow-org/small-fix 

Small perms fixes
This commit is contained in:
Johnny 2025-02-22 13:38:05 -05:00 committed by GitHub
parent 69850f83d3 8eea19d03d
commit 2d39f21b51
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 43 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
invoice.php
View File

@ -3,10 +3,18 @@
// If client_id is in URI then show client Side Bar and client header
if (isset($_GET['client_id'])) {
require_once "includes/inc_all_client.php";
} else {
} else {
require_once "includes/inc_all.php";
}
// Perms
enforceUserPermission('module_sales');
$invoice_permission_snippet = '';
if (!empty($client_access_string)) {
$invoice_permission_snippet = "AND invoice_client_id IN ($client_access_string)";
}
if (isset($_GET['invoice_id'])) {
$invoice_id = intval($_GET['invoice_id']);
@ -17,7 +25,8 @@ if (isset($_GET['invoice_id'])) {
LEFT JOIN clients ON invoice_client_id = client_id
LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
WHERE invoice_id = $invoice_id"
WHERE invoice_id = $invoice_id
$invoice_permission_snippet"
);
if (mysqli_num_rows($sql) == 0) {
@ -215,13 +224,13 @@ if (isset($_GET['invoice_id'])) {
</a>
<?php } ?>
<?php } ?>
<?php if (($invoice_status == 'Sent' || $invoice_status == 'Viewed') && $invoice_amount == 0 && $invoice_status !== 'Non-Billable') { ?>
<a class="btn btn-dark" href="post.php?mark_invoice_non-billable=<?php echo $invoice_id; ?>">
Mark Non-Billable
</a>
<?php } ?>
</div>
<div class="col-4">

5
invoices.php
View File

@ -17,6 +17,10 @@ if (isset($_GET['client_id'])) {
// Perms
enforceUserPermission('module_sales');
$invoice_permission_snippet = '';
if (!empty($client_access_string)) {
$invoice_permission_snippet = "AND invoice_client_id IN ($client_access_string)";
}
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Sent' $client_query"));
$sent_count = $row['num'];
@ -94,6 +98,7 @@ $sql = mysqli_query(
$overdue_query
AND DATE(invoice_date) BETWEEN '$dtf' AND '$dtt'
AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$q%' OR invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR invoice_status LIKE '%$q%' OR invoice_amount LIKE '%$q%' OR category_name LIKE '%$q%')
$invoice_permission_snippet
$client_query
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

14
quote.php
View File

@ -3,10 +3,17 @@
// If client_id is in URI then show client Side Bar and client header
if (isset($_GET['client_id'])) {
require_once "includes/inc_all_client.php";
} else {
} else {
require_once "includes/inc_all.php";
}
// Perms
enforceUserPermission('module_sales');
$quote_permission_snippet = '';
if (!empty($client_access_string)) {
$quote_permission_snippet = "AND quote_client_id IN ($client_access_string)";
}
if (isset($_GET['quote_id'])) {
$quote_id = intval($_GET['quote_id']);
@ -17,7 +24,8 @@ if (isset($_GET['quote_id'])) {
LEFT JOIN clients ON quote_client_id = client_id
LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
WHERE quote_id = $quote_id"
WHERE quote_id = $quote_id
$quote_permission_snippet"
);
if (mysqli_num_rows($sql) == 0) {
@ -186,7 +194,7 @@ if (isset($_GET['quote_id'])) {
</a>
<?php if (lookupUserPermission("module_sales") >= 2) { ?>
<a class="dropdown-item" href="#"
data-toggle = "ajax-modal"
data-toggle = "ajax-modal"
data-ajax-url = "ajax/ajax_quote_copy.php"
data-ajax-id = "<?php echo $quote_id; ?>"
>

11
quotes.php
View File

@ -17,6 +17,10 @@ if (isset($_GET['client_id'])) {
// Perms
enforceUserPermission('module_sales');
$quote_permission_snippet = '';
if (!empty($client_access_string)) {
$quote_permission_snippet = "AND quote_client_id IN ($client_access_string)";
}
$sql = mysqli_query(
$mysqli,
@ -25,6 +29,7 @@ $sql = mysqli_query(
LEFT JOIN categories ON quote_category_id = category_id
WHERE (CONCAT(quote_prefix,quote_number) LIKE '%$q%' OR quote_scope LIKE '%$q%' OR category_name LIKE '%$q%' OR quote_status LIKE '%$q%' OR quote_amount LIKE '%$q%' OR client_name LIKE '%$q%')
AND DATE(quote_date) BETWEEN '$dtf' AND '$dtt'
$quote_permission_snippet
$client_query
ORDER BY $sort $order LIMIT $record_from, $record_to"
);
@ -206,7 +211,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<tr>
<td class="text-bold">
<a href="quote.php?<?php echo $client_url; ?>quote_id=<?php echo $quote_id; ?>">
<?php echo "$quote_prefix$quote_number"; ?>
<?php echo "$quote_prefix$quote_number"; ?>
</a>
</td>
<td><?php echo $quote_scope_display; ?></td>
@ -231,7 +236,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
</button>
<div class="dropdown-menu">
<a class="dropdown-item" href="#"
data-toggle = "ajax-modal"
data-toggle = "ajax-modal"
data-ajax-url = "ajax/ajax_quote_edit.php"
data-ajax-id = "<?php echo $quote_id; ?>"
>
@ -239,7 +244,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
</a>
<?php if (lookupUserPermission("module_sales") >= 2) { ?>
<a class="dropdown-item" href="#"
data-toggle = "ajax-modal"
data-toggle = "ajax-modal"
data-ajax-url = "ajax/ajax_quote_copy.php"
data-ajax-id = "<?php echo $quote_id; ?>"
>

14
ticket.php
View File

@ -11,6 +11,10 @@ if (isset($_GET['client_id'])) {
// Perms
enforceUserPermission('module_support');
$ticket_permission_snippet = '';
if (!empty($client_access_string)) {
$ticket_permission_snippet = "AND ticket_client_id IN ($client_access_string)";
}
// Initialize the HTML Purifier to prevent XSS
require_once "plugins/htmlpurifier/HTMLPurifier.standalone.php";
@ -20,12 +24,6 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting
$purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
$purifier = new HTMLPurifier($purifier_config);
// Ticket client access snippet
$ticket_permission_snippet = '';
if (!empty($client_access_string)) {
$ticket_permission_snippet = "AND ticket_client_id IN ($client_access_string)";
}
if (isset($_GET['ticket_id'])) {
$ticket_id = intval($_GET['ticket_id']);
@ -51,7 +49,7 @@ if (isset($_GET['ticket_id'])) {
if (mysqli_num_rows($sql) == 0) {
echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='tickets.php'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
include_once "footer.php";
include_once "includes/footer.php";
} else {
$row = mysqli_fetch_array($sql);
@ -981,7 +979,7 @@ if (isset($_GET['ticket_id'])) {
</td>
</tr>
<?php
}
}
?>
</table>
</div>