AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-03 14:17:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set EnforceClientAccess Perms throughout expenses, modals and post along with listing

Browse Source
This commit is contained in:
johnnyq
2026-07-09 14:51:51 -04:00
parent c01645c4e2
commit 68f705b135
6 changed files with 35 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
agent/modals/expense/expense_add.php
View File

@@ -169,7 +169,7 @@ ob_start();
<option value="0">- Client (Optional) -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);

2
agent/modals/expense/expense_bulk_edit_client.php
View File

@@ -36,7 +36,7 @@ ob_start();
<option value="0">- No Client -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);

2
agent/modals/expense/expense_copy.php
View File

@@ -176,7 +176,7 @@ ob_start();
<option value="">- Select Client -</option>
<?php
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);

10
agent/modals/expense/expense_edit.php
View File

@@ -21,10 +21,14 @@ $expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);
$expense_client_id = intval($row['expense_client_id']);
$client_id = intval($row['expense_client_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$category_name = nullable_htmlentities($row['category_name']);
if ($client_id) {
enforceClientAccess();
}
// Generate the HTML form content using output buffering.
ob_start();
?>
@@ -199,12 +203,12 @@ ob_start();
<option value="">- Select Client -</option>
<?php
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
?>
<option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>
<?php
}