AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 09:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enforce client scoping on API expense reads and record updates

Browse Source 
Fixes (expenses/read.php missing apiClientScopeSql), plus an unscoped UPDATE in contacts/update.php and follow-up writes firing on zero-row updates in assets/credentials.
This commit is contained in:
johnnyq
2026-08-06 11:00:49 -04:00
parent cbf8922f5b
commit 49a3c2d266
4 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api/v1/expenses/read.php
View File

@@ -5,18 +5,16 @@ require_once '../validate_api_key.php';
require_once '../require_get_method.php';
// Expenses aren't client-scoped; access is gated by module_financial in enforce_api_rbac.php
if (isset($_GET['expense_id'])) {
// Expense via ID (single)
$id = intval($_GET['expense_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id'");
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id' AND 1=1 " . apiClientScopeSql('expense_client_id') . "");
} else {
// All expenses
$sql = mysqli_query($mysqli, "SELECT * FROM expenses ORDER BY expense_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE 1=1 " . apiClientScopeSql('expense_client_id') . " ORDER BY expense_id LIMIT $limit OFFSET $offset");
}
// Output