AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Centralize client portal access checks through contactCan()

Browse Source 
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
This commit is contained in:
johnnyq
2026-07-25 17:55:30 -04:00
parent 887063394a
commit 497ea3b669
18 changed files with 62 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
client/contacts.php
View File

@@ -8,10 +8,7 @@ header("Content-Security-Policy: default-src 'self'");
require_once "includes/inc_all.php";
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
header("Location: post.php?logout");
exit();
}
enforceContactCan('contacts');
$contacts_sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_email, contact_primary, contact_technical, contact_billing FROM contacts WHERE contact_client_id = $session_client_id AND contacts.contact_archived_at IS NULL ORDER BY contact_created_at");
?>