diff --git a/asset_details.php b/asset_details.php index cb020ec9..ce40fb48 100644 --- a/asset_details.php +++ b/asset_details.php @@ -11,7 +11,6 @@ if (isset($_GET['client_id'])) { $client_url = ''; } - if (isset($_GET['asset_id'])) { $asset_id = intval($_GET['asset_id']); @@ -25,7 +24,7 @@ if (isset($_GET['asset_id'])) { "); $row = mysqli_fetch_array($sql); - $client_id = intval($row['asset_client_id']); + $client_id = intval($row['client_id']); $client_name = nullable_htmlentities($row['client_name']); $asset_id = intval($row['asset_id']); $asset_type = nullable_htmlentities($row['asset_type']); diff --git a/assets.php b/assets.php index 14eb96d3..45dcda07 100644 --- a/assets.php +++ b/assets.php @@ -66,11 +66,13 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, " SUM(CASE WHEN asset_type IN ('Firewall/Router', 'switch', 'access point') THEN 1 ELSE 0 END) AS network_count, SUM(CASE WHEN asset_type NOT IN ('laptop', 'desktop', 'server', 'virtual machine', 'Firewall/Router', 'switch', 'access point') THEN 1 ELSE 0 END) AS other_count FROM ( - SELECT assets.* FROM assets + SELECT assets.* FROM assets + LEFT JOIN clients ON client_id = asset_client_id LEFT JOIN contacts ON asset_contact_id = contact_id LEFT JOIN locations ON asset_location_id = location_id LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE asset_$archive_query + $access_permission_query $client_query ) AS filtered_assets; ")); @@ -106,8 +108,10 @@ $sql = mysqli_query( WHERE asset_$archive_query AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%') AND ($type_query) + $access_permission_query $location_query $client_query + ORDER BY $sort $order LIMIT $record_from, $record_to" ); @@ -226,7 +230,7 @@ if (mysqli_num_rows($os_sql) > 0) { getMessage()); - $access_permission_query = ""; // Ensure safe default if query fails +// Client access permission check +// Default allow, if a list of allowed clients is set & the user isn't an admin, restrict them +$access_permission_query = ""; +if ($client_access_string && !$session_is_admin) { + $access_permission_query = "AND clients.client_id IN ($client_access_string)"; } // Include the settings vars diff --git a/contacts.php b/contacts.php index 801faa0d..9b7eae6e 100644 --- a/contacts.php +++ b/contacts.php @@ -65,6 +65,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS contacts.*, clients.*, WHERE contact_$archive_query $tag_query AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%') + $access_permission_query $client_query $location_query GROUP BY contact_id @@ -158,7 +159,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); >- All Clients -
-

Domain Management

+

Domains

diff --git a/global_search.php b/global_search.php index b8e130bd..9e1d01e4 100644 --- a/global_search.php +++ b/global_search.php @@ -93,8 +93,8 @@ if (isset($_GET['query'])) { $sql_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM scheduled_tickets LEFT JOIN clients ON scheduled_ticket_client_id = client_id - WHERE scheduled_ticket_subject LIKE '%$query%' - OR scheduled_ticket_details LIKE '%$query%' + WHERE (scheduled_ticket_subject LIKE '%$query%' + OR scheduled_ticket_details LIKE '%$query%') $access_permission_query ORDER BY scheduled_ticket_id DESC LIMIT 5" ); diff --git a/includes/get_side_nav_counts.php b/includes/get_side_nav_counts.php index a371a9c7..c448632c 100644 --- a/includes/get_side_nav_counts.php +++ b/includes/get_side_nav_counts.php @@ -6,11 +6,11 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS nu $num_active_clients = $row['num']; // Active Ticket Count -$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4")); +$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 $access_permission_query")); $num_active_tickets = $row['num']; // Recurring Ticket Count -$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('scheduled_ticket_id') AS num FROM scheduled_tickets")); +$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('scheduled_ticket_id') AS num FROM scheduled_tickets LEFT JOIN clients ON client_id = scheduled_ticket_client_id WHERE 1 = 1 $access_permission_query")); $num_recurring_tickets = $row['num']; // Active Project Count diff --git a/locations.php b/locations.php index 9c10745d..192f190a 100644 --- a/locations.php +++ b/locations.php @@ -43,6 +43,7 @@ $sql = mysqli_query( WHERE location_$archive_query $tag_query AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%') + $access_permission_query $client_query GROUP BY location_id ORDER BY location_primary DESC, $sort $order LIMIT $record_from, $record_to" diff --git a/networks.php b/networks.php index bf2a7564..03c18a69 100644 --- a/networks.php +++ b/networks.php @@ -28,6 +28,7 @@ $sql = mysqli_query( LEFT JOIN locations ON location_id = network_location_id WHERE network_$archive_query AND (network_name LIKE '%$q%' OR network_description LIKE '%$q%' OR network_vlan LIKE '%$q%' OR network LIKE '%$q%' OR network_gateway LIKE '%$q%' OR network_subnet LIKE '%$q%' OR network_primary_dns LIKE '%$q%' OR network_secondary_dns LIKE '%$q%' OR network_dhcp_range LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%') + $access_permission_query $client_query ORDER BY $sort $order LIMIT $record_from, $record_to" ); diff --git a/services.php b/services.php index e53c1f6e..85c960f0 100644 --- a/services.php +++ b/services.php @@ -24,6 +24,7 @@ $sql = mysqli_query( "SELECT SQL_CALC_FOUND_ROWS * FROM services LEFT JOIN clients ON client_id = service_client_id WHERE (service_name LIKE '%$q%' OR service_description LIKE '%$q%' OR service_category LIKE '%$q%' OR client_name LIKE '%$q%') + $access_permission_query $client_query ORDER BY $sort $order LIMIT $record_from, $record_to" ); diff --git a/software.php b/software.php index 66f62c97..70ea7b5e 100644 --- a/software.php +++ b/software.php @@ -25,6 +25,7 @@ $sql = mysqli_query( WHERE software_template = 0 AND software_$archive_query AND (software_name LIKE '%$q%' OR software_type LIKE '%$q%' OR software_key LIKE '%$q%' OR client_name LIKE '%$q%') + $access_permission_query $client_query ORDER BY $sort $order LIMIT $record_from, $record_to");