From 7a793cbbccb7fe6772f8683fecc7eb7b92c72e12 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Fri, 24 Jul 2026 22:51:57 -0400
Subject: [PATCH] Add more enforceClientAccess to agent ajax gets

---
 agent/ajax.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/agent/ajax.php b/agent/ajax.php
index 25372868..bd11c2e1 100644
--- a/agent/ajax.php
+++ b/agent/ajax.php
@@ -308,6 +308,8 @@ if (isset($_GET['get_client_contacts'])) {
 
     $client_id = intval($_GET['client_id']);
 
+    enforceClientAccess();
+
     $contact_sql = mysqli_query(
         $mysqli,
         "SELECT contact_id, contact_name, contact_primary, contact_important, contact_technical FROM contacts
@@ -332,6 +334,8 @@ if (isset($_GET['get_client_assets'])) {
 
     $client_id = intval($_GET['client_id']);
 
+    enforceClientAccess();
+
     $asset_sql = mysqli_query(
         $mysqli,
         "SELECT asset_id, asset_name, contact_name FROM assets
@@ -357,6 +361,8 @@ if (isset($_GET['get_client_locations'])) {
 
     $client_id = intval($_GET['client_id']);
 
+    enforceClientAccess();
+
     $locations_sql = mysqli_query(
         $mysqli,
         "SELECT location_id, location_name FROM locations
@@ -381,6 +387,8 @@ if (isset($_GET['get_client_vendors'])) {
 
     $client_id = intval($_GET['client_id']);
 
+    enforceClientAccess();
+
     $vendors_sql = mysqli_query(
         $mysqli,
         "SELECT vendor_id, vendor_name FROM vendors
@@ -1078,6 +1086,4 @@ if (isset($_GET['get_credential_via_id'])) {
     $check_recent_view = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS recent_view FROM logs WHERE log_type = 'Credential' AND log_action = 'View' AND log_user_id = $session_user_id AND log_entity_id = $credential_id AND log_client_id = $client_id AND log_created_at > (NOW() - INTERVAL 5 MINUTE)"));
 
     if (intval($check_recent_view['recent_view']) == 0) {
-        logAudit("Credential", "View", "$session_name viewed credential $name", $client_id, $credential_id);
-    }
-}
+        logAudit("Credential", "View", "$session_name viewed credential $name", $client_i
\ No newline at end of file