AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Module permissions modal enforcement sweep to match its post counterpart

Browse Source
This commit is contained in:
johnnyq
2026-07-25 00:28:42 -04:00
parent 7a793cbbcc
commit 761b2a7af4
39 changed files with 78 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
agent/modals/account/account_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_financial', 2);
$account_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");

2
agent/modals/asset/asset_bulk_assign_contact.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$client_id = intval($_GET['client_id']);
enforceClientAccess();

2
agent/modals/asset/asset_bulk_assign_location.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$client_id = intval($_GET['client_id']);
enforceClientAccess();

2
agent/modals/client/client_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_client', 2);
$client_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id $access_permission_query LIMIT 1");

2
agent/modals/contact/contact_bulk_assign_location.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_client', 2);
$client_id = intval($_GET['client_id']);
enforceClientAccess();

2
agent/modals/document/document_add_from_template.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$client_id = intval($_GET['client_id'] ?? 0);
enforceClientAccess();

2
agent/modals/document/document_bulk_move.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$client_id = intval($_GET['client_id']);
$selected_ids = array_map('intval', $_GET['selected_ids'] ?? []);

2
agent/modals/document/document_move.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$document_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");

2
agent/modals/document/document_rename.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$document_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");

2
agent/modals/document/document_version_view.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support');
// Initialize the HTML Purifier to prevent XSS
require_once "../../../libs/htmlpurifier/HTMLPurifier.standalone.php";

2
agent/modals/document/document_view.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support');
// Initialize the HTML Purifier to prevent XSS
require_once "../../../libs/htmlpurifier/HTMLPurifier.standalone.php";

2
agent/modals/expense/expense_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_financial', 2);
$expense_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses

2
agent/modals/file/file_move.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$file_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $file_id LIMIT 1");

2
agent/modals/file/file_rename.php
View File

@@ -1,6 +1,8 @@
<?php
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$file_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $file_id LIMIT 1");

2
agent/modals/folder/folder_rename.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$folder_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_id = $folder_id LIMIT 1");

2
agent/modals/invoice/invoice_copy.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");

2
agent/modals/invoice/invoice_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");

2
agent/modals/invoice/invoice_item_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$item_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoice_items LEFT JOIN invoices ON invoice_id = item_invoice_id WHERE item_id = $item_id LIMIT 1");

2
agent/modals/location/location_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_client', 2);
$location_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $location_id LIMIT 1");

2
agent/modals/payment/invoice_apply_credit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT invoice_prefix, invoice_number, invoice_client_id

2
agent/modals/payment/payment_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$payment_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM payments LEFT JOIN invoices ON invoice_id = payment_invoice_id WHERE payment_id = $payment_id LIMIT 1");

2
agent/modals/product/product_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$product_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM products WHERE product_id = $product_id LIMIT 1");

2
agent/modals/project/project_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$project_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_id = $project_id LIMIT 1");

2
agent/modals/project/project_link_closed_ticket.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$project_id = intval($_GET['project_id']);
$client_id = intval($_GET['client_id'] ?? 0);

2
agent/modals/project/project_link_ticket.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$project_id = intval($_GET['project_id']);
$client_id = intval($_GET['client_id'] ?? 0);

2
agent/modals/quote/quote_copy.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");

2
agent/modals/quote/quote_item_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$item_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM quote_items LEFT JOIN quotes ON quote_id = item_quote_id WHERE item_id = $item_id LIMIT 1");

2
agent/modals/quote/quote_to_invoice.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['quote_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id LIMIT 1");

2
agent/modals/recurring_expense/recurring_expense_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_financial', 2);
$recurring_expense_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id LIMIT 1");

2
agent/modals/recurring_invoice/recurring_invoice_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id LIMIT 1");

2
agent/modals/recurring_invoice/recurring_invoice_item_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$item_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items LEFT JOIN recurring_invoices ON recurring_invoice_id = item_recurring_invoice_id WHERE item_id = $item_id LIMIT 1");

2
agent/modals/recurring_ticket/recurring_ticket_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$recurring_ticket_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id LIMIT 1");

2
agent/modals/service/service.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support');
$service_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM services WHERE service_id = $service_id LIMIT 1");

2
agent/modals/service/service_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$service_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM services WHERE service_id = $service_id LIMIT 1");

2
agent/modals/ticket/ticket_billable.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_support', 2);
$ticket_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");

2
agent/modals/trip/trip_copy.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_financial', 2);
$trip_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM trips WHERE trip_id = $trip_id LIMIT 1");

2
agent/modals/trip/trip_edit.php
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_financial', 2);
$trip_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM trips WHERE trip_id = $trip_id LIMIT 1");

2
agent/modals/vendor/vendor.php vendored
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_client');
$vendor_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");

2
agent/modals/vendor/vendor_edit.php vendored
View File

@@ -2,6 +2,8 @@
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_client', 2);
$vendor_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");