diff --git a/admin/database_updates/2.4.6.php b/admin/database_updates/2.4.6.php
new file mode 100644
index 00000000..3d3c876d
--- /dev/null
+++ b/admin/database_updates/2.4.6.php
@@ -0,0 +1,11 @@
+
- Check boxes to authorize user client access. No boxes grant full client access. Admin users are unaffected.
+ Allow restricts the user to the selected clients (no Allow = full access). Deny blocks a client regardless of Allow. Admin users are unaffected.
-
-
-
-
-
-
-
+
+ Set all:
+
+
+
+
-
+
+
+
+
Client
+
No Rule
+
Allow
+
Deny
+
+
+
- $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
- while ($row = mysqli_fetch_assoc($sql_client_select)) {
- $client_id = intval($row['client_id']);
- $client_name = escapeHtml($row['client_name']);
+
- ?>
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-
+
-
+
+
+
diff --git a/admin/modals/user/user_edit.php b/admin/modals/user/user_edit.php
index 20c66c17..86c96e8d 100644
--- a/admin/modals/user/user_edit.php
+++ b/admin/modals/user/user_edit.php
@@ -18,16 +18,22 @@ $user_config_force_mfa = intval($row['user_config_force_mfa']);
$user_role_id = intval($row['user_role_id']);
$user_initials = escapeHtml(initials($user_name));
-// Get User Client Access Permissions
-$user_client_access_sql = mysqli_query($mysqli,"SELECT client_id FROM user_client_permissions WHERE user_id = $user_id");
-$client_access_array = [];
+// Get User Client Access Permissions (allow + deny)
+$user_client_access_sql = mysqli_query($mysqli,"SELECT client_id, permission_type FROM user_client_permissions WHERE user_id = $user_id");
+$client_allow_array = []; // allow
+$client_deny_array = []; // deny
while ($row = mysqli_fetch_assoc($user_client_access_sql)) {
- $client_access_array[] = intval($row['client_id']);
+ if ($row['permission_type'] === 'deny') {
+ $client_deny_array[] = intval($row['client_id']);
+ } else {
+ $client_allow_array[] = intval($row['client_id']);
+ }
}
-// Generate the HTML form content using output buffering.
ob_start();
+
?>
+
Editing user:
@@ -161,37 +167,55 @@ ob_start();
- Check boxes to authorize user client access. No boxes grant full client access. Admin users are unaffected.
+ Allow restricts the user to the selected clients (no Allow = full access). Deny blocks a client regardless of Allow. Admin users are unaffected.
-
-
-
-
-
-
-
+
+ Set all:
+
+
+
+
-
+
+
+
+
Client
+
No Rule
+
Allow
+
Deny
+
+
+
- $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
- while ($row = mysqli_fetch_assoc($sql_client_select)) {
- $client_id_select = intval($row['client_id']);
- $client_name_select = escapeHtml($row['client_name']);
+
- ?>
+
+
+
+ >
+
+
+ >
+
+
+ >
+
+
-
-
- >
-
-
-
-
-
-
-
+
+
+
+
diff --git a/admin/post/users.php b/admin/post/users.php
index 3630a547..8e23f137 100644
--- a/admin/post/users.php
+++ b/admin/post/users.php
@@ -19,11 +19,13 @@ if (isset($_POST['add_user'])) {
$user_id = mysqli_insert_id($mysqli);
- // Add Client Access Permissions if set
- if (isset($_POST['clients'])) {
- foreach($_POST['clients'] as $client_id) {
- $client_id = intval($client_id);
- mysqli_query($mysqli,"INSERT INTO user_client_permissions SET user_id = $user_id, client_id = $client_id");
+ // Add Client Access (allow / deny per client)
+ if (isset($_POST['client_permission'])) {
+ foreach ($_POST['client_permission'] as $perm_client_id => $perm_type) {
+ $perm_client_id = intval($perm_client_id);
+ if ($perm_type === 'allow' || $perm_type === 'deny') {
+ mysqli_query($mysqli, "INSERT INTO user_client_permissions SET user_id = $user_id, client_id = $perm_client_id, permission_type = '$perm_type'");
+ }
}
}
@@ -107,12 +109,14 @@ if (isset($_POST['edit_user'])) {
$user_id = intval($_POST['user_id']);
$new_password = trim($_POST['new_password']);
- // Update Client Access
+ // Update Client Access (allow / deny per client)
mysqli_query($mysqli,"DELETE FROM user_client_permissions WHERE user_id = $user_id");
- if (isset($_POST['clients'])) {
- foreach($_POST['clients'] as $client_id) {
- $client_id = intval($client_id);
- mysqli_query($mysqli,"INSERT INTO user_client_permissions SET user_id = $user_id, client_id = $client_id");
+ if (isset($_POST['client_permission'])) {
+ foreach ($_POST['client_permission'] as $perm_client_id => $perm_type) {
+ $perm_client_id = intval($perm_client_id);
+ if ($perm_type === 'allow' || $perm_type === 'deny') {
+ mysqli_query($mysqli, "INSERT INTO user_client_permissions SET user_id = $user_id, client_id = $perm_client_id, permission_type = '$perm_type'");
+ }
}
}
diff --git a/db.sql b/db.sql
index fb43ab2e..832e141b 100644
--- a/db.sql
+++ b/db.sql
@@ -2785,6 +2785,7 @@ DROP TABLE IF EXISTS `user_client_permissions`;
CREATE TABLE `user_client_permissions` (
`user_id` int(11) NOT NULL,
`client_id` int(11) NOT NULL,
+ `permission_type` enum('allow','deny') NOT NULL DEFAULT 'allow',
PRIMARY KEY (`user_id`,`client_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
/*!40101 SET character_set_client = @saved_cs_client */;
@@ -2995,4 +2996,4 @@ CREATE TABLE `vendors` (
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
--- Dump completed on 2026-07-22 17:36:39
+-- Dump completed on 2026-07-25 13:20:49
diff --git a/functions/auth.php b/functions/auth.php
index 16ab06fe..f25cbb54 100644
--- a/functions/auth.php
+++ b/functions/auth.php
@@ -82,10 +82,25 @@ function enforceClientAccess($client_id = null) {
redirect('clients.php');
}
+ // Deny list wins: an explicit deny blocks access regardless of any allow rule
+ $deny_sql = "SELECT client_id
+ FROM user_client_permissions
+ WHERE user_id = $session_user_id
+ AND client_id = $client_id
+ AND permission_type = 'deny'
+ LIMIT 1";
+ $deny_result = mysqli_query($mysqli, $deny_sql);
+ if ($deny_result && mysqli_num_rows($deny_result) > 0) {
+ logAudit('Client', 'Access', "$session_name was denied permission from accessing client", $client_id, $client_id);
+ flashAlert('Access Denied - You do not have permission to access that client!', 'error');
+ redirect('clients.php');
+ }
+
// Check if this user has any client permissions set
$permissions_sql = "SELECT client_id
FROM user_client_permissions
WHERE user_id = $session_user_id
+ AND permission_type = 'allow'
LIMIT 1";
$permissions_result = mysqli_query($mysqli, $permissions_sql);
@@ -100,6 +115,7 @@ function enforceClientAccess($client_id = null) {
FROM user_client_permissions
WHERE user_id = $session_user_id
AND client_id = $client_id
+ AND permission_type = 'allow'
LIMIT 1";
$access_result = mysqli_query($mysqli, $access_sql);
diff --git a/includes/load_user_session.php b/includes/load_user_session.php
index d308dbe6..00c3997a 100644
--- a/includes/load_user_session.php
+++ b/includes/load_user_session.php
@@ -49,17 +49,30 @@ if ($session_user_archived_at !== null) {
redirect("/login.php");
}
-// Load user client permissions
-$user_client_access_sql = "SELECT client_id FROM user_client_permissions WHERE user_id = $session_user_id";
+// Load user client permissions (allow + deny lists)
+$user_client_access_sql = "SELECT client_id, permission_type FROM user_client_permissions WHERE user_id = $session_user_id";
$user_client_access_result = mysqli_query($mysqli, $user_client_access_sql);
-$client_access_array = [];
+$client_access_array = []; // allow
+$client_deny_array = []; // deny
while ($row = mysqli_fetch_assoc($user_client_access_result)) {
- $client_access_array[] = $row['client_id'];
+ if ($row['permission_type'] === 'deny') {
+ $client_deny_array[] = (int) $row['client_id'];
+ } else {
+ $client_access_array[] = (int) $row['client_id'];
+ }
}
$client_access_string = implode(',', $client_access_array);
+$client_deny_string = implode(',', $client_deny_array);
+
$access_permission_query = "";
-if ($client_access_string && !$session_is_admin) {
- $access_permission_query = "AND clients.client_id IN ($client_access_string)";
+if (!$session_is_admin) {
+ // Restrict to the allow list (if any), then subtract the deny list
+ if ($client_access_string) {
+ $access_permission_query .= " AND clients.client_id IN ($client_access_string)";
+ }
+ if ($client_deny_string) {
+ $access_permission_query .= " AND clients.client_id NOT IN ($client_deny_string)";
+ }
}