From 5b499084389797111f573fa803fff5f1c39eae8b Mon Sep 17 00:00:00 2001 From: johnnyq Date: Mon, 2 Mar 2026 17:20:00 -0500 Subject: [PATCH] Vendors: Add missing CSRF, need to update the permissions as a vendor can be client or global and permissions need to be set based off if the referal url has client_id or not --- agent/modals/vendor/vendor_add.php | 1 + .../vendor/vendor_add_from_template.php | 2 +- agent/modals/vendor/vendor_contact_add.php | 3 +- agent/modals/vendor/vendor_contact_edit.php | 1 + agent/modals/vendor/vendor_edit.php | 1 + agent/modals/vendor/vendor_export.php | 1 + agent/post/vendor.php | 36 ++++++++++++------ agent/post/vendor_contact.php | 38 +++++++++++++------ agent/vendors.php | 12 +++--- 9 files changed, 65 insertions(+), 30 deletions(-) diff --git a/agent/modals/vendor/vendor_add.php b/agent/modals/vendor/vendor_add.php index ff2317b3..b2109b77 100644 --- a/agent/modals/vendor/vendor_add.php +++ b/agent/modals/vendor/vendor_add.php @@ -14,6 +14,7 @@ ob_start();
+
diff --git a/agent/modals/vendor/vendor_add_from_template.php b/agent/modals/vendor/vendor_add_from_template.php index 69d51c34..b18f6e0a 100644 --- a/agent/modals/vendor/vendor_add_from_template.php +++ b/agent/modals/vendor/vendor_add_from_template.php @@ -15,7 +15,7 @@ ob_start();
- +
diff --git a/agent/modals/vendor/vendor_contact_add.php b/agent/modals/vendor/vendor_contact_add.php index 40872c70..52a91237 100644 --- a/agent/modals/vendor/vendor_contact_add.php +++ b/agent/modals/vendor/vendor_contact_add.php @@ -8,6 +8,7 @@
+
@@ -91,4 +92,4 @@
- \ No newline at end of file + diff --git a/agent/modals/vendor/vendor_contact_edit.php b/agent/modals/vendor/vendor_contact_edit.php index d6883ae4..a3319cb8 100644 --- a/agent/modals/vendor/vendor_contact_edit.php +++ b/agent/modals/vendor/vendor_contact_edit.php @@ -8,6 +8,7 @@
+
diff --git a/agent/modals/vendor/vendor_edit.php b/agent/modals/vendor/vendor_edit.php index 8240e13f..25027556 100644 --- a/agent/modals/vendor/vendor_edit.php +++ b/agent/modals/vendor/vendor_edit.php @@ -33,6 +33,7 @@ ob_start();
+
diff --git a/agent/modals/vendor/vendor_export.php b/agent/modals/vendor/vendor_export.php index 46413899..05fda2e8 100644 --- a/agent/modals/vendor/vendor_export.php +++ b/agent/modals/vendor/vendor_export.php @@ -15,6 +15,7 @@ ob_start();
+
diff --git a/agent/post/vendor.php b/agent/post/vendor.php index 4792cf84..c8dbc3ec 100644 --- a/agent/post/vendor.php +++ b/agent/post/vendor.php @@ -4,10 +4,14 @@ * ITFlow - GET/POST request handler for vendors */ + // Todo: 2026-03-02 JQ - Need Permssions reworked as we have client vendors and Global Vendors basically check the referral url if it has client_id then Perm check client else perm check financial. + defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); if (isset($_POST['add_vendor_from_template'])) { + validateCSRFToken($_POST['csrf_token']); + // GET POST Data $client_id = intval($_POST['client_id']); //Used if this vendor is under a contact otherwise its 0 for under company and or template $vendor_template_id = intval($_POST['vendor_template_id']); @@ -48,6 +52,8 @@ if (isset($_POST['add_vendor_from_template'])) { if (isset($_POST['add_vendor'])) { + validateCSRFToken($_POST['csrf_token']); + require_once 'vendor_model.php'; $client_id = intval($_POST['client_id']); // Used if this vendor is under a contact otherwise its 0 for under company @@ -66,6 +72,8 @@ if (isset($_POST['add_vendor'])) { if (isset($_POST['edit_vendor'])) { + validateCSRFToken($_POST['csrf_token']); + require_once 'vendor_model.php'; $vendor_id = intval($_POST['vendor_id']); @@ -86,6 +94,8 @@ if (isset($_POST['edit_vendor'])) { if (isset($_GET['archive_vendor'])) { + validateCSRFToken($_GET['csrf_token']); + $vendor_id = intval($_GET['archive_vendor']); //Get Vendor Name @@ -104,9 +114,11 @@ if (isset($_GET['archive_vendor'])) { } -if(isset($_GET['unarchive_vendor'])){ +if(isset($_GET['restore_vendor'])){ - $vendor_id = intval($_GET['unarchive_vendor']); + validateCSRFToken($_GET['csrf_token']); + + $vendor_id = intval($_GET['restore_vendor']); // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id"); @@ -116,7 +128,7 @@ if(isset($_GET['unarchive_vendor'])){ mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); - logAction("Vendor", "Unarchive", "$session_name unarchived vendor $vendor_name", $client_id, $vendor_id); + logAction("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id); flash_alert("Vendor $vendor_name restored"); @@ -126,6 +138,10 @@ if(isset($_GET['unarchive_vendor'])){ if (isset($_GET['delete_vendor'])) { + validateCSRFToken($_GET['csrf_token']); + + validateAdminRole(); + $vendor_id = intval($_GET['delete_vendor']); //Get Vendor Name @@ -154,8 +170,6 @@ if (isset($_POST['bulk_archive_vendors'])) { validateCSRFToken($_POST['csrf_token']); - validateAdminRole(); - if (isset($_POST['vendor_ids'])) { // Get Selected Count @@ -187,12 +201,10 @@ if (isset($_POST['bulk_archive_vendors'])) { } -if (isset($_POST['bulk_unarchive_vendors'])) { +if (isset($_POST['bulk_restore_vendors'])) { validateCSRFToken($_POST['csrf_token']); - validateAdminRole(); - if (isset($_POST['vendor_ids'])) { // Get Selected Count @@ -211,13 +223,13 @@ if (isset($_POST['bulk_unarchive_vendors'])) { mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); - logAction("Vendor", "Unarchive", "$session_name unarchived vendor $vendor_name", $client_id, $vendor_id); + logAction("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id); } - logAction("Vendor", "Bulk Unarchive", "$session_name unarchived $count vendor(s)"); + logAction("Vendor", "Bulk Restore", "$session_name restored $count vendor(s)"); - flash_alert("Unarchived $count vendor(s)"); + flash_alert("Restored $count vendor(s)"); } @@ -271,6 +283,8 @@ if (isset($_POST['bulk_delete_vendors'])) { if (isset($_POST['export_vendors_csv'])) { + validateCSRFToken($_POST['csrf_token']); + if ($_POST['client_id']) { $client_id = intval($_POST['client_id']); $client_query = "WHERE vendor_client_id = $client_id"; diff --git a/agent/post/vendor_contact.php b/agent/post/vendor_contact.php index c580c65f..4b70b03c 100644 --- a/agent/post/vendor_contact.php +++ b/agent/post/vendor_contact.php @@ -8,6 +8,8 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); if (isset($_POST['add_vendor_contact'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); require_once 'post/user/vendor_contact_model.php'; @@ -28,6 +30,8 @@ if (isset($_POST['add_vendor_contact'])) { if (isset($_POST['edit_vendor_contact'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); require_once 'post/user/vendor_contact_model.php'; @@ -48,7 +52,7 @@ if (isset($_POST['edit_vendor_contact'])) { if (isset($_POST['bulk_archive_vendor_contacts'])) { - //validateCSRFToken($_POST['csrf_token']); + validateCSRFToken($_POST['csrf_token']); enforceUserPermission('module_client', 2); @@ -79,9 +83,9 @@ if (isset($_POST['bulk_archive_vendor_contacts'])) { } -if (isset($_POST['bulk_unarchive_vendor_contacts'])) { +if (isset($_POST['bulk_restore_vendor_contacts'])) { - //validateCSRFToken($_POST['csrf_token']); + validateCSRFToken($_POST['csrf_token']); enforceUserPermission('module_client', 2); @@ -109,13 +113,13 @@ if (isset($_POST['bulk_unarchive_vendor_contacts'])) { mysqli_query($mysqli,"UPDATE contacts SET contact_archived_at = NULL WHERE contact_id = $contact_id"); - logAction("Contact", "Unarchive", "$session_name unarchived $contact_name", $client_id, $contact_id); + logAction("Contact", "Restore", "$session_name restored $contact_name", $client_id, $contact_id); } - logAction("Contact", "Bulk Unarchive", "$session_name Unarchived $count contacts", $client_id); + logAction("Contact", "Bulk Restore", "$session_name restored $count contacts", $client_id); - flash_alert("You unarchived $count contact(s)"); + flash_alert("Restored $count contact(s)"); } @@ -178,6 +182,8 @@ if (isset($_POST['bulk_delete_vendor_contacts'])) { if (isset($_GET['archive_vendor_contact'])) { + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_client', 2); $contact_id = intval($_GET['archive_contact']); @@ -204,11 +210,13 @@ if (isset($_GET['archive_vendor_contact'])) { } -if (isset($_GET['unarchive_vendor_contact'])) { +if (isset($_GET['restore_vendor_contact'])) { - validateAdminRole(); + validateCSRFToken($_GET['csrf_token']); - $contact_id = intval($_GET['unarchive_contact']); + enforceUserPermission('module_client', 2); + + $contact_id = intval($_GET['restre_contact']); // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); @@ -224,9 +232,9 @@ if (isset($_GET['unarchive_vendor_contact'])) { mysqli_query($mysqli,"UPDATE contacts SET contact_archived_at = NULL WHERE contact_id = $contact_id"); - logAction("Contact", "Unarchive", "$session_name unarchived contact $contact_name", $client_id, $contact_id); + logAction("Contact", "Restore", "$session_name restored contact $contact_name", $client_id, $contact_id); - flash_alert("Contact $contact_name has been Unarchived"); + flash_alert("Contact $contact_name Restored"); redirect(); @@ -234,6 +242,8 @@ if (isset($_GET['unarchive_vendor_contact'])) { if (isset($_GET['delete_vendor_contact'])) { + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_client', 3); $contact_id = intval($_GET['delete_contact']); @@ -270,6 +280,8 @@ if (isset($_GET['delete_vendor_contact'])) { if (isset($_POST['export_vendor_contacts_csv'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client'); $client_id = intval($_POST['client_id']); @@ -321,6 +333,8 @@ if (isset($_POST['export_vendor_contacts_csv'])) { if (isset($_POST["import_vendor_contacts_csv"])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); $client_id = intval($_POST['client_id']); @@ -421,6 +435,8 @@ if (isset($_POST["import_vendor_contacts_csv"])) { if (isset($_GET['download_vendor_contacts_csv_template'])) { + validateCSRFToken($_GET['csrf_token']); + $client_id = intval($_GET['download_client_contacts_csv_template']); //get records from database diff --git a/agent/vendors.php b/agent/vendors.php index fd012730..f95c73ce 100644 --- a/agent/vendors.php +++ b/agent/vendors.php @@ -88,8 +88,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));