AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 00:40:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

More Client Scoping fixes

Browse Source
This commit is contained in:
johnnyq
2026-07-16 14:29:23 -04:00
parent 1251944dcc
commit 41d029937a
6 changed files with 19 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
agent/modals/project/project_edit.php
View File

@@ -90,25 +90,6 @@ ob_start();
</select>
</div>
</div>
<div class="form-group">
<label>Client</label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-users"></i></span>
</div>
<select class="form-control select2" name="client_id">
<option value="0">- No Client -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$select_client_id = intval($row['client_id']);
$select_client_name = escapeHtml($row['client_name']);
?>
<option value="<?php echo $select_client_id; ?>" <?php if ($client_id == $select_client_id) { echo "selected"; } ?>><?php echo $select_client_name; ?></option>
<?php } ?>
</select>
</div>
</div>
</div>
<div class="modal-footer">
<button type="submit" name="edit_project" class="btn btn-primary text-bold">

1
agent/modals/ticket/ticket_reply_edit.php
View File

@@ -35,7 +35,6 @@ ob_start();
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<input type="hidden" name="ticket_reply_id" value="<?php echo $ticket_reply_id; ?>">
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
<div class="modal-body">

5
agent/post/project.php
View File

@@ -105,14 +105,15 @@ if (isset($_POST['edit_project'])) {
$project_description = escapeSql($_POST['description']);
$due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']);
$client_id = intval(getFieldById('projects', $project_id, 'project_client_id'));
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
enforceClientAccess();
}
mysqli_query($mysqli, "UPDATE projects SET project_name = '$project_name', project_description = '$project_description', project_due = '$due_date', project_manager = $project_manager, project_client_id = $client_id WHERE project_id = $project_id");
mysqli_query($mysqli, "UPDATE projects SET project_name = '$project_name', project_description = '$project_description', project_due = '$due_date', project_manager = $project_manager WHERE project_id = $project_id");
logAudit("Project", "Edit", "$session_name edited project $project_name", $client_id, $project_id);

7
agent/post/quote.php
View File

@@ -59,7 +59,12 @@ if (isset($_POST['add_quote_copy'])) {
$date = escapeSql($_POST['date']);
$expire = escapeSql($_POST['expire']);
enforceClientAccess();
// Source: can you read the quote you're copying FROM?
$source_client_id = intval(getFieldById('quotes', $quote_id, 'quote_client_id'));
enforceClientAccess($source_client_id);
// Destination: can you write to the client you're copying INTO?
enforceClientAccess($client_id);
$config_quote_prefix = escapeSql($config_quote_prefix);

12
agent/post/ticket.php
View File

@@ -1731,7 +1731,8 @@ if (isset($_POST['add_ticket_reply'])) {
$ticket_id = intval($_POST['ticket_id']);
$ticket_reply = $_POST['ticket_reply']; // Reply is SQL escaped below
$ticket_status = intval($_POST['status']);
$client_id = intval($_POST['client_id']);
$client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));
// Don't Enforce Client Access if Ticket doesn't have an assigned client
if ($client_id) {
@@ -1917,7 +1918,14 @@ if (isset($_POST['edit_ticket_reply'])) {
$ticket_reply_type = escapeSql($_POST['ticket_reply_type']);
$ticket_reply_time_worked = escapeSql($_POST['time']);
$client_id = intval($_POST['client_id']);
$sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM ticket_replies
LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id
WHERE ticket_reply_id = $ticket_reply_id
LIMIT 1"
);
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']);
// Don't Enforce Client Access if Ticket doesn't have an assigned client
if ($client_id) {

1
agent/ticket.php
View File

@@ -589,7 +589,6 @@ if (isset($_GET['ticket_id'])) {
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<input type="hidden" name="ticket_id" id="ticket_id" value="<?php echo $ticket_id; ?>">
<input type="hidden" name="client_id" id="client_id" value="<?php echo $client_id; ?>">
<div class="card card-body d-print-none p-3">