AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 17:00:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add secure file handler for client ticket attachment and file view along with client and contact permission isolation, add the handler links in asset and contact

Browse Source
This commit is contained in:
johnnyq
2026-07-15 18:35:32 -04:00
parent c8f616ebee
commit 3838d052f0
9 changed files with 300 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
agent/asset.php
View File

@@ -941,7 +941,6 @@ if (isset($_GET['asset_id'])) {
$file_id = intval($row['file_id']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";
@@ -972,7 +971,7 @@ if (isset($_GET['asset_id'])) {
?>
<tr>
<td><a class="text-dark" href="<?= "../uploads/clients/$client_id/$file_reference_name"; ?>" target="_blank" ><?= "$file_name<br><span class='text-secondary'>$file_description</span>"; ?></a></td>
<td><a class="text-dark" href="file.php?file_id=<?= $file_id; ?>&action=view" target="_blank" ><?= "$file_name<br><span class='text-secondary'>$file_description</span>"; ?></a></td>
<td><?= $file_created_at; ?></td>
<td class="text-center">
<a href="post.php?unlink_asset_from_file&asset_id=<?= $asset_id; ?>&file_id=<?= $file_id; ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>" class="btn btn-secondary btn-sm" title="Unlink"><i class="fas fa-fw fa-unlink"></i></a>

3
agent/contact.php
View File

@@ -1047,7 +1047,6 @@ if (isset($_GET['contact_id'])) {
$file_description = escapeHtml($row['file_description']);
$file_size = escapeHtml($row['file_size']);
$file_size_KB = round($file_size / 1024);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_created_at = escapeHtml($row['file_created_at']);
@@ -1057,7 +1056,7 @@ if (isset($_GET['contact_id'])) {
<tr>
<td>
<div><a href="../uploads/clients/<?php echo $client_id; ?>/<?php echo $file_reference_name; ?>"><?php echo $file_name; ?></a></div>
<div><a href="file.php?file_id=<?= $file_id; ?>&action=view" target="_blank"><?= $file_name; ?></a></div>
<div class="text-secondary"><?php echo $file_description; ?></div>
</td>
<td><?php echo $file_mime_type; ?></td>

2
agent/document.php
View File

@@ -225,7 +225,7 @@ $page_title = $row['document_name'];
?>
<div class="ml-2">
<a href="files.php?client_id=<?= $client_id ?>&folder_id=<?= $folder_id ?>&q=<?= $file_name ?>" target="_blank"><?= $file_name ?></a>
<a href="file.php?file_id=<?= $file_id ?>&action=view" target="_blank"><?= $file_name ?></a>
<a class="confirm-link" href="post.php?unlink_file_from_document&file_id=<?= $file_id ?>&document_id=<?= $document_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<i class="fas fa-fw fa-unlink text-secondary float-right" title="Unlink File"></i>
</a>

9
agent/modals/asset/asset_details.php → agent/modals/asset/asset.php
View File

@@ -220,8 +220,6 @@ if (isset($_GET['client_id'])) {
$client_url = '';
}
enforceClientAccess();
ob_start();
?>
@@ -863,7 +861,6 @@ ob_start();
$file_name = escapeHtml($row['file_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_description = escapeHtml($row['file_description']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";
@@ -891,7 +888,11 @@ ob_start();
$file_created_at = escapeHtml($row['file_created_at']);
?>
<tr>
<td><a class="text-dark" href="<?php echo "../uploads/clients/$client_id/$file_reference_name"; ?>" target="_blank" ><?php echo "$file_name<br><span class='text-secondary'>$file_description</span>"; ?></a></td>
<td>
<a class="text-dark" href="file.php?file_id=<?=$file_id ?>&action=view" target="_blank" >
<?php echo "$file_name<br><span class='text-secondary'>$file_description</span>"; ?>
</a>
</td>
<td><?php echo $file_mime_type; ?></td>
<td><?php echo $file_created_at; ?></td>
</tr>

6
agent/modals/contact/contact_details.php → agent/modals/contact/contact.php
View File

@@ -821,11 +821,11 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_linked_files)) {
$file_id = intval($row['file_id']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_size = escapeHtml($row['file_size']);
$file_size_KB = round($file_size / 1024);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_created_at = escapeHtml($row['file_created_at']);
@@ -833,7 +833,9 @@ ob_start();
?>
<tr>
<td>
<div><a href="../uploads/clients/<?= $client_id ?>/<?= $file_reference_name ?>" target="_blank"><?= $file_name ?></a></div>
<div>
<a href="file.php?file_id=<?= $file_id ?>&action=view" target="_blank"><?= $file_name ?></a>
</div>
<div class="text-secondary"><?= $file_description ?></div>
</td>
<td><?= $file_mime_type ?></td>