Add Missing clientEnforcement in various modals, already handled on POST also add client selection in edit trip and enforce client permissions on trips

agent/modals/document/document_bulk_move.php

@@ -7,6 +7,8 @@ $selected_ids = array_map('intval', $_GET['selected_ids'] ?? []);
 
 $count = count($selected_ids);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_edit_visibility.php

@@ -14,9 +14,12 @@ $document_name = nullable_htmlentities($row['document_name']);
 $document_client_visible = intval($row['document_client_visible']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title">
         <i class="fa fa-fw fa-handshake mr-2"></i>

agent/modals/document/document_link_asset.php

@@ -13,9 +13,12 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-desktop mr-2"></i>Link Asset to <strong><?= $document_name ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_link_contact.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_link_file.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_link_software.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_link_vendor.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_move.php

@@ -11,10 +11,12 @@ $client_id = intval($row['document_client_id']);
 $document_folder_id = nullable_htmlentities($row['document_folder_id']);
 $document_name = nullable_htmlentities($row['document_name']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-file-alt mr-2"></i>Moving document: <strong><?php echo $document_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_rename.php

@@ -10,10 +10,12 @@ $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['document_client_id']);
 $document_name = nullable_htmlentities($row['document_name']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-file-alt mr-2"></i>Renaming document: <strong><?php echo $document_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_version_view.php

@@ -12,15 +12,17 @@ $purifier = new HTMLPurifier($purifier_config);
 
 $document_version_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM document_versions WHERE document_version_id = $document_version_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT * FROM document_versions LEFT JOIN documents ON document_id = document_version_document_id WHERE document_version_id = $document_version_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $document_version_name = nullable_htmlentities($row['document_version_name']);
 $document_version_content = $purifier->purify($row['document_version_content']);
+$client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/document/document_view.php

@@ -17,10 +17,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $docum
 $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $document_content = $purifier->purify($row['document_content']);
+$client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">