AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set EnforceClientAccess Perms throughout expenses, modals and post along with listing

Browse Source
This commit is contained in:
johnnyq
2026-07-09 14:51:51 -04:00
parent c01645c4e2
commit 68f705b135
6 changed files with 35 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
agent/post/expense.php
View File

@@ -57,6 +57,10 @@ if (isset($_POST['edit_expense'])) {
require_once 'expense_model.php';
if ($client_id) {
enforceClientAccess();
}
$expense_id = intval($_POST['expense_id']);
// Get old receipt
@@ -106,6 +110,10 @@ if (isset($_GET['delete_expense'])) {
$expense_description = sanitizeInput($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
unlink("../uploads/expenses/$expense_receipt");
mysqli_query($mysqli,"DELETE FROM expenses WHERE expense_id = $expense_id");
@@ -144,6 +152,10 @@ if (isset($_POST['bulk_edit_expense_category'])) {
$expense_description = sanitizeInput($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
mysqli_query($mysqli,"UPDATE expenses SET expense_category_id = $category_id WHERE expense_id = $expense_id");
logAction("Expense", "Edit", "$session_name assigned expense $expense_descrition to category $category_name", $client_id, $expense_id);
@@ -185,6 +197,10 @@ if (isset($_POST['bulk_edit_expense_account'])) {
$expense_description = sanitizeInput($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
mysqli_query($mysqli,"UPDATE expenses SET expense_account_id = $account_id WHERE expense_id = $expense_id");
logAction("Expense", "Edit", "$session_name assigned expense $expense_descrition to account $account_name", $client_id, $expense_id);
@@ -208,6 +224,8 @@ if (isset($_POST['bulk_edit_expense_client'])) {
$client_id = intval($_POST['bulk_client_id']);
enforceClientAccess();
// Get Client name for logging and Notification
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
@@ -258,6 +276,10 @@ if (isset($_POST['bulk_delete_expenses'])) {
$expense_receipt = sanitizeInput($row['expense_receipt']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
enforceClientAccess();
}
unlink("../uploads/expenses/$expense_receipt");
mysqli_query($mysqli, "DELETE FROM expenses WHERE expense_id = $expense_id");
@@ -324,11 +346,13 @@ if (isset($_POST['export_expenses_csv'])) {
LEFT JOIN categories ON expense_category_id = category_id
LEFT JOIN vendors ON expense_vendor_id = vendor_id
LEFT JOIN accounts ON expense_account_id = account_id
LEFT JOIN clients ON expense_client_id = client_id
WHERE expense_vendor_id > 0
$date_query
$account_query
$vendor_query
$category_query
$access_permission_query
ORDER BY expense_date DESC
");