AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 12:35:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add more enforceClientAccess to agent ajax gets

Browse Source
This commit is contained in:
johnnyq
2026-07-24 22:51:57 -04:00
parent 113ef4b9a4
commit 7a793cbbcc
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
agent/ajax.php
View File

@@ -308,6 +308,8 @@ if (isset($_GET['get_client_contacts'])) {
$client_id = intval($_GET['client_id']); $client_id = intval($_GET['client_id']);
enforceClientAccess();
$contact_sql = mysqli_query( $contact_sql = mysqli_query(
$mysqli, $mysqli,
"SELECT contact_id, contact_name, contact_primary, contact_important, contact_technical FROM contacts "SELECT contact_id, contact_name, contact_primary, contact_important, contact_technical FROM contacts
@@ -332,6 +334,8 @@ if (isset($_GET['get_client_assets'])) {
$client_id = intval($_GET['client_id']); $client_id = intval($_GET['client_id']);
enforceClientAccess();
$asset_sql = mysqli_query( $asset_sql = mysqli_query(
$mysqli, $mysqli,
"SELECT asset_id, asset_name, contact_name FROM assets "SELECT asset_id, asset_name, contact_name FROM assets
@@ -357,6 +361,8 @@ if (isset($_GET['get_client_locations'])) {
$client_id = intval($_GET['client_id']); $client_id = intval($_GET['client_id']);
enforceClientAccess();
$locations_sql = mysqli_query( $locations_sql = mysqli_query(
$mysqli, $mysqli,
"SELECT location_id, location_name FROM locations "SELECT location_id, location_name FROM locations
@@ -381,6 +387,8 @@ if (isset($_GET['get_client_vendors'])) {
$client_id = intval($_GET['client_id']); $client_id = intval($_GET['client_id']);
enforceClientAccess();
$vendors_sql = mysqli_query( $vendors_sql = mysqli_query(
$mysqli, $mysqli,
"SELECT vendor_id, vendor_name FROM vendors "SELECT vendor_id, vendor_name FROM vendors
@@ -1078,6 +1086,4 @@ if (isset($_GET['get_credential_via_id'])) {
$check_recent_view = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS recent_view FROM logs WHERE log_type = 'Credential' AND log_action = 'View' AND log_user_id = $session_user_id AND log_entity_id = $credential_id AND log_client_id = $client_id AND log_created_at > (NOW() - INTERVAL 5 MINUTE)")); $check_recent_view = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS recent_view FROM logs WHERE log_type = 'Credential' AND log_action = 'View' AND log_user_id = $session_user_id AND log_entity_id = $credential_id AND log_client_id = $client_id AND log_created_at > (NOW() - INTERVAL 5 MINUTE)"));
if (intval($check_recent_view['recent_view']) == 0) { if (intval($check_recent_view['recent_view']) == 0) {
logAudit("Credential", "View", "$session_name viewed credential $name", $client_id, $credential_id); logAudit("Credential", "View", "$session_name viewed credential $name", $client_i
}
}