From 68f705b135b35fdc83d6739fb5c8292060f54016 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 9 Jul 2026 14:51:51 -0400
Subject: [PATCH] Set EnforceClientAccess Perms throughout expenses, modals and
 post along with listing

---
 agent/expenses.php                            |  1 +
 agent/modals/expense/expense_add.php          |  2 +-
 .../expense/expense_bulk_edit_client.php      |  2 +-
 agent/modals/expense/expense_copy.php         |  2 +-
 agent/modals/expense/expense_edit.php         | 10 +++++---
 agent/post/expense.php                        | 24 +++++++++++++++++++
 6 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/agent/expenses.php b/agent/expenses.php
index a183f7e6..40221b04 100644
--- a/agent/expenses.php
+++ b/agent/expenses.php
@@ -52,6 +52,7 @@ $sql = mysqli_query(
     $category_query
     AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
     $account_query
+    $access_permission_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/agent/modals/expense/expense_add.php b/agent/modals/expense/expense_add.php
index 03a12e2c..db759a82 100644
--- a/agent/modals/expense/expense_add.php
+++ b/agent/modals/expense/expense_add.php
@@ -169,7 +169,7 @@ ob_start();
                             <option value="0">- Client (Optional) -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name = nullable_htmlentities($row['client_name']);
diff --git a/agent/modals/expense/expense_bulk_edit_client.php b/agent/modals/expense/expense_bulk_edit_client.php
index b65ff79d..35b43cc7 100644
--- a/agent/modals/expense/expense_bulk_edit_client.php
+++ b/agent/modals/expense/expense_bulk_edit_client.php
@@ -36,7 +36,7 @@ ob_start();
                     <option value="0">- No Client -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $client_id = intval($row['client_id']);
                         $client_name = nullable_htmlentities($row['client_name']);
diff --git a/agent/modals/expense/expense_copy.php b/agent/modals/expense/expense_copy.php
index 36dd5c54..8e8e5183 100644
--- a/agent/modals/expense/expense_copy.php
+++ b/agent/modals/expense/expense_copy.php
@@ -176,7 +176,7 @@ ob_start();
                             <option value="">- Select Client -</option>
                             <?php
 
-                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
+                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_clients)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = nullable_htmlentities($row['client_name']);
diff --git a/agent/modals/expense/expense_edit.php b/agent/modals/expense/expense_edit.php
index 34d012c0..18f5f4d4 100644
--- a/agent/modals/expense/expense_edit.php
+++ b/agent/modals/expense/expense_edit.php
@@ -21,10 +21,14 @@ $expense_created_at = nullable_htmlentities($row['expense_created_at']);
 $expense_vendor_id = intval($row['expense_vendor_id']);
 $expense_category_id = intval($row['expense_category_id']);
 $expense_account_id = intval($row['expense_account_id']);
-$expense_client_id = intval($row['expense_client_id']);
+$client_id = intval($row['expense_client_id']);
 $vendor_name = nullable_htmlentities($row['vendor_name']);
 $category_name = nullable_htmlentities($row['category_name']);
 
+if ($client_id) {
+    enforceClientAccess();
+}
+
 // Generate the HTML form content using output buffering.
 ob_start();
 ?>
@@ -199,12 +203,12 @@ ob_start();
                             <option value="">- Select Client -</option>
                             <?php
 
-                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
+                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_clients)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = nullable_htmlentities($row['client_name']);
                                 ?>
-                                <option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
+                                <option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
 
                                 <?php
                             }
diff --git a/agent/post/expense.php b/agent/post/expense.php
index 4b0a50cc..21f4cad4 100644
--- a/agent/post/expense.php
+++ b/agent/post/expense.php
@@ -57,6 +57,10 @@ if (isset($_POST['edit_expense'])) {
 
     require_once 'expense_model.php';
 
+    if ($client_id) {
+        enforceClientAccess();
+    }
+
     $expense_id = intval($_POST['expense_id']);
 
     // Get old receipt
@@ -106,6 +110,10 @@ if (isset($_GET['delete_expense'])) {
     $expense_description = sanitizeInput($row['expense_description']);
     $client_id = intval($row['expense_client_id']);
 
+    if ($client_id) {
+        enforceClientAccess();
+    }
+
     unlink("../uploads/expenses/$expense_receipt");
 
     mysqli_query($mysqli,"DELETE FROM expenses WHERE expense_id = $expense_id");
@@ -144,6 +152,10 @@ if (isset($_POST['bulk_edit_expense_category'])) {
             $expense_description = sanitizeInput($row['expense_description']);
             $client_id = intval($row['expense_client_id']);
 
+            if ($client_id) {
+                enforceClientAccess();
+            }
+
             mysqli_query($mysqli,"UPDATE expenses SET expense_category_id = $category_id WHERE expense_id = $expense_id");
 
             logAction("Expense", "Edit", "$session_name assigned expense $expense_descrition to category $category_name", $client_id, $expense_id);
@@ -185,6 +197,10 @@ if (isset($_POST['bulk_edit_expense_account'])) {
             $expense_description = sanitizeInput($row['expense_description']);
             $client_id = intval($row['expense_client_id']);
 
+            if ($client_id) {
+                enforceClientAccess();
+            }
+
             mysqli_query($mysqli,"UPDATE expenses SET expense_account_id = $account_id WHERE expense_id = $expense_id");
 
             logAction("Expense", "Edit", "$session_name assigned expense $expense_descrition to account $account_name", $client_id, $expense_id);
@@ -208,6 +224,8 @@ if (isset($_POST['bulk_edit_expense_client'])) {
 
     $client_id = intval($_POST['bulk_client_id']);
 
+    enforceClientAccess();
+
     // Get Client name for logging and Notification
     $client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
 
@@ -258,6 +276,10 @@ if (isset($_POST['bulk_delete_expenses'])) {
             $expense_receipt = sanitizeInput($row['expense_receipt']);
             $client_id = intval($row['expense_client_id']);
 
+            if ($client_id) {
+                enforceClientAccess();
+            }
+
             unlink("../uploads/expenses/$expense_receipt");
 
             mysqli_query($mysqli, "DELETE FROM expenses WHERE expense_id = $expense_id");
@@ -324,11 +346,13 @@ if (isset($_POST['export_expenses_csv'])) {
       LEFT JOIN categories ON expense_category_id = category_id
       LEFT JOIN vendors ON expense_vendor_id = vendor_id
       LEFT JOIN accounts ON expense_account_id = account_id
+      LEFT JOIN clients ON expense_client_id = client_id
       WHERE expense_vendor_id > 0
       $date_query
       $account_query
       $vendor_query
       $category_query
+      $access_permission_query
       ORDER BY expense_date DESC
     ");