From 64684e1248f89a570ef927d2e3a44b7c02f571b7 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Sun, 8 Sep 2024 22:52:38 +0100 Subject: [PATCH] Enforce CSRF for post/asset and post/account Tiny bit of tidying --- account_add_modal.php | 2 ++ account_edit_modal.php | 1 + accounts.php | 2 +- admin_bulk_mail.php | 1 + admin_mail_queue.php | 1 + client_asset_add_modal.php | 2 +- client_asset_copy_modal.php | 1 + client_asset_details.php | 2 +- client_asset_edit_modal.php | 1 + client_asset_export_modal.php | 5 +++-- client_asset_import_modal.php | 1 + client_asset_interface_add_modal.php | 2 +- client_asset_interface_edit_modal.php | 2 +- client_asset_transfer_modal.php | 2 ++ client_assets.php | 12 +++++++----- client_contact_details.php | 4 ++-- client_contacts.php | 1 + client_documents.php | 1 + client_files.php | 1 + client_locations.php | 1 + client_logins.php | 1 + client_vendors.php | 1 + expenses.php | 2 ++ post/account.php | 4 ++++ post/asset.php | 20 ++++++++++++++++++-- post/custom_field.php | 2 -- products.php | 1 + report_assets.php | 8 +++++--- tickets.php | 1 + 29 files changed, 64 insertions(+), 21 deletions(-) diff --git a/account_add_modal.php b/account_add_modal.php index 08df7019..dfc7bccf 100644 --- a/account_add_modal.php +++ b/account_add_modal.php @@ -8,6 +8,8 @@
+ +
diff --git a/account_edit_modal.php b/account_edit_modal.php index 94847ec1..b521c839 100644 --- a/account_edit_modal.php +++ b/account_edit_modal.php @@ -9,6 +9,7 @@
+
diff --git a/accounts.php b/accounts.php index 2f65a9d4..73e411d6 100644 --- a/accounts.php +++ b/accounts.php @@ -93,7 +93,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + Archive diff --git a/admin_bulk_mail.php b/admin_bulk_mail.php index d7febe65..2fc8ae87 100644 --- a/admin_bulk_mail.php +++ b/admin_bulk_mail.php @@ -28,6 +28,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
+
diff --git a/admin_mail_queue.php b/admin_mail_queue.php index 2a26cfbe..3ba993f6 100644 --- a/admin_mail_queue.php +++ b/admin_mail_queue.php @@ -92,6 +92,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
"> diff --git a/client_asset_add_modal.php b/client_asset_add_modal.php index 12b514d9..0128f34e 100644 --- a/client_asset_add_modal.php +++ b/client_asset_add_modal.php @@ -9,7 +9,7 @@ - +
diff --git a/client_asset_copy_modal.php b/client_asset_copy_modal.php index dae1e8c1..a70a9317 100644 --- a/client_asset_copy_modal.php +++ b/client_asset_copy_modal.php @@ -8,6 +8,7 @@
+
diff --git a/client_asset_details.php b/client_asset_details.php index 84b47647..de8573d2 100644 --- a/client_asset_details.php +++ b/client_asset_details.php @@ -334,7 +334,7 @@ if (isset($_GET['asset_id'])) {
- + Delete diff --git a/client_asset_edit_modal.php b/client_asset_edit_modal.php index a013b46e..970edabb 100644 --- a/client_asset_edit_modal.php +++ b/client_asset_edit_modal.php @@ -8,6 +8,7 @@
+ diff --git a/client_asset_export_modal.php b/client_asset_export_modal.php index d02eb260..d26cd1f9 100644 --- a/client_asset_export_modal.php +++ b/client_asset_export_modal.php @@ -8,11 +8,12 @@ + +
- +
diff --git a/client_asset_import_modal.php b/client_asset_import_modal.php index 85a3cf1e..583bf346 100644 --- a/client_asset_import_modal.php +++ b/client_asset_import_modal.php @@ -8,6 +8,7 @@
+

Format csv file with headings & data:
Name, Description, Type, Make, Model, Serial, OS, Assigned To, Location

diff --git a/client_asset_interface_add_modal.php b/client_asset_interface_add_modal.php index b6d44f20..b2183a7c 100644 --- a/client_asset_interface_add_modal.php +++ b/client_asset_interface_add_modal.php @@ -9,8 +9,8 @@
- +
diff --git a/client_asset_interface_edit_modal.php b/client_asset_interface_edit_modal.php index 3b004522..301001a2 100644 --- a/client_asset_interface_edit_modal.php +++ b/client_asset_interface_edit_modal.php @@ -9,7 +9,7 @@
- +
diff --git a/client_asset_transfer_modal.php b/client_asset_transfer_modal.php index c52f52eb..76ecb451 100644 --- a/client_asset_transfer_modal.php +++ b/client_asset_transfer_modal.php @@ -8,7 +8,9 @@
+ +
diff --git a/client_assets.php b/client_assets.php index 6a04e080..88d3c586 100644 --- a/client_assets.php +++ b/client_assets.php @@ -176,8 +176,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- - All Assets + + All Assets 0) { ?> @@ -244,6 +244,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+ +
"> @@ -545,19 +547,19 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); 2) { ?> - + Unarchive Transfer - + Archive - + Delete diff --git a/client_contact_details.php b/client_contact_details.php index 5aff1925..7ac3ab8e 100644 --- a/client_contact_details.php +++ b/client_contact_details.php @@ -297,10 +297,10 @@ if (isset($_GET['contact_id'])) {
- + Archive - + Delete diff --git a/client_contacts.php b/client_contacts.php index ee832ae9..2528b22c 100644 --- a/client_contacts.php +++ b/client_contacts.php @@ -188,6 +188,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
"> diff --git a/client_documents.php b/client_documents.php index f73d2262..439a2894 100644 --- a/client_documents.php +++ b/client_documents.php @@ -198,6 +198,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
diff --git a/client_files.php b/client_files.php index b27c6342..b7d177a4 100644 --- a/client_files.php +++ b/client_files.php @@ -243,6 +243,7 @@ $num_of_files = mysqli_num_rows($sql); +
diff --git a/client_locations.php b/client_locations.php index 6ad27c11..13c028cb 100644 --- a/client_locations.php +++ b/client_locations.php @@ -137,6 +137,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
"> diff --git a/client_logins.php b/client_logins.php index f8b0c2dc..8e7c5806 100644 --- a/client_logins.php +++ b/client_logins.php @@ -136,6 +136,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
"> diff --git a/client_vendors.php b/client_vendors.php index 74e6502e..ddcbbb0f 100644 --- a/client_vendors.php +++ b/client_vendors.php @@ -99,6 +99,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
"> diff --git a/expenses.php b/expenses.php index 6c0c60d0..08518c33 100644 --- a/expenses.php +++ b/expenses.php @@ -205,6 +205,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+ +
"> diff --git a/post/account.php b/post/account.php index 1a5b3a6c..3e5ad6cd 100644 --- a/post/account.php +++ b/post/account.php @@ -5,6 +5,7 @@ */ if (isset($_POST['add_account'])) { + validateCSRFToken($_POST['csrf_token']); $name = sanitizeInput($_POST['name']); $opening_balance = floatval($_POST['opening_balance']); @@ -24,6 +25,7 @@ if (isset($_POST['add_account'])) { } if (isset($_POST['edit_account'])) { + validateCSRFToken($_POST['csrf_token']); $account_id = intval($_POST['account_id']); $name = sanitizeInput($_POST['name']); @@ -42,6 +44,7 @@ if (isset($_POST['edit_account'])) { } if (isset($_GET['archive_account'])) { + validateCSRFToken($_GET['csrf_token']); $account_id = intval($_GET['archive_account']); mysqli_query($mysqli,"UPDATE accounts SET account_archived_at = NOW() WHERE account_id = $account_id"); @@ -55,6 +58,7 @@ if (isset($_GET['archive_account'])) { } +// Not used anywhere? if (isset($_GET['delete_account'])) { $account_id = intval($_GET['delete_account']); diff --git a/post/asset.php b/post/asset.php index 20f00280..1bbc735e 100644 --- a/post/asset.php +++ b/post/asset.php @@ -6,6 +6,7 @@ if (isset($_POST['add_asset'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $client_id = intval($_POST['client_id']); @@ -105,6 +106,7 @@ if (isset($_POST['add_asset'])) { if (isset($_POST['edit_asset'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $asset_id = intval($_POST['asset_id']); @@ -197,6 +199,7 @@ if (isset($_POST['edit_asset'])) { if (isset($_POST['change_client_asset'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $current_asset_id = intval($_POST['current_asset_id']); @@ -244,6 +247,7 @@ if (isset($_POST['change_client_asset'])) { if (isset($_GET['archive_asset'])) { + validateCSRFToken($_GET['csrf_token']); validateTechRole(); $asset_id = intval($_GET['archive_asset']); @@ -268,6 +272,7 @@ if (isset($_GET['archive_asset'])) { if (isset($_GET['unarchive_asset'])) { + validateCSRFToken($_GET['csrf_token']); validateTechRole(); $asset_id = intval($_GET['unarchive_asset']); @@ -291,6 +296,7 @@ if (isset($_GET['unarchive_asset'])) { if (isset($_GET['delete_asset'])) { + validateCSRFToken($_GET['csrf_token']); validateAdminRole(); $asset_id = intval($_GET['delete_asset']); @@ -318,6 +324,7 @@ if (isset($_GET['delete_asset'])) { if (isset($_POST['bulk_assign_asset_location'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $location_id = intval($_POST['bulk_location_id']); @@ -357,6 +364,7 @@ if (isset($_POST['bulk_assign_asset_location'])) { if (isset($_POST['bulk_assign_asset_contact'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $contact_id = intval($_POST['bulk_contact_id']); @@ -396,6 +404,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) { if (isset($_POST['bulk_edit_asset_status'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $status = sanitizeInput($_POST['bulk_status']); @@ -429,8 +438,9 @@ if (isset($_POST['bulk_edit_asset_status'])) { } if (isset($_POST['bulk_archive_assets'])) { + + validateCSRFToken($_POST['csrf_token']); validateAdminRole(); - //validateCSRFToken($_POST['csrf_token']); $count = 0; // Default 0 $asset_ids = $_POST['asset_ids']; // Get array of asset IDs to be deleted @@ -469,8 +479,9 @@ if (isset($_POST['bulk_archive_assets'])) { } if (isset($_POST['bulk_unarchive_assets'])) { + + validateCSRFToken($_POST['csrf_token']); validateAdminRole(); - //validateCSRFToken($_POST['csrf_token']); $count = 0; // Default 0 $asset_ids = $_POST['asset_ids']; // Get array of asset IDs to be deleted @@ -509,6 +520,7 @@ if (isset($_POST['bulk_unarchive_assets'])) { if (isset($_POST["import_client_assets_csv"])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $client_id = intval($_POST['client_id']); @@ -655,6 +667,7 @@ if (isset($_GET['download_client_assets_csv_template'])) { if (isset($_POST['export_client_assets_csv'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $client_id = intval($_POST['client_id']); @@ -704,6 +717,7 @@ if (isset($_POST['export_client_assets_csv'])) { if (isset($_POST['add_asset_interface'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $asset_id = intval($_POST['asset_id']); @@ -740,6 +754,7 @@ if (isset($_POST['add_asset_interface'])) { if (isset($_POST['edit_asset_interface'])) { + validateCSRFToken($_POST['csrf_token']); validateTechRole(); $interface_id = intval($_POST['interface_id']); @@ -775,6 +790,7 @@ if (isset($_POST['edit_asset_interface'])) { if (isset($_GET['delete_asset_interface'])) { + validateCSRFToken($_GET['csrf_token']); validateAdminRole(); $interface_id = intval($_GET['delete_asset_interface']); diff --git a/post/custom_field.php b/post/custom_field.php index db985f94..53220610 100644 --- a/post/custom_field.php +++ b/post/custom_field.php @@ -8,7 +8,6 @@ if(isset($_POST['create_custom_field'])){ require_once 'post/custom_field_model.php'; - $table = sanitizeInput($_POST['table']); mysqli_query($mysqli,"INSERT INTO custom_fields SET custom_field_table = '$table', custom_field_label = '$label', custom_field_type = '$type'"); @@ -26,7 +25,6 @@ if(isset($_POST['edit_custom_field'])){ require_once 'post/custom_field_model.php'; - $custom_field_id = intval($_POST['custom_field_id']); mysqli_query($mysqli,"UPDATE custom_fields SET custom_field_label = '$label', custom_field_type = '$type' WHERE custom_field_id = $custom_field_id"); diff --git a/products.php b/products.php index 1f5e966b..6b28f93e 100644 --- a/products.php +++ b/products.php @@ -124,6 +124,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
"> diff --git a/report_assets.php b/report_assets.php index 98118b73..4c1b39af 100644 --- a/report_assets.php +++ b/report_assets.php @@ -223,6 +223,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+ +
"> @@ -525,19 +527,19 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); 2) { ?> - + Unarchive Transfer - + Archive - + Delete diff --git a/tickets.php b/tickets.php index e7befa31..02ade7a6 100644 --- a/tickets.php +++ b/tickets.php @@ -299,6 +299,7 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']);
+
">