AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 00:40:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set EnforceClientAccess Perms throughout expenses, modals and post along with listing

Browse Source
This commit is contained in:
johnnyq
2026-07-09 14:51:51 -04:00
parent c01645c4e2
commit 68f705b135
6 changed files with 35 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
agent/expenses.php
View File

@@ -52,6 +52,7 @@ $sql = mysqli_query(
$category_query
AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
$account_query
$access_permission_query
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

2
agent/modals/expense/expense_add.php
View File

@@ -169,7 +169,7 @@ ob_start();
<option value="0">- Client (Optional) -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);

2
agent/modals/expense/expense_bulk_edit_client.php
View File

@@ -36,7 +36,7 @@ ob_start();
<option value="0">- No Client -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);

2
agent/modals/expense/expense_copy.php
View File

@@ -176,7 +176,7 @@ ob_start();
<option value="">- Select Client -</option>
<?php
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);

10
agent/modals/expense/expense_edit.php
View File

@@ -21,10 +21,14 @@ $expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);
$expense_client_id = intval($row['expense_client_id']);
$client_id = intval($row['expense_client_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$category_name = nullable_htmlentities($row['category_name']);
if ($client_id) {
enforceClientAccess();
}
// Generate the HTML form content using output buffering.
ob_start();
?>
@@ -199,12 +203,12 @@ ob_start();
<option value="">- Select Client -</option>
<?php
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
?>
<option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
<?php
}

24
agent/post/expense.php
View File

@@ -57,6 +57,10 @@ if (isset($_POST['edit_expense'])) {
require_once 'expense_model.php';
if ($client_id) {
enforceClientAccess();
}
$expense_id = intval($_POST['expense_id']);
// Get old receipt
@@ -106,6 +110,10 @@ if (isset($_GET['delete_expense'])) {
$expense_description = sanitizeInput($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
unlink("../uploads/expenses/$expense_receipt");
mysqli_query($mysqli,"DELETE FROM expenses WHERE expense_id = $expense_id");
@@ -144,6 +152,10 @@ if (isset($_POST['bulk_edit_expense_category'])) {
$expense_description = sanitizeInput($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
mysqli_query($mysqli,"UPDATE expenses SET expense_category_id = $category_id WHERE expense_id = $expense_id");
logAction("Expense", "Edit", "$session_name assigned expense $expense_descrition to category $category_name", $client_id, $expense_id);
@@ -185,6 +197,10 @@ if (isset($_POST['bulk_edit_expense_account'])) {
$expense_description = sanitizeInput($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
mysqli_query($mysqli,"UPDATE expenses SET expense_account_id = $account_id WHERE expense_id = $expense_id");
logAction("Expense", "Edit", "$session_name assigned expense $expense_descrition to account $account_name", $client_id, $expense_id);
@@ -208,6 +224,8 @@ if (isset($_POST['bulk_edit_expense_client'])) {
$client_id = intval($_POST['bulk_client_id']);
enforceClientAccess();
// Get Client name for logging and Notification
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
@@ -258,6 +276,10 @@ if (isset($_POST['bulk_delete_expenses'])) {
$expense_receipt = sanitizeInput($row['expense_receipt']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
unlink("../uploads/expenses/$expense_receipt");
mysqli_query($mysqli, "DELETE FROM expenses WHERE expense_id = $expense_id");
@@ -324,11 +346,13 @@ if (isset($_POST['export_expenses_csv'])) {
LEFT JOIN categories ON expense_category_id = category_id
LEFT JOIN vendors ON expense_vendor_id = vendor_id
LEFT JOIN accounts ON expense_account_id = account_id
LEFT JOIN clients ON expense_client_id = client_id
WHERE expense_vendor_id > 0
$date_query
$account_query
$vendor_query
$category_query
$access_permission_query
ORDER BY expense_date DESC
");