AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Centralize client portal access checks through contactCan()

Browse Source 
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
This commit is contained in:
johnnyq
2026-07-25 17:55:30 -04:00
parent 887063394a
commit 497ea3b669
18 changed files with 62 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
client/assets.php
View File

@@ -8,10 +8,7 @@ header("Content-Security-Policy: default-src 'self'");
require_once "includes/inc_all.php";
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
header("Location: post.php?logout");
exit();
}
enforceContactCan('itdoc');
$assets_sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_client_id = $session_client_id AND asset_archived_at IS NULL ORDER BY asset_type ASC, asset_name ASC");
?>