AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-24 17:30:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

More Client Scoping fixes

Browse Source
This commit is contained in:
johnnyq
2026-07-16 14:29:23 -04:00
parent 1251944dcc
commit 41d029937a
6 changed files with 19 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
agent/post/quote.php
View File

@@ -59,7 +59,12 @@ if (isset($_POST['add_quote_copy'])) {
$date = escapeSql($_POST['date']);
$expire = escapeSql($_POST['expire']);
enforceClientAccess();
// Source: can you read the quote you're copying FROM?
$source_client_id = intval(getFieldById('quotes', $quote_id, 'quote_client_id'));
enforceClientAccess($source_client_id);
// Destination: can you write to the client you're copying INTO?
enforceClientAccess($client_id);
$config_quote_prefix = escapeSql($config_quote_prefix);