AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Centralize client portal access checks through contactCan()

Browse Source 
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
This commit is contained in:
johnnyq
2026-07-25 17:55:30 -04:00
parent 887063394a
commit 497ea3b669
18 changed files with 62 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
client/includes/header.php
View File

@@ -49,7 +49,7 @@ header("X-Frame-Options: DENY"); // Legacy
<a class="nav-link <?php if (basename($_SERVER['PHP_SELF']) == "tickets.php" || basename($_SERVER['PHP_SELF']) == "ticket_add.php" || basename($_SERVER['PHP_SELF']) == "ticket.php") {echo "active";} ?>" href="/client/tickets.php">Tickets</a>
</li>
<?php if (($session_contact_primary == 1 || $session_contact_is_billing_contact) && $config_module_enable_accounting == 1) { ?>
<?php if (contactCan('accounting') && $config_module_enable_accounting == 1) { ?>
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle <?php echo in_array(basename($_SERVER['PHP_SELF']), ['invoices.php', 'quotes.php', 'autopay.php']) ? 'active' : ''; ?>" href="#" id="navbarDropdown1" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
Finance
@@ -63,7 +63,7 @@ header("X-Frame-Options: DENY"); // Legacy
</li>
<?php } ?>
<?php if ($config_module_enable_itdoc && ($session_contact_primary == 1 || $session_contact_is_technical_contact)) { ?>
<?php if ($config_module_enable_itdoc && contactCan('itdoc')) { ?>
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle <?php echo in_array(basename($_SERVER['PHP_SELF']), ['documents.php', 'contacts.php', 'domains.php', 'certificates.php']) ? 'active' : ''; ?>" href="#" id="navbarDropdown2" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
Technical