AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 09:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce client scoping on API expense reads and record updates

Browse Source 
Fixes (expenses/read.php missing apiClientScopeSql), plus an unscoped UPDATE in contacts/update.php and follow-up writes firing on zero-row updates in assets/credentials.
This commit is contained in:
johnnyq
2026-08-06 11:00:49 -04:00
parent cbf8922f5b
commit 49a3c2d266
4 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api/v1/assets/update.php
View File

@@ -21,7 +21,7 @@ if (!empty($asset_id)) {
$update_sql = mysqli_query($mysqli, "UPDATE assets SET asset_name = '$name', asset_description = '$description', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_uri = '$uri', asset_uri_2 = '$uri_2', asset_status = '$status', asset_location_id = $location, asset_vendor_id = $vendor, asset_contact_id = $contact, asset_purchase_date = $purchase_date, asset_warranty_expire = $warranty_expire, asset_install_date = $install_date, asset_notes = '$notes' WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1");
// Check insert & get insert ID
if ($update_sql) {
if ($update_sql && $asset_row) {
$update_count = mysqli_affected_rows($mysqli);
// Update Primary Interface

2
api/v1/contacts/update.php
View File

@@ -23,7 +23,7 @@ if (!empty($contact_id)) {
mysqli_query($mysqli,"UPDATE contacts SET contact_primary = 0 WHERE contact_client_id = $client_id");
}
$update_sql = mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_department = '$department', contact_email = '$email', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile', contact_notes = '$notes', contact_primary = '$primary', contact_important = '$important', contact_billing = '$billing', contact_technical = '$technical', contact_location_id = $location_id, contact_client_id = $client_id WHERE contact_id = $contact_id LIMIT 1");
$update_sql = mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_department = '$department', contact_email = '$email', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile', contact_notes = '$notes', contact_primary = '$primary', contact_important = '$important', contact_billing = '$billing', contact_technical = '$technical', contact_location_id = $location_id, contact_client_id = $client_id WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1");
// Check insert & get insert ID
if ($update_sql) {

2
api/v1/credentials/update.php
View File

@@ -20,7 +20,7 @@ if (!empty($_POST['api_key_decrypt_password']) && !empty($credential_id)) {
$update_sql = mysqli_query($mysqli,"UPDATE credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id WHERE credential_id = '$credential_id' AND credential_client_id = $client_id LIMIT 1");
// Check insert & get insert ID
if ($update_sql) {
if ($update_sql && $credential_row) {
$update_count = mysqli_affected_rows($mysqli);
if ($password_changed) {

6
api/v1/expenses/read.php
View File

@@ -5,18 +5,16 @@ require_once '../validate_api_key.php';
require_once '../require_get_method.php';
// Expenses aren't client-scoped; access is gated by module_financial in enforce_api_rbac.php
if (isset($_GET['expense_id'])) {
// Expense via ID (single)
$id = intval($_GET['expense_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id'");
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id' AND 1=1 " . apiClientScopeSql('expense_client_id') . "");
} else {
// All expenses
$sql = mysqli_query($mysqli, "SELECT * FROM expenses ORDER BY expense_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE 1=1 " . apiClientScopeSql('expense_client_id') . " ORDER BY expense_id LIMIT $limit OFFSET $offset");
}
// Output