diff --git a/admin/post/users.php b/admin/post/users.php index 388929260..b670ed8b3 100644 --- a/admin/post/users.php +++ b/admin/post/users.php @@ -328,7 +328,7 @@ if (isset($_POST['restore_user'])) { } -if (isset($_POST['export_users'])) { +if (isExportRequest('export_users')) { validateCSRFToken(); diff --git a/agent/modals/client/client_download_pdf.php b/agent/modals/client/client_download_pdf.php index 312918f48..8f0f76e58 100644 --- a/agent/modals/client/client_download_pdf.php +++ b/agent/modals/client/client_download_pdf.php @@ -17,7 +17,7 @@
  • - + @@ -26,7 +26,7 @@
  • - + @@ -35,7 +35,7 @@
  • - + @@ -44,7 +44,7 @@
  • - + @@ -53,7 +53,7 @@
  • - + @@ -62,7 +62,7 @@
  • - + @@ -71,7 +71,7 @@
  • - + @@ -80,7 +80,7 @@
  • - + @@ -89,7 +89,7 @@
  • - + @@ -102,7 +102,7 @@
  • - + @@ -111,7 +111,7 @@
  • - + @@ -120,7 +120,7 @@
  • - + @@ -129,7 +129,7 @@
  • - + @@ -138,7 +138,7 @@
  • - + @@ -147,7 +147,7 @@
  • - + @@ -156,7 +156,7 @@
  • - + @@ -165,7 +165,7 @@
  • - + diff --git a/agent/post/asset.php b/agent/post/asset.php index d04e3bd72..871cb7698 100644 --- a/agent/post/asset.php +++ b/agent/post/asset.php @@ -1316,7 +1316,7 @@ if (isset($_GET['download_assets_csv_template'])) { } -if (isset($_POST['export_assets'])) { +if (isExportRequest('export_assets')) { validateCSRFToken(); @@ -2056,7 +2056,7 @@ if (isset($_GET['download_client_asset_interfaces_csv_template'])) { } -if (isset($_POST['export_asset_interfaces'])) { +if (isExportRequest('export_asset_interfaces')) { validateCSRFToken(); diff --git a/agent/post/certificate.php b/agent/post/certificate.php index 9820ce197..8a91aa6b8 100644 --- a/agent/post/certificate.php +++ b/agent/post/certificate.php @@ -338,7 +338,7 @@ if (isset($_POST['bulk_delete_certificates'])) { } -if (isset($_POST['export_certificates'])) { +if (isExportRequest('export_certificates')) { validateCSRFToken(); diff --git a/agent/post/client.php b/agent/post/client.php index e94686e1a..6f4d7b106 100644 --- a/agent/post/client.php +++ b/agent/post/client.php @@ -356,7 +356,7 @@ if (isset($_GET['delete_client'])) { } -if (isset($_POST['export_clients'])) { +if (isExportRequest('export_clients')) { validateCSRFToken(); @@ -1192,26 +1192,26 @@ if (isset($_POST["export_client_pdf"])) { $company_logo = escapeHtml($row['company_logo']); $client_id = intval($_POST["client_id"]); - $export_contacts = intval($_POST["export_contacts"]); - $export_locations = intval($_POST["export_locations"]); - $export_assets = intval($_POST["export_assets"]); - $export_software = intval($_POST["export_software"]); + $export_contacts = intval($_POST["include_contacts"] ?? 0); + $export_locations = intval($_POST["include_locations"] ?? 0); + $export_assets = intval($_POST["include_assets"] ?? 0); + $export_software = intval($_POST["include_software"] ?? 0); $export_credentials = 0; if (lookupUserPermission("module_credential") >= 1) { - $export_credentials = intval($_POST["export_credentials"] ?? 0); + $export_credentials = intval($_POST["include_credentials"] ?? 0); } - $export_networks = intval($_POST["export_networks"]); - $export_certificates = intval($_POST["export_certificates"]); - $export_domains = intval($_POST["export_domains"]); - $export_tickets = intval($_POST["export_tickets"]); - $export_recurring_tickets = intval($_POST["export_recurring_tickets"]); - $export_vendors = intval($_POST["export_vendors"]); - $export_invoices = intval($_POST["export_invoices"]); - $export_recurring_invoices = intval($_POST["export_recurring_invoices"]); - $export_quotes = intval($_POST["export_quotes"]); - $export_payments = intval($_POST["export_payments"]); - $export_trips = intval($_POST["export_trips"]); - $export_logs = intval($_POST["export_logs"]); + $export_networks = intval($_POST["include_networks"] ?? 0); + $export_certificates = intval($_POST["include_certificates"] ?? 0); + $export_domains = intval($_POST["include_domains"] ?? 0); + $export_tickets = intval($_POST["include_tickets"] ?? 0); + $export_recurring_tickets = intval($_POST["include_recurring_tickets"] ?? 0); + $export_vendors = intval($_POST["include_vendors"] ?? 0); + $export_invoices = intval($_POST["include_invoices"] ?? 0); + $export_recurring_invoices = intval($_POST["include_recurring_invoices"] ?? 0); + $export_quotes = intval($_POST["include_quotes"] ?? 0); + $export_payments = intval($_POST["include_payments"] ?? 0); + $export_trips = intval($_POST["include_trips"] ?? 0); + $export_logs = intval($_POST["include_logs"] ?? 0); enforceClientAccess(); diff --git a/agent/post/contact.php b/agent/post/contact.php index edabf6425..ef2c95b9e 100644 --- a/agent/post/contact.php +++ b/agent/post/contact.php @@ -1262,7 +1262,7 @@ if (isset($_GET['unlink_contact_from_file'])) { } -if (isset($_POST['export_contacts'])) { +if (isExportRequest('export_contacts')) { validateCSRFToken(); diff --git a/agent/post/credential.php b/agent/post/credential.php index db7694098..a884a43e6 100644 --- a/agent/post/credential.php +++ b/agent/post/credential.php @@ -410,7 +410,7 @@ if (isset($_POST['bulk_delete_credentials'])) { } -if (isset($_POST['export_credentials'])) { +if (isExportRequest('export_credentials')) { validateCSRFToken(); diff --git a/agent/post/domain.php b/agent/post/domain.php index 60adc8a43..5b3e32c3c 100644 --- a/agent/post/domain.php +++ b/agent/post/domain.php @@ -455,7 +455,7 @@ if (isset($_POST['bulk_refresh_domains'])) { } -if (isset($_POST['export_domains'])) { +if (isExportRequest('export_domains')) { validateCSRFToken(); diff --git a/agent/post/expense.php b/agent/post/expense.php index ce269108e..d2f5c39a6 100644 --- a/agent/post/expense.php +++ b/agent/post/expense.php @@ -298,7 +298,7 @@ if (isset($_POST['bulk_delete_expenses'])) { } -if (isset($_POST['export_expenses'])) { +if (isExportRequest('export_expenses')) { validateCSRFToken(); diff --git a/agent/post/income.php b/agent/post/income.php index 79da2bfa4..c24c04b42 100644 --- a/agent/post/income.php +++ b/agent/post/income.php @@ -307,7 +307,7 @@ if (isset($_POST['bulk_edit_income_method'])) { } -if (isset($_POST['export_income'])) { +if (isExportRequest('export_income')) { validateCSRFToken(); diff --git a/agent/post/invoice.php b/agent/post/invoice.php index 3c5975966..5cc734be5 100644 --- a/agent/post/invoice.php +++ b/agent/post/invoice.php @@ -657,7 +657,7 @@ if (isset($_GET['email_invoice'])) { } -if (isset($_POST['export_invoices'])) { +if (isExportRequest('export_invoices')) { validateCSRFToken(); diff --git a/agent/post/location.php b/agent/post/location.php index 72aab550c..01619678c 100644 --- a/agent/post/location.php +++ b/agent/post/location.php @@ -388,7 +388,7 @@ if (isset($_POST['bulk_delete_locations'])) { } -if (isset($_POST['export_locations'])) { +if (isExportRequest('export_locations')) { validateCSRFToken(); diff --git a/agent/post/network.php b/agent/post/network.php index dbf6c86f6..0e2b1f2c1 100644 --- a/agent/post/network.php +++ b/agent/post/network.php @@ -172,7 +172,7 @@ if (isset($_POST['bulk_delete_networks'])) { } -if (isset($_POST['export_networks'])) { +if (isExportRequest('export_networks')) { validateCSRFToken(); diff --git a/agent/post/product.php b/agent/post/product.php index 56555c4c4..aded5b520 100644 --- a/agent/post/product.php +++ b/agent/post/product.php @@ -244,7 +244,7 @@ if (isset($_POST['bulk_delete_products'])) { } -if (isset($_POST['export_products'])) { +if (isExportRequest('export_products')) { validateCSRFToken(); diff --git a/agent/post/quote.php b/agent/post/quote.php index 2de119994..e41deae9e 100644 --- a/agent/post/quote.php +++ b/agent/post/quote.php @@ -692,7 +692,7 @@ if (isset($_GET['mark_quote_invoiced'])) { } -if (isset($_POST['export_quotes'])) { +if (isExportRequest('export_quotes')) { validateCSRFToken(); diff --git a/agent/post/recurring_invoice.php b/agent/post/recurring_invoice.php index b91678827..62b2c9462 100644 --- a/agent/post/recurring_invoice.php +++ b/agent/post/recurring_invoice.php @@ -617,7 +617,7 @@ if (isset($_POST['set_recurring_payment'])) { } -if (isset($_POST['export_recurring_invoices'])) { +if (isExportRequest('export_recurring_invoices')) { validateCSRFToken(); diff --git a/agent/post/software.php b/agent/post/software.php index 16ebe26e9..ec07d5892 100644 --- a/agent/post/software.php +++ b/agent/post/software.php @@ -226,7 +226,7 @@ if (isset($_GET['delete_software'])) { } -if (isset($_POST['export_software'])) { +if (isExportRequest('export_software')) { validateCSRFToken(); diff --git a/agent/post/ticket.php b/agent/post/ticket.php index 8fb35b1ee..aa6bfb224 100644 --- a/agent/post/ticket.php +++ b/agent/post/ticket.php @@ -2741,7 +2741,7 @@ if (isset($_POST['add_quote_from_ticket'])) { } -if (isset($_POST['export_tickets'])) { +if (isExportRequest('export_tickets')) { validateCSRFToken(); diff --git a/agent/post/transaction.php b/agent/post/transaction.php index 0cdd368c7..15b86683c 100644 --- a/agent/post/transaction.php +++ b/agent/post/transaction.php @@ -9,7 +9,7 @@ if (!defined('FROM_POST_HANDLER')) { exit; } -if (isset($_POST['export_transactions'])) { +if (isExportRequest('export_transactions')) { validateCSRFToken(); diff --git a/agent/post/trip.php b/agent/post/trip.php index 86c6ec71a..9e0cbc87b 100644 --- a/agent/post/trip.php +++ b/agent/post/trip.php @@ -84,7 +84,7 @@ if (isset($_GET['delete_trip'])) { } -if (isset($_POST['export_trips'])) { +if (isExportRequest('export_trips')) { validateCSRFToken(); diff --git a/agent/post/vendor.php b/agent/post/vendor.php index d263a7bb1..ca0bca4f2 100644 --- a/agent/post/vendor.php +++ b/agent/post/vendor.php @@ -353,7 +353,7 @@ if (isset($_POST['bulk_delete_vendors'])) { } -if (isset($_POST['export_vendors'])) { +if (isExportRequest('export_vendors')) { validateCSRFToken(); diff --git a/functions/export.php b/functions/export.php index d80739f29..91e0d0011 100644 --- a/functions/export.php +++ b/functions/export.php @@ -348,6 +348,17 @@ function resolveExportFormat($format) { return ($format === 'pdf') ? 'pdf' : 'csv'; } +/* + * The gate every export handler opens on. Keying on isset() alone means any other + * field that happens to share the trigger's name fires the export - the client PDF + * pack's section checkboxes (export_assets=1, export_contacts=1, ...) did exactly + * that, and since post.php loads every handler, the first match won and streamed a + * CSV instead. Only 'csv' or 'pdf' - what renderExportButtons() posts - counts. + */ +function isExportRequest($trigger) { + return isset($_POST[$trigger]) && in_array($_POST[$trigger], ['csv', 'pdf'], true); +} + /* * PDF is capped - see EXPORT_PDF_MAX_ROWS. Call this after the row count is known * and before beginExport(); it redirects rather than returning on refusal.