AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 09:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce client scoping on API expense reads and record updates

Browse Source 
Fixes (expenses/read.php missing apiClientScopeSql), plus an unscoped UPDATE in contacts/update.php and follow-up writes firing on zero-row updates in assets/credentials.
This commit is contained in:
johnnyq
2026-08-06 11:00:49 -04:00
parent cbf8922f5b
commit 49a3c2d266
4 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
api/v1/credentials/update.php
View File

@@ -20,7 +20,7 @@ if (!empty($_POST['api_key_decrypt_password']) && !empty($credential_id)) {
$update_sql = mysqli_query($mysqli,"UPDATE credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id WHERE credential_id = '$credential_id' AND credential_client_id = $client_id LIMIT 1");
// Check insert & get insert ID
if ($update_sql) {
if ($update_sql && $credential_row) {
$update_count = mysqli_affected_rows($mysqli);
if ($password_changed) {