From 590bad3bcc6959d6dcde90b47eae2813c2fac0e1 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Wed, 15 Jul 2026 18:55:40 -0400
Subject: [PATCH] Global Search: use secure file handler on files in global
 search

---
 agent/global_search.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/agent/global_search.php b/agent/global_search.php
index 73ab6f6e..38a8aef1 100644
--- a/agent/global_search.php
+++ b/agent/global_search.php
@@ -459,7 +459,6 @@ if (isset($_GET['query'])) {
                             while ($row = mysqli_fetch_assoc($sql_files)) {
                                 $file_id = intval($row['file_id']);
                                 $file_name = escapeHtml($row['file_name']);
-                                $file_reference_name = escapeHtml($row['file_reference_name']);
                                 $file_description = escapeHtml($row['file_description']);
                                 $folder_id = intval($row['folder_id']);
                                 $folder_name = escapeHtml($row['folder_name']);
@@ -468,7 +467,11 @@ if (isset($_GET['query'])) {
 
                                 ?>
                                 <tr>
-                                    <td><a href="../uploads/clients/<?php echo $client_id; ?>/<?php echo $file_reference_name; ?>" download="<?php echo $file_name; ?>"><?php echo "$folder_name/$file_name"; ?></a></td>
+                                    <td>
+                                        <a href="file.php?file_id=<?= $file_id ?>&action=view" target="_blank">
+                                            <?= "$folder_name/$file_name"; ?>
+                                        </a>
+                                    </td>
                                     <td><?php echo $file_description; ?></td>
                                     <td>
                                         <a href="files.php?client_id=<?php echo $client_id; ?>&folder_id=<?php echo $folder_id; ?>"><?php echo $client_name; ?></a>