diff --git a/asset_details.php b/asset_details.php index cb020ec9..ce40fb48 100644 --- a/asset_details.php +++ b/asset_details.php @@ -11,7 +11,6 @@ if (isset($_GET['client_id'])) { $client_url = ''; } - if (isset($_GET['asset_id'])) { $asset_id = intval($_GET['asset_id']); @@ -25,7 +24,7 @@ if (isset($_GET['asset_id'])) { "); $row = mysqli_fetch_array($sql); - $client_id = intval($row['asset_client_id']); + $client_id = intval($row['client_id']); $client_name = nullable_htmlentities($row['client_name']); $asset_id = intval($row['asset_id']); $asset_type = nullable_htmlentities($row['asset_type']); diff --git a/assets.php b/assets.php index 14eb96d3..45dcda07 100644 --- a/assets.php +++ b/assets.php @@ -66,11 +66,13 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, " SUM(CASE WHEN asset_type IN ('Firewall/Router', 'switch', 'access point') THEN 1 ELSE 0 END) AS network_count, SUM(CASE WHEN asset_type NOT IN ('laptop', 'desktop', 'server', 'virtual machine', 'Firewall/Router', 'switch', 'access point') THEN 1 ELSE 0 END) AS other_count FROM ( - SELECT assets.* FROM assets + SELECT assets.* FROM assets + LEFT JOIN clients ON client_id = asset_client_id LEFT JOIN contacts ON asset_contact_id = contact_id LEFT JOIN locations ON asset_location_id = location_id LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE asset_$archive_query + $access_permission_query $client_query ) AS filtered_assets; ")); @@ -106,8 +108,10 @@ $sql = mysqli_query( WHERE asset_$archive_query AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%') AND ($type_query) + $access_permission_query $location_query $client_query + ORDER BY $sort $order LIMIT $record_from, $record_to" ); @@ -226,7 +230,7 @@ if (mysqli_num_rows($os_sql) > 0) { getMessage()); - $access_permission_query = ""; // Ensure safe default if query fails +// Client access permission check +// Default allow, if a list of allowed clients is set & the user isn't an admin, restrict them +$access_permission_query = ""; +if ($client_access_string && !$session_is_admin) { + $access_permission_query = "AND clients.client_id IN ($client_access_string)"; } // Include the settings vars diff --git a/contacts.php b/contacts.php index 801faa0d..9b7eae6e 100644 --- a/contacts.php +++ b/contacts.php @@ -65,6 +65,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS contacts.*, clients.*, WHERE contact_$archive_query $tag_query AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%') + $access_permission_query $client_query $location_query GROUP BY contact_id @@ -158,7 +159,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); >- All Clients -