From 41d029937a0bf9ee0a71b07bcfa1dca93445272d Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 16 Jul 2026 14:29:23 -0400
Subject: [PATCH] More Client Scoping fixes

---
 agent/modals/project/project_edit.php     | 19 -------------------
 agent/modals/ticket/ticket_reply_edit.php |  1 -
 agent/post/project.php                    |  5 +++--
 agent/post/quote.php                      |  7 ++++++-
 agent/post/ticket.php                     | 12 ++++++++++--
 agent/ticket.php                          |  1 -
 6 files changed, 19 insertions(+), 26 deletions(-)

diff --git a/agent/modals/project/project_edit.php b/agent/modals/project/project_edit.php
index 43f06174..c6552f10 100644
--- a/agent/modals/project/project_edit.php
+++ b/agent/modals/project/project_edit.php
@@ -90,25 +90,6 @@ ob_start();
                 </select>
             </div>
         </div>
-        <div class="form-group">
-            <label>Client</label>
-            <div class="input-group">
-                <div class="input-group-prepend">
-                    <span class="input-group-text"><i class="fa fa-fw fa-users"></i></span>
-                </div>
-                <select class="form-control select2" name="client_id">
-                    <option value="0">- No Client -</option>
-                    <?php
-                    $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
-                    while ($row = mysqli_fetch_assoc($sql)) {
-                        $select_client_id = intval($row['client_id']);
-                        $select_client_name = escapeHtml($row['client_name']);
-                        ?>
-                        <option value="<?php echo $select_client_id; ?>" <?php if ($client_id == $select_client_id) { echo "selected"; } ?>><?php echo $select_client_name; ?></option>
-                    <?php } ?>
-                </select>
-            </div>
-        </div>
     </div>
     <div class="modal-footer">
         <button type="submit" name="edit_project" class="btn btn-primary text-bold">
diff --git a/agent/modals/ticket/ticket_reply_edit.php b/agent/modals/ticket/ticket_reply_edit.php
index 938e2289..0c8f950a 100644
--- a/agent/modals/ticket/ticket_reply_edit.php
+++ b/agent/modals/ticket/ticket_reply_edit.php
@@ -35,7 +35,6 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="ticket_reply_id" value="<?php echo $ticket_reply_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
 
     <div class="modal-body">
 
diff --git a/agent/post/project.php b/agent/post/project.php
index b0b9cff8..a2b38697 100644
--- a/agent/post/project.php
+++ b/agent/post/project.php
@@ -105,14 +105,15 @@ if (isset($_POST['edit_project'])) {
     $project_description = escapeSql($_POST['description']);
     $due_date = escapeSql($_POST['due_date']);
     $project_manager = intval($_POST['project_manager']);
-    $client_id = intval($_POST['client_id']);
+    
+    $client_id = intval(getFieldById('projects', $project_id, 'project_client_id'));
 
     // Don't Enforce Client Access if Project doesn't have an assigned client
     if ($client_id) {
         enforceClientAccess();
     }
 
-    mysqli_query($mysqli, "UPDATE projects SET project_name = '$project_name', project_description = '$project_description', project_due = '$due_date', project_manager = $project_manager, project_client_id = $client_id WHERE project_id = $project_id");
+    mysqli_query($mysqli, "UPDATE projects SET project_name = '$project_name', project_description = '$project_description', project_due = '$due_date', project_manager = $project_manager WHERE project_id = $project_id");
 
     logAudit("Project", "Edit", "$session_name edited project $project_name", $client_id, $project_id);
 
diff --git a/agent/post/quote.php b/agent/post/quote.php
index 13046a0f..e940646b 100644
--- a/agent/post/quote.php
+++ b/agent/post/quote.php
@@ -59,7 +59,12 @@ if (isset($_POST['add_quote_copy'])) {
     $date = escapeSql($_POST['date']);
     $expire = escapeSql($_POST['expire']);
 
-    enforceClientAccess();
+    // Source: can you read the quote you're copying FROM?
+    $source_client_id = intval(getFieldById('quotes', $quote_id, 'quote_client_id'));
+    enforceClientAccess($source_client_id);
+
+    // Destination: can you write to the client you're copying INTO?
+    enforceClientAccess($client_id);
 
     $config_quote_prefix = escapeSql($config_quote_prefix);
 
diff --git a/agent/post/ticket.php b/agent/post/ticket.php
index 28ce77af..847bcde0 100644
--- a/agent/post/ticket.php
+++ b/agent/post/ticket.php
@@ -1731,7 +1731,8 @@ if (isset($_POST['add_ticket_reply'])) {
     $ticket_id = intval($_POST['ticket_id']);
     $ticket_reply = $_POST['ticket_reply']; // Reply is SQL escaped below
     $ticket_status = intval($_POST['status']);
-    $client_id = intval($_POST['client_id']);
+    
+    $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));
 
     // Don't Enforce Client Access if Ticket doesn't have an assigned client
     if ($client_id) {
@@ -1917,7 +1918,14 @@ if (isset($_POST['edit_ticket_reply'])) {
     $ticket_reply_type = escapeSql($_POST['ticket_reply_type']);
     $ticket_reply_time_worked = escapeSql($_POST['time']);
 
-    $client_id = intval($_POST['client_id']);
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM ticket_replies
+        LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id
+        WHERE ticket_reply_id = $ticket_reply_id
+        LIMIT 1"
+    );
+
+    $row = mysqli_fetch_assoc($sql);
+    $client_id = intval($row['ticket_client_id']);
 
     // Don't Enforce Client Access if Ticket doesn't have an assigned client
     if ($client_id) {
diff --git a/agent/ticket.php b/agent/ticket.php
index a7a03d67..3bf6e3be 100644
--- a/agent/ticket.php
+++ b/agent/ticket.php
@@ -589,7 +589,6 @@ if (isset($_GET['ticket_id'])) {
                         <form action="post.php" method="post" autocomplete="off">
                             <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
                             <input type="hidden" name="ticket_id" id="ticket_id" value="<?php echo $ticket_id; ?>">
-                            <input type="hidden" name="client_id" id="client_id" value="<?php echo $client_id; ?>">
 
                             <div class="card card-body d-print-none p-3">