From 317fe913596185e402e5c56cf5e2ba625f601802 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 9 Jul 2026 16:07:54 -0400 Subject: [PATCH] Add Missing clientEnforcement in various modals, already handled on POST also add client selection in edit trip and enforce client permissions on trips --- agent/modals/asset/asset_interface_edit.php | 5 ++- agent/modals/document/document_bulk_move.php | 2 ++ .../document/document_edit_visibility.php | 3 ++ agent/modals/document/document_link_asset.php | 3 ++ .../modals/document/document_link_contact.php | 2 ++ agent/modals/document/document_link_file.php | 2 ++ .../document/document_link_software.php | 2 ++ .../modals/document/document_link_vendor.php | 2 ++ agent/modals/document/document_move.php | 4 ++- agent/modals/document/document_rename.php | 4 ++- .../modals/document/document_version_view.php | 6 ++-- agent/modals/document/document_view.php | 4 ++- agent/modals/file/file_bulk_move.php | 2 ++ agent/modals/file/file_move.php | 5 ++- agent/modals/file/file_rename.php | 4 ++- agent/modals/file/file_upload.php | 3 ++ agent/modals/folder/folder_add.php | 3 ++ agent/modals/folder/folder_rename.php | 5 ++- agent/modals/invoice/invoice_copy.php | 5 ++- agent/modals/invoice/invoice_edit.php | 4 ++- agent/modals/invoice/invoice_item_edit.php | 7 ++-- .../modals/invoice/invoice_recurring_add.php | 4 +++ agent/modals/location/location_edit.php | 2 ++ agent/modals/payment/invoice_apply_credit.php | 4 ++- agent/modals/payment/payment_add.php | 4 ++- agent/modals/payment/payment_bulk_add.php | 2 ++ agent/modals/payment/payment_edit.php | 6 +++- .../payment/payment_saved_method_add.php | 4 ++- agent/modals/project/project_edit.php | 6 +++- .../project/project_link_closed_ticket.php | 1 + agent/modals/project/project_link_ticket.php | 1 + agent/modals/quote/quote_copy.php | 4 ++- agent/modals/quote/quote_item_edit.php | 7 ++-- agent/modals/quote/quote_to_invoice.php | 4 +++ agent/modals/rack/rack_device_add.php | 5 ++- .../recurring_expense_add.php | 2 +- .../recurring_expense_edit.php | 10 ++++-- .../recurring_invoice_edit.php | 5 ++- .../recurring_invoice_item_edit.php | 7 ++-- .../recurring_ticket_edit.php | 6 +++- agent/modals/service/service_details.php | 5 ++- agent/modals/service/service_edit.php | 5 ++- agent/modals/ticket/ticket_reply_edit.php | 4 +++ agent/modals/trip/trip_add.php | 2 +- agent/modals/trip/trip_copy.php | 8 +++-- agent/modals/trip/trip_edit.php | 34 ++++++++++++++++++- agent/post/asset.php | 2 ++ agent/post/trip.php | 2 +- agent/recurring_expenses.php | 1 + agent/trips.php | 1 + 50 files changed, 188 insertions(+), 37 deletions(-) diff --git a/agent/modals/asset/asset_interface_edit.php b/agent/modals/asset/asset_interface_edit.php index fc99b1e8..6cca3174 100644 --- a/agent/modals/asset/asset_interface_edit.php +++ b/agent/modals/asset/asset_interface_edit.php @@ -28,6 +28,8 @@ $interface_ipv6 = nullable_htmlentities($row['interface_ipv6']); $interface_primary = intval($row['interface_primary']); $interface_notes = nullable_htmlentities($row['interface_notes']); +enforceClientAccess(); + // Determine the linked interface for $interface_id $linked_interface_id = null; $sql_link = mysqli_query($mysqli, " @@ -45,9 +47,10 @@ if ($link_row = mysqli_fetch_assoc($sql_link)) { } } -// Generate the HTML form content using output buffering. ob_start(); + ?> +
Editing Interface: -
diff --git a/agent/post/asset.php b/agent/post/asset.php index 8f01972b..a7ba2489 100644 --- a/agent/post/asset.php +++ b/agent/post/asset.php @@ -1201,6 +1201,8 @@ if (isset($_POST['export_assets_csv'])) { $client_row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id")); $client_name = $client_row['client_name']; $file_name_prepend = "$client_name-"; + + enforceClientAccess(); } else { $client_query = ''; $client_id = 0; // for Logging diff --git a/agent/post/trip.php b/agent/post/trip.php index 378faf90..83d4a0d2 100644 --- a/agent/post/trip.php +++ b/agent/post/trip.php @@ -40,7 +40,7 @@ if (isset($_POST['edit_trip'])) { $trip_id = intval($_POST['trip_id']); - $client_id = intval(getFieldById('trips', $trip_id, 'trip_client_id')); + $client_id = intval($_POST['client_id']); if ($client_id) { enforceClientAccess(); diff --git a/agent/recurring_expenses.php b/agent/recurring_expenses.php index 93399fdc..63f8eac0 100644 --- a/agent/recurring_expenses.php +++ b/agent/recurring_expenses.php @@ -18,6 +18,7 @@ $sql = mysqli_query( LEFT JOIN clients ON recurring_expense_client_id = client_id WHERE DATE(recurring_expense_created_at) BETWEEN '$dtf' AND '$dtt' AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR recurring_expense_description LIKE '%$q%' OR recurring_expense_amount LIKE '%$q%') + $access_permission_query ORDER BY $sort $order LIMIT $record_from, $record_to" ); diff --git a/agent/trips.php b/agent/trips.php index 4bef15c1..b1f119d7 100644 --- a/agent/trips.php +++ b/agent/trips.php @@ -24,6 +24,7 @@ $sql = mysqli_query( AND DATE(trip_date) BETWEEN '$dtf' AND '$dtt' AND trip_archived_at IS NULL $client_query + $access_permission_query ORDER BY $sort $order LIMIT $record_from, $record_to" );