AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-03-09 23:34:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add Some Client Permission Checks to the new Global View and some tidying

Browse Source
This commit is contained in:
johnnyq
2025-02-21 00:28:36 -05:00
parent ab3ffdf7fc
commit 64f3df6baf
13 changed files with 36 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
check_login.php
View File

@@ -77,30 +77,22 @@ $session_company_currency = $row['company_currency'];
// Set Currency Format
$currency_format = numfmt_create($session_company_locale, NumberFormatter::CURRENCY);
// Get User Client Access Permissions
$user_client_access_sql = "SELECT client_id FROM user_permissions WHERE user_id = $session_user_id";
$user_client_access_result = mysqli_query($mysqli, $user_client_access_sql);
try {
// Get User Client Access Permissions
$user_client_access_sql = "SELECT client_id FROM user_permissions WHERE user_id = $session_user_id";
$user_client_access_result = mysqli_query($mysqli, $user_client_access_sql);
$client_access_array = [];
while ($row = mysqli_fetch_assoc($user_client_access_result)) {
$client_access_array[] = $row['client_id'];
}
$client_access_array = [];
while ($row = mysqli_fetch_assoc($user_client_access_result)) {
$client_access_array[] = $row['client_id'];
}
$client_access_string = implode(',', $client_access_array);
$client_access_string = implode(',', $client_access_array);
// Client access permission check
// Default allow, if a list of allowed clients is set & the user isn't an admin, restrict them
$access_permission_query = "";
if ($client_access_string && !$session_is_admin) {
$access_permission_query = "AND clients.client_id IN ($client_access_string)";
}
} catch (Exception $e) {
// Handle exception
error_log('MySQL error: ' . $e->getMessage());
$access_permission_query = ""; // Ensure safe default if query fails
// Client access permission check
// Default allow, if a list of allowed clients is set & the user isn't an admin, restrict them
$access_permission_query = "";
if ($client_access_string && !$session_is_admin) {
$access_permission_query = "AND clients.client_id IN ($client_access_string)";
}
// Include the settings vars