Add Missing clientEnforcement in various modals, already handled on POST also add client selection in edit trip and enforce client permissions on trips

agent/modals/asset/asset_interface_edit.php

@@ -28,6 +28,8 @@ $interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
 $interface_primary = intval($row['interface_primary']);
 $interface_notes = nullable_htmlentities($row['interface_notes']);
 
+enforceClientAccess();
+
 // Determine the linked interface for $interface_id
 $linked_interface_id = null;
 $sql_link = mysqli_query($mysqli, "
@@ -45,9 +47,10 @@ if ($link_row = mysqli_fetch_assoc($sql_link)) {
     }
 }
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class='fa fa-fw fa-ethernet mr-2'></i>Editing Interface: <?php echo $asset_name; ?> - <strong><?php echo $interface_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_bulk_move.php

@@ -7,6 +7,8 @@ $selected_ids = array_map('intval', $_GET['selected_ids'] ?? []);
 
 $count = count($selected_ids);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_edit_visibility.php

@@ -14,9 +14,12 @@ $document_name = nullable_htmlentities($row['document_name']);
 $document_client_visible = intval($row['document_client_visible']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title">
         <i class="fa fa-fw fa-handshake mr-2"></i>

agent/modals/document/document_link_asset.php

@@ -13,9 +13,12 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-desktop mr-2"></i>Link Asset to <strong><?= $document_name ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_link_contact.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_link_file.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_link_software.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_link_vendor.php

@@ -13,6 +13,8 @@ $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/document/document_move.php

@@ -11,10 +11,12 @@ $client_id = intval($row['document_client_id']);
 $document_folder_id = nullable_htmlentities($row['document_folder_id']);
 $document_name = nullable_htmlentities($row['document_name']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-file-alt mr-2"></i>Moving document: <strong><?php echo $document_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_rename.php

@@ -10,10 +10,12 @@ $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['document_client_id']);
 $document_name = nullable_htmlentities($row['document_name']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-file-alt mr-2"></i>Renaming document: <strong><?php echo $document_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/document/document_version_view.php

@@ -12,15 +12,17 @@ $purifier = new HTMLPurifier($purifier_config);
 
 $document_version_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM document_versions WHERE document_version_id = $document_version_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT * FROM document_versions LEFT JOIN documents ON document_id = document_version_document_id WHERE document_version_id = $document_version_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $document_version_name = nullable_htmlentities($row['document_version_name']);
 $document_version_content = $purifier->purify($row['document_version_content']);
+$client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/document/document_view.php

@@ -17,10 +17,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $docum
 $row = mysqli_fetch_assoc($sql);
 $document_name = nullable_htmlentities($row['document_name']);
 $document_content = $purifier->purify($row['document_content']);
+$client_id = intval($row['document_client_id']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/file/file_bulk_move.php

@@ -13,6 +13,8 @@ $count_files = count($file_ids);
 $count_docs  = count($document_ids);
 $total       = $count_files + $count_docs;
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/file/file_move.php

@@ -35,9 +35,12 @@ if ($file_ext == 'pdf') {
     $file_icon = "file";
 }
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-<?php echo $file_icon; ?> mr-2"></i>Moving File: <strong><?php echo $file_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/file/file_rename.php

@@ -35,8 +35,10 @@ if ($file_ext == 'pdf') {
     $file_icon = "file";
 }
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-<?php echo $file_icon; ?> mr-2"></i>Renaming file: <strong><?php echo $file_name; ?></strong></h5>

agent/modals/file/file_upload.php

@@ -7,9 +7,12 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $asset_id = intval($_GET['asset_id'] ?? 0);
 intval($_GET['folder_id'] ?? 0);
 
+enforceClientAccess();
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-cloud-upload-alt mr-2"></i>Upload File(s)</h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/folder/folder_add.php

@@ -6,9 +6,12 @@ $client_id = intval($_GET['client_id'] ?? 0);
 $current_folder_id = intval($_GET['current_folder_id'] ?? 0);
 $folder_name = nullable_htmlentities(getFieldByID('folders', $current_folder_id, 'folder_name') ?? '/');
 
+enforceClientAccess();
+
 ob_start();
 
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-folder-plus mr-2"></i>Creating folder in <strong><?= $folder_name ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/folder/folder_rename.php

@@ -8,11 +8,14 @@ $sql = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_id = $folder_id
 
 $row = mysqli_fetch_assoc($sql);
 $folder_name = nullable_htmlentities($row['folder_name']);
+$client_id = intval($row['folder_client_id']);
 
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-folder mr-2"></i>Renaming folder: <strong><?php echo $folder_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/invoice/invoice_copy.php

@@ -10,9 +10,12 @@ $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
 $invoice_number = intval($row['invoice_number']);
 $client_name = nullable_htmlentities($row['client_name']);
+$client_id = intval($row['invoice_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/invoice/invoice_edit.php

@@ -18,8 +18,10 @@ $category_id = intval($row['invoice_category_id']);
 $client_id = intval($row['client_id']);
 $client_name = nullable_htmlentities($row['client_name']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/invoice/invoice_item_edit.php

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $item_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_id = $item_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT * FROM invoice_items LEFT JOIN invoices ON invoice_id = item_invoice_id WHERE item_id = $item_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $item_name = nullable_htmlentities($row['item_name']);
 $item_description = nullable_htmlentities($row['item_description']);
@@ -13,9 +13,12 @@ $item_price = floatval($row['item_price']);
 $item_created_at = nullable_htmlentities($row['item_created_at']);
 $tax_id = intval($row['item_tax_id']);
 $product_id = intval($row['item_product_id']);
+$client_id = intval($row['invoice_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/invoice/invoice_recurring_add.php

@@ -9,8 +9,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice
 $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
 $invoice_number = intval($row['invoice_number']);
+$client_id = intval($row['invoice_client_id']);
+
+enforceClientAccess();
 
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/location/location_edit.php

@@ -28,6 +28,8 @@ $location_contact_id = intval($row['location_contact_id']);
 $client_id = intval($row['location_client_id']);
 $location_primary = intval($row['location_primary']);
 
+enforceClientAccess();
+
 // Tags
 $location_tag_id_array = array();
 $sql_location_tags = mysqli_query($mysqli, "SELECT * FROM location_tags WHERE location_id = $location_id");

agent/modals/payment/invoice_apply_credit.php

@@ -19,8 +19,10 @@ $row = mysqli_fetch_assoc($sql_credit_balance);
 
 $credit_balance = floatval($row['credit_balance']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/payment/payment_add.php

@@ -32,8 +32,10 @@ $amount_paid = floatval($row['amount_paid']);
 
 $balance = $invoice_amount - $amount_paid;
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/payment/payment_bulk_add.php

@@ -30,6 +30,8 @@ $amount_paid = floatval($row['amount_paid']);
 
 $balance = $invoice_amounts - $amount_paid;
 
+enforceClientAccess();
+
 ob_start();
 
 ?>

agent/modals/payment/payment_edit.php

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $payment_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payments WHERE payment_id = $payment_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT * FROM payments LEFT JOIN invoices ON invoice_id = payment_invoice_id WHERE payment_id = $payment_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $payment_date = nullable_htmlentities($row['payment_date']);
@@ -12,8 +12,12 @@ $payment_method = nullable_htmlentities($row['payment_method']);
 $payment_amount = floatval($row['payment_amount']);
 $payment_reference = nullable_htmlentities($row['payment_reference']);
 $payment_account_id = intval($row['payment_account_id']);
+$client_id = intval($row['invoice_client_id']);
+
+enforceClientAccess();
 
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/payment/payment_saved_method_add.php

@@ -12,8 +12,10 @@ $invoice_number = intval($row['invoice_number']);
 $invoice_amount = floatval($row['invoice_amount']);
 $client_id = intval($row['invoice_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/project/project_edit.php

@@ -21,8 +21,12 @@ $project_archived_at = nullable_htmlentities($row['project_archived_at']);
 $client_id = intval($row['project_client_id']);
 $project_manager = intval($row['project_manager']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/project/project_link_closed_ticket.php

@@ -7,6 +7,7 @@ $client_id = intval($_GET['client_id'] ?? 0);
 
 if ($client_id) {
     $client_ticket_select_query = "AND ticket_client_id = $client_id"; // Used when linking a ticket to the project
+    enforceClientAccess();
 } else {
     $client_ticket_select_query = '';
 }

agent/modals/project/project_link_ticket.php

@@ -7,6 +7,7 @@ $client_id = intval($_GET['client_id'] ?? 0);
 
 if ($client_id) {
     $client_ticket_select_query = "AND ticket_client_id = $client_id"; // Used when linking a ticket to the project
+    enforceClientAccess();
 } else {
     $client_ticket_select_query = '';
 }

agent/modals/quote/quote_copy.php

@@ -12,8 +12,10 @@ $quote_number = intval($row['quote_number']);
 $client_id = intval($row['client_id']);
 $client_name = nullable_htmlentities($row['client_name']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/quote/quote_item_edit.php

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $item_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM quote_items WHERE item_id = $item_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT * FROM quote_items LEFT JOIN quotes ON quote_id = item_quote_id WHERE item_id = $item_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $item_name = nullable_htmlentities($row['item_name']);
 $item_description = nullable_htmlentities($row['item_description']);
@@ -13,9 +13,12 @@ $item_price = floatval($row['item_price']);
 $item_created_at = nullable_htmlentities($row['item_created_at']);
 $tax_id = intval($row['item_tax_id']);
 $product_id = intval($row['item_product_id']);
+$client_id = intval($row['quote_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/quote/quote_to_invoice.php

@@ -9,8 +9,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id LI
 $row = mysqli_fetch_assoc($sql);
 $quote_prefix = nullable_htmlentities($row['quote_prefix']);
 $quote_number = intval($row['quote_number']);
+$client_id = intval($row['quote_client_id']);
+
+enforceClientAccess();
 
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/rack/rack_device_add.php

@@ -10,9 +10,12 @@ $row = mysqli_fetch_assoc($sql);
 $rack_name = nullable_htmlentities($row['rack_name']);
 $client_id = intval($row['rack_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-server mr-2"></i>Adding Device to Rack <strong><?php echo $rack_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/recurring_expense/recurring_expense_add.php

@@ -213,7 +213,7 @@ ob_start();
                             <option value="0">- Client (Optional) -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name = nullable_htmlentities($row['client_name']);

agent/modals/recurring_expense/recurring_expense_edit.php

@@ -23,7 +23,11 @@ $recurring_expense_created_at = nullable_htmlentities($row['recurring_expense_cr
 $recurring_expense_vendor_id = intval($row['recurring_expense_vendor_id']);
 $recurring_expense_category_id = intval($row['recurring_expense_category_id']);
 $recurring_expense_account_id = intval($row['recurring_expense_account_id']);
-$recurring_expense_client_id = intval($row['recurring_expense_client_id']);
+$client_id = intval($row['recurring_expense_client_id']);
+
+if ($client_id) {
+    enforceClientAccess();
+}
 
 // Generate the HTML form content using output buffering.
 ob_start();
@@ -238,12 +242,12 @@ ob_start();
                             <option value="">- Select Client -</option>
                             <?php
 
-                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
+                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_clients)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = nullable_htmlentities($row['client_name']);
                                 ?>
-                                <option <?php if ($recurring_expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
+                                <option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
 
                                 <?php
                             }

agent/modals/recurring_invoice/recurring_invoice_edit.php

@@ -16,9 +16,12 @@ $recurring_invoice_created_at = date('Y-m-d', strtotime($row['recurring_invoice_
 $recurring_invoice_next_date = nullable_htmlentities($row['recurring_invoice_next_date']);
 $recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
 $category_id = intval($row['recurring_invoice_category_id']);
+$client_id = intval($row['recurring_invoice_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/recurring_invoice/recurring_invoice_item_edit.php

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $item_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items WHERE item_id = $item_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items LEFT JOIN recurring_invoices ON recurring_invoice_id = item_recurring_invoice_id WHERE item_id = $item_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $item_name = nullable_htmlentities($row['item_name']);
 $item_description = nullable_htmlentities($row['item_description']);
@@ -13,9 +13,12 @@ $item_price = floatval($row['item_price']);
 $item_created_at = nullable_htmlentities($row['item_created_at']);
 $tax_id = intval($row['item_tax_id']);
 $product_id = intval($row['item_product_id']);
+$client_id = intval($row['recurring_invoice_client_id']);
+
+enforceClientAccess();
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/recurring_ticket/recurring_ticket_edit.php

@@ -27,8 +27,12 @@ while ($row = mysqli_fetch_assoc($sql_additional_assets)) {
     $additional_assets_array[] = $additional_asset_id;
 }
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">

agent/modals/service/service_details.php

@@ -17,6 +17,8 @@ $service_updated_at = nullable_htmlentities($row['service_updated_at']);
 $service_review_due = nullable_htmlentities($row['service_review_due']);
 $client_id = intval($row['service_client_id']);
 
+enforceClientAccess();
+
 // Service Importance
 if ($service_importance == "High") {
     $service_importance_display = "<span class='p-2 badge badge-danger'>$service_importance</span>";
@@ -88,9 +90,10 @@ $sql_docs = mysqli_query(
     WHERE service_id = $service_id"
 );
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title text-white"><i class="fa fa-fw fa-stream mr-2"></i><?php echo $service_name; ?></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/service/service_edit.php

@@ -18,6 +18,8 @@ $service_updated_at = nullable_htmlentities($row['service_updated_at']);
 $service_review_due = nullable_htmlentities($row['service_review_due']);
 $client_id = intval($row['service_client_id']);
 
+enforceClientAccess();
+
 // Associated Assets (and their credentials/networks/locations)
 $sql_assets = mysqli_query(
     $mysqli,
@@ -81,9 +83,10 @@ $sql_docs = mysqli_query(
     WHERE service_id = $service_id"
 );
 
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title text-white"><i class="fa fa-fw fa-stream mr-2"></i>Editing service: <strong><?php echo $service_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">

agent/modals/ticket/ticket_reply_edit.php

@@ -17,6 +17,10 @@ $ticket_reply_time_worked_formatted = date_format($ticket_reply_time_worked, 'H:
 $ticket_reply = nullable_htmlentities($row['ticket_reply']);
 $client_id = intval($row['ticket_client_id']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 // Generate the HTML form content using output buffering.
 ob_start();
 

agent/modals/trip/trip_add.php

@@ -125,7 +125,7 @@ ob_start();
                         <option value="0">- Client (Optional) -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at is NULL ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at is NULL $access_permission_query ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = nullable_htmlentities($row['client_name']);

agent/modals/trip/trip_copy.php

@@ -18,8 +18,12 @@ $trip_archived_at = nullable_htmlentities($row['trip_archived_at']);
 $round_trip = nullable_htmlentities($row['round_trip']);
 $client_id = intval($row['trip_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
@@ -144,7 +148,7 @@ ob_start();
                         <option value="">- Client (Optional) -</option>
                         <?php
 
-                        $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_clients)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = nullable_htmlentities($row['client_name']);

agent/modals/trip/trip_edit.php

@@ -18,8 +18,12 @@ $trip_archived_at = nullable_htmlentities($row['trip_archived_at']);
 $round_trip = nullable_htmlentities($row['round_trip']);
 $client_id = intval($row['trip_client_id']);
 
-// Generate the HTML form content using output buffering.
+if ($client_id) {
+    enforceClientAccess();
+}
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
@@ -131,6 +135,34 @@ ob_start();
             </div>
         </div>
 
+        <?php if (isset($_GET['client_id'])) { ?>
+            <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
+        <?php } else { ?>
+
+            <div class="form-group">
+                <label>Client</label>
+                <div class="input-group">
+                    <div class="input-group-prepend">
+                        <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
+                    </div>
+                    <select class="form-control select2" name="client_id">
+                        <option value="">- Client (Optional) -</option>
+                        <?php
+
+                        $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        while ($row = mysqli_fetch_assoc($sql_clients)) {
+                            $client_id_select = intval($row['client_id']);
+                            $client_name_select = nullable_htmlentities($row['client_name']);
+                            ?>
+                            <option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
+
+                        <?php } ?>
+                    </select>
+                </div>
+            </div>
+
+        <?php } ?>
+
     </div>
 
     <div class="modal-footer">

agent/post/asset.php

@@ -1201,6 +1201,8 @@ if (isset($_POST['export_assets_csv'])) {
         $client_row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"));
         $client_name = $client_row['client_name'];
         $file_name_prepend = "$client_name-";
+
+        enforceClientAccess();
     } else {
         $client_query = '';
         $client_id = 0; // for Logging

agent/post/trip.php

@@ -40,7 +40,7 @@ if (isset($_POST['edit_trip'])) {
 
     $trip_id = intval($_POST['trip_id']);
 
-    $client_id = intval(getFieldById('trips', $trip_id, 'trip_client_id'));
+    $client_id = intval($_POST['client_id']);
 
     if ($client_id) {
         enforceClientAccess();

agent/recurring_expenses.php

@@ -18,6 +18,7 @@ $sql = mysqli_query(
     LEFT JOIN clients ON recurring_expense_client_id = client_id
     WHERE DATE(recurring_expense_created_at) BETWEEN '$dtf' AND '$dtt'
     AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR recurring_expense_description LIKE '%$q%' OR recurring_expense_amount LIKE '%$q%')
+    $access_permission_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 

agent/trips.php

@@ -24,6 +24,7 @@ $sql = mysqli_query(
     AND DATE(trip_date) BETWEEN '$dtf' AND '$dtt'
     AND trip_archived_at IS NULL
     $client_query
+    $access_permission_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );