AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Feature: Add Deny Client Access to Client Access Permssions - BREAKS UI, MUST UPDATE DB USING php scripts/cli_update.php --db_update

Browse Source
This commit is contained in:
johnnyq
2026-07-25 13:22:52 -04:00
parent ff4b69b511
commit 3756561458
7 changed files with 155 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
functions/auth.php
View File

@@ -82,10 +82,25 @@ function enforceClientAccess($client_id = null) {
redirect('clients.php');
}
// Deny list wins: an explicit deny blocks access regardless of any allow rule
$deny_sql = "SELECT client_id
FROM user_client_permissions
WHERE user_id = $session_user_id
AND client_id = $client_id
AND permission_type = 'deny'
LIMIT 1";
$deny_result = mysqli_query($mysqli, $deny_sql);
if ($deny_result && mysqli_num_rows($deny_result) > 0) {
logAudit('Client', 'Access', "$session_name was denied permission from accessing client", $client_id, $client_id);
flashAlert('Access Denied - You do not have permission to access that client!', 'error');
redirect('clients.php');
}
// Check if this user has any client permissions set
$permissions_sql = "SELECT client_id
FROM user_client_permissions
WHERE user_id = $session_user_id
AND permission_type = 'allow'
LIMIT 1";
$permissions_result = mysqli_query($mysqli, $permissions_sql);
@@ -100,6 +115,7 @@ function enforceClientAccess($client_id = null) {
FROM user_client_permissions
WHERE user_id = $session_user_id
AND client_id = $client_id
AND permission_type = 'allow'
LIMIT 1";
$access_result = mysqli_query($mysqli, $access_sql);