-
-
diff --git a/accounts.php b/accounts.php
index b4fbae9e..8a17f890 100644
--- a/accounts.php
+++ b/accounts.php
@@ -1,17 +1,20 @@
- $sb, 'o' => $o)));
+$url_query_strings_sb = http_build_query(array_merge($_GET, array('sb' => $sb, 'o' => $o)));
-$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM accounts
- WHERE account_name LIKE '%$q%' AND company_id = $session_company_id
- ORDER BY $sb $o LIMIT $record_from, $record_to");
+$sql = mysqli_query(
+ $mysqli,
+ "SELECT SQL_CALC_FOUND_ROWS * FROM accounts
+ WHERE account_name LIKE '%$q%' AND company_id = $session_company_id
+ ORDER BY $sb $o LIMIT $record_from, $record_to"
+);
$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
@@ -19,15 +22,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+require_once("account_add_modal.php");
+require_once("footer.php");
diff --git a/ajax.php b/ajax.php
index 3902a37b..f743d7f4 100644
--- a/ajax.php
+++ b/ajax.php
@@ -141,7 +141,9 @@ if (isset($_GET['network_get_json_details'])) {
}
// Lookup all client locations, as networks can be associated with any client location
- $locations_sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations
+ $locations_sql = mysqli_query(
+ $mysqli,
+ "SELECT location_id, location_name FROM locations
WHERE location_client_id = '$client_id' AND company_id = '$session_company_id'"
);
while ($row = mysqli_fetch_array($locations_sql)) {
@@ -153,7 +155,7 @@ if (isset($_GET['network_get_json_details'])) {
if (isset($_POST['client_set_notes'])) {
$client_id = intval($_POST['client_id']);
- $notes = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['notes'])));
+ $notes = sanitizeInput($_POST['notes']);
// Update notes
mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = '$client_id'");
@@ -165,10 +167,10 @@ if (isset($_POST['client_set_notes'])) {
if (isset($_POST['contact_set_notes'])) {
$contact_id = intval($_POST['contact_id']);
- $notes = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['notes'])));
+ $notes = sanitizeInput($_POST['notes']);
// Update notes
- mysqli_query($mysqli, "UPDATE contacts SET contact_notes = '$notes' WHERE contact_id = contact_id");
+ mysqli_query($mysqli, "UPDATE contacts SET contact_notes = '$notes' WHERE contact_id = $contact_id");
// Logging
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Modify', log_description = '$session_name modified contact notes', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, company_id = $session_company_id");
@@ -226,28 +228,28 @@ if (isset($_GET['share_generate_link'])) {
$item_encrypted_credential = ''; // Default empty
$client_id = intval($_GET['client_id']);
- $item_type = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['type'])));
+ $item_type = sanitizeInput($_GET['type']);
$item_id = intval($_GET['id']);
- $item_note = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['note'])));
+ $item_note = sanitizeInput($_GET['note']);
$item_view_limit = intval($_GET['views']);
- $item_expires = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['expires'])));
+ $item_expires = sanitizeInput($_GET['expires']);
$item_key = randomString(156);
if ($item_type == "Document") {
$row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = '$item_id' AND document_client_id = '$client_id' LIMIT 1"));
- $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['document_name']));
+ $item_name = sanitizeInput($row['document_name']);
}
if ($item_type == "File") {
$row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = '$item_id' AND file_client_id = '$client_id' LIMIT 1"));
- $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['file_name']));
+ $item_name = sanitizeInput($row['file_name']);
}
if ($item_type == "Login") {
$login = mysqli_query($mysqli, "SELECT login_name, login_username, login_password FROM logins WHERE login_id = '$item_id' AND login_client_id = '$client_id' LIMIT 1");
$row = mysqli_fetch_array($login);
- $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['login_name']));
+ $item_name = sanitizeInput($row['login_name']);
// Decrypt & re-encrypt username/password for sharing
$login_encryption_key = randomString();
diff --git a/api/v1/assets/asset_model.php b/api/v1/assets/asset_model.php
new file mode 100644
index 00000000..5d92ae65
--- /dev/null
+++ b/api/v1/assets/asset_model.php
@@ -0,0 +1,137 @@
+ 0) {
else {
$return_arr['success'] = "False";
$return_arr['message'] = "Auth success but delete query failed. Ensure ALL required variables are provided and database schema is up-to-date. Most likely cause: asset/client/company ID mismatch.";
+
+ // Log any database/schema related errors to the PHP Error log
+ if (mysqli_error($mysqli)) {
+ error_log("API Database Error: " . mysqli_error($mysqli));
+ }
}
echo json_encode($return_arr);
-exit();
\ No newline at end of file
+exit();
diff --git a/api/v1/documents/read.php b/api/v1/documents/read.php
new file mode 100644
index 00000000..ede88862
--- /dev/null
+++ b/api/v1/documents/read.php
@@ -0,0 +1,19 @@
+ 0) {
else {
$return_arr['success'] = "False";
$return_arr['message'] = "No resource (for this client and company) with the specified parameter(s).";
+
+ // Log any database/schema related errors to the PHP Error log
+ if (mysqli_error($mysqli)) {
+ error_log("API Database Error: " . mysqli_error($mysqli));
+ }
+
echo json_encode($return_arr);
exit();
-}
\ No newline at end of file
+}
diff --git a/api/v1/require_get_method.php b/api/v1/require_get_method.php
index 4ce0b1f9..bc6cafdc 100644
--- a/api/v1/require_get_method.php
+++ b/api/v1/require_get_method.php
@@ -7,7 +7,11 @@ if ($_SERVER['REQUEST_METHOD'] !== "GET") {
exit();
}
-// Wildcard client ID for most SELECT queries
+// Wildcard client ID for most SELECT queries, unless otherwise specified (and allowed)
if ($client_id == 0) {
- $client_id = "%";
-}
\ No newline at end of file
+ if (isset($_GET['client_id'])) {
+ $client_id = intval($_GET['client_id']);
+ } else {
+ $client_id = "%";
+ }
+}
diff --git a/api/v1/software/read.php b/api/v1/software/read.php
index 0b09d9a0..7d1b1820 100644
--- a/api/v1/software/read.php
+++ b/api/v1/software/read.php
@@ -7,36 +7,35 @@ require_once('../require_get_method.php');
if (isset($_GET['software_id'])) {
$id = intval($_GET['software_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id' AND company_id = '$company_id'");
-}
-// Specific software via key
-if (isset($_GET['software_key'])) {
+} elseif (isset($_GET['software_key'])) {
+ // Specific software via key
+
$key = mysqli_real_escape_string($mysqli, $_GET['software_license']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
-}
-// Software by name
-elseif (isset($_GET['software_name'])) {
+} elseif (isset($_GET['software_name'])) {
+ // Software by name
+
$name = mysqli_real_escape_string($mysqli, $_GET['software_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
-}
-// Software via type
-elseif (isset($_GET['software_type'])) {
+} elseif (isset($_GET['software_type'])) {
+ // Software via type
+
$type = intval($_GET['software_type']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
-}
-// Software via client ID (if allowed)
-elseif (isset($_GET['client_id']) && $client_id == "%") {
- $client_id = intval($_GET['client_id']);
+} elseif (isset($_GET['client_id'])) {
+ // Software via client ID
+
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
-}
-// All software(s)
-else {
+} else {
+ // All software(s)
+
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
}
// Output
-require_once("../read_output.php");
\ No newline at end of file
+require_once("../read_output.php");
diff --git a/api/v1/tickets/read.php b/api/v1/tickets/read.php
index b0ee19e6..075212c4 100644
--- a/api/v1/tickets/read.php
+++ b/api/v1/tickets/read.php
@@ -7,12 +7,12 @@ require_once('../require_get_method.php');
if (isset($_GET['ticket_id'])) {
$id = intval($_GET['ticket_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$id' AND ticket_client_id LIKE '$client_id' AND company_id = '$company_id'");
-}
-// All tickets
-else {
+} else {
+ // All tickets
+
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset");
}
// Output
-require_once("../read_output.php");
\ No newline at end of file
+require_once("../read_output.php");
diff --git a/api/v1/update_output.php b/api/v1/update_output.php
index 59e7c13c..da985b54 100644
--- a/api/v1/update_output.php
+++ b/api/v1/update_output.php
@@ -16,8 +16,13 @@ if (isset($update_count) && is_numeric($update_count) && $update_count > 0) {
// Query returned false: something went wrong, or it was declined due to required variables missing
else {
$return_arr['success'] = "False";
- $return_arr['message'] = "Auth success but update query failed/returned no results. Ensure ALL required variables are provided and database schema is up-to-date. Most likely cause: non-existent module ID (contact ID/ticket ID/etc)";
+ $return_arr['message'] = "Auth success but update query failed/returned no results. Ensure ALL required variables are provided and database schema is up-to-date. Most likely cause: non-existent module ID (i.e. bad contact ID/ticket ID/etc).";
+
+ // Log any database/schema related errors to the PHP Error log
+ if (mysqli_error($mysqli)) {
+ error_log("API Database Error: " . mysqli_error($mysqli));
+ }
}
echo json_encode($return_arr);
-exit();
\ No newline at end of file
+exit();
diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php
index 6fa07065..3eeb02c5 100644
--- a/api/v1/validate_api_key.php
+++ b/api/v1/validate_api_key.php
@@ -7,7 +7,7 @@
*/
// Includes
-require_once( __DIR__ . '../../../functions.php');
+require_once(__DIR__ . '../../../functions.php');
require_once(__DIR__ . "../../../config.php");
// JSON header
@@ -16,9 +16,8 @@ header('Content-Type: application/json');
// POST data
$_POST = json_decode(file_get_contents('php://input'), true);
-// Get user IP
+// Get IP & UA
$ip = strip_tags(mysqli_real_escape_string($mysqli, getIP()));
-// Get user agent
$user_agent = strip_tags(mysqli_real_escape_string($mysqli, $_SERVER['HTTP_USER_AGENT']));
// Setup return array
@@ -81,10 +80,10 @@ if (isset($api_key)) {
header(WORDING_UNAUTHORIZED);
echo json_encode($return_arr);
exit();
- }
- // Success
- else {
+ } else {
+
+ // SUCCESS
// Set client ID, company ID & key name
$row = mysqli_fetch_array($sql);
@@ -95,21 +94,17 @@ if (isset($api_key)) {
// Set limit & offset for queries
if (isset($_GET['limit'])) {
$limit = intval($_GET['limit']);
- }
- elseif (isset($_POST['limit'])) {
+ } elseif (isset($_POST['limit'])) {
$limit = intval($_POST['limit']);
- }
- else {
+ } else {
$limit = 50;
}
if (isset($_GET['offset'])) {
$offset = intval($_GET['offset']);
- }
- elseif (isset($_POST['offset'])) {
+ } elseif (isset($_POST['offset'])) {
$offset = intval($_POST['offset']);
- }
- else {
+ } else {
$offset = 0;
}
diff --git a/api_key_add_modal.php b/api_key_add_modal.php
index 5303699f..23cefd42 100644
--- a/api_key_add_modal.php
+++ b/api_key_add_modal.php
@@ -5,7 +5,7 @@ $key = randomString(156);
diff --git a/base32static.php b/base32static.php
index 980a89c4..a59feaff 100644
--- a/base32static.php
+++ b/base32static.php
@@ -44,7 +44,7 @@ class Base32Static {
$i=0;
while($i < count($fiveBitBinaryArray)) {
- $base32 .= self::$map[base_convert(str_pad($fiveBitBinaryArray[$i], 5,'0'), 2, 10)];
+ $base32 .= self::$map[base_convert(str_pad($fiveBitBinaryArray[$i], 5, '0'), 2, 10)];
$i++;
}
@@ -71,7 +71,7 @@ class Base32Static {
substr($input, -($allowedValues[$i])) != str_repeat(self::$map[32], $allowedValues[$i])) return false;
}
- $input = str_replace('=','', $input);
+ $input = str_replace('=', '', $input);
$input = str_split($input);
$binaryString = "";
@@ -87,7 +87,7 @@ class Base32Static {
$eightBits = str_split($x, 8);
for ($z = 0; $z < count($eightBits); $z++) {
- $binaryString .= ( ($y = chr(base_convert($eightBits[$z], 2, 10))) || ord($y) == 48 ) ? $y:"";
+ $binaryString .= (($y = chr(base_convert($eightBits[$z], 2, 10))) || ord($y) == 48) ? $y:"";
}
}
diff --git a/blank.php b/blank.php
index f09e0d6d..c7ea11e0 100644
--- a/blank.php
+++ b/blank.php
@@ -2,10 +2,10 @@
- -
- Dashboard
-
- - Blank Page
+ -
+ Dashboard
+
+ - Blank Page
@@ -18,6 +18,17 @@
+
diff --git a/calendar_add_modal.php b/calendar_add_modal.php
index e90c3852..80dcc7f1 100644
--- a/calendar_add_modal.php
+++ b/calendar_add_modal.php
@@ -1,41 +1,41 @@
-
-
diff --git a/calendar_event_add_modal.php b/calendar_event_add_modal.php
index eff6307a..14bff4af 100644
--- a/calendar_event_add_modal.php
+++ b/calendar_event_add_modal.php
@@ -1,162 +1,156 @@