AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:10:45 -04:00
parent d62b6e2ae7
commit 7bc47a58fe
338 changed files with 3057 additions and 3057 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
agent/accounts.php
View File

@@ -31,7 +31,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="card-body">
<form autocomplete="off">
<div class="input-group">
<input type="search" class="form-control col-md-4" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Accounts">
<input type="search" class="form-control col-md-4" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Accounts">
<div class="input-group-append">
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
</div>
@@ -61,10 +61,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$account_currency_code = nullable_htmlentities($row['account_currency_code']);
$account_notes = nullable_htmlentities($row['account_notes']);
$account_currency_code = escapeHtml($row['account_currency_code']);
$account_notes = escapeHtml($row['account_notes']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
$row = mysqli_fetch_assoc($sql_payments);

8
agent/ajax.php
View File

@@ -135,10 +135,10 @@ if (isset($_GET['ticket_query_views'])) {
$users = array_unique($users);
if (count($users) > 1) {
// Multiple viewers
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . nullable_htmlentities(implode(", ", $users) . " are viewing this ticket.");
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . escapeHtml(implode(", ", $users) . " are viewing this ticket.");
} else {
// Single viewer
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . nullable_htmlentities(implode("", $users) . " is viewing this ticket.");
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . escapeHtml(implode("", $users) . " is viewing this ticket.");
}
} else {
// No viewers
@@ -725,7 +725,7 @@ if (isset($_GET['client_duplicate_check'])) {
if (mysqli_num_rows($sql_clients) > 0) {
while ($row = mysqli_fetch_assoc($sql_clients)) {
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . nullable_htmlentities($row['client_name']) . "</i> already exists.";
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . escapeHtml($row['client_name']) . "</i> already exists.";
}
}
}
@@ -747,7 +747,7 @@ if (isset($_GET['contact_email_check'])) {
$sql_contacts = mysqli_query($mysqli, "SELECT contact_email FROM contacts WHERE contact_email = '$email' LIMIT 1");
if (mysqli_num_rows($sql_contacts) > 0) {
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . nullable_htmlentities($row['contact_email']) . "</i> already exists.";
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . escapeHtml($row['contact_email']) . "</i> already exists.";
}
}

184
agent/asset_details.php
View File

@@ -31,58 +31,58 @@ if (isset($_GET['asset_id'])) {
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_uri = sanitize_url($row['asset_uri']);
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
$asset_uri_client = sanitize_url($row['asset_uri_client']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_network_id = intval($row['interface_network_id']);
$device_icon = getAssetIcon($asset_type);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_archived_at) {
$contact_name_display = "<span class='text-danger' title='Archived'><s>$contact_name</s></span>";
} else {
$contact_name_display = $contact_name;
}
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
if (empty($location_name)) {
$location_name = "-";
}
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_display = "<span class='text-danger' title='Archived'><s>$location_name</s></span>";
} else {
@@ -129,12 +129,12 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
$asset_tag_name = nullable_htmlentities($row['tag_name']);
$asset_tag_color = nullable_htmlentities($row['tag_color']);
$asset_tag_name = escapeHtml($row['tag_name']);
$asset_tag_color = escapeHtml($row['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
$asset_tag_icon = escapeHtml($row['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}
@@ -528,17 +528,17 @@ if (isset($_GET['asset_id'])) {
<?php while ($row = mysqli_fetch_assoc($sql_related_interfaces)) { ?>
<?php
$interface_id = intval($row['interface_id']);
$interface_name = nullable_htmlentities($row['interface_name']);
$interface_description = nullable_htmlentities($row['interface_description']);
$interface_type = nullable_htmlentities($row['interface_type']);
$interface_mac = nullable_htmlentities($row['interface_mac']);
$interface_ip = nullable_htmlentities($row['interface_ip']);
$interface_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$interface_name = escapeHtml($row['interface_name']);
$interface_description = escapeHtml($row['interface_description']);
$interface_type = escapeHtml($row['interface_type']);
$interface_mac = escapeHtml($row['interface_mac']);
$interface_ip = escapeHtml($row['interface_ip']);
$interface_nat_ip = escapeHtml($row['interface_nat_ip']);
$interface_ipv6 = escapeHtml($row['interface_ipv6']);
$interface_primary = intval($row['interface_primary']);
$network_id = intval($row['network_id']);
$network_name = nullable_htmlentities($row['network_name']);
$interface_notes = nullable_htmlentities($row['interface_notes']);
$network_name = escapeHtml($row['network_name']);
$interface_notes = escapeHtml($row['interface_notes']);
// Prepare display text
$interface_mac_display = $interface_mac ?: '-';
@@ -550,10 +550,10 @@ if (isset($_GET['asset_id'])) {
// Connected interface details
$connected_asset_id = intval($row['connected_asset_id']);
$connected_asset_name = nullable_htmlentities($row['connected_asset_name']);
$connected_asset_type = nullable_htmlentities($row['connected_asset_type']);
$connected_asset_name = escapeHtml($row['connected_asset_name']);
$connected_asset_type = escapeHtml($row['connected_asset_type']);
$connected_asset_icon = getAssetIcon($connected_asset_type);
$connected_interface_name = nullable_htmlentities($row['connected_interface_name']);
$connected_interface_name = escapeHtml($row['connected_interface_name']);
// Show either "-" or "AssetName - Port"
@@ -640,29 +640,29 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
if (empty($credential_uri)) {
$credential_uri_display = "-";
} else {
$credential_uri_display = "$credential_uri<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button><a href='$credential_uri' target='_blank'><i class='fa fa-external-link-alt text-secondary'></i></a>";
}
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_note = escapeHtml($row['credential_note']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$credential_asset_id = intval($row['credential_asset_id']);
@@ -674,12 +674,12 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);
$credential_tag_name = nullable_htmlentities($row['tag_name']);
$credential_tag_color = nullable_htmlentities($row['tag_color']);
$credential_tag_name = escapeHtml($row['tag_name']);
$credential_tag_color = escapeHtml($row['tag_color']);
if (empty($credential_tag_color)) {
$credential_tag_color = "dark";
}
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
$credential_tag_icon = escapeHtml($row['tag_icon']);
if (empty($credential_tag_icon)) {
$credential_tag_icon = "tag";
}
@@ -774,15 +774,15 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_version = nullable_htmlentities($row['software_version']);
$software_type = nullable_htmlentities($row['software_type']);
$software_license_type = nullable_htmlentities($row['software_license_type']);
$software_key = nullable_htmlentities($row['software_key']);
$software_seats = nullable_htmlentities($row['software_seats']);
$software_purchase = nullable_htmlentities($row['software_purchase']);
$software_expire = nullable_htmlentities($row['software_expire']);
$software_notes = nullable_htmlentities($row['software_notes']);
$software_name = escapeHtml($row['software_name']);
$software_version = escapeHtml($row['software_version']);
$software_type = escapeHtml($row['software_type']);
$software_license_type = escapeHtml($row['software_license_type']);
$software_key = escapeHtml($row['software_key']);
$software_seats = escapeHtml($row['software_seats']);
$software_purchase = escapeHtml($row['software_purchase']);
$software_expire = escapeHtml($row['software_expire']);
$software_notes = escapeHtml($row['software_notes']);
$seat_count = 0;
@@ -860,11 +860,11 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$linked_documents[] = $document_id;
@@ -939,10 +939,10 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_files)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_ext = nullable_htmlentities($row['file_ext']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";
} elseif ($file_ext == 'gz' || $file_ext == 'tar' || $file_ext == 'zip' || $file_ext == '7z' || $file_ext == 'rar') {
@@ -966,7 +966,7 @@ if (isset($_GET['asset_id'])) {
} else {
$file_icon = "file";
}
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_created_at = escapeHtml($row['file_created_at']);
$linked_files[] = $file_id;
@@ -1011,10 +1011,10 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
$recurring_ticket_id = intval($row['recurring_ticket_id']);
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
?>
<tr>
@@ -1090,15 +1090,15 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status_id = intval($row['ticket_status_id']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
if (empty($ticket_updated_at)) {
if ($ticket_status_name == "Closed") {
$ticket_updated_at_display = "<p>Never</p>";
@@ -1108,7 +1108,7 @@ if (isset($_GET['asset_id'])) {
} else {
$ticket_updated_at_display = $ticket_updated_at;
}
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
if ($ticket_priority == "High") {
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
@@ -1127,7 +1127,7 @@ if (isset($_GET['asset_id'])) {
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
}
} else {
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
$ticket_assigned_to_display = escapeHtml($row['user_name']);
}
?>
@@ -1181,10 +1181,10 @@ if (isset($_GET['asset_id'])) {
while ($row = mysqli_fetch_assoc($sql_linked_services)) {
$service_id = intval($row['service_id']);
$service_name = nullable_htmlentities($row['service_name']);
$service_description = nullable_htmlentities($row['service_description']);
$service_category = nullable_htmlentities($row['service_category']);
$service_importance = nullable_htmlentities($row['service_importance']);
$service_name = escapeHtml($row['service_name']);
$service_description = escapeHtml($row['service_description']);
$service_category = escapeHtml($row['service_category']);
$service_importance = escapeHtml($row['service_importance']);
$linked_services[] = $service_id;

68
agent/assets.php
View File

@@ -223,12 +223,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<?php if ($client_url) { ?>
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
<?php } ?>
<input type="hidden" name="type" value="<?php echo stripslashes(nullable_htmlentities($_GET['type'])); ?>">
<input type="hidden" name="type" value="<?php echo stripslashes(escapeHtml($_GET['type'])); ?>">
<input type="hidden" name="archived" value="<?php echo $archived; ?>">
<div class="row">
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search <?php if (!empty($_GET['type'])) { echo ucwords(stripslashes(nullable_htmlentities($_GET['type']))); } else { echo "Asset"; } ?>s">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search <?php if (!empty($_GET['type'])) { echo ucwords(stripslashes(escapeHtml($_GET['type']))); } else { echo "Asset"; } ?>s">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -250,7 +250,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php
@@ -277,7 +277,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php
@@ -305,7 +305,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']); ?>
$tag_name = escapeHtml($row['tag_name']); ?>
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
@@ -517,63 +517,63 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
if ($asset_description) {
$asset_description_display = $asset_description;
} else {
$asset_description_display = "-";
}
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
if ($asset_serial) {
$asset_serial_display = "<span class='text-monospace'>$asset_serial</span>";
} else {
$asset_serial_display = "-";
}
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_ip = getFallBack(nullable_htmlentities($row['interface_ip']));
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities(getFallBack($row['interface_mac']));
$asset_os = escapeHtml($row['asset_os']);
$asset_ip = getFallBack(escapeHtml($row['interface_ip']));
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml(getFallBack($row['interface_mac']));
$asset_uri = sanitize_url($row['asset_uri']);
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
$asset_uri_client = sanitize_url($row['asset_uri_client']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
if ($asset_purchase_date) {
$asset_purchase_date_display = $asset_purchase_date;
} else {
$asset_purchase_date_display = "-";
}
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
if ($asset_warranty_expire) {
$asset_warranty_expire_display = $asset_warranty_expire;
} else {
$asset_warranty_expire_display = "-";
}
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_install_date = escapeHtml($row['asset_install_date']);
if ($asset_install_date) {
$asset_install_date_display = $asset_install_date;
} else {
$asset_install_date_display = "-";
}
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
if ($asset_physical_location) {
$asset_physical_location_display = "<div class='text-secondary'>$asset_physical_location</div>";
} else {
$asset_physical_location_display = "";
}
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_archived_at = nullable_htmlentities($row['asset_archived_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_archived_at = escapeHtml($row['asset_archived_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
@@ -581,24 +581,24 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$device_icon = getAssetIcon($asset_type);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_archived_at) {
$contact_archive_display = "<span class='text-danger'>(Archived)</span>";
} else {
$contact_archive_display = '';
}
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
if ($contact_name) {
$contact_name_display = "<a class='ajax-modal' href='#' data-modal-url='modals/contact/contact_details.php?id=$asset_contact_id' data-modal-size='lg'>$contact_name $contact_archive_display</a>";
} else {
$contact_name_display = "-";
}
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
if (empty($location_name)) {
$location_name = "-";
}
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_display = "<div class='text-danger' title='Archived'><s>$location_name</s></div>";
} else {
@@ -615,12 +615,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
$asset_tag_name = nullable_htmlentities($row['tag_name']);
$asset_tag_color = nullable_htmlentities($row['tag_color']);
$asset_tag_name = escapeHtml($row['tag_name']);
$asset_tag_color = escapeHtml($row['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
$asset_tag_icon = escapeHtml($row['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}

20
agent/calendar.php
View File

@@ -41,8 +41,8 @@ if (isset($_GET['calendar_id'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM calendars");
while ($row = mysqli_fetch_assoc($sql)) {
$calendar_id = intval($row['calendar_id']);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
?>
<div class="form-group d-flex align-items-center">
<i class="fas fa-fw fa-circle mr-2" style="color:<?= $calendar_color ?>;"></i><?= $calendar_name ?>
@@ -128,15 +128,15 @@ require_once "modals/calendar/calendar_event_add.php";
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['event_id']);
$event_title = nullable_htmlentities($row['event_title']);
$event_description = nullable_htmlentities($row['event_description']);
$event_location = nullable_htmlentities($row['event_location']);
$event_start = nullable_htmlentities($row['event_start']);
$event_end = nullable_htmlentities($row['event_end']);
$event_repeat = nullable_htmlentities($row['event_repeat']);
$event_title = escapeHtml($row['event_title']);
$event_description = escapeHtml($row['event_description']);
$event_location = escapeHtml($row['event_location']);
$event_start = escapeHtml($row['event_start']);
$event_end = escapeHtml($row['event_end']);
$event_repeat = escapeHtml($row['event_repeat']);
$calendar_id = intval($row['calendar_id']);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
$client_id = intval($row['event_client_id']);
}

20
agent/certificates.php
View File

@@ -87,7 +87,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Certificates">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Certificates">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -113,7 +113,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php
@@ -196,15 +196,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$certificate_id = intval($row['certificate_id']);
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_description = nullable_htmlentities($row['certificate_description']);
$certificate_domain = nullable_htmlentities($row['certificate_domain']);
$certificate_issued_by = nullable_htmlentities($row['certificate_issued_by']);
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
$certificate_created_at = nullable_htmlentities($row['certificate_created_at']);
$certificate_archived_at = nullable_htmlentities($row['certificate_archived_at']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_description = escapeHtml($row['certificate_description']);
$certificate_domain = escapeHtml($row['certificate_domain']);
$certificate_issued_by = escapeHtml($row['certificate_issued_by']);
$certificate_expire = escapeHtml($row['certificate_expire']);
$certificate_created_at = escapeHtml($row['certificate_created_at']);
$certificate_archived_at = escapeHtml($row['certificate_archived_at']);
$certificate_expire_ago = timeAgo($certificate_expire);
// Convert the expiry date to a timestamp

12
agent/client_autopay.php
View File

@@ -11,8 +11,8 @@ require_once 'libs/stripe-php/init.php';
// Get Stripe vars
$stripe_vars = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT config_stripe_enable, config_stripe_publishable, config_stripe_secret FROM settings WHERE company_id = 1"));
$config_stripe_enable = intval($stripe_vars['config_stripe_enable']);
$config_stripe_publishable = nullable_htmlentities($stripe_vars['config_stripe_publishable']);
$config_stripe_secret = nullable_htmlentities($stripe_vars['config_stripe_secret']);
$config_stripe_publishable = escapeHtml($stripe_vars['config_stripe_publishable']);
$config_stripe_secret = escapeHtml($stripe_vars['config_stripe_secret']);
// Get client's StripeID from database
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
@@ -104,10 +104,10 @@ if (!$config_stripe_enable || !$config_stripe_publishable || !$config_stripe_sec
logApp("Stripe", "error", "Exception when fetching payment method info for $stripe_pm: $error");
}
$card_name = nullable_htmlentities($payment_method->billing_details->name);
$card_brand = nullable_htmlentities($payment_method->card->display_brand);
$card_last4 = nullable_htmlentities($payment_method->card->last4);
$card_expires = nullable_htmlentities($payment_method->card->exp_month) . "/" . nullable_htmlentities($payment_method->card->exp_year);
$card_name = escapeHtml($payment_method->billing_details->name);
$card_brand = escapeHtml($payment_method->card->display_brand);
$card_last4 = escapeHtml($payment_method->card->last4);
$card_expires = escapeHtml($payment_method->card->exp_month) . "/" . escapeHtml($payment_method->card->exp_year);
?>

108
agent/client_overview.php
View File

@@ -235,15 +235,15 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_important_contacts)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_email = escapeHtml($row['contact_email']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_photo = escapeHtml($row['contact_photo']);
$contact_primary = intval($row['contact_primary']);
$contact_initials = initials($contact_name);
if ($contact_primary == 1) {
@@ -319,11 +319,11 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_favorite_assets)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_type = escapeHtml($row['asset_type']);
$asset_icon = getAssetIcon($asset_type);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
?>
<tr>
@@ -363,8 +363,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_favorite_credentials)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = sanitize_url($row['credential_uri']);
if (empty($credential_uri)) {
$credential_uri_display = "-";
@@ -372,14 +372,14 @@ $sql_asset_retired = mysqli_query(
$credential_uri_display = "<a href='$credential_uri'>" . truncate($credential_uri,40) . "</a><button class='btn btn-sm clipboardjs' type='button' title='$credential_uri' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_uri_2 = sanitize_url($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "";
@@ -428,32 +428,32 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_shared_items)) {
$item_id = intval($row['item_id']);
$item_active = nullable_htmlentities($row['item_active']);
$item_key = nullable_htmlentities($row['item_key']);
$item_type = nullable_htmlentities($row['item_type']);
$item_active = escapeHtml($row['item_active']);
$item_key = escapeHtml($row['item_key']);
$item_type = escapeHtml($row['item_type']);
$item_related_id = intval($row['item_related_id']);
$item_note = nullable_htmlentities($row['item_note']);
$item_recipient = nullable_htmlentities($row['item_recipient']);
$item_views = nullable_htmlentities($row['item_views']);
$item_view_limit = nullable_htmlentities($row['item_view_limit']);
$item_created_at = nullable_htmlentities($row['item_created_at']);
$item_expire_at = nullable_htmlentities($row['item_expire_at']);
$item_note = escapeHtml($row['item_note']);
$item_recipient = escapeHtml($row['item_recipient']);
$item_views = escapeHtml($row['item_views']);
$item_view_limit = escapeHtml($row['item_view_limit']);
$item_created_at = escapeHtml($row['item_created_at']);
$item_expire_at = escapeHtml($row['item_expire_at']);
$item_expire_at_human = timeAgo($row['item_expire_at']);
if ($item_type == 'Credential') {
$share_item_sql = mysqli_query($mysqli, "SELECT credential_name FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id");
$share_item = mysqli_fetch_assoc($share_item_sql);
$item_name = nullable_htmlentities($share_item['credential_name']);
$item_name = escapeHtml($share_item['credential_name']);
$item_icon = "fas fa-key";
} elseif ($item_type == 'Document') {
$share_item_sql = mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = $item_related_id AND document_client_id = $client_id");
$share_item = mysqli_fetch_assoc($share_item_sql);
$item_name = nullable_htmlentities($share_item['document_name']);
$item_name = escapeHtml($share_item['document_name']);
$item_icon = "fas fa-folder";
} elseif ($item_type == 'File') {
$share_item_sql = mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id");
$share_item = mysqli_fetch_assoc($share_item_sql);
$item_name = nullable_htmlentities($share_item['file_name']);
$item_name = escapeHtml($share_item['file_name']);
$item_icon = "fas fa-paperclip";
}
?>
@@ -504,8 +504,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_domains_expiring)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_expire = escapeHtml($row['domain_expire']);
$domain_expire_human = timeAgo($row['domain_expire']);
?>
@@ -522,8 +522,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_certificates_expiring)) {
$certificate_id = intval($row['certificate_id']);
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_expire = escapeHtml($row['certificate_expire']);
$certificate_expire_human = timeAgo($row['certificate_expire']);
?>
@@ -540,8 +540,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_asset_warranties_expiring)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_name = escapeHtml($row['asset_name']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_warranty_expire_human = timeAgo($row['asset_warranty_expire']);
?>
@@ -560,8 +560,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_asset_retire)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_name = escapeHtml($row['asset_name']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_install_date_human = timeAgo($row['asset_install_date']);
?>
@@ -579,8 +579,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_licenses_expiring)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_expire = nullable_htmlentities($row['software_expire']);
$software_name = escapeHtml($row['software_name']);
$software_expire = escapeHtml($row['software_expire']);
$software_expire_human = timeAgo($row['software_expire']);
?>
@@ -622,8 +622,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_domains_expired)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_expire = escapeHtml($row['domain_expire']);
$domain_expire_human = timeAgo($row['domain_expire']);
?>
@@ -640,8 +640,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_certificates_expired)) {
$certificate_id = intval($row['certificate_id']);
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_expire = escapeHtml($row['certificate_expire']);
$certificate_expire_human = timeAgo($row['certificate_expire']);
?>
@@ -658,8 +658,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_asset_warranties_expired)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_name = escapeHtml($row['asset_name']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_warranty_expire_human = timeAgo($row['asset_warranty_expire']);
?>
@@ -678,8 +678,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_asset_retired)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_name = escapeHtml($row['asset_name']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_install_date_human = timeAgo($row['asset_install_date']);
?>
@@ -697,8 +697,8 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_licenses_expired)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_expire = nullable_htmlentities($row['software_expire']);
$software_name = escapeHtml($row['software_name']);
$software_expire = escapeHtml($row['software_expire']);
$software_expire_human = timeAgo($row['software_expire']);
?>
@@ -734,10 +734,10 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_stale_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_created_at_human = timeAgo($row['ticket_created_at']);
?>
@@ -774,7 +774,7 @@ $sql_asset_retired = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_recent_activities)) {
$log_created_at_time_ago = timeAgo($row['log_created_at']);
$log_description = nullable_htmlentities($row['log_description']);
$log_description = escapeHtml($row['log_description']);
?>
<tr>

70
agent/clients.php
View File

@@ -33,7 +33,7 @@ if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) {
// Industry Filter
if (isset($_GET['industry']) & !empty($_GET['industry'])) {
$industry_query = "AND (clients.client_type = '" . sanitizeInput($_GET['industry']) . "')";
$industry_filter = nullable_htmlentities($_GET['industry']);
$industry_filter = escapeHtml($_GET['industry']);
} else {
// Default - any
$industry_query = '';
@@ -43,7 +43,7 @@ if (isset($_GET['industry']) & !empty($_GET['industry'])) {
// Referral Filter
if (isset($_GET['referral']) & !empty($_GET['referral'])) {
$referral_query = "AND (clients.client_referral = '" . sanitizeInput($_GET['referral']) . "')";
$referral_filter = nullable_htmlentities($_GET['referral']);
$referral_filter = escapeHtml($_GET['referral']);
} else {
// Default - any
$referral_query = '';
@@ -114,7 +114,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-5">
<div class="form-group">
<div class="input-group">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search <?php if($leads_filter == 0){ echo "clients"; } else { echo "leads"; } ?>" autofocus>
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search <?php if($leads_filter == 0){ echo "clients"; } else { echo "leads"; } ?>" autofocus>
<div class="input-group-append">
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
@@ -219,9 +219,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="form-group">
<label>Date range</label>
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
</div>
</div>
<div class="col-md-3">
@@ -239,7 +239,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']); ?>
$tag_name = escapeHtml($row['tag_name']); ?>
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
@@ -256,7 +256,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<?php
$sql_industries_filter = mysqli_query($mysqli, "SELECT DISTINCT client_type FROM clients WHERE 1 = 1 AND client_$archive_query AND client_type != '' $leads_query ORDER BY client_type ASC");
while ($row = mysqli_fetch_assoc($sql_industries_filter)) {
$industry_name = nullable_htmlentities($row['client_type']);
$industry_name = escapeHtml($row['client_type']);
?>
<option <?php if ($industry_name == $industry_filter) { echo "selected"; } ?>><?php echo $industry_name; ?></option>
<?php
@@ -275,7 +275,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<?php
$sql_referrals_filter = mysqli_query($mysqli, "SELECT DISTINCT client_referral FROM clients WHERE 1 = 1 AND client_$archive_query AND client_referral != '' $leads_query ORDER BY client_referral ASC");
while ($row = mysqli_fetch_assoc($sql_referrals_filter)) {
$referral_name = nullable_htmlentities($row['client_referral']);
$referral_name = escapeHtml($row['client_referral']);
?>
<option <?php if ($referral_name == $referral_filter) { echo "selected"; } ?>><?php echo $referral_name; ?></option>
<?php
@@ -330,39 +330,39 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_type = nullable_htmlentities($row['client_type']);
$client_name = escapeHtml($row['client_name']);
$client_type = escapeHtml($row['client_type']);
$location_id = intval($row['location_id']);
$location_country = nullable_htmlentities($row['location_country']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_country = escapeHtml($row['location_country']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
if (empty($location_address) && empty($location_city) && empty($location_state) && empty($location_zip)) {
$location_address_display = "-";
} else {
$location_address_display = "<div class='media'><i class='fa fa-fw fa-map-marker-alt text-secondary mt-1 mr-2'></i><div class='media-body'>$location_address<div>$location_city $location_state $location_zip</div><div><small>$location_country</small></div></div></div>";
}
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$client_website = nullable_htmlentities($row['client_website']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$client_website = escapeHtml($row['client_website']);
$client_rate = floatval($row['client_rate']);
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
$client_currency_code = escapeHtml($row['client_currency_code']);
$client_net_terms = intval($row['client_net_terms']);
$client_tax_id_number = nullable_htmlentities($row['client_tax_id_number']);
$client_referral = nullable_htmlentities($row['client_referral']);
$client_abbreviation = nullable_htmlentities($row['client_abbreviation']);
$client_notes = nullable_htmlentities($row['client_notes']);
$client_tax_id_number = escapeHtml($row['client_tax_id_number']);
$client_referral = escapeHtml($row['client_referral']);
$client_abbreviation = escapeHtml($row['client_abbreviation']);
$client_notes = escapeHtml($row['client_notes']);
$client_created_at = date('Y-m-d', strtotime($row['client_created_at']));
$client_updated_at = nullable_htmlentities($row['client_updated_at']);
$client_archived_at = nullable_htmlentities($row['client_archived_at']);
$client_updated_at = escapeHtml($row['client_updated_at']);
$client_archived_at = escapeHtml($row['client_archived_at']);
$client_is_lead = intval($row['client_lead']);
// Abbreviation
@@ -376,12 +376,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
$client_tag_id = intval($row['tag_id']);
$client_tag_name = nullable_htmlentities($row['tag_name']);
$client_tag_color = nullable_htmlentities($row['tag_color']);
$client_tag_name = escapeHtml($row['tag_name']);
$client_tag_color = escapeHtml($row['tag_color']);
if (empty($client_tag_color)) {
$client_tag_color = "dark";
}
$client_tag_icon = nullable_htmlentities($row['tag_icon']);
$client_tag_icon = escapeHtml($row['tag_icon']);
if (empty($client_tag_icon)) {
$client_tag_icon = "tag";
}

192
agent/contact_details.php
View File

@@ -31,28 +31,28 @@ if (isset($_GET['contact_id'])) {
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_department =nullable_htmlentities($row['contact_department']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_pin = nullable_htmlentities($row['contact_pin']);
$client_name = escapeHtml($row['client_name']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_department =escapeHtml($row['contact_department']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$contact_photo = escapeHtml($row['contact_photo']);
$contact_pin = escapeHtml($row['contact_pin']);
$contact_initials = initials($contact_name);
$contact_notes = nullable_htmlentities($row['contact_notes']);
$contact_notes = escapeHtml($row['contact_notes']);
$contact_primary = intval($row['contact_primary']);
$contact_important = intval($row['contact_important']);
$contact_billing = intval($row['contact_billing']);
$contact_technical = intval($row['contact_technical']);
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
$contact_created_at = escapeHtml($row['contact_created_at']);
$contact_location_id = intval($row['contact_location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$auth_method = nullable_htmlentities($row['user_auth_method']);
$location_name = escapeHtml($row['location_name']);
$auth_method = escapeHtml($row['user_auth_method']);
$contact_client_id = intval($row['contact_client_id']);
// Override Tab Title // No Sanitizing needed as this var will opnly be used in the tab title
@@ -123,12 +123,12 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
$contact_tag_id = intval($row['tag_id']);
$contact_tag_name = nullable_htmlentities($row['tag_name']);
$contact_tag_color = nullable_htmlentities($row['tag_color']);
$contact_tag_name = escapeHtml($row['tag_name']);
$contact_tag_color = escapeHtml($row['tag_color']);
if (empty($contact_tag_color)) {
$contact_tag_color = "dark";
}
$contact_tag_icon = nullable_htmlentities($row['tag_icon']);
$contact_tag_icon = escapeHtml($row['tag_icon']);
if (empty($contact_tag_icon)) {
$contact_tag_icon = "tag";
}
@@ -365,48 +365,48 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_assets)) {
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
if ($asset_serial) {
$asset_serial_display = $asset_serial;
} else {
$asset_serial_display = "-";
}
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_os = escapeHtml($row['asset_os']);
if (empty($asset_os)) {
$asset_os_display = "-";
} else {
$asset_os_display = $asset_os;
}
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ip = escapeHtml($row['interface_ip']);
if (empty($asset_ip)) {
$asset_ip_display = "-";
} else {
$asset_ip_display = "$asset_ip<button class='btn btn-sm' data-clipboard-text='$asset_ip'><i class='far fa-copy text-secondary'></i></button>";
}
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
if (empty($asset_install_date)) {
$asset_install_date_display = "-";
} else {
$asset_install_date_display = $asset_install_date;
}
$asset_uri = nullable_htmlentities($row['asset_uri']);
$asset_uri_2 = nullable_htmlentities($row['asset_uri_2']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_uri = escapeHtml($row['asset_uri']);
$asset_uri_2 = escapeHtml($row['asset_uri_2']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$device_icon = getAssetIcon($asset_type);
// Tags
@@ -416,12 +416,12 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
$asset_tag_name = nullable_htmlentities($row['tag_name']);
$asset_tag_color = nullable_htmlentities($row['tag_color']);
$asset_tag_name = escapeHtml($row['tag_name']);
$asset_tag_color = escapeHtml($row['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
$asset_tag_icon = escapeHtml($row['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}
@@ -537,30 +537,30 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
$credential_id = intval($row['credentials_credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
if (empty($credential_uri)) {
$credential_uri_display = "-";
} else {
$credential_uri_display = "$credential_uri<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button><a href='$credential_uri' target='_blank'><i class='fa fa-external-link-alt text-secondary'></i></a>";
}
$credential_uri_2 = nullable_htmlentities($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_uri_2 = escapeHtml($row['credential_uri_2']);
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_note = escapeHtml($row['credential_note']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$credential_asset_id = intval($row['credential_asset_id']);
@@ -572,12 +572,12 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);
$credential_tag_name = nullable_htmlentities($row['tag_name']);
$credential_tag_color = nullable_htmlentities($row['tag_color']);
$credential_tag_name = escapeHtml($row['tag_name']);
$credential_tag_color = escapeHtml($row['tag_color']);
if (empty($credential_tag_color)) {
$credential_tag_color = "dark";
}
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
$credential_tag_icon = escapeHtml($row['tag_icon']);
if (empty($credential_tag_icon)) {
$credential_tag_icon = "tag";
}
@@ -674,15 +674,15 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_linked_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_version = nullable_htmlentities($row['software_version']);
$software_type = nullable_htmlentities($row['software_type']);
$software_license_type = nullable_htmlentities($row['software_license_type']);
$software_key = nullable_htmlentities($row['software_key']);
$software_seats = nullable_htmlentities($row['software_seats']);
$software_purchase = nullable_htmlentities($row['software_purchase']);
$software_expire = nullable_htmlentities($row['software_expire']);
$software_notes = nullable_htmlentities($row['software_notes']);
$software_name = escapeHtml($row['software_name']);
$software_version = escapeHtml($row['software_version']);
$software_type = escapeHtml($row['software_type']);
$software_license_type = escapeHtml($row['software_license_type']);
$software_key = escapeHtml($row['software_key']);
$software_seats = escapeHtml($row['software_seats']);
$software_purchase = escapeHtml($row['software_purchase']);
$software_expire = escapeHtml($row['software_expire']);
$software_notes = escapeHtml($row['software_notes']);
$seat_count = 0;
@@ -749,10 +749,10 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
$recurring_ticket_id = intval($row['recurring_ticket_id']);
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
?>
<tr>
@@ -829,15 +829,15 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_status = nullable_htmlentities($row['ticket_status']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status = escapeHtml($row['ticket_status']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
if (empty($ticket_updated_at)) {
if ($ticket_status == "Closed") {
$ticket_updated_at_display = "<p>Never</p>";
@@ -847,7 +847,7 @@ if (isset($_GET['contact_id'])) {
} else {
$ticket_updated_at_display = $ticket_updated_at;
}
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
if ($ticket_priority == "High") {
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
@@ -866,7 +866,7 @@ if (isset($_GET['contact_id'])) {
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
}
} else {
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
$ticket_assigned_to_display = escapeHtml($row['user_name']);
}
?>
@@ -918,10 +918,10 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_linked_services)) {
$service_id = intval($row['service_id']);
$service_name = nullable_htmlentities($row['service_name']);
$service_description = nullable_htmlentities($row['service_description']);
$service_category = nullable_htmlentities($row['service_category']);
$service_importance = nullable_htmlentities($row['service_importance']);
$service_name = escapeHtml($row['service_name']);
$service_description = escapeHtml($row['service_description']);
$service_category = escapeHtml($row['service_category']);
$service_importance = escapeHtml($row['service_importance']);
$linked_services[] = $service_id;
@@ -977,11 +977,11 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_linked_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$linked_documents[] = $document_id;
@@ -1043,13 +1043,13 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_linked_files)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_size = nullable_htmlentities($row['file_size']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_size = escapeHtml($row['file_size']);
$file_size_KB = round($file_size / 1024);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_created_at = escapeHtml($row['file_created_at']);
$linked_files[] = $file_id;
@@ -1115,10 +1115,10 @@ if (isset($_GET['contact_id'])) {
while ($row = mysqli_fetch_assoc($sql_related_notes)) {
$contact_note_id = intval($row['contact_note_id']);
$contact_note_type = nullable_htmlentities($row['contact_note_type']);
$contact_note = nl2br(nullable_htmlentities($row['contact_note']));
$note_by = nullable_htmlentities($row['user_name']);
$contact_note_created_at = nullable_htmlentities($row['contact_note_created_at']);
$contact_note_type = escapeHtml($row['contact_note_type']);
$contact_note = nl2br(escapeHtml($row['contact_note']));
$note_by = escapeHtml($row['user_name']);
$contact_note_created_at = escapeHtml($row['contact_note_created_at']);
// Get the corresponding icon for the note type
$note_type_icon = isset($note_types_array[$contact_note_type]) ? $note_types_array[$contact_note_type] : 'fa-fw fa-sticky-note'; // default icon if not found

50
agent/contacts.php
View File

@@ -122,7 +122,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Contacts">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Contacts">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -146,7 +146,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']); ?>
$tag_name = escapeHtml($row['tag_name']); ?>
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
@@ -171,7 +171,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php
@@ -198,7 +198,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php
@@ -329,37 +329,37 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
if (empty($contact_title)) {
$contact_title_display = "";
} else {
$contact_title_display = "<small class='text-secondary'>$contact_title</small>";
}
$contact_department = getFallBack(nullable_htmlentities($row['contact_department']));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_department = getFallBack(escapeHtml($row['contact_department']));
$contact_extension = escapeHtml($row['contact_extension']);
if (empty($contact_extension)) {
$contact_extension_display = "";
} else {
$contact_extension_display = "<small class='text-secondary ml-1'>x$contact_extension</small>";
}
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
if (empty($contact_phone)) {
$contact_phone_display = "";
} else {
$contact_phone_display = "<div><i class='fas fa-fw fa-phone mr-2'></i><a href='tel:$contact_phone'>$contact_phone$contact_extension_display</a></div>";
}
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
if (empty($contact_mobile)) {
$contact_mobile_display = "";
} else {
$contact_mobile_display = "<div class='mt-2'><i class='fas fa-fw fa-mobile-alt mr-2'></i><a href='tel:$contact_mobile'>$contact_mobile</a></div>";
}
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_email = escapeHtml($row['contact_email']);
if (empty($contact_email)) {
$contact_email_display = "";
} else {
@@ -369,33 +369,33 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
if (empty($contact_info_display)) {
$contact_info_display = "-";
}
$contact_pin = nullable_htmlentities($row['contact_pin']);
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_pin = escapeHtml($row['contact_pin']);
$contact_photo = escapeHtml($row['contact_photo']);
$contact_initials = initials($contact_name);
$contact_notes = nullable_htmlentities($row['contact_notes']);
$contact_notes = escapeHtml($row['contact_notes']);
$contact_primary = intval($row['contact_primary']);
$contact_important = intval($row['contact_important']);
$contact_billing = intval($row['contact_billing']);
$contact_technical = intval($row['contact_technical']);
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_created_at = escapeHtml($row['contact_created_at']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_primary == 1) {
$contact_primary_display = "<small class='text-success'>Primary Contact</small>";
} else {
$contact_primary_display = false;
}
$contact_location_id = intval($row['contact_location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
if (empty($location_name)) {
$location_name = "<span class='text-muted'>N/A</span>";
}
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_display = "<div class='text-danger' title='Archived'><s>$location_name</s></div>";
} else {
$location_name_display = $location_name;
}
$auth_method = nullable_htmlentities($row['user_auth_method']);
$auth_method = escapeHtml($row['user_auth_method']);
$contact_user_id = intval($row['contact_user_id']);
if ($contact_user_id) {
$user_exists_display = "<span class='badge badge-pill badge-dark p-1' title='User: $auth_method'><i class='fas fa-fw fa-user'></i></span>";
@@ -448,12 +448,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
$contact_tag_id = intval($row['tag_id']);
$contact_tag_name = nullable_htmlentities($row['tag_name']);
$contact_tag_color = nullable_htmlentities($row['tag_color']);
$contact_tag_name = escapeHtml($row['tag_name']);
$contact_tag_color = escapeHtml($row['tag_color']);
if (empty($contact_tag_color)) {
$contact_tag_color = "dark";
}
$contact_tag_icon = nullable_htmlentities($row['tag_icon']);
$contact_tag_icon = escapeHtml($row['tag_icon']);
if (empty($contact_tag_icon)) {
$contact_tag_icon = "tag";
}

54
agent/credentials.php
View File

@@ -139,7 +139,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Credentials">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Credentials">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -163,7 +163,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']); ?>
$tag_name = escapeHtml($row['tag_name']); ?>
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
@@ -182,7 +182,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php
@@ -209,7 +209,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php
@@ -314,10 +314,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$credential_id = intval($row['c_credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = sanitize_url($row['credential_uri']);
if (empty($credential_uri)) {
$credential_uri_display = "-";
@@ -325,28 +325,28 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$credential_uri_display = "<a href='$credential_uri'>" . truncate($credential_uri,40) . "</a><button class='btn btn-sm clipboardjs' type='button' title='$credential_uri' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_uri_2 = sanitize_url($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_created_at = nullable_htmlentities($row['credential_created_at']);
$credential_archived_at = nullable_htmlentities($row['credential_archived_at']);
$credential_note = escapeHtml($row['credential_note']);
$credential_created_at = escapeHtml($row['credential_created_at']);
$credential_archived_at = escapeHtml($row['credential_archived_at']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$credential_asset_id = intval($row['credential_asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
// Tags
$credential_tag_name_display_array = array();
@@ -355,12 +355,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);
$credential_tag_name = nullable_htmlentities($row['tag_name']);
$credential_tag_color = nullable_htmlentities($row['tag_color']);
$credential_tag_name = escapeHtml($row['tag_name']);
$credential_tag_color = escapeHtml($row['tag_color']);
if (empty($credential_tag_color)) {
$credential_tag_color = "dark";
}
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
$credential_tag_icon = escapeHtml($row['tag_icon']);
if (empty($credential_tag_icon)) {
$credential_tag_icon = "tag";
}
@@ -403,16 +403,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
if (mysqli_num_rows($sql_shared) > 0) {
$row = mysqli_fetch_assoc($sql_shared);
$item_id = intval($row['item_id']);
$item_active = nullable_htmlentities($row['item_active']);
$item_key = nullable_htmlentities($row['item_key']);
$item_type = nullable_htmlentities($row['item_type']);
$item_active = escapeHtml($row['item_active']);
$item_key = escapeHtml($row['item_key']);
$item_type = escapeHtml($row['item_type']);
$item_related_id = intval($row['item_related_id']);
$item_note = nullable_htmlentities($row['item_note']);
$item_recipient = nullable_htmlentities($row['item_recipient']);
$item_views = nullable_htmlentities($row['item_views']);
$item_view_limit = nullable_htmlentities($row['item_view_limit']);
$item_created_at = nullable_htmlentities($row['item_created_at']);
$item_expire_at = nullable_htmlentities($row['item_expire_at']);
$item_note = escapeHtml($row['item_note']);
$item_recipient = escapeHtml($row['item_recipient']);
$item_views = escapeHtml($row['item_views']);
$item_view_limit = escapeHtml($row['item_view_limit']);
$item_created_at = escapeHtml($row['item_created_at']);
$item_expire_at = escapeHtml($row['item_expire_at']);
$item_expire_at_human = timeAgo($row['item_expire_at']);
}

32
agent/dashboard.php
View File

@@ -423,7 +423,7 @@ if ($user_config_dashboard_financial_enable == 1) {
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_accounts)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
?>
<tr>
@@ -478,11 +478,11 @@ if ($user_config_dashboard_financial_enable == 1) {
</thead>
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_latest_invoice_payments)) {
$payment_date = nullable_htmlentities($row['payment_date']);
$payment_date = escapeHtml($row['payment_date']);
$payment_amount = floatval($row['payment_amount']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
<td><?php echo $payment_date; ?></td>
@@ -519,10 +519,10 @@ if ($user_config_dashboard_financial_enable == 1) {
</thead>
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_latest_expenses)) {
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$category_name = nullable_htmlentities($row['category_name']);
$vendor_name = escapeHtml($row['vendor_name']);
$category_name = escapeHtml($row['category_name']);
?>
<tr>
<td><?php echo $expense_date; ?></td>
@@ -711,24 +711,24 @@ if ($user_config_dashboard_technical_enable == 1) {
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_your_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status_id = intval($row['ticket_status']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_created_at_time_ago = timeAgo($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
$ticket_updated_at_time_ago = timeAgo($row['ticket_updated_at']);
$ticket_updated_at_display = empty($ticket_updated_at) ? (empty($ticket_closed_at) ? "<p class='text-danger'>Never</p>" : "<p>Never</p>") : $ticket_updated_at_time_ago;
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$contact_id = intval($row['ticket_contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
if ($client_id) {
$has_client = "&client_id=$client_id";
} else {

40
agent/document_details.php
View File

@@ -32,15 +32,15 @@ if (mysqli_num_rows($sql_document) == 0) {
$row = mysqli_fetch_assoc($sql_document);
$folder_name = nullable_htmlentities($row['folder_name']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$folder_name = escapeHtml($row['folder_name']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_content = $purifier->purify($row['document_content']);
$document_created_by_id = intval($row['document_created_by']);
$document_created_by_name = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_archived_at = nullable_htmlentities($row['document_archived_at']);
$document_created_by_name = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$document_archived_at = escapeHtml($row['document_archived_at']);
$document_folder_id = intval($row['document_folder_id']);
$document_client_visible = intval($row['document_client_visible']);
@@ -64,7 +64,7 @@ $page_title = $row['document_name'];
while ($folder_id > 0) {
$sql_folder = mysqli_query($mysqli, "SELECT folder_name, parent_folder FROM folders WHERE folder_id = $folder_id");
if ($row_folder = mysqli_fetch_assoc($sql_folder)) {
$folder_name = nullable_htmlentities($row_folder['folder_name']);
$folder_name = escapeHtml($row_folder['folder_name']);
$parent_folder = intval($row_folder['parent_folder']);
// Prepend the folder to the beginning of the array
@@ -152,14 +152,14 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_document_versions)) {
$document_version_id = intval($row['document_version_id']);
$document_version_name = nullable_htmlentities($row['document_version_name']);
$document_version_description = nullable_htmlentities($row['document_version_description']);
$document_version_name = escapeHtml($row['document_version_name']);
$document_version_description = escapeHtml($row['document_version_description']);
if ($document_version_description ) {
$document_version_description_display = $document_version_description;
} else {
$document_version_description_display = "-";
}
$document_version_author = nullable_htmlentities($row['user_name']);
$document_version_author = escapeHtml($row['user_name']);
$document_version_created_date = date('Y-m-d', strtotime($row['document_version_created_at']));
?>
@@ -219,7 +219,7 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_files)) {
$file_id = intval($row['file_id']);
$folder_id = intval($row['file_folder_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_name = escapeHtml($row['file_name']);
$linked_files[] = $file_id;
@@ -251,7 +251,7 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$linked_contacts[] = $contact_id;
@@ -285,7 +285,7 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$linked_assets[] = $asset_id;
@@ -321,7 +321,7 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
$linked_software[] = $software_id;
@@ -353,7 +353,7 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
$associated_vendors[] = $vendor_id;
@@ -402,10 +402,10 @@ $page_title = $row['document_name'];
while ($row = mysqli_fetch_assoc($sql_document_versions)) {
$document_version_id = intval($row['document_version_id']);
$document_version_name = nullable_htmlentities($row['document_version_name']);
$document_version_description = nullable_htmlentities($row['document_version_description']);
$document_version_author = nullable_htmlentities($row['user_name']);
$document_version_created_date = nullable_htmlentities($row['document_version_created_at']);
$document_version_name = escapeHtml($row['document_version_name']);
$document_version_description = escapeHtml($row['document_version_description']);
$document_version_author = escapeHtml($row['user_name']);
$document_version_created_date = escapeHtml($row['document_version_created_at']);
?>
<div class="mt-1 <?php if($document_id === $document_version_id){ echo "text-bold"; } ?>">

24
agent/domains.php
View File

@@ -99,7 +99,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="row">
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Domains">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Domains">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -125,7 +125,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php
@@ -232,9 +232,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_description = nullable_htmlentities($row['domain_description']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_description = escapeHtml($row['domain_description']);
$domain_expire = escapeHtml($row['domain_expire']);
$domain_expire_ago = timeAgo($domain_expire);
// Convert the expiry date to a timestamp
$domain_expire_timestamp = strtotime($row['domain_expire'] ?? '');
@@ -257,14 +257,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$domain_webhost_id = intval($row['webhost_id']);
$domain_dnshost_id = intval($row['dnshost_id']);
$domain_mailhost_id = intval($row['mailhost_id']);
$domain_registrar_name = nullable_htmlentities($row['registrar_name']);
$domain_webhost_name = nullable_htmlentities($row['webhost_name']);
$domain_dnshost_name = nullable_htmlentities($row['dnshost_name']);
$domain_mailhost_name = nullable_htmlentities($row['mailhost_name']);
$domain_created_at = nullable_htmlentities($row['domain_created_at']);
$domain_archived_at = nullable_htmlentities($row['domain_archived_at']);
$domain_registrar_name = escapeHtml($row['registrar_name']);
$domain_webhost_name = escapeHtml($row['webhost_name']);
$domain_dnshost_name = escapeHtml($row['dnshost_name']);
$domain_mailhost_name = escapeHtml($row['mailhost_name']);
$domain_created_at = escapeHtml($row['domain_created_at']);
$domain_archived_at = escapeHtml($row['domain_archived_at']);
$client_id = intval($row['domain_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Add - if empty on the table
$domain_registrar_name_display = $domain_registrar_name ? "
<a class='ajax-modal' href='#' data-modal-url='modals/vendor/vendor_details.php?id=$domain_registrar_id'>

34
agent/expenses.php
View File

@@ -82,7 +82,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="row">
<div class="col-sm-4">
<div class="input-group">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Expenses">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Expenses">
<div class="input-group-append">
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
@@ -132,9 +132,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="form-group">
<label>Date range</label>
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
</div>
</div>
<div class="col-sm-2">
@@ -148,7 +148,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql_vendors_filter)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option <?php if ($vendor_filter == $vendor_id) { echo "selected"; } ?> value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php
@@ -168,7 +168,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_categories_filter = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND EXISTS (SELECT 1 FROM expenses WHERE expense_category_id = category_id) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
<?php
@@ -188,7 +188,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_accounts_filter = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE EXISTS (SELECT 1 FROM expenses WHERE expense_account_id = account_id) ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts_filter)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
?>
<option <?php if ($account_filter == $account_id) { echo "selected"; } ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
<?php
@@ -254,20 +254,20 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$expense_id = intval($row['expense_id']);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
$expense_category_id = intval($row['expense_category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$account_name = nullable_htmlentities($row['account_name']);
$category_name = escapeHtml($row['category_name']);
$account_name = escapeHtml($row['account_name']);
$expense_account_id = intval($row['expense_account_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
if(empty($client_name)) {
$client_name_display = "-";
} else {

42
agent/files.php
View File

@@ -43,7 +43,7 @@ $breadcrumb_folder_id = $get_folder_id;
while ($breadcrumb_folder_id > 0) {
$sql_folder = mysqli_query($mysqli, "SELECT folder_name, parent_folder FROM folders WHERE folder_id = $breadcrumb_folder_id AND folder_client_id = $client_id");
if ($row_folder = mysqli_fetch_assoc($sql_folder)) {
$folder_name = nullable_htmlentities($row_folder['folder_name']);
$folder_name = escapeHtml($row_folder['folder_name']);
$parent_folder = intval($row_folder['parent_folder']);
array_unshift($folder_path, [
@@ -107,7 +107,7 @@ function display_folders($parent_folder_id, $client_id, $indent = 0, $render_roo
while ($row = mysqli_fetch_assoc($sql_folders)) {
$folder_id = intval($row['folder_id']);
$folder_name = nullable_htmlentities($row['folder_name']);
$folder_name = escapeHtml($row['folder_name']);
$row_files = mysqli_fetch_assoc(mysqli_query(
$mysqli,
@@ -307,14 +307,14 @@ if ($view == 1) {
// Normalize FILES into $items
while ($row = mysqli_fetch_assoc($sql_files)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_reference_name= nullable_htmlentities($row['file_reference_name']);
$file_ext = nullable_htmlentities($row['file_ext']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_reference_name= escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
$file_size = intval($row['file_size']);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_uploaded_by = nullable_htmlentities($row['user_name']);
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_uploaded_by = escapeHtml($row['user_name']);
$file_created_at = escapeHtml($row['file_created_at']);
$file_archived_at = $row['file_archived_at'];
// determine icon
@@ -360,9 +360,9 @@ if ($view == 1) {
// Normalize DOCUMENTS into $items
while ($row = mysqli_fetch_assoc($sql_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by_name = nullable_htmlentities($row['user_name']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by_name = escapeHtml($row['user_name']);
$document_created_at = $row['document_created_at'];
$document_updated_at = $row['document_updated_at'];
$document_archived_at = $row['document_archived_at'];
@@ -508,7 +508,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
<div class="col-md-5">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q"
value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>"
value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>"
placeholder="Search files and documents in <?php echo ($get_folder_id == 0 ? 'all folders' : 'current folder'); ?>">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
@@ -594,14 +594,14 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
$files = [];
while ($row = mysqli_fetch_assoc($sql)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_reference_name= nullable_htmlentities($row['file_reference_name']);
$file_ext = nullable_htmlentities($row['file_ext']);
$file_name = escapeHtml($row['file_name']);
$file_reference_name= escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
$file_size = intval($row['file_size']);
$file_size_KB = number_format($file_size / 1024);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_uploaded_by = nullable_htmlentities($row['user_name']);
$file_archived_at = nullable_htmlentities($row['file_archived_at']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_uploaded_by = escapeHtml($row['user_name']);
$file_archived_at = escapeHtml($row['file_archived_at']);
$files[] = [
'id' => $file_id,
@@ -743,7 +743,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
$file_shared = (mysqli_num_rows($sql_shared) > 0);
if ($file_shared) {
$row_shared = mysqli_fetch_assoc($sql_shared);
$item_recipient = nullable_htmlentities($row_shared['item_recipient']);
$item_recipient = escapeHtml($row_shared['item_recipient']);
$item_expire_at_human = timeAgo($row_shared['item_expire_at']);
}
?>
@@ -855,7 +855,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
$doc_shared = (mysqli_num_rows($sql_shared) > 0);
if ($doc_shared) {
$row_shared = mysqli_fetch_assoc($sql_shared);
$item_recipient = nullable_htmlentities($row_shared['item_recipient']);
$item_recipient = escapeHtml($row_shared['item_recipient']);
$item_expire_at_human = timeAgo($row_shared['item_expire_at']);
}
?>

138
agent/global_search.php
View File

@@ -147,7 +147,7 @@ if (isset($_GET['query'])) {
ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
);
$q = nullable_htmlentities($_GET['query']);
$q = escapeHtml($_GET['query']);
?>
@@ -181,10 +181,10 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$client_website = nullable_htmlentities($row['client_website']);
$client_name = escapeHtml($row['client_name']);
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$client_website = escapeHtml($row['client_website']);
?>
<tr>
@@ -227,17 +227,17 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$contact_department = nullable_htmlentities($row['contact_department']);
$client_name = escapeHtml($row['client_name']);
$contact_department = escapeHtml($row['contact_department']);
?>
<tr>
@@ -283,12 +283,12 @@ if (isset($_GET['query'])) {
<?php
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_description = nullable_htmlentities($row['vendor_description']);
$vendor_phone_country_code = nullable_htmlentities($row['vendor_phone_country_code']);
$vendor_phone = nullable_htmlentities(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
$vendor_name = escapeHtml($row['vendor_name']);
$vendor_description = escapeHtml($row['vendor_description']);
$vendor_phone_country_code = escapeHtml($row['vendor_phone_country_code']);
$vendor_phone = escapeHtml(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -330,11 +330,11 @@ if (isset($_GET['query'])) {
<?php
while ($row = mysqli_fetch_assoc($sql_domains)) {
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_expiry = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_expiry = escapeHtml($row['domain_expire']);
$domain_id = intval($row['domain_id']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -373,8 +373,8 @@ if (isset($_GET['query'])) {
<?php
while ($row = mysqli_fetch_assoc($sql_products)) {
$product_name = nullable_htmlentities($row['product_name']);
$product_description = nullable_htmlentities($row['product_description']);
$product_name = escapeHtml($row['product_name']);
$product_description = escapeHtml($row['product_description']);
?>
<tr>
<td><a href="products.php?q=<?php echo $q ?>"><?php echo $product_name; ?></a></td>
@@ -413,9 +413,9 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -458,13 +458,13 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_files)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_name = escapeHtml($row['file_name']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_description = escapeHtml($row['file_description']);
$folder_id = intval($row['folder_id']);
$folder_name = nullable_htmlentities($row['folder_name']);
$folder_name = escapeHtml($row['folder_name']);
$client_id = intval($row['file_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -509,11 +509,11 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$client_name = nullable_htmlentities($row['client_name']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$client_name = escapeHtml($row['client_name']);
$client_id = intval($row['ticket_client_id']);
?>
@@ -559,10 +559,10 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_recurring_tickets)) {
$recurring_ticket_id = intval($row['recurring_ticket_id']);
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$client_name = nullable_htmlentities($row['client_name']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
$client_name = escapeHtml($row['client_name']);
$client_id = intval($row['client_id']);
?>
@@ -608,13 +608,13 @@ if (isset($_GET['query'])) {
<?php
while ($row = mysqli_fetch_assoc($sql_credentials)) {
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_client_id = intval($row['credential_client_id']);
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -661,13 +661,13 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_quotes)) {
$quote_id = intval($row['quote_id']);
$quote_prefix = nullable_htmlentities($row['quote_prefix']);
$quote_prefix = escapeHtml($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$quote_amount = floatval($row['quote_amount']);
$quote_currency_code = nullable_htmlentities($row['quote_currency_code']);
$quote_status = nullable_htmlentities($row['quote_status']);
$quote_currency_code = escapeHtml($row['quote_currency_code']);
$quote_status = escapeHtml($row['quote_status']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -712,13 +712,13 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_invoices)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = nullable_htmlentities($row['invoice_currency_code']);
$invoice_status = nullable_htmlentities($row['invoice_status']);
$invoice_currency_code = escapeHtml($row['invoice_currency_code']);
$invoice_status = escapeHtml($row['invoice_status']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<tr>
@@ -764,39 +764,39 @@ if (isset($_GET['query'])) {
while ($row = mysqli_fetch_assoc($sql_assets)) {
$client_id = intval($row['asset_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
if (empty($asset_description)) {
$asset_description_display = "-";
} else {
$asset_description_display = $asset_description;
}
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
if (empty($asset_serial)) {
$asset_serial_display = "-";
} else {
$asset_serial_display = $asset_serial;
}
$asset_uri = nullable_htmlentities($row['asset_uri']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_uri = escapeHtml($row['asset_uri']);
$asset_status = escapeHtml($row['asset_status']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
$device_icon = getAssetIcon($asset_type);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_id = nullable_htmlentities($row['contact_id']);
$contact_name = escapeHtml($row['contact_name']);
$contact_id = escapeHtml($row['contact_id']);
if (empty($contact_name)) {
$contact_name_display = "-";
}else{
$contact_name_display = "<a href='contact_details.php?client_id=$client_id&contact_id=$contact_id'>$contact_name</a>";
}
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if (empty($contact_archived_at)) {
$contact_archived_display = "";
} else {
@@ -853,11 +853,11 @@ if (isset($_GET['query'])) {
echo '</div></div>';
}
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$client_id = intval($row['ticket_client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Output the ticket header
?>

2
agent/includes/client_side_nav.php
View File

@@ -1,5 +1,5 @@
<!-- Main Sidebar Container -->
<aside class="main-sidebar sidebar-dark-<?php echo nullable_htmlentities($config_theme); ?> d-print-none">
<aside class="main-sidebar sidebar-dark-<?php echo escapeHtml($config_theme); ?> d-print-none">
<a class="brand-link pb-1 mt-1" href="/agent/clients.php">
<p class="h5">

58
agent/includes/inc_all_client.php
View File

@@ -32,38 +32,38 @@ if (isset($_GET['client_id'])) {
} else {
$row = mysqli_fetch_assoc($sql);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$client_is_lead = intval($row['client_lead']);
$client_type = nullable_htmlentities($row['client_type']);
$client_website = nullable_htmlentities($row['client_website']);
$client_referral = nullable_htmlentities($row['client_referral']);
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
$client_type = escapeHtml($row['client_type']);
$client_website = escapeHtml($row['client_website']);
$client_referral = escapeHtml($row['client_referral']);
$client_currency_code = escapeHtml($row['client_currency_code']);
$client_net_terms = intval($row['client_net_terms']);
$client_tax_id_number = nullable_htmlentities($row['client_tax_id_number']);
$client_abbreviation = nullable_htmlentities($row['client_abbreviation']);
$client_tax_id_number = escapeHtml($row['client_tax_id_number']);
$client_abbreviation = escapeHtml($row['client_abbreviation']);
$client_rate = floatval($row['client_rate']);
$client_notes = nullable_htmlentities($row['client_notes']);
$client_created_at = nullable_htmlentities($row['client_created_at']);
$client_archived_at = nullable_htmlentities($row['client_archived_at']);
$client_notes = escapeHtml($row['client_notes']);
$client_created_at = escapeHtml($row['client_created_at']);
$client_archived_at = escapeHtml($row['client_archived_at']);
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_email = escapeHtml($row['contact_email']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_primary = intval($row['contact_primary']);
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_country = nullable_htmlentities($row['location_country']);
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_name = escapeHtml($row['location_name']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_country = escapeHtml($row['location_country']);
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_primary = intval($row['location_primary']);
// Tab Title // No Sanitizing needed
@@ -77,12 +77,12 @@ if (isset($_GET['client_id'])) {
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
$client_tag_id = intval($row['tag_id']);
$client_tag_name = nullable_htmlentities($row['tag_name']);
$client_tag_color = nullable_htmlentities($row['tag_color']);
$client_tag_name = escapeHtml($row['tag_name']);
$client_tag_color = escapeHtml($row['tag_color']);
if (empty($client_tag_color)) {
$client_tag_color = "dark";
}
$client_tag_icon = nullable_htmlentities($row['tag_icon']);
$client_tag_icon = escapeHtml($row['tag_icon']);
if (empty($client_tag_icon)) {
$client_tag_icon = "tag";
}

8
agent/includes/side_nav.php
View File

@@ -1,9 +1,9 @@
<!-- Main Sidebar Container -->
<aside class="main-sidebar sidebar-dark-<?php echo nullable_htmlentities($config_theme); ?> d-print-none">
<aside class="main-sidebar sidebar-dark-<?php echo escapeHtml($config_theme); ?> d-print-none">
<a class="brand-link" href="/agent/dashboard.php">
<div class="brand-image"></div>
<span class="brand-text h4"><?php echo nullable_htmlentities($session_company_name); ?></span>
<span class="brand-text h4"><?php echo escapeHtml($session_company_name); ?></span>
</a>
<!-- Sidebar -->
@@ -205,9 +205,9 @@
);
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
$custom_link_name = escapeHtml($row['custom_link_name']);
$custom_link_uri = sanitize_url($row['custom_link_uri']);
$custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
$custom_link_icon = escapeHtml($row['custom_link_icon']);
$custom_link_new_tab = intval($row['custom_link_new_tab']);
if ($custom_link_new_tab == 1) {
$target = "target='_blank' rel='noopener noreferrer'";

96
agent/invoice.php
View File

@@ -39,35 +39,35 @@ if (isset($_GET['invoice_id'])) {
$row = mysqli_fetch_assoc($sql);
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
$invoice_status = nullable_htmlentities($row['invoice_status']);
$invoice_date = nullable_htmlentities($row['invoice_date']);
$invoice_due = nullable_htmlentities($row['invoice_due']);
$invoice_scope = escapeHtml($row['invoice_scope']);
$invoice_status = escapeHtml($row['invoice_status']);
$invoice_date = escapeHtml($row['invoice_date']);
$invoice_due = escapeHtml($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_discount = floatval($row['invoice_discount_amount']);
$invoice_credit = floatval($row['invoice_credit_amount']);
$invoice_currency_code = nullable_htmlentities($row['invoice_currency_code']);
$invoice_note = nullable_htmlentities($row['invoice_note']);
$invoice_url_key = nullable_htmlentities($row['invoice_url_key']);
$invoice_created_at = nullable_htmlentities($row['invoice_created_at']);
$invoice_currency_code = escapeHtml($row['invoice_currency_code']);
$invoice_note = escapeHtml($row['invoice_note']);
$invoice_url_key = escapeHtml($row['invoice_url_key']);
$invoice_created_at = escapeHtml($row['invoice_created_at']);
$category_id = intval($row['invoice_category_id']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_country = nullable_htmlentities($row['location_country']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$client_website = nullable_htmlentities($row['client_website']);
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
$client_name = escapeHtml($row['client_name']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_country = escapeHtml($row['location_country']);
$contact_email = escapeHtml($row['contact_email']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$client_website = escapeHtml($row['client_website']);
$client_currency_code = escapeHtml($row['client_currency_code']);
$client_net_terms = intval($row['client_net_terms']);
if ($client_net_terms == 0) {
$client_net_terms = $config_default_net_terms;
@@ -80,23 +80,23 @@ if (isset($_GET['invoice_id'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_id = intval($row['company_id']);
$company_name = nullable_htmlentities($row['company_name']);
$company_country = nullable_htmlentities($row['company_country']);
$company_address = nullable_htmlentities($row['company_address']);
$company_city = nullable_htmlentities($row['company_city']);
$company_state = nullable_htmlentities($row['company_state']);
$company_zip = nullable_htmlentities($row['company_zip']);
$company_phone_country_code = nullable_htmlentities($row['company_phone_country_code']);
$company_phone = nullable_htmlentities(formatPhoneNumber($row['company_phone'], $company_phone_country_code));
$company_email = nullable_htmlentities($row['company_email']);
$company_website = nullable_htmlentities($row['company_website']);
$company_tax_id = nullable_htmlentities($row['company_tax_id']);
$company_name = escapeHtml($row['company_name']);
$company_country = escapeHtml($row['company_country']);
$company_address = escapeHtml($row['company_address']);
$company_city = escapeHtml($row['company_city']);
$company_state = escapeHtml($row['company_state']);
$company_zip = escapeHtml($row['company_zip']);
$company_phone_country_code = escapeHtml($row['company_phone_country_code']);
$company_phone = escapeHtml(formatPhoneNumber($row['company_phone'], $company_phone_country_code));
$company_email = escapeHtml($row['company_email']);
$company_website = escapeHtml($row['company_website']);
$company_tax_id = escapeHtml($row['company_tax_id']);
if ($config_invoice_show_tax_id && !empty($company_tax_id)) {
$company_tax_id_display = "Tax ID: $company_tax_id";
} else {
$company_tax_id_display = "";
}
$company_logo = nullable_htmlentities($row['company_logo']);
$company_logo = escapeHtml($row['company_logo']);
$sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
@@ -399,13 +399,13 @@ if (isset($_GET['invoice_id'])) {
while ($row = mysqli_fetch_assoc($sql_invoice_items)) {
$item_id = intval($row['item_id']);
$item_name = nullable_htmlentities($row['item_name']);
$item_description = nullable_htmlentities($row['item_description']);
$item_name = escapeHtml($row['item_name']);
$item_description = escapeHtml($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_tax = floatval($row['item_tax']);
$item_total = floatval($row['item_total']);
$item_created_at = nullable_htmlentities($row['item_created_at']);
$item_created_at = escapeHtml($row['item_created_at']);
$tax_id = intval($row['item_tax_id']);
$item_product_id = intval($row['item_product_id']);
$total_tax = $item_tax + $total_tax;
@@ -473,7 +473,7 @@ if (isset($_GET['invoice_id'])) {
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id = intval($row['tax_id']);
$tax_name = nullable_htmlentities($row['tax_name']);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);
?>
<option value="<?php echo $tax_id; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>
@@ -566,7 +566,7 @@ if (isset($_GET['invoice_id'])) {
</div>
</div>
<hr class="d-none d-print-block mt-5">
<div class="d-none d-print-block text-center text-secondary"><?php echo nl2br(nullable_htmlentities($config_invoice_footer)); ?></div>
<div class="d-none d-print-block text-center text-secondary"><?php echo nl2br(escapeHtml($config_invoice_footer)); ?></div>
</div>
</div>
<div class="row d-print-none mb-3">
@@ -597,8 +597,8 @@ if (isset($_GET['invoice_id'])) {
while ($row = mysqli_fetch_assoc($sql_history)) {
$history_created_at = $row['history_created_at'];
$history_status = nullable_htmlentities($row['history_status']);
$history_description = nullable_htmlentities($row['history_description']);
$history_status = escapeHtml($row['history_status']);
$history_description = escapeHtml($row['history_description']);
?>
<tr>
@@ -645,11 +645,11 @@ if (isset($_GET['invoice_id'])) {
while ($row = mysqli_fetch_assoc($sql_payments)) {
$payment_id = intval($row['payment_id']);
$payment_date = nullable_htmlentities($row['payment_date']);
$payment_date = escapeHtml($row['payment_date']);
$payment_amount = floatval($row['payment_amount']);
$payment_currency_code = nullable_htmlentities($row['payment_currency_code']);
$payment_reference = nullable_htmlentities($row['payment_reference']);
$account_name = nullable_htmlentities($row['account_name']);
$payment_currency_code = escapeHtml($row['payment_currency_code']);
$payment_reference = escapeHtml($row['payment_reference']);
$account_name = escapeHtml($row['account_name']);
?>
<tr>
@@ -709,8 +709,8 @@ if (isset($_GET['invoice_id'])) {
while ($row = mysqli_fetch_assoc($sql_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_total_time_worked = floatval($row['total_time_worked']);
?>

38
agent/invoices.php
View File

@@ -181,7 +181,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="card-body">
<form class="mb-4" autocomplete="off">
<input type="hidden" name="status" value="<?php if (isset($_GET['status'])) { echo nullable_htmlentities($_GET['status']); } ?>">
<input type="hidden" name="status" value="<?php if (isset($_GET['status'])) { echo escapeHtml($_GET['status']); } ?>">
<?php if ($client_url) { ?>
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
<?php } ?>
@@ -189,7 +189,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-sm-4">
<div class="form-group mb-md-0">
<div class="input-group">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Invoices">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(escapeHtml($q));} ?>" placeholder="Search Invoices">
<div class="input-group-append">
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
@@ -206,7 +206,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_categories_filter = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND EXISTS (SELECT 1 FROM invoices WHERE invoice_category_id = category_id) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
<?php
@@ -246,9 +246,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="form-group">
<label>Date range</label>
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
</div>
</div>
</div>
@@ -317,33 +317,33 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_number = nullable_htmlentities($row['invoice_number']);
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = escapeHtml($row['invoice_number']);
$invoice_scope = escapeHtml($row['invoice_scope']);
if (empty($invoice_scope)) {
$invoice_scope_display = "-";
} else {
$invoice_scope_display = $invoice_scope;
}
$invoice_status = nullable_htmlentities($row['invoice_status']);
$invoice_date = nullable_htmlentities($row['invoice_date']);
$invoice_due = nullable_htmlentities($row['invoice_due']);
$invoice_status = escapeHtml($row['invoice_status']);
$invoice_date = escapeHtml($row['invoice_date']);
$invoice_due = escapeHtml($row['invoice_due']);
$invoice_discount = floatval($row['invoice_discount_amount']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = nullable_htmlentities($row['invoice_currency_code']);
$invoice_created_at = nullable_htmlentities($row['invoice_created_at']);
$invoice_currency_code = escapeHtml($row['invoice_currency_code']);
$invoice_created_at = escapeHtml($row['invoice_created_at']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
$category_name = escapeHtml($row['category_name']);
$client_currency_code = escapeHtml($row['client_currency_code']);
$client_net_terms = intval($row['client_net_terms']);
if ($client_net_terms == 0) {
$client_net_terms = $config_default_net_terms;
}
$recurring_invoice_id = intval($row['recurring_invoice_id']);
$recurring_invoice_prefix = nullable_htmlentities($row['recurring_invoice_prefix']);
$recurring_invoice_number = nullable_htmlentities($row['recurring_invoice_number']);
$recurring_invoice_prefix = escapeHtml($row['recurring_invoice_prefix']);
$recurring_invoice_number = escapeHtml($row['recurring_invoice_number']);
if($recurring_invoice_id) {
$recurring_invoice_display = "<i class='fas fa-fw fa-redo-alt text-secondary mr-1'></i><a href='recurring_invoice.php?recurring_invoice_id=$recurring_invoice_id'>$recurring_invoice_prefix$recurring_invoice_number</a>";
} else {

46
agent/locations.php
View File

@@ -109,7 +109,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Locations">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Locations">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -132,7 +132,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']); ?>
$tag_name = escapeHtml($row['tag_name']); ?>
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
@@ -159,7 +159,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php
@@ -260,39 +260,39 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_description = nullable_htmlentities($row['location_description']);
$location_country = nullable_htmlentities($row['location_country']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_name = escapeHtml($row['location_name']);
$location_description = escapeHtml($row['location_description']);
$location_country = escapeHtml($row['location_country']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
if (empty($location_phone)) {
$location_phone_display = "-";
} else {
$location_phone_display = $location_phone;
}
$location_fax_country_code = nullable_htmlentities($row['location_fax_country_code']);
$location_fax = nullable_htmlentities(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
$location_fax_country_code = escapeHtml($row['location_fax_country_code']);
$location_fax = escapeHtml(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
if ($location_fax) {
$location_fax_display = "<div class='text-secondary'>Fax: $location_fax</div>";
} else {
$location_fax_display = '';
}
$location_hours = nullable_htmlentities($row['location_hours']);
$location_hours = escapeHtml($row['location_hours']);
if (empty($location_hours)) {
$location_hours_display = "-";
} else {
$location_hours_display = $location_hours;
}
$location_photo = nullable_htmlentities($row['location_photo']);
$location_notes = nullable_htmlentities($row['location_notes']);
$location_created_at = nullable_htmlentities($row['location_created_at']);
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_photo = escapeHtml($row['location_photo']);
$location_notes = escapeHtml($row['location_notes']);
$location_created_at = escapeHtml($row['location_created_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
$location_contact_id = intval($row['location_contact_id']);
$location_primary = intval($row['location_primary']);
if ( $location_primary == 1 ) {
@@ -309,12 +309,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql_location_tags)) {
$location_tag_id = intval($row['tag_id']);
$location_tag_name = nullable_htmlentities($row['tag_name']);
$location_tag_color = nullable_htmlentities($row['tag_color']);
$location_tag_name = escapeHtml($row['tag_name']);
$location_tag_color = escapeHtml($row['tag_color']);
if (empty($location_tag_color)) {
$location_tag_color = "dark";
}
$location_tag_icon = nullable_htmlentities($row['tag_icon']);
$location_tag_icon = escapeHtml($row['tag_icon']);
if (empty($location_tag_icon)) {
$location_tag_icon = "tag";
}

4
agent/modals/account/account_edit.php
View File

@@ -7,8 +7,8 @@ $account_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$account_name = nullable_htmlentities($row['account_name']);
$account_notes = nullable_htmlentities($row['account_notes']);
$account_name = escapeHtml($row['account_name']);
$account_notes = escapeHtml($row['account_notes']);
// Generate the HTML form content using output buffering.
ob_start();

18
agent/modals/asset/asset_add.php
View File

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
$client_id = intval($_GET['client_id'] ?? 0);
$contact_id = intval($_GET['contact_id'] ?? 0);
$type = nullable_htmlentities(ucwords($_GET['type']) ?? '');
$type = escapeHtml(ucwords($_GET['type']) ?? '');
if ($client_id) {
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
@@ -87,7 +87,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_client_select)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
<?php } ?>
@@ -201,7 +201,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_location_select)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?= $location_id ?>"><?= $location_name ?></option>
<?php } ?>
@@ -234,7 +234,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_contact_select)) {
$contact_id_select = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option
<?php if ($contact_id == $contact_id_select) {
@@ -266,7 +266,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option><?= $asset_status_select ?></option>
<?php } ?>
@@ -290,8 +290,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_network_select)) {
$network_id = intval($row['network_id']);
$network_name = nullable_htmlentities($row['network_name']);
$network = nullable_htmlentities($row['network']);
$network_name = escapeHtml($row['network_name']);
$network = escapeHtml($row['network']);
?>
<option value="<?= $network_id ?>"><?= $network_name ?> - <?= $network ?></option>
@@ -395,7 +395,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_vendor_select)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
@@ -497,7 +497,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']);
$tag_name = escapeHtml($row['tag_name']);
?>
<option value="<?= $tag_id ?>"><?= $tag_name ?></option>
<?php } ?>

6
agent/modals/asset/asset_bulk_add_ticket.php
View File

@@ -68,7 +68,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -98,7 +98,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option <?php if ($session_user_id == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>
@@ -118,7 +118,7 @@ ob_start();
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = nullable_htmlentities($row['project_name']); ?>
$project_name_select = escapeHtml($row['project_name']); ?>
<option value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_assign_contact.php
View File

@@ -36,7 +36,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $contact_id; ?>"><?php echo $contact_name; ?></option>

2
agent/modals/asset/asset_bulk_assign_location.php
View File

@@ -37,7 +37,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_assign_tags.php
View File

@@ -40,7 +40,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_edit_status.php
View File

@@ -38,7 +38,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option><?= $asset_status_select ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_transfer_client.php
View File

@@ -42,7 +42,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($clients_sql)) {
$client_id_select = intval($row["client_id"]);
$client_name_select = nullable_htmlentities($row["client_name"]);
$client_name_select = escapeHtml($row["client_name"]);
?>
<option value='<?php echo $client_id_select; ?>'><?php echo $client_name_select; ?></option>
<?php

58
agent/modals/asset/asset_copy.php
View File

@@ -14,29 +14,29 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['asset_client_id']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_uri = nullable_htmlentities($row['asset_uri']);
$asset_uri_2 = nullable_htmlentities($row['asset_uri_2']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_archived_at = nullable_htmlentities($row['asset_archived_at']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_uri = escapeHtml($row['asset_uri']);
$asset_uri_2 = escapeHtml($row['asset_uri_2']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_archived_at = escapeHtml($row['asset_archived_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
@@ -184,7 +184,7 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_name_select = escapeHtml($row['location_name']);
?>
<option <?php if ($asset_location_id == $location_id_select) { echo "selected"; } ?> value="<?php echo $location_id_select; ?>"><?php echo $location_name_select; ?></option>
<?php } ?>
@@ -216,7 +216,7 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $contact_id_select; ?>"><?php echo $contact_name_select; ?></option>
<?php } ?>
@@ -241,7 +241,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option <?php if ($asset_status_select == $asset_status) { echo "selected"; } ?>>
<?= $asset_status_select ?>
@@ -268,8 +268,8 @@ ob_start();
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_networks)) {
$network_id_select = intval($row['network_id']);
$network_name_select = nullable_htmlentities($row['network_name']);
$network_select = nullable_htmlentities($row['network']);
$network_name_select = escapeHtml($row['network_name']);
$network_select = escapeHtml($row['network']);
?>
<option <?php if ($asset_network_id == $network_id_select) { echo "selected"; } ?> value="<?php echo $network_id_select; ?>"><?php echo $network_name_select; ?> - <?php echo $network_select; ?></option>
@@ -361,7 +361,7 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($asset_vendor_id == $vendor_id_select) { echo "selected"; } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>

178
agent/modals/asset/asset_details.php
View File

@@ -17,58 +17,58 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_uri = sanitize_url($row['asset_uri']);
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
$asset_uri_client = sanitize_url($row['asset_uri_client']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_network_id = intval($row['interface_network_id']);
$device_icon = getAssetIcon($asset_type);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_archived_at) {
$contact_name_display = "<span class='text-danger' title='Archived'><s>$contact_name</s></span>";
} else {
$contact_name_display = $contact_name;
}
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
if (empty($location_name)) {
$location_name = "-";
}
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_display = "<span class='text-danger' title='Archived'><s>$location_name</s></span>";
} else {
@@ -82,12 +82,12 @@ $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
$asset_tag_name = nullable_htmlentities($row['tag_name']);
$asset_tag_color = nullable_htmlentities($row['tag_color']);
$asset_tag_name = escapeHtml($row['tag_name']);
$asset_tag_color = escapeHtml($row['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
$asset_tag_icon = escapeHtml($row['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}
@@ -440,17 +440,17 @@ ob_start();
<?php while ($row = mysqli_fetch_assoc($sql_related_interfaces)) { ?>
<?php
$interface_id = intval($row['interface_id']);
$interface_name = nullable_htmlentities($row['interface_name']);
$interface_description = nullable_htmlentities($row['interface_description']);
$interface_type = nullable_htmlentities($row['interface_type']);
$interface_mac = nullable_htmlentities($row['interface_mac']);
$interface_ip = nullable_htmlentities($row['interface_ip']);
$interface_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$interface_name = escapeHtml($row['interface_name']);
$interface_description = escapeHtml($row['interface_description']);
$interface_type = escapeHtml($row['interface_type']);
$interface_mac = escapeHtml($row['interface_mac']);
$interface_ip = escapeHtml($row['interface_ip']);
$interface_nat_ip = escapeHtml($row['interface_nat_ip']);
$interface_ipv6 = escapeHtml($row['interface_ipv6']);
$interface_primary = intval($row['interface_primary']);
$network_id = intval($row['network_id']);
$network_name = nullable_htmlentities($row['network_name']);
$interface_notes = nullable_htmlentities($row['interface_notes']);
$network_name = escapeHtml($row['network_name']);
$interface_notes = escapeHtml($row['interface_notes']);
// Prepare display text
$interface_mac_display = $interface_mac ?: '-';
@@ -462,10 +462,10 @@ ob_start();
// Connected interface details
$connected_asset_id = intval($row['connected_asset_id']);
$connected_asset_name = nullable_htmlentities($row['connected_asset_name']);
$connected_asset_type = nullable_htmlentities($row['connected_asset_type']);
$connected_asset_name = escapeHtml($row['connected_asset_name']);
$connected_asset_type = escapeHtml($row['connected_asset_type']);
$connected_asset_icon = getAssetIcon($connected_asset_type);
$connected_interface_name = nullable_htmlentities($row['connected_interface_name']);
$connected_interface_name = escapeHtml($row['connected_interface_name']);
// Show either "-" or "AssetName - Port"
@@ -518,29 +518,29 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
if (empty($credential_uri)) {
$credential_uri_display = "-";
} else {
$credential_uri_display = "$credential_uri";
}
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_note = escapeHtml($row['credential_note']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$credential_asset_id = intval($row['credential_asset_id']);
@@ -552,12 +552,12 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);
$credential_tag_name = nullable_htmlentities($row['tag_name']);
$credential_tag_color = nullable_htmlentities($row['tag_color']);
$credential_tag_name = escapeHtml($row['tag_name']);
$credential_tag_color = escapeHtml($row['tag_color']);
if (empty($credential_tag_color)) {
$credential_tag_color = "dark";
}
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
$credential_tag_icon = escapeHtml($row['tag_icon']);
if (empty($credential_tag_icon)) {
$credential_tag_icon = "tag";
}
@@ -615,15 +615,15 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status_id = intval($row['ticket_status_id']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
if (empty($ticket_updated_at)) {
if ($ticket_status_name == "Closed") {
$ticket_updated_at_display = "<p>Never</p>";
@@ -633,7 +633,7 @@ ob_start();
} else {
$ticket_updated_at_display = $ticket_updated_at;
}
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
if ($ticket_priority == "High") {
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
@@ -652,7 +652,7 @@ ob_start();
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
}
} else {
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
$ticket_assigned_to_display = escapeHtml($row['user_name']);
}
?>
@@ -702,10 +702,10 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
$recurring_ticket_id = intval($row['recurring_ticket_id']);
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
?>
<tr>
@@ -740,15 +740,15 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_version = nullable_htmlentities($row['software_version']);
$software_type = nullable_htmlentities($row['software_type']);
$software_license_type = nullable_htmlentities($row['software_license_type']);
$software_key = nullable_htmlentities($row['software_key']);
$software_seats = nullable_htmlentities($row['software_seats']);
$software_purchase = nullable_htmlentities($row['software_purchase']);
$software_expire = nullable_htmlentities($row['software_expire']);
$software_notes = nullable_htmlentities($row['software_notes']);
$software_name = escapeHtml($row['software_name']);
$software_version = escapeHtml($row['software_version']);
$software_type = escapeHtml($row['software_type']);
$software_license_type = escapeHtml($row['software_license_type']);
$software_key = escapeHtml($row['software_key']);
$software_seats = escapeHtml($row['software_seats']);
$software_purchase = escapeHtml($row['software_purchase']);
$software_expire = escapeHtml($row['software_expire']);
$software_notes = escapeHtml($row['software_notes']);
$seat_count = 0;
@@ -808,11 +808,11 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$linked_documents[] = $document_id;
@@ -860,11 +860,11 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_files)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_description = nullable_htmlentities($row['file_description']);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_ext = nullable_htmlentities($row['file_ext']);
$file_name = escapeHtml($row['file_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_description = escapeHtml($row['file_description']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";
} elseif ($file_ext == 'gz' || $file_ext == 'tar' || $file_ext == 'zip' || $file_ext == '7z' || $file_ext == 'rar') {
@@ -888,7 +888,7 @@ ob_start();
} else {
$file_icon = "file";
}
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_created_at = escapeHtml($row['file_created_at']);
?>
<tr>
<td><a class="text-dark" href="<?php echo "../uploads/clients/$client_id/$file_reference_name"; ?>" target="_blank" ><?php echo "$file_name<br><span class='text-secondary'>$file_description</span>"; ?></a></td>

2
agent/modals/asset/asset_documents.php
View File

@@ -12,7 +12,7 @@
<?php
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
$related_document_id = intval($row['document_id']);
$related_document_name = nullable_htmlentities($row['document_name']);
$related_document_name = escapeHtml($row['document_name']);
?>
<p>
<i class="fas fa-fw fa-document text-secondary"></i>

76
agent/modals/asset/asset_edit.php
View File

@@ -14,31 +14,31 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['asset_client_id']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_uri = nullable_htmlentities($row['asset_uri']);
$asset_uri_2 = nullable_htmlentities($row['asset_uri_2']);
$asset_uri_client = nullable_htmlentities($row['asset_uri_client']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_uri = escapeHtml($row['asset_uri']);
$asset_uri_2 = escapeHtml($row['asset_uri_2']);
$asset_uri_client = escapeHtml($row['asset_uri_client']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_archived_at = nullable_htmlentities($row['asset_archived_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_archived_at = escapeHtml($row['asset_archived_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
@@ -213,8 +213,8 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_name_select = escapeHtml($row['location_name']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_select_display = "($location_name_select) - ARCHIVED";
} else {
@@ -251,8 +251,8 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_archived_at) {
$contact_name_select_display = "($contact_name_select) - ARCHIVED";
} else {
@@ -284,7 +284,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option <?php if ($asset_status_select == $asset_status) { echo "selected"; } ?>>
<?= $asset_status_select ?>
@@ -311,9 +311,9 @@ ob_start();
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_networks)) {
$network_id_select = intval($row['network_id']);
$network_name_select = nullable_htmlentities($row['network_name']);
$network_select = nullable_htmlentities($row['network']);
$network_archived_at = nullable_htmlentities($row['network_archived_at']);
$network_name_select = escapeHtml($row['network_name']);
$network_select = escapeHtml($row['network']);
$network_archived_at = escapeHtml($row['network_archived_at']);
if ($network_archived_at) {
$network_name_select_display = "($network_name_select - $network_select) - ARCHIVED";
} else {
@@ -419,8 +419,8 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_archived_at = nullable_htmlentities($row['vendor_archived_at']);
$vendor_name_select = escapeHtml($row['vendor_name']);
$vendor_archived_at = escapeHtml($row['vendor_archived_at']);
if ($vendor_archived_at) {
$vendor_name_select_display = "($vendor_name_select) - ARCHIVED";
} else {
@@ -509,7 +509,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?= $tag_id_select ?>" <?php if (in_array($tag_id_select, $asset_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>
@@ -536,9 +536,9 @@ ob_start();
<ul>
<?php
while ($row = mysqli_fetch_assoc($sql_asset_history)) {
$asset_history_status = nullable_htmlentities($row['asset_history_status']);
$asset_history_description = nullable_htmlentities($row['asset_history_description']);
$asset_history_created_at = nullable_htmlentities($row['asset_history_created_at']);
$asset_history_status = escapeHtml($row['asset_history_status']);
$asset_history_description = escapeHtml($row['asset_history_description']);
$asset_history_created_at = escapeHtml($row['asset_history_created_at']);
echo "<li><span class='text-monospace'>$asset_history_created_at</span> <span class='badge badge-pill badge-secondary mt-1'>$asset_history_status</span><br/>$asset_history_description</li><br/>";
}
?>

10
agent/modals/asset/asset_interface_add.php
View File

@@ -72,7 +72,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option><?= $interface_type_select ?></option>
<?php } ?>
@@ -114,8 +114,8 @@ ob_start();
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_network_select)) {
$network_id = $row['network_id'];
$network_name = nullable_htmlentities($row['network_name']);
$network = nullable_htmlentities($row['network']);
$network_name = escapeHtml($row['network_name']);
$network = escapeHtml($row['network']);
?>
<option value="<?php echo $network_id; ?>">
<?php echo "$network_name - $network"; ?>
@@ -205,8 +205,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_interfaces_select)) {
$interface_id_select = intval($row['interface_id']);
$interface_name_select = nullable_htmlentities($row['interface_name']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$interface_name_select = escapeHtml($row['interface_name']);
$asset_name_select = escapeHtml($row['asset_name']);
?>
<option value="<?php echo $interface_id_select; ?>">
<?php echo "$asset_name_select - $interface_name_select"; ?>

4
agent/modals/asset/asset_interface_bulk_edit_network.php
View File

@@ -42,8 +42,8 @@ ob_start();
");
while ($net_row = mysqli_fetch_assoc($sql_network_select)) {
$network_id_select = intval($net_row['network_id']);
$network_name_select = nullable_htmlentities($net_row['network_name']);
$network_select = nullable_htmlentities($net_row['network']);
$network_name_select = escapeHtml($net_row['network_name']);
$network_select = escapeHtml($net_row['network']);
?>
<option value="<?php echo $network_id_select; ?>"><?php echo "$network_name_select - $network_select"; ?></option>
<?php

2
agent/modals/asset/asset_interface_bulk_edit_type.php
View File

@@ -41,7 +41,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option><?= $interface_type_select ?></option>
<?php } ?>

28
agent/modals/asset/asset_interface_edit.php
View File

@@ -16,17 +16,17 @@ $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['asset_client_id']);
$asset_id = intval($row['interface_asset_id']);
$network_id = intval($row['interface_network_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$interface_id = intval($row['interface_id']);
$interface_name = nullable_htmlentities($row['interface_name']);
$interface_description = nullable_htmlentities($row['interface_description']);
$interface_type = nullable_htmlentities($row['interface_type']);
$interface_mac = nullable_htmlentities($row['interface_mac']);
$interface_ip = nullable_htmlentities($row['interface_ip']);
$interface_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$interface_name = escapeHtml($row['interface_name']);
$interface_description = escapeHtml($row['interface_description']);
$interface_type = escapeHtml($row['interface_type']);
$interface_mac = escapeHtml($row['interface_mac']);
$interface_ip = escapeHtml($row['interface_ip']);
$interface_nat_ip = escapeHtml($row['interface_nat_ip']);
$interface_ipv6 = escapeHtml($row['interface_ipv6']);
$interface_primary = intval($row['interface_primary']);
$interface_notes = nullable_htmlentities($row['interface_notes']);
$interface_notes = escapeHtml($row['interface_notes']);
enforceClientAccess();
@@ -140,7 +140,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option <?php if($interface_type == $interface_type_select) { echo "selected"; } ?>>
<?= $interface_type_select ?>
@@ -174,8 +174,8 @@ ob_start();
");
while ($net_row = mysqli_fetch_assoc($sql_network_select)) {
$network_id_select = intval($net_row['network_id']);
$network_name_select = nullable_htmlentities($net_row['network_name']);
$network_select = nullable_htmlentities($net_row['network']);
$network_name_select = escapeHtml($net_row['network_name']);
$network_select = escapeHtml($net_row['network']);
$selected = ($network_id == $network_id_select) ? 'selected' : '';
echo "<option value='$network_id_select' $selected>$network_name_select - $network_select</option>";
@@ -303,8 +303,8 @@ ob_start();
");
while ($row_if = mysqli_fetch_assoc($sql_interfaces_select)) {
$iface_id_select = intval($row_if['interface_id']);
$iface_name_select = nullable_htmlentities($row_if['interface_name']);
$iface_asset_name_select = nullable_htmlentities($row_if['asset_name']);
$iface_name_select = escapeHtml($row_if['interface_name']);
$iface_asset_name_select = escapeHtml($row_if['asset_name']);
$selected = ($linked_interface_id === $iface_id_select) ? 'selected' : '';
echo "<option value='$iface_id_select' $selected>";

6
agent/modals/asset/asset_interface_multiple_add.php
View File

@@ -53,7 +53,7 @@
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option><?= $interface_type_select ?></option>
<?php } ?>
@@ -85,8 +85,8 @@
$sql_network_select = mysqli_query($mysqli, "SELECT network_id, network_name, network FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_network_select)) {
$network_id = $row['network_id'];
$network_name = nullable_htmlentities($row['network_name']);
$network = nullable_htmlentities($row['network']);
$network_name = escapeHtml($row['network_name']);
$network = escapeHtml($row['network']);
?>
<option value="<?php echo $network_id; ?>">
<?php echo "$network_name - $network"; ?>

4
agent/modals/asset/asset_link_credential.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -49,7 +49,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_credentials_select)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
?>
<option value="<?php echo $credential_id ?>"><?php echo $credential_name; ?></option>
<?php

4
agent/modals/asset/asset_link_document.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -50,7 +50,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_documents_select)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
?>
<option value="<?php echo $document_id ?>"><?php echo $document_name; ?></option>
<?php

6
agent/modals/asset/asset_link_file.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -52,8 +52,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>
<?php

4
agent/modals/asset/asset_link_service.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -49,7 +49,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_services_select)) {
$service_id = intval($row['service_id']);
$service_name = nullable_htmlentities($row['service_name']);
$service_name = escapeHtml($row['service_name']);
?>
<option value="<?php echo $service_id ?>"><?php echo $service_name; ?></option>
<?php

4
agent/modals/asset/asset_link_software.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -52,7 +52,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_software_select)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
?>
<option value="<?php echo $software_id ?>"><?php echo $software_name; ?></option>

4
agent/modals/calendar/calendar_edit.php
View File

@@ -7,8 +7,8 @@ $calendar_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM calendars WHERE calendar_id = $calendar_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
// Generate the HTML form content using output buffering.
ob_start();

8
agent/modals/calendar/calendar_event_add.php
View File

@@ -42,8 +42,8 @@
$sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$calendar_id = intval($row['calendar_id']);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
?>
<option <?php if ($config_default_calendar == $calendar_id) { echo "selected"; } ?> data-content="<i class='fa fa-circle mr-2' style='color:<?php echo $calendar_color; ?>;'></i> <?php echo $calendar_name; ?>" value="<?php echo $calendar_id; ?>"><?php echo $calendar_name; ?></option>
<?php } ?>
@@ -136,8 +136,8 @@
$sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$client_name = escapeHtml($row['client_name']);
$contact_email = escapeHtml($row['contact_email']);
?>
<option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>

24
agent/modals/calendar/calendar_event_edit.php
View File

@@ -7,15 +7,15 @@ $event_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id WHERE event_id = $event_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$event_title = nullable_htmlentities($row['event_title']);
$event_description = nullable_htmlentities($row['event_description']);
$event_location = nullable_htmlentities($row['event_location']);
$event_start = nullable_htmlentities($row['event_start']);
$event_end = nullable_htmlentities($row['event_end']);
$event_repeat = nullable_htmlentities($row['event_repeat']);
$event_title = escapeHtml($row['event_title']);
$event_description = escapeHtml($row['event_description']);
$event_location = escapeHtml($row['event_location']);
$event_start = escapeHtml($row['event_start']);
$event_end = escapeHtml($row['event_end']);
$event_repeat = escapeHtml($row['event_repeat']);
$calendar_id = intval($row['calendar_id']);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
$client_id = intval($row['event_client_id']);
// Generate the HTML form content using output buffering.
@@ -64,8 +64,8 @@ ob_start();
$sql_calendars_select = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
while ($row = mysqli_fetch_assoc($sql_calendars_select)) {
$calendar_id_select = intval($row['calendar_id']);
$calendar_name_select = nullable_htmlentities($row['calendar_name']);
$calendar_color_select = nullable_htmlentities($row['calendar_color']);
$calendar_name_select = escapeHtml($row['calendar_name']);
$calendar_color_select = escapeHtml($row['calendar_color']);
?>
<option data-content="<i class='fa fa-circle mr-2' style='color:<?php echo $calendar_color_select; ?>;'></i> <?php echo $calendar_name_select; ?>"<?php if ($calendar_id == $calendar_id_select) { echo "selected"; } ?> value="<?php echo $calendar_id_select; ?>"><?php echo $calendar_name_select; ?></option>
@@ -159,8 +159,8 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
$contact_email_select = nullable_htmlentities($row['contact_email']);
$client_name_select = escapeHtml($row['client_name']);
$contact_email_select = escapeHtml($row['contact_email']);
?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>

4
agent/modals/certificate/certificate_add.php
View File

@@ -53,7 +53,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -96,7 +96,7 @@ ob_start();
$domains_sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id ORDER BY domain_name ASC");
while ($domain_row = mysqli_fetch_assoc($domains_sql)) {
$domain_id = intval($domain_row['domain_id']);
$domain_name = nullable_htmlentities($domain_row['domain_name']);
$domain_name = escapeHtml($domain_row['domain_name']);
echo "<option value=\"$domain_id\">$domain_name</option>";
}
?>

26
agent/modals/certificate/certificate_edit.php
View File

@@ -9,15 +9,15 @@ $certificate_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = $certificate_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_description = nullable_htmlentities($row['certificate_description']);
$certificate_domain = nullable_htmlentities($row['certificate_domain']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_description = escapeHtml($row['certificate_description']);
$certificate_domain = escapeHtml($row['certificate_domain']);
$certificate_domain_id = intval($row['certificate_domain_id']);
$certificate_issued_by = nullable_htmlentities($row['certificate_issued_by']);
$certificate_public_key = nullable_htmlentities($row['certificate_public_key']);
$certificate_notes = nullable_htmlentities($row['certificate_notes']);
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
$certificate_created_at = nullable_htmlentities($row['certificate_created_at']);
$certificate_issued_by = escapeHtml($row['certificate_issued_by']);
$certificate_public_key = escapeHtml($row['certificate_public_key']);
$certificate_notes = escapeHtml($row['certificate_notes']);
$certificate_expire = escapeHtml($row['certificate_expire']);
$certificate_created_at = escapeHtml($row['certificate_created_at']);
$client_id = intval($row['certificate_client_id']);
$history_sql = mysqli_query($mysqli, "SELECT * FROM certificate_history WHERE certificate_history_certificate_id = $certificate_id");
@@ -93,7 +93,7 @@ ob_start();
$domains_sql = mysqli_query($mysqli, "SELECT domain_id, domain_name FROM domains WHERE domain_client_id = $client_id");
while ($row = mysqli_fetch_assoc($domains_sql)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_name = escapeHtml($row['domain_name']);
?>
<option value="<?php echo $domain_id; ?>" <?php if ($certificate_domain_id == $domain_id) { echo "selected"; } ?>><?php echo $domain_name; ?></option>
@@ -171,10 +171,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($history_sql)) {
$certificate_modified_at = nullable_htmlentities($row['certificate_history_modified_at']);
$certificate_field = nullable_htmlentities($row['certificate_history_column']);
$certificate_before_value = nullable_htmlentities($row['certificate_history_old_value']);
$certificate_after_value = nullable_htmlentities($row['certificate_history_new_value']);
$certificate_modified_at = escapeHtml($row['certificate_history_modified_at']);
$certificate_field = escapeHtml($row['certificate_history_column']);
$certificate_before_value = escapeHtml($row['certificate_history_old_value']);
$certificate_after_value = escapeHtml($row['certificate_history_new_value']);
?>
<tr>
<td><?php echo $certificate_modified_at; ?></td>

4
agent/modals/client/client_add.php
View File

@@ -109,7 +109,7 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($referral_sql)) {
$referral = nullable_htmlentities($row['category_name']); ?>
$referral = escapeHtml($row['category_name']); ?>
<option><?php echo $referral; ?></option>
<?php } ?>
@@ -144,7 +144,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

6
agent/modals/client/client_bulk_add_ticket.php
View File

@@ -64,7 +64,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -97,7 +97,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>
@@ -120,7 +120,7 @@ ob_start();
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = nullable_htmlentities($row['project_name']); ?>
$project_name_select = escapeHtml($row['project_name']); ?>
<option value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
<?php } ?>

2
agent/modals/client/client_bulk_assign_tags.php
View File

@@ -41,7 +41,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/client/client_bulk_edit_referral.php
View File

@@ -33,7 +33,7 @@ ob_start();
<?php
$referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($referral_sql)) {
$referral = nullable_htmlentities($row['category_name']); ?>
$referral = escapeHtml($row['category_name']); ?>
<option><?php echo $referral; ?></option>
<?php } ?>

18
agent/modals/client/client_bulk_email.php
View File

@@ -28,20 +28,20 @@ ob_start();
<div class="form-group col-sm-6">
<select type="text" class="form-control select2" name="mail_from">
<option value="<?php echo nullable_htmlentities($config_mail_from_email); ?>">
<?php echo nullable_htmlentities("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_invoice_from_email); ?>">
<?php echo nullable_htmlentities("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_quote_from_email); ?>">
<?php echo nullable_htmlentities("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_ticket_from_email); ?>">
<?php echo nullable_htmlentities("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_mail_from_email); ?>">
<?php echo escapeHtml("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_invoice_from_email); ?>">
<?php echo escapeHtml("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_quote_from_email); ?>">
<?php echo escapeHtml("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_ticket_from_email); ?>">
<?php echo escapeHtml("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
</select>
</div>
<div class="form-group col-sm-6">
<input type="text" class="form-control" name="mail_from_name" placeholder="From Name" maxlength="255"
value="<?php echo nullable_htmlentities($config_mail_from_name); ?>">
value="<?php echo escapeHtml($config_mail_from_name); ?>">
</div>
</div>

2
agent/modals/client/client_credit_add.php
View File

@@ -73,7 +73,7 @@
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>

22
agent/modals/client/client_edit.php
View File

@@ -7,18 +7,18 @@ $client_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id $access_permission_query LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$client_is_lead = intval($row['client_lead']);
$client_type = nullable_htmlentities($row['client_type']);
$client_website = nullable_htmlentities($row['client_website']);
$client_referral = nullable_htmlentities($row['client_referral']);
$client_type = escapeHtml($row['client_type']);
$client_website = escapeHtml($row['client_website']);
$client_referral = escapeHtml($row['client_referral']);
$client_net_terms = intval($row['client_net_terms']);
$client_tax_id_number = nullable_htmlentities($row['client_tax_id_number']);
$client_abbreviation = nullable_htmlentities($row['client_abbreviation']);
$client_tax_id_number = escapeHtml($row['client_tax_id_number']);
$client_abbreviation = escapeHtml($row['client_abbreviation']);
$client_rate = floatval($row['client_rate']);
$client_notes = nullable_htmlentities($row['client_notes']);
$client_created_at = nullable_htmlentities($row['client_created_at']);
$client_archived_at = nullable_htmlentities($row['client_archived_at']);
$client_notes = escapeHtml($row['client_notes']);
$client_created_at = escapeHtml($row['client_created_at']);
$client_archived_at = escapeHtml($row['client_archived_at']);
// Client Tags
$client_tag_id_array = array();
@@ -123,7 +123,7 @@ ob_start();
$referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND (category_archived_at > '$client_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($referral_sql)) {
$referral = nullable_htmlentities($row['category_name']);
$referral = escapeHtml($row['category_name']);
?>
<option <?php if ($client_referral == $referral) {
echo "selected";
@@ -167,7 +167,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $client_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

6
agent/modals/contact/contact_add.php
View File

@@ -64,7 +64,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_client_select)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id_select == $client_id) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
<?php } ?>
@@ -170,7 +170,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_location_select)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?= $location_id ?>"><?= $location_name ?></option>
<?php } ?>
@@ -290,7 +290,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']);
$tag_name = escapeHtml($row['tag_name']);
?>
<option value="<?= $tag_id ?>"><?= $tag_name ?></option>
<?php } ?>

2
agent/modals/contact/contact_bulk_assign_location.php
View File

@@ -35,7 +35,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php } ?>

2
agent/modals/contact/contact_bulk_assign_tags.php
View File

@@ -40,7 +40,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

18
agent/modals/contact/contact_bulk_email.php
View File

@@ -26,20 +26,20 @@ ob_start();
<div class="form-group col-sm-6">
<select type="text" class="form-control select2" name="mail_from">
<option value="<?php echo nullable_htmlentities($config_mail_from_email); ?>">
<?php echo nullable_htmlentities("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_invoice_from_email); ?>">
<?php echo nullable_htmlentities("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_quote_from_email); ?>">
<?php echo nullable_htmlentities("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_ticket_from_email); ?>">
<?php echo nullable_htmlentities("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_mail_from_email); ?>">
<?php echo escapeHtml("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_invoice_from_email); ?>">
<?php echo escapeHtml("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_quote_from_email); ?>">
<?php echo escapeHtml("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_ticket_from_email); ?>">
<?php echo escapeHtml("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
</select>
</div>
<div class="form-group col-sm-6">
<input type="text" class="form-control" name="mail_from_name" placeholder="From Name" maxlength="255"
value="<?php echo nullable_htmlentities($config_mail_from_name); ?>">
value="<?php echo escapeHtml($config_mail_from_name); ?>">
</div>
</div>

152
agent/modals/contact/contact_details.php
View File

@@ -17,38 +17,38 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_department = nullable_htmlentities($row['contact_department']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_pin = nullable_htmlentities($row['contact_pin']);
$client_name = escapeHtml($row['client_name']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_department = escapeHtml($row['contact_department']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$contact_photo = escapeHtml($row['contact_photo']);
$contact_pin = escapeHtml($row['contact_pin']);
$contact_initials = initials($contact_name);
$contact_notes = nullable_htmlentities($row['contact_notes']);
$contact_notes = escapeHtml($row['contact_notes']);
$contact_primary = intval($row['contact_primary']);
$contact_important = intval($row['contact_important']);
$contact_billing = intval($row['contact_billing']);
$contact_technical = intval($row['contact_technical']);
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
$contact_created_at = escapeHtml($row['contact_created_at']);
$contact_location_id = intval($row['contact_location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_country = nullable_htmlentities($row['location_country']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_name = escapeHtml($row['location_name']);
$location_country = escapeHtml($row['location_country']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_phone_display = empty($location_phone) ? "-" : $location_phone;
$auth_method = nullable_htmlentities($row['user_auth_method']);
$auth_method = escapeHtml($row['user_auth_method']);
$contact_client_id = intval($row['contact_client_id']);
// Related Assets Query - 1 to 1 relationship
@@ -115,12 +115,12 @@ $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
$contact_tag_id = intval($row['tag_id']);
$contact_tag_name = nullable_htmlentities($row['tag_name']);
$contact_tag_color = nullable_htmlentities($row['tag_color']);
$contact_tag_name = escapeHtml($row['tag_name']);
$contact_tag_color = escapeHtml($row['tag_color']);
if (empty($contact_tag_color)) {
$contact_tag_color = "dark";
}
$contact_tag_icon = nullable_htmlentities($row['tag_icon']);
$contact_tag_icon = escapeHtml($row['tag_icon']);
if (empty($contact_tag_icon)) {
$contact_tag_icon = "tag";
}
@@ -451,18 +451,18 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_related_assets)) {
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_serial_display = empty($asset_serial) ? "-" : $asset_serial;
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_install_date_display = empty($asset_install_date) ? "-" : $asset_install_date;
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_status = escapeHtml($row['asset_status']);
$device_icon = getAssetIcon($asset_type);
@@ -471,12 +471,12 @@ ob_start();
$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
while ($row2 = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row2['tag_id']);
$asset_tag_name = nullable_htmlentities($row2['tag_name']);
$asset_tag_color = nullable_htmlentities($row2['tag_color']);
$asset_tag_name = escapeHtml($row2['tag_name']);
$asset_tag_color = escapeHtml($row2['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row2['tag_icon']);
$asset_tag_icon = escapeHtml($row2['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}
@@ -543,22 +543,22 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
$credential_id = intval($row['credentials_credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_uri = escapeHtml($row['credential_uri']);
$credential_uri_display = empty($credential_uri) ? "-" : $credential_uri;
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
@@ -609,15 +609,15 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_status = nullable_htmlentities($row['ticket_status']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status = escapeHtml($row['ticket_status']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
if (empty($ticket_updated_at)) {
if ($ticket_status == "Closed") {
@@ -647,7 +647,7 @@ ob_start();
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
}
} else {
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
$ticket_assigned_to_display = escapeHtml($row['user_name']);
}
?>
<tr>
@@ -687,10 +687,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
?>
<tr>
<td class="text-bold"><?= $recurring_ticket_subject ?></td>
@@ -723,11 +723,11 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_linked_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_version = nullable_htmlentities($row['software_version']);
$software_type = nullable_htmlentities($row['software_type']);
$software_key = nullable_htmlentities($row['software_key']);
$software_seats = nullable_htmlentities($row['software_seats']);
$software_name = escapeHtml($row['software_name']);
$software_version = escapeHtml($row['software_version']);
$software_type = escapeHtml($row['software_type']);
$software_key = escapeHtml($row['software_key']);
$software_seats = escapeHtml($row['software_seats']);
$seat_count = 0;
@@ -776,11 +776,11 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_linked_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$linked_documents[] = $document_id;
?>
@@ -821,13 +821,13 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_linked_files)) {
$file_name = nullable_htmlentities($row['file_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_size = nullable_htmlentities($row['file_size']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_size = escapeHtml($row['file_size']);
$file_size_KB = round($file_size / 1024);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_created_at = escapeHtml($row['file_created_at']);
$linked_files[] = intval($row['file_id']);
?>
@@ -864,10 +864,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_related_notes)) {
$contact_note_type = nullable_htmlentities($row['contact_note_type']);
$contact_note = nullable_htmlentities($row['contact_note']);
$note_by = nullable_htmlentities($row['user_name']);
$contact_note_created_at = nullable_htmlentities($row['contact_note_created_at']);
$contact_note_type = escapeHtml($row['contact_note_type']);
$contact_note = escapeHtml($row['contact_note']);
$note_by = escapeHtml($row['user_name']);
$contact_note_created_at = escapeHtml($row['contact_note_created_at']);
$note_type_icon = isset($note_types_array[$contact_note_type]) ? $note_types_array[$contact_note_type] : 'fa-fw fa-sticky-note';
?>

36
agent/modals/contact/contact_edit.php
View File

@@ -14,27 +14,27 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['contact_client_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_department = nullable_htmlentities($row['contact_department']);
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_pin = nullable_htmlentities($row['contact_pin']);
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_department = escapeHtml($row['contact_department']);
$contact_extension = escapeHtml($row['contact_extension']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$contact_pin = escapeHtml($row['contact_pin']);
$contact_photo = escapeHtml($row['contact_photo']);
$contact_initials = initials($contact_name);
$contact_notes = nullable_htmlentities($row['contact_notes']);
$contact_notes = escapeHtml($row['contact_notes']);
$contact_primary = intval($row['contact_primary']);
$contact_important = intval($row['contact_important']);
$contact_billing = intval($row['contact_billing']);
$contact_technical = intval($row['contact_technical']);
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_created_at = escapeHtml($row['contact_created_at']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
$contact_location_id = intval($row['contact_location_id']);
$auth_method = nullable_htmlentities($row['user_auth_method']);
$auth_method = escapeHtml($row['user_auth_method']);
$contact_user_id = intval($row['contact_user_id']);
// Tags
@@ -177,8 +177,8 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $contact_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_name_select = escapeHtml($row['location_name']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_select_display = "($location_name_select) - ARCHIVED";
} else {
@@ -321,7 +321,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $contact_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

4
agent/modals/contact/contact_link_asset.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
ob_start();
@@ -46,7 +46,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_assets_select)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
?>
<option value="<?php echo $asset_id ?>"><?php echo $asset_name; ?></option>
<?php

4
agent/modals/contact/contact_link_credential.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -47,7 +47,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_credentials_select)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
?>
<option value="<?php echo $credential_id ?>"><?php echo $credential_name; ?></option>
<?php

4
agent/modals/contact/contact_link_document.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -50,7 +50,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_documents_select)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
?>
<option value="<?php echo $document_id ?>"><?php echo $document_name; ?></option>
<?php

6
agent/modals/contact/contact_link_file.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -52,8 +52,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>
<?php

4
agent/modals/contact/contact_link_service.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -49,7 +49,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_services_select)) {
$service_id = intval($row['service_id']);
$service_name = nullable_htmlentities($row['service_name']);
$service_name = escapeHtml($row['service_name']);
?>
<option value="<?php echo $service_id ?>"><?php echo $service_name; ?></option>
<?php

4
agent/modals/contact/contact_link_software.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -51,7 +51,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_software_select)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
?>
<option value="<?php echo $software_id ?>"><?php echo $software_name; ?></option>
<?php

4
agent/modals/contact/contact_note_add.php
View File

@@ -6,7 +6,7 @@ $contact_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT contact_name FROM contacts WHERE contact_id = $contact_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
ob_start();
@@ -40,7 +40,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_contact_note_types_select)) {
$contact_note_type_select = nullable_htmlentities($row['category_name']);
$contact_note_type_select = escapeHtml($row['category_name']);
?>
<option><?= $contact_note_type_select ?></option>
<?php } ?>

10
agent/modals/credential/credential_add.php
View File

@@ -57,7 +57,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -170,7 +170,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id_select = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option
<?php if ($contact_id == $contact_id_select) { echo "selected"; } ?>
@@ -197,8 +197,8 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN locations on asset_location_id = location_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$asset_id_select = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_location = nullable_htmlentities($row['location_name']);
$asset_name = escapeHtml($row['asset_name']);
$asset_location = escapeHtml($row['location_name']);
$asset_display_string = $asset_name;
if (!empty($asset_location)) {
@@ -236,7 +236,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/credential/credential_bulk_assign_tags.php
View File

@@ -39,7 +39,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

28
agent/modals/credential/credential_edit.php
View File

@@ -10,18 +10,18 @@ $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $c
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['credential_client_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_uri_2 = nullable_htmlentities($row['credential_uri_2']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
$credential_uri_2 = escapeHtml($row['credential_uri_2']);
$credential_uri_link = sanitize_url($row['credential_uri']);
$credential_uri_2_link = sanitize_url($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_created_at = nullable_htmlentities($row['credential_created_at']);
$credential_archived_at = nullable_htmlentities($row['credential_archived_at']);
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_note = escapeHtml($row['credential_note']);
$credential_created_at = escapeHtml($row['credential_created_at']);
$credential_archived_at = escapeHtml($row['credential_archived_at']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$credential_asset_id = intval($row['credential_asset_id']);
@@ -190,7 +190,7 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
?>
<option <?php if ($credential_contact_id == $contact_id_select) { echo "selected"; } ?> value="<?php echo $contact_id_select; ?>"><?php echo $contact_name_select; ?></option>
<?php } ?>
@@ -211,8 +211,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, location_name FROM assets LEFT JOIN locations on asset_location_id = location_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_location_select = nullable_htmlentities($row['location_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_location_select = escapeHtml($row['location_name']);
$asset_select_display_string = $asset_name_select;
if (!empty($asset_location_select)) {
@@ -247,7 +247,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $credential_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

18
agent/modals/credential/credential_view.php
View File

@@ -10,21 +10,21 @@ $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $c
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['credential_client_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_uri_2 = nullable_htmlentities($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptLoginEntry($row['credential_username']));
$credential_password = nullable_htmlentities(decryptLoginEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
$credential_uri_2 = escapeHtml($row['credential_uri_2']);
$credential_username = escapeHtml(decryptLoginEntry($row['credential_username']));
$credential_password = escapeHtml(decryptLoginEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_created_at = nullable_htmlentities($row['credential_created_at']);
$credential_note = escapeHtml($row['credential_note']);
$credential_created_at = escapeHtml($row['credential_created_at']);
enforceClientAccess();

4
agent/modals/document/document_add_file_relation.php
View File

@@ -25,8 +25,8 @@
WHERE file_client_id = $client_id ORDER BY folder_name ASC, file_name ASC");
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>

4
agent/modals/document/document_add_from_template.php
View File

@@ -34,7 +34,7 @@ ob_start();
$sql_document_templates = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_archived_at IS NULL ORDER BY document_template_name ASC");
while ($row = mysqli_fetch_assoc($sql_document_templates)) {
$document_template_id = intval($row['document_template_id']);
$document_template_name = nullable_htmlentities($row['document_template_name']);
$document_template_name = escapeHtml($row['document_template_name']);
?>
<option value="<?php echo $document_template_id ?>"><?php echo $document_template_name; ?></option>
<?php
@@ -76,7 +76,7 @@ ob_start();
$sql_folders = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_client_id = $client_id ORDER BY folder_name ASC");
while ($row = mysqli_fetch_assoc($sql_folders)) {
$folder_id = intval($row['folder_id']);
$folder_name = nullable_htmlentities($row['folder_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option <?php if (isset($_GET['folder_id']) && $_GET['folder_id'] == $folder_id) echo "selected"; ?> value="<?php echo $folder_id ?>"><?php echo $folder_name; ?></option>
<?php

2
agent/modals/document/document_bulk_move.php
View File

@@ -43,7 +43,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = array(
'folder_id' => intval($row['folder_id']),
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder' => intval($row['parent_folder']),
'children' => array()
);

6
agent/modals/document/document_edit.php
View File

@@ -9,9 +9,9 @@ $document_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_content = nullable_htmlentities($row['document_content']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_content = escapeHtml($row['document_content']);
$document_folder_id = intval($row['document_folder_id']);
$document_client_visible = intval($row['document_client_visible']);
$client_id = intval($row['document_client_id']);

2
agent/modals/document/document_edit_visibility.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$document_client_visible = intval($row['document_client_visible']);
$client_id = intval($row['document_client_id']);

4
agent/modals/document/document_link_asset.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -51,7 +51,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_assets_select)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
?>
<option value="<?= $asset_id ?>"><?= $asset_name ?></option>

4
agent/modals/document/document_link_contact.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -51,7 +51,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_contacts_select)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option value="<?= $contact_id ?>"><?= $contact_name ?></option>

6
agent/modals/document/document_link_file.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -53,8 +53,8 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>

4
agent/modals/document/document_link_software.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -52,7 +52,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_software_select)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
?>
<option value="<?= $software_id ?>"><?= $software_name ?></option>

6
agent/modals/document/document_move.php
View File

@@ -8,8 +8,8 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $docum
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_folder_id = nullable_htmlentities($row['document_folder_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_folder_id = escapeHtml($row['document_folder_id']);
$document_name = escapeHtml($row['document_name']);
enforceClientAccess();
@@ -45,7 +45,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = array(
'folder_id' => intval($row['folder_id']),
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder' => intval($row['parent_folder']),
'children' => array()
);

2
agent/modals/document/document_rename.php
View File

@@ -8,7 +8,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $docum
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
enforceClientAccess();

2
agent/modals/document/document_version_view.php
View File

@@ -15,7 +15,7 @@ $document_version_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM document_versions LEFT JOIN documents ON document_id = document_version_document_id WHERE document_version_id = $document_version_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_version_name = nullable_htmlentities($row['document_version_name']);
$document_version_name = escapeHtml($row['document_version_name']);
$document_version_content = $purifier->purify($row['document_version_content']);
$client_id = intval($row['document_client_id']);

2
agent/modals/document/document_view.php
View File

@@ -15,7 +15,7 @@ $document_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$document_content = $purifier->purify($row['document_content']);
$client_id = intval($row['document_client_id']);

10
agent/modals/domain/domain_add.php
View File

@@ -51,7 +51,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -98,7 +98,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>
@@ -119,7 +119,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>
@@ -140,7 +140,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>
@@ -161,7 +161,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>

30
agent/modals/domain/domain_edit.php
View File

@@ -9,21 +9,21 @@ $domain_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = $domain_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_description = nullable_htmlentities($row['domain_description']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_description = escapeHtml($row['domain_description']);
$domain_expire = escapeHtml($row['domain_expire']);
$domain_registrar = intval($row['domain_registrar']);
$domain_webhost = intval($row['domain_webhost']);
$domain_dnshost = intval($row['domain_dnshost']);
$domain_mailhost = intval($row['domain_mailhost']);
$domain_ip = nullable_htmlentities($row['domain_ip']);
$domain_name_servers = nullable_htmlentities($row['domain_name_servers']);
$domain_mail_servers = nullable_htmlentities($row['domain_mail_servers']);
$domain_txt = nullable_htmlentities($row['domain_txt']);
$domain_raw_whois = nullable_htmlentities($row['domain_raw_whois']);
$domain_notes = nullable_htmlentities($row['domain_notes']);
$domain_created_at = nullable_htmlentities($row['domain_created_at']);
$domain_archived_at = nullable_htmlentities($row['domain_archived_at']);
$domain_ip = escapeHtml($row['domain_ip']);
$domain_name_servers = escapeHtml($row['domain_name_servers']);
$domain_mail_servers = escapeHtml($row['domain_mail_servers']);
$domain_txt = escapeHtml($row['domain_txt']);
$domain_raw_whois = escapeHtml($row['domain_raw_whois']);
$domain_notes = escapeHtml($row['domain_notes']);
$domain_created_at = escapeHtml($row['domain_created_at']);
$domain_archived_at = escapeHtml($row['domain_archived_at']);
$client_id = intval($row['domain_client_id']);
$history_sql = mysqli_query($mysqli, "SELECT * FROM domain_history WHERE domain_history_domain_id = $domain_id");
@@ -261,10 +261,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($history_sql)) {
$domain_modified_at = nullable_htmlentities($row['domain_history_modified_at']);
$domain_field = nullable_htmlentities($row['domain_history_column']);
$domain_before_value = nullable_htmlentities($row['domain_history_old_value']);
$domain_after_value = nullable_htmlentities($row['domain_history_new_value']);
$domain_modified_at = escapeHtml($row['domain_history_modified_at']);
$domain_field = escapeHtml($row['domain_history_column']);
$domain_before_value = escapeHtml($row['domain_history_old_value']);
$domain_after_value = escapeHtml($row['domain_history_new_value']);
?>
<tr>
<td><?php echo $domain_modified_at; ?></td>

8
agent/modals/expense/expense_add.php
View File

@@ -53,7 +53,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
@@ -93,7 +93,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
@@ -138,7 +138,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -172,7 +172,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?= $client_id_select ?>"><?= $client_name ?></option>

2
agent/modals/expense/expense_bulk_edit_account.php
View File

@@ -34,7 +34,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");

2
agent/modals/expense/expense_bulk_edit_category.php
View File

@@ -40,7 +40,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

2
agent/modals/expense/expense_bulk_edit_client.php
View File

@@ -39,7 +39,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>

20
agent/modals/expense/expense_copy.php
View File

@@ -7,13 +7,13 @@ $expense_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);
@@ -71,7 +71,7 @@ ob_start();
$sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts)) {
$account_id_select = intval($row['account_id']);
$account_name_select = nullable_htmlentities($row['account_name']);
$account_name_select = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id_select");
@@ -109,7 +109,7 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($expense_vendor_id == $vendor_id_select) { ?> selected <?php } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>
<?php
@@ -151,7 +151,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id_select = intval($row['category_id']);
$category_name_select = nullable_htmlentities($row['category_name']);
$category_name_select = escapeHtml($row['category_name']);
?>
<option <?php if ($expense_category_id == $category_id_select) { ?> selected <?php } ?> value="<?php echo $category_id_select; ?>"><?php echo $category_name_select; ?></option>
<?php
@@ -179,7 +179,7 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
$client_name_select = escapeHtml($row['client_name']);
?>
<option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>

26
agent/modals/expense/expense_edit.php
View File

@@ -11,19 +11,19 @@ $sql = mysqli_query($mysqli, "SELECT * FROM expenses
);
$row = mysqli_fetch_assoc($sql);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);
$client_id = intval($row['expense_client_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$category_name = nullable_htmlentities($row['category_name']);
$vendor_name = escapeHtml($row['vendor_name']);
$category_name = escapeHtml($row['category_name']);
if ($client_id) {
enforceClientAccess();
@@ -82,9 +82,9 @@ ob_start();
$sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance, account_archived_at FROM accounts WHERE (account_archived_at > '$expense_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts)) {
$account_id_select = intval($row['account_id']);
$account_name_select = nullable_htmlentities($row['account_name']);
$account_name_select = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$account_archived_at = nullable_htmlentities($row['account_archived_at']);
$account_archived_at = escapeHtml($row['account_archived_at']);
if (empty($account_archived_at)) {
$account_archived_display = "";
} else {
@@ -127,7 +127,7 @@ ob_start();
$sql_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND (vendor_archived_at > '$expense_created_at' OR vendor_archived_at IS NULL) ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_select)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($expense_vendor_id == $vendor_id_select) { ?> selected <?php } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>
<?php
@@ -172,7 +172,7 @@ ob_start();
$sql_select = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND (category_archived_at > '$expense_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_select)) {
$category_id_select = intval($row['category_id']);
$category_name_select = nullable_htmlentities($row['category_name']);
$category_name_select = escapeHtml($row['category_name']);
?>
<option <?php if ($expense_category_id == $category_id_select) { ?> selected <?php } ?> value="<?php echo $category_id_select; ?>"><?php echo $category_name_select; ?></option>
<?php
@@ -206,7 +206,7 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
$client_name_select = escapeHtml($row['client_name']);
?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>

6
agent/modals/expense/expense_export.php
View File

@@ -30,7 +30,7 @@ ob_start();
$sql_accounts_filter = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts_filter)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
?>
<option <?php if ($account_filter == $account_id) { echo "selected"; } ?> value="<?= $account_id ?>"><?= $account_name ?></option>
<?php
@@ -54,7 +54,7 @@ ob_start();
$sql_vendors_filter = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = 0 ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors_filter)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option <?php if ($vendor_filter == $vendor_id) { echo "selected"; } ?> value="<?= $vendor_id ?>"><?= $vendor_name ?></option>
<?php
@@ -78,7 +78,7 @@ ob_start();
$sql_categories_filter = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?= $category_id ?>"><?= $category_name ?></option>
<?php

12
agent/modals/expense/expense_refund.php
View File

@@ -7,13 +7,13 @@ $expense_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);

2
agent/modals/file/file_bulk_move.php
View File

@@ -70,7 +70,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = [
'folder_id' => (int)$row['folder_id'],
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder'=> (int)$row['parent_folder'],
'children' => []
];

4
agent/modals/file/file_link_asset.php
View File

@@ -28,7 +28,7 @@
);
while ($row = mysqli_fetch_assoc($sql_assets_select)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
?>
<option value="<?php echo $asset_id ?>"><?php echo $asset_name; ?></option>
@@ -50,7 +50,7 @@
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$linked_assets[] = $asset_id;

Some files were not shown because too many files have changed in this diff Show More