From 32811fd1d2db0291f3a5112410947c2f315cbcd2 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 27 Aug 2026 15:27:55 -0400
Subject: [PATCH] Security: gate and client-scope the client overview record
 pages

---
 agent/asset.php     | 4 ++++
 agent/contact.php   | 4 ++++
 agent/contacts.php  | 3 +++
 agent/locations.php | 3 +++
 4 files changed, 14 insertions(+)

diff --git a/agent/asset.php b/agent/asset.php
index c326c8fb2..b15ceccf7 100644
--- a/agent/asset.php
+++ b/agent/asset.php
@@ -11,6 +11,9 @@ if (isset($_GET['client_id'])) {
     $client_url = '';
 }
 
+// Perms
+enforceUserPermission('module_support');
+
 if (isset($_GET['asset_id'])) {
     $asset_id = intval($_GET['asset_id']);
 
@@ -28,6 +31,7 @@ if (isset($_GET['asset_id'])) {
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_id = $asset_id
+        " . clientScopeSql('asset_client_id') . "
         $client_query
         LIMIT 1
     ");
diff --git a/agent/contact.php b/agent/contact.php
index 4a9cc2ac4..764751df6 100644
--- a/agent/contact.php
+++ b/agent/contact.php
@@ -11,6 +11,9 @@ if (isset($_GET['client_id'])) {
     $client_url = '';
 }
 
+// Perms
+enforceUserPermission('module_client');
+
 if (isset($_GET['contact_id'])) {
     $contact_id = intval($_GET['contact_id']);
 
@@ -23,6 +26,7 @@ if (isset($_GET['contact_id'])) {
         LEFT JOIN locations ON location_id = contact_location_id
         LEFT JOIN users ON user_id = contact_user_id
         WHERE contact_id = $contact_id
+        " . clientScopeSql('contact_client_id') . "
         $client_query
         LIMIT 1
     ");
diff --git a/agent/contacts.php b/agent/contacts.php
index 1d0583124..56880f60c 100644
--- a/agent/contacts.php
+++ b/agent/contacts.php
@@ -31,6 +31,9 @@ if (isset($_GET['client_id'])) {
     }
 }
 
+// Perms
+enforceUserPermission('module_client');
+
 // Tags Filter
 if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) {
     // Sanitize each element of the tags array
diff --git a/agent/locations.php b/agent/locations.php
index 803c737cc..7279379a7 100644
--- a/agent/locations.php
+++ b/agent/locations.php
@@ -43,6 +43,9 @@ if (!$client_url) {
     }
 }
 
+// Perms
+enforceUserPermission('module_client');
+
 // Tags Filter
 if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) {
     // Sanitize each element of the tags array