AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 17:00:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:10:45 -04:00
parent d62b6e2ae7
commit 7bc47a58fe
338 changed files with 3057 additions and 3057 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
agent/modals/account/account_edit.php
View File

@@ -7,8 +7,8 @@ $account_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$account_name = nullable_htmlentities($row['account_name']);
$account_notes = nullable_htmlentities($row['account_notes']);
$account_name = escapeHtml($row['account_name']);
$account_notes = escapeHtml($row['account_notes']);
// Generate the HTML form content using output buffering.
ob_start();

18
agent/modals/asset/asset_add.php
View File

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
$client_id = intval($_GET['client_id'] ?? 0);
$contact_id = intval($_GET['contact_id'] ?? 0);
$type = nullable_htmlentities(ucwords($_GET['type']) ?? '');
$type = escapeHtml(ucwords($_GET['type']) ?? '');
if ($client_id) {
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
@@ -87,7 +87,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_client_select)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
<?php } ?>
@@ -201,7 +201,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_location_select)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?= $location_id ?>"><?= $location_name ?></option>
<?php } ?>
@@ -234,7 +234,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_contact_select)) {
$contact_id_select = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option
<?php if ($contact_id == $contact_id_select) {
@@ -266,7 +266,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option><?= $asset_status_select ?></option>
<?php } ?>
@@ -290,8 +290,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_network_select)) {
$network_id = intval($row['network_id']);
$network_name = nullable_htmlentities($row['network_name']);
$network = nullable_htmlentities($row['network']);
$network_name = escapeHtml($row['network_name']);
$network = escapeHtml($row['network']);
?>
<option value="<?= $network_id ?>"><?= $network_name ?> - <?= $network ?></option>
@@ -395,7 +395,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_vendor_select)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
@@ -497,7 +497,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']);
$tag_name = escapeHtml($row['tag_name']);
?>
<option value="<?= $tag_id ?>"><?= $tag_name ?></option>
<?php } ?>

6
agent/modals/asset/asset_bulk_add_ticket.php
View File

@@ -68,7 +68,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -98,7 +98,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option <?php if ($session_user_id == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>
@@ -118,7 +118,7 @@ ob_start();
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = nullable_htmlentities($row['project_name']); ?>
$project_name_select = escapeHtml($row['project_name']); ?>
<option value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_assign_contact.php
View File

@@ -36,7 +36,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $contact_id; ?>"><?php echo $contact_name; ?></option>

2
agent/modals/asset/asset_bulk_assign_location.php
View File

@@ -37,7 +37,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_assign_tags.php
View File

@@ -40,7 +40,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_edit_status.php
View File

@@ -38,7 +38,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option><?= $asset_status_select ?></option>
<?php } ?>

2
agent/modals/asset/asset_bulk_transfer_client.php
View File

@@ -42,7 +42,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($clients_sql)) {
$client_id_select = intval($row["client_id"]);
$client_name_select = nullable_htmlentities($row["client_name"]);
$client_name_select = escapeHtml($row["client_name"]);
?>
<option value='<?php echo $client_id_select; ?>'><?php echo $client_name_select; ?></option>
<?php

58
agent/modals/asset/asset_copy.php
View File

@@ -14,29 +14,29 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['asset_client_id']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_uri = nullable_htmlentities($row['asset_uri']);
$asset_uri_2 = nullable_htmlentities($row['asset_uri_2']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_archived_at = nullable_htmlentities($row['asset_archived_at']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_uri = escapeHtml($row['asset_uri']);
$asset_uri_2 = escapeHtml($row['asset_uri_2']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_archived_at = escapeHtml($row['asset_archived_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
@@ -184,7 +184,7 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_name_select = escapeHtml($row['location_name']);
?>
<option <?php if ($asset_location_id == $location_id_select) { echo "selected"; } ?> value="<?php echo $location_id_select; ?>"><?php echo $location_name_select; ?></option>
<?php } ?>
@@ -216,7 +216,7 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $contact_id_select; ?>"><?php echo $contact_name_select; ?></option>
<?php } ?>
@@ -241,7 +241,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option <?php if ($asset_status_select == $asset_status) { echo "selected"; } ?>>
<?= $asset_status_select ?>
@@ -268,8 +268,8 @@ ob_start();
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_networks)) {
$network_id_select = intval($row['network_id']);
$network_name_select = nullable_htmlentities($row['network_name']);
$network_select = nullable_htmlentities($row['network']);
$network_name_select = escapeHtml($row['network_name']);
$network_select = escapeHtml($row['network']);
?>
<option <?php if ($asset_network_id == $network_id_select) { echo "selected"; } ?> value="<?php echo $network_id_select; ?>"><?php echo $network_name_select; ?> - <?php echo $network_select; ?></option>
@@ -361,7 +361,7 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($asset_vendor_id == $vendor_id_select) { echo "selected"; } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>

178
agent/modals/asset/asset_details.php
View File

@@ -17,58 +17,58 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_uri = sanitize_url($row['asset_uri']);
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
$asset_uri_client = sanitize_url($row['asset_uri_client']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_network_id = intval($row['interface_network_id']);
$device_icon = getAssetIcon($asset_type);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_archived_at) {
$contact_name_display = "<span class='text-danger' title='Archived'><s>$contact_name</s></span>";
} else {
$contact_name_display = $contact_name;
}
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
if (empty($location_name)) {
$location_name = "-";
}
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_display = "<span class='text-danger' title='Archived'><s>$location_name</s></span>";
} else {
@@ -82,12 +82,12 @@ $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
$asset_tag_name = nullable_htmlentities($row['tag_name']);
$asset_tag_color = nullable_htmlentities($row['tag_color']);
$asset_tag_name = escapeHtml($row['tag_name']);
$asset_tag_color = escapeHtml($row['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
$asset_tag_icon = escapeHtml($row['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}
@@ -440,17 +440,17 @@ ob_start();
<?php while ($row = mysqli_fetch_assoc($sql_related_interfaces)) { ?>
<?php
$interface_id = intval($row['interface_id']);
$interface_name = nullable_htmlentities($row['interface_name']);
$interface_description = nullable_htmlentities($row['interface_description']);
$interface_type = nullable_htmlentities($row['interface_type']);
$interface_mac = nullable_htmlentities($row['interface_mac']);
$interface_ip = nullable_htmlentities($row['interface_ip']);
$interface_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$interface_name = escapeHtml($row['interface_name']);
$interface_description = escapeHtml($row['interface_description']);
$interface_type = escapeHtml($row['interface_type']);
$interface_mac = escapeHtml($row['interface_mac']);
$interface_ip = escapeHtml($row['interface_ip']);
$interface_nat_ip = escapeHtml($row['interface_nat_ip']);
$interface_ipv6 = escapeHtml($row['interface_ipv6']);
$interface_primary = intval($row['interface_primary']);
$network_id = intval($row['network_id']);
$network_name = nullable_htmlentities($row['network_name']);
$interface_notes = nullable_htmlentities($row['interface_notes']);
$network_name = escapeHtml($row['network_name']);
$interface_notes = escapeHtml($row['interface_notes']);
// Prepare display text
$interface_mac_display = $interface_mac ?: '-';
@@ -462,10 +462,10 @@ ob_start();
// Connected interface details
$connected_asset_id = intval($row['connected_asset_id']);
$connected_asset_name = nullable_htmlentities($row['connected_asset_name']);
$connected_asset_type = nullable_htmlentities($row['connected_asset_type']);
$connected_asset_name = escapeHtml($row['connected_asset_name']);
$connected_asset_type = escapeHtml($row['connected_asset_type']);
$connected_asset_icon = getAssetIcon($connected_asset_type);
$connected_interface_name = nullable_htmlentities($row['connected_interface_name']);
$connected_interface_name = escapeHtml($row['connected_interface_name']);
// Show either "-" or "AssetName - Port"
@@ -518,29 +518,29 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
if (empty($credential_uri)) {
$credential_uri_display = "-";
} else {
$credential_uri_display = "$credential_uri";
}
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_note = escapeHtml($row['credential_note']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$credential_asset_id = intval($row['credential_asset_id']);
@@ -552,12 +552,12 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);
$credential_tag_name = nullable_htmlentities($row['tag_name']);
$credential_tag_color = nullable_htmlentities($row['tag_color']);
$credential_tag_name = escapeHtml($row['tag_name']);
$credential_tag_color = escapeHtml($row['tag_color']);
if (empty($credential_tag_color)) {
$credential_tag_color = "dark";
}
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
$credential_tag_icon = escapeHtml($row['tag_icon']);
if (empty($credential_tag_icon)) {
$credential_tag_icon = "tag";
}
@@ -615,15 +615,15 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status_id = intval($row['ticket_status_id']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
if (empty($ticket_updated_at)) {
if ($ticket_status_name == "Closed") {
$ticket_updated_at_display = "<p>Never</p>";
@@ -633,7 +633,7 @@ ob_start();
} else {
$ticket_updated_at_display = $ticket_updated_at;
}
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
if ($ticket_priority == "High") {
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
@@ -652,7 +652,7 @@ ob_start();
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
}
} else {
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
$ticket_assigned_to_display = escapeHtml($row['user_name']);
}
?>
@@ -702,10 +702,10 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
$recurring_ticket_id = intval($row['recurring_ticket_id']);
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
?>
<tr>
@@ -740,15 +740,15 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_version = nullable_htmlentities($row['software_version']);
$software_type = nullable_htmlentities($row['software_type']);
$software_license_type = nullable_htmlentities($row['software_license_type']);
$software_key = nullable_htmlentities($row['software_key']);
$software_seats = nullable_htmlentities($row['software_seats']);
$software_purchase = nullable_htmlentities($row['software_purchase']);
$software_expire = nullable_htmlentities($row['software_expire']);
$software_notes = nullable_htmlentities($row['software_notes']);
$software_name = escapeHtml($row['software_name']);
$software_version = escapeHtml($row['software_version']);
$software_type = escapeHtml($row['software_type']);
$software_license_type = escapeHtml($row['software_license_type']);
$software_key = escapeHtml($row['software_key']);
$software_seats = escapeHtml($row['software_seats']);
$software_purchase = escapeHtml($row['software_purchase']);
$software_expire = escapeHtml($row['software_expire']);
$software_notes = escapeHtml($row['software_notes']);
$seat_count = 0;
@@ -808,11 +808,11 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$linked_documents[] = $document_id;
@@ -860,11 +860,11 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_related_files)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_description = nullable_htmlentities($row['file_description']);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_ext = nullable_htmlentities($row['file_ext']);
$file_name = escapeHtml($row['file_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_description = escapeHtml($row['file_description']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_ext = escapeHtml($row['file_ext']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";
} elseif ($file_ext == 'gz' || $file_ext == 'tar' || $file_ext == 'zip' || $file_ext == '7z' || $file_ext == 'rar') {
@@ -888,7 +888,7 @@ ob_start();
} else {
$file_icon = "file";
}
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_created_at = escapeHtml($row['file_created_at']);
?>
<tr>
<td><a class="text-dark" href="<?php echo "../uploads/clients/$client_id/$file_reference_name"; ?>" target="_blank" ><?php echo "$file_name<br><span class='text-secondary'>$file_description</span>"; ?></a></td>

2
agent/modals/asset/asset_documents.php
View File

@@ -12,7 +12,7 @@
<?php
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
$related_document_id = intval($row['document_id']);
$related_document_name = nullable_htmlentities($row['document_name']);
$related_document_name = escapeHtml($row['document_name']);
?>
<p>
<i class="fas fa-fw fa-document text-secondary"></i>

76
agent/modals/asset/asset_edit.php
View File

@@ -14,31 +14,31 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['asset_client_id']);
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_os = nullable_htmlentities($row['asset_os']);
$asset_ip = nullable_htmlentities($row['interface_ip']);
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$asset_mac = nullable_htmlentities($row['interface_mac']);
$asset_uri = nullable_htmlentities($row['asset_uri']);
$asset_uri_2 = nullable_htmlentities($row['asset_uri_2']);
$asset_uri_client = nullable_htmlentities($row['asset_uri_client']);
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_photo = nullable_htmlentities($row['asset_photo']);
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
$asset_notes = nullable_htmlentities($row['asset_notes']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_os = escapeHtml($row['asset_os']);
$asset_ip = escapeHtml($row['interface_ip']);
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
$asset_mac = escapeHtml($row['interface_mac']);
$asset_uri = escapeHtml($row['asset_uri']);
$asset_uri_2 = escapeHtml($row['asset_uri_2']);
$asset_uri_client = escapeHtml($row['asset_uri_client']);
$asset_status = escapeHtml($row['asset_status']);
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_photo = escapeHtml($row['asset_photo']);
$asset_physical_location = escapeHtml($row['asset_physical_location']);
$asset_notes = escapeHtml($row['asset_notes']);
$asset_favorite = intval($row['asset_favorite']);
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
$asset_archived_at = nullable_htmlentities($row['asset_archived_at']);
$asset_created_at = escapeHtml($row['asset_created_at']);
$asset_archived_at = escapeHtml($row['asset_archived_at']);
$asset_vendor_id = intval($row['asset_vendor_id']);
$asset_location_id = intval($row['asset_location_id']);
$asset_contact_id = intval($row['asset_contact_id']);
@@ -213,8 +213,8 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_name_select = escapeHtml($row['location_name']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_select_display = "($location_name_select) - ARCHIVED";
} else {
@@ -251,8 +251,8 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if ($contact_archived_at) {
$contact_name_select_display = "($contact_name_select) - ARCHIVED";
} else {
@@ -284,7 +284,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$asset_status_select = nullable_htmlentities($row['category_name']);
$asset_status_select = escapeHtml($row['category_name']);
?>
<option <?php if ($asset_status_select == $asset_status) { echo "selected"; } ?>>
<?= $asset_status_select ?>
@@ -311,9 +311,9 @@ ob_start();
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_networks)) {
$network_id_select = intval($row['network_id']);
$network_name_select = nullable_htmlentities($row['network_name']);
$network_select = nullable_htmlentities($row['network']);
$network_archived_at = nullable_htmlentities($row['network_archived_at']);
$network_name_select = escapeHtml($row['network_name']);
$network_select = escapeHtml($row['network']);
$network_archived_at = escapeHtml($row['network_archived_at']);
if ($network_archived_at) {
$network_name_select_display = "($network_name_select - $network_select) - ARCHIVED";
} else {
@@ -419,8 +419,8 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_archived_at = nullable_htmlentities($row['vendor_archived_at']);
$vendor_name_select = escapeHtml($row['vendor_name']);
$vendor_archived_at = escapeHtml($row['vendor_archived_at']);
if ($vendor_archived_at) {
$vendor_name_select_display = "($vendor_name_select) - ARCHIVED";
} else {
@@ -509,7 +509,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?= $tag_id_select ?>" <?php if (in_array($tag_id_select, $asset_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>
@@ -536,9 +536,9 @@ ob_start();
<ul>
<?php
while ($row = mysqli_fetch_assoc($sql_asset_history)) {
$asset_history_status = nullable_htmlentities($row['asset_history_status']);
$asset_history_description = nullable_htmlentities($row['asset_history_description']);
$asset_history_created_at = nullable_htmlentities($row['asset_history_created_at']);
$asset_history_status = escapeHtml($row['asset_history_status']);
$asset_history_description = escapeHtml($row['asset_history_description']);
$asset_history_created_at = escapeHtml($row['asset_history_created_at']);
echo "<li><span class='text-monospace'>$asset_history_created_at</span> <span class='badge badge-pill badge-secondary mt-1'>$asset_history_status</span><br/>$asset_history_description</li><br/>";
}
?>

10
agent/modals/asset/asset_interface_add.php
View File

@@ -72,7 +72,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option><?= $interface_type_select ?></option>
<?php } ?>
@@ -114,8 +114,8 @@ ob_start();
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_network_select)) {
$network_id = $row['network_id'];
$network_name = nullable_htmlentities($row['network_name']);
$network = nullable_htmlentities($row['network']);
$network_name = escapeHtml($row['network_name']);
$network = escapeHtml($row['network']);
?>
<option value="<?php echo $network_id; ?>">
<?php echo "$network_name - $network"; ?>
@@ -205,8 +205,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_interfaces_select)) {
$interface_id_select = intval($row['interface_id']);
$interface_name_select = nullable_htmlentities($row['interface_name']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$interface_name_select = escapeHtml($row['interface_name']);
$asset_name_select = escapeHtml($row['asset_name']);
?>
<option value="<?php echo $interface_id_select; ?>">
<?php echo "$asset_name_select - $interface_name_select"; ?>

4
agent/modals/asset/asset_interface_bulk_edit_network.php
View File

@@ -42,8 +42,8 @@ ob_start();
");
while ($net_row = mysqli_fetch_assoc($sql_network_select)) {
$network_id_select = intval($net_row['network_id']);
$network_name_select = nullable_htmlentities($net_row['network_name']);
$network_select = nullable_htmlentities($net_row['network']);
$network_name_select = escapeHtml($net_row['network_name']);
$network_select = escapeHtml($net_row['network']);
?>
<option value="<?php echo $network_id_select; ?>"><?php echo "$network_name_select - $network_select"; ?></option>
<?php

2
agent/modals/asset/asset_interface_bulk_edit_type.php
View File

@@ -41,7 +41,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option><?= $interface_type_select ?></option>
<?php } ?>

28
agent/modals/asset/asset_interface_edit.php
View File

@@ -16,17 +16,17 @@ $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['asset_client_id']);
$asset_id = intval($row['interface_asset_id']);
$network_id = intval($row['interface_network_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$interface_id = intval($row['interface_id']);
$interface_name = nullable_htmlentities($row['interface_name']);
$interface_description = nullable_htmlentities($row['interface_description']);
$interface_type = nullable_htmlentities($row['interface_type']);
$interface_mac = nullable_htmlentities($row['interface_mac']);
$interface_ip = nullable_htmlentities($row['interface_ip']);
$interface_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
$interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
$interface_name = escapeHtml($row['interface_name']);
$interface_description = escapeHtml($row['interface_description']);
$interface_type = escapeHtml($row['interface_type']);
$interface_mac = escapeHtml($row['interface_mac']);
$interface_ip = escapeHtml($row['interface_ip']);
$interface_nat_ip = escapeHtml($row['interface_nat_ip']);
$interface_ipv6 = escapeHtml($row['interface_ipv6']);
$interface_primary = intval($row['interface_primary']);
$interface_notes = nullable_htmlentities($row['interface_notes']);
$interface_notes = escapeHtml($row['interface_notes']);
enforceClientAccess();
@@ -140,7 +140,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option <?php if($interface_type == $interface_type_select) { echo "selected"; } ?>>
<?= $interface_type_select ?>
@@ -174,8 +174,8 @@ ob_start();
");
while ($net_row = mysqli_fetch_assoc($sql_network_select)) {
$network_id_select = intval($net_row['network_id']);
$network_name_select = nullable_htmlentities($net_row['network_name']);
$network_select = nullable_htmlentities($net_row['network']);
$network_name_select = escapeHtml($net_row['network_name']);
$network_select = escapeHtml($net_row['network']);
$selected = ($network_id == $network_id_select) ? 'selected' : '';
echo "<option value='$network_id_select' $selected>$network_name_select - $network_select</option>";
@@ -303,8 +303,8 @@ ob_start();
");
while ($row_if = mysqli_fetch_assoc($sql_interfaces_select)) {
$iface_id_select = intval($row_if['interface_id']);
$iface_name_select = nullable_htmlentities($row_if['interface_name']);
$iface_asset_name_select = nullable_htmlentities($row_if['asset_name']);
$iface_name_select = escapeHtml($row_if['interface_name']);
$iface_asset_name_select = escapeHtml($row_if['asset_name']);
$selected = ($linked_interface_id === $iface_id_select) ? 'selected' : '';
echo "<option value='$iface_id_select' $selected>";

6
agent/modals/asset/asset_interface_multiple_add.php
View File

@@ -53,7 +53,7 @@
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
$interface_type_select = nullable_htmlentities($row['category_name']);
$interface_type_select = escapeHtml($row['category_name']);
?>
<option><?= $interface_type_select ?></option>
<?php } ?>
@@ -85,8 +85,8 @@
$sql_network_select = mysqli_query($mysqli, "SELECT network_id, network_name, network FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_network_select)) {
$network_id = $row['network_id'];
$network_name = nullable_htmlentities($row['network_name']);
$network = nullable_htmlentities($row['network']);
$network_name = escapeHtml($row['network_name']);
$network = escapeHtml($row['network']);
?>
<option value="<?php echo $network_id; ?>">
<?php echo "$network_name - $network"; ?>

4
agent/modals/asset/asset_link_credential.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -49,7 +49,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_credentials_select)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
?>
<option value="<?php echo $credential_id ?>"><?php echo $credential_name; ?></option>
<?php

4
agent/modals/asset/asset_link_document.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -50,7 +50,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_documents_select)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
?>
<option value="<?php echo $document_id ?>"><?php echo $document_name; ?></option>
<?php

6
agent/modals/asset/asset_link_file.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -52,8 +52,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>
<?php

4
agent/modals/asset/asset_link_service.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -49,7 +49,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_services_select)) {
$service_id = intval($row['service_id']);
$service_name = nullable_htmlentities($row['service_name']);
$service_name = escapeHtml($row['service_name']);
?>
<option value="<?php echo $service_id ?>"><?php echo $service_name; ?></option>
<?php

4
agent/modals/asset/asset_link_software.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets
");
$row = mysqli_fetch_assoc($sql);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Generate the HTML form content using output buffering.
@@ -52,7 +52,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_software_select)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
?>
<option value="<?php echo $software_id ?>"><?php echo $software_name; ?></option>

4
agent/modals/calendar/calendar_edit.php
View File

@@ -7,8 +7,8 @@ $calendar_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM calendars WHERE calendar_id = $calendar_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
// Generate the HTML form content using output buffering.
ob_start();

8
agent/modals/calendar/calendar_event_add.php
View File

@@ -42,8 +42,8 @@
$sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$calendar_id = intval($row['calendar_id']);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
?>
<option <?php if ($config_default_calendar == $calendar_id) { echo "selected"; } ?> data-content="<i class='fa fa-circle mr-2' style='color:<?php echo $calendar_color; ?>;'></i> <?php echo $calendar_name; ?>" value="<?php echo $calendar_id; ?>"><?php echo $calendar_name; ?></option>
<?php } ?>
@@ -136,8 +136,8 @@
$sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$client_name = escapeHtml($row['client_name']);
$contact_email = escapeHtml($row['contact_email']);
?>
<option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>

24
agent/modals/calendar/calendar_event_edit.php
View File

@@ -7,15 +7,15 @@ $event_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id WHERE event_id = $event_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$event_title = nullable_htmlentities($row['event_title']);
$event_description = nullable_htmlentities($row['event_description']);
$event_location = nullable_htmlentities($row['event_location']);
$event_start = nullable_htmlentities($row['event_start']);
$event_end = nullable_htmlentities($row['event_end']);
$event_repeat = nullable_htmlentities($row['event_repeat']);
$event_title = escapeHtml($row['event_title']);
$event_description = escapeHtml($row['event_description']);
$event_location = escapeHtml($row['event_location']);
$event_start = escapeHtml($row['event_start']);
$event_end = escapeHtml($row['event_end']);
$event_repeat = escapeHtml($row['event_repeat']);
$calendar_id = intval($row['calendar_id']);
$calendar_name = nullable_htmlentities($row['calendar_name']);
$calendar_color = nullable_htmlentities($row['calendar_color']);
$calendar_name = escapeHtml($row['calendar_name']);
$calendar_color = escapeHtml($row['calendar_color']);
$client_id = intval($row['event_client_id']);
// Generate the HTML form content using output buffering.
@@ -64,8 +64,8 @@ ob_start();
$sql_calendars_select = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
while ($row = mysqli_fetch_assoc($sql_calendars_select)) {
$calendar_id_select = intval($row['calendar_id']);
$calendar_name_select = nullable_htmlentities($row['calendar_name']);
$calendar_color_select = nullable_htmlentities($row['calendar_color']);
$calendar_name_select = escapeHtml($row['calendar_name']);
$calendar_color_select = escapeHtml($row['calendar_color']);
?>
<option data-content="<i class='fa fa-circle mr-2' style='color:<?php echo $calendar_color_select; ?>;'></i> <?php echo $calendar_name_select; ?>"<?php if ($calendar_id == $calendar_id_select) { echo "selected"; } ?> value="<?php echo $calendar_id_select; ?>"><?php echo $calendar_name_select; ?></option>
@@ -159,8 +159,8 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
$contact_email_select = nullable_htmlentities($row['contact_email']);
$client_name_select = escapeHtml($row['client_name']);
$contact_email_select = escapeHtml($row['contact_email']);
?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>

4
agent/modals/certificate/certificate_add.php
View File

@@ -53,7 +53,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -96,7 +96,7 @@ ob_start();
$domains_sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id ORDER BY domain_name ASC");
while ($domain_row = mysqli_fetch_assoc($domains_sql)) {
$domain_id = intval($domain_row['domain_id']);
$domain_name = nullable_htmlentities($domain_row['domain_name']);
$domain_name = escapeHtml($domain_row['domain_name']);
echo "<option value=\"$domain_id\">$domain_name</option>";
}
?>

26
agent/modals/certificate/certificate_edit.php
View File

@@ -9,15 +9,15 @@ $certificate_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = $certificate_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_description = nullable_htmlentities($row['certificate_description']);
$certificate_domain = nullable_htmlentities($row['certificate_domain']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_description = escapeHtml($row['certificate_description']);
$certificate_domain = escapeHtml($row['certificate_domain']);
$certificate_domain_id = intval($row['certificate_domain_id']);
$certificate_issued_by = nullable_htmlentities($row['certificate_issued_by']);
$certificate_public_key = nullable_htmlentities($row['certificate_public_key']);
$certificate_notes = nullable_htmlentities($row['certificate_notes']);
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
$certificate_created_at = nullable_htmlentities($row['certificate_created_at']);
$certificate_issued_by = escapeHtml($row['certificate_issued_by']);
$certificate_public_key = escapeHtml($row['certificate_public_key']);
$certificate_notes = escapeHtml($row['certificate_notes']);
$certificate_expire = escapeHtml($row['certificate_expire']);
$certificate_created_at = escapeHtml($row['certificate_created_at']);
$client_id = intval($row['certificate_client_id']);
$history_sql = mysqli_query($mysqli, "SELECT * FROM certificate_history WHERE certificate_history_certificate_id = $certificate_id");
@@ -93,7 +93,7 @@ ob_start();
$domains_sql = mysqli_query($mysqli, "SELECT domain_id, domain_name FROM domains WHERE domain_client_id = $client_id");
while ($row = mysqli_fetch_assoc($domains_sql)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_name = escapeHtml($row['domain_name']);
?>
<option value="<?php echo $domain_id; ?>" <?php if ($certificate_domain_id == $domain_id) { echo "selected"; } ?>><?php echo $domain_name; ?></option>
@@ -171,10 +171,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($history_sql)) {
$certificate_modified_at = nullable_htmlentities($row['certificate_history_modified_at']);
$certificate_field = nullable_htmlentities($row['certificate_history_column']);
$certificate_before_value = nullable_htmlentities($row['certificate_history_old_value']);
$certificate_after_value = nullable_htmlentities($row['certificate_history_new_value']);
$certificate_modified_at = escapeHtml($row['certificate_history_modified_at']);
$certificate_field = escapeHtml($row['certificate_history_column']);
$certificate_before_value = escapeHtml($row['certificate_history_old_value']);
$certificate_after_value = escapeHtml($row['certificate_history_new_value']);
?>
<tr>
<td><?php echo $certificate_modified_at; ?></td>

4
agent/modals/client/client_add.php
View File

@@ -109,7 +109,7 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($referral_sql)) {
$referral = nullable_htmlentities($row['category_name']); ?>
$referral = escapeHtml($row['category_name']); ?>
<option><?php echo $referral; ?></option>
<?php } ?>
@@ -144,7 +144,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

6
agent/modals/client/client_bulk_add_ticket.php
View File

@@ -64,7 +64,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -97,7 +97,7 @@ ob_start();
);
while ($row = mysqli_fetch_assoc($sql)) {
$user_id = intval($row['user_id']);
$user_name = nullable_htmlentities($row['user_name']); ?>
$user_name = escapeHtml($row['user_name']); ?>
<option value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
<?php } ?>
</select>
@@ -120,7 +120,7 @@ ob_start();
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = nullable_htmlentities($row['project_name']); ?>
$project_name_select = escapeHtml($row['project_name']); ?>
<option value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
<?php } ?>

2
agent/modals/client/client_bulk_assign_tags.php
View File

@@ -41,7 +41,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/client/client_bulk_edit_referral.php
View File

@@ -33,7 +33,7 @@ ob_start();
<?php
$referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($referral_sql)) {
$referral = nullable_htmlentities($row['category_name']); ?>
$referral = escapeHtml($row['category_name']); ?>
<option><?php echo $referral; ?></option>
<?php } ?>

18
agent/modals/client/client_bulk_email.php
View File

@@ -28,20 +28,20 @@ ob_start();
<div class="form-group col-sm-6">
<select type="text" class="form-control select2" name="mail_from">
<option value="<?php echo nullable_htmlentities($config_mail_from_email); ?>">
<?php echo nullable_htmlentities("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_invoice_from_email); ?>">
<?php echo nullable_htmlentities("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_quote_from_email); ?>">
<?php echo nullable_htmlentities("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_ticket_from_email); ?>">
<?php echo nullable_htmlentities("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_mail_from_email); ?>">
<?php echo escapeHtml("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_invoice_from_email); ?>">
<?php echo escapeHtml("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_quote_from_email); ?>">
<?php echo escapeHtml("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_ticket_from_email); ?>">
<?php echo escapeHtml("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
</select>
</div>
<div class="form-group col-sm-6">
<input type="text" class="form-control" name="mail_from_name" placeholder="From Name" maxlength="255"
value="<?php echo nullable_htmlentities($config_mail_from_name); ?>">
value="<?php echo escapeHtml($config_mail_from_name); ?>">
</div>
</div>

2
agent/modals/client/client_credit_add.php
View File

@@ -73,7 +73,7 @@
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>

22
agent/modals/client/client_edit.php
View File

@@ -7,18 +7,18 @@ $client_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id $access_permission_query LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$client_is_lead = intval($row['client_lead']);
$client_type = nullable_htmlentities($row['client_type']);
$client_website = nullable_htmlentities($row['client_website']);
$client_referral = nullable_htmlentities($row['client_referral']);
$client_type = escapeHtml($row['client_type']);
$client_website = escapeHtml($row['client_website']);
$client_referral = escapeHtml($row['client_referral']);
$client_net_terms = intval($row['client_net_terms']);
$client_tax_id_number = nullable_htmlentities($row['client_tax_id_number']);
$client_abbreviation = nullable_htmlentities($row['client_abbreviation']);
$client_tax_id_number = escapeHtml($row['client_tax_id_number']);
$client_abbreviation = escapeHtml($row['client_abbreviation']);
$client_rate = floatval($row['client_rate']);
$client_notes = nullable_htmlentities($row['client_notes']);
$client_created_at = nullable_htmlentities($row['client_created_at']);
$client_archived_at = nullable_htmlentities($row['client_archived_at']);
$client_notes = escapeHtml($row['client_notes']);
$client_created_at = escapeHtml($row['client_created_at']);
$client_archived_at = escapeHtml($row['client_archived_at']);
// Client Tags
$client_tag_id_array = array();
@@ -123,7 +123,7 @@ ob_start();
$referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND (category_archived_at > '$client_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($referral_sql)) {
$referral = nullable_htmlentities($row['category_name']);
$referral = escapeHtml($row['category_name']);
?>
<option <?php if ($client_referral == $referral) {
echo "selected";
@@ -167,7 +167,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $client_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

6
agent/modals/contact/contact_add.php
View File

@@ -64,7 +64,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_client_select)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id_select == $client_id) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
<?php } ?>
@@ -170,7 +170,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_location_select)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?= $location_id ?>"><?= $location_name ?></option>
<?php } ?>
@@ -290,7 +290,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id = intval($row['tag_id']);
$tag_name = nullable_htmlentities($row['tag_name']);
$tag_name = escapeHtml($row['tag_name']);
?>
<option value="<?= $tag_id ?>"><?= $tag_name ?></option>
<?php } ?>

2
agent/modals/contact/contact_bulk_assign_location.php
View File

@@ -35,7 +35,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
<?php } ?>

2
agent/modals/contact/contact_bulk_assign_tags.php
View File

@@ -40,7 +40,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

18
agent/modals/contact/contact_bulk_email.php
View File

@@ -26,20 +26,20 @@ ob_start();
<div class="form-group col-sm-6">
<select type="text" class="form-control select2" name="mail_from">
<option value="<?php echo nullable_htmlentities($config_mail_from_email); ?>">
<?php echo nullable_htmlentities("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_invoice_from_email); ?>">
<?php echo nullable_htmlentities("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_quote_from_email); ?>">
<?php echo nullable_htmlentities("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo nullable_htmlentities($config_ticket_from_email); ?>">
<?php echo nullable_htmlentities("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_mail_from_email); ?>">
<?php echo escapeHtml("$config_mail_from_name - $config_mail_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_invoice_from_email); ?>">
<?php echo escapeHtml("$config_invoice_from_name - $config_invoice_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_quote_from_email); ?>">
<?php echo escapeHtml("$config_quote_from_name - $config_quote_from_email"); ?></option>
<option value="<?php echo escapeHtml($config_ticket_from_email); ?>">
<?php echo escapeHtml("$config_ticket_from_name - $config_ticket_from_email"); ?></option>
</select>
</div>
<div class="form-group col-sm-6">
<input type="text" class="form-control" name="mail_from_name" placeholder="From Name" maxlength="255"
value="<?php echo nullable_htmlentities($config_mail_from_name); ?>">
value="<?php echo escapeHtml($config_mail_from_name); ?>">
</div>
</div>

152
agent/modals/contact/contact_details.php
View File

@@ -17,38 +17,38 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_department = nullable_htmlentities($row['contact_department']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_pin = nullable_htmlentities($row['contact_pin']);
$client_name = escapeHtml($row['client_name']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_department = escapeHtml($row['contact_department']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_extension = escapeHtml($row['contact_extension']);
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$contact_photo = escapeHtml($row['contact_photo']);
$contact_pin = escapeHtml($row['contact_pin']);
$contact_initials = initials($contact_name);
$contact_notes = nullable_htmlentities($row['contact_notes']);
$contact_notes = escapeHtml($row['contact_notes']);
$contact_primary = intval($row['contact_primary']);
$contact_important = intval($row['contact_important']);
$contact_billing = intval($row['contact_billing']);
$contact_technical = intval($row['contact_technical']);
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
$contact_created_at = escapeHtml($row['contact_created_at']);
$contact_location_id = intval($row['contact_location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_country = nullable_htmlentities($row['location_country']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_name = escapeHtml($row['location_name']);
$location_country = escapeHtml($row['location_country']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_phone_display = empty($location_phone) ? "-" : $location_phone;
$auth_method = nullable_htmlentities($row['user_auth_method']);
$auth_method = escapeHtml($row['user_auth_method']);
$contact_client_id = intval($row['contact_client_id']);
// Related Assets Query - 1 to 1 relationship
@@ -115,12 +115,12 @@ $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
$contact_tag_id = intval($row['tag_id']);
$contact_tag_name = nullable_htmlentities($row['tag_name']);
$contact_tag_color = nullable_htmlentities($row['tag_color']);
$contact_tag_name = escapeHtml($row['tag_name']);
$contact_tag_color = escapeHtml($row['tag_color']);
if (empty($contact_tag_color)) {
$contact_tag_color = "dark";
}
$contact_tag_icon = nullable_htmlentities($row['tag_icon']);
$contact_tag_icon = escapeHtml($row['tag_icon']);
if (empty($contact_tag_icon)) {
$contact_tag_icon = "tag";
}
@@ -451,18 +451,18 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_related_assets)) {
$asset_id = intval($row['asset_id']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_type = escapeHtml($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_serial_display = empty($asset_serial) ? "-" : $asset_serial;
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
$asset_install_date = escapeHtml($row['asset_install_date']);
$asset_install_date_display = empty($asset_install_date) ? "-" : $asset_install_date;
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_status = escapeHtml($row['asset_status']);
$device_icon = getAssetIcon($asset_type);
@@ -471,12 +471,12 @@ ob_start();
$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
while ($row2 = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row2['tag_id']);
$asset_tag_name = nullable_htmlentities($row2['tag_name']);
$asset_tag_color = nullable_htmlentities($row2['tag_color']);
$asset_tag_name = escapeHtml($row2['tag_name']);
$asset_tag_color = escapeHtml($row2['tag_color']);
if (empty($asset_tag_color)) {
$asset_tag_color = "dark";
}
$asset_tag_icon = nullable_htmlentities($row2['tag_icon']);
$asset_tag_icon = escapeHtml($row2['tag_icon']);
if (empty($asset_tag_icon)) {
$asset_tag_icon = "tag";
}
@@ -543,22 +543,22 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
$credential_id = intval($row['credentials_credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_uri = escapeHtml($row['credential_uri']);
$credential_uri_display = empty($credential_uri) ? "-" : $credential_uri;
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
if (empty($credential_username)) {
$credential_username_display = "-";
} else {
$credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
}
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
@@ -609,15 +609,15 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
$ticket_status = nullable_htmlentities($row['ticket_status']);
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_priority = escapeHtml($row['ticket_priority']);
$ticket_status = escapeHtml($row['ticket_status']);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);
$ticket_created_at = escapeHtml($row['ticket_created_at']);
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
if (empty($ticket_updated_at)) {
if ($ticket_status == "Closed") {
@@ -647,7 +647,7 @@ ob_start();
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
}
} else {
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
$ticket_assigned_to_display = escapeHtml($row['user_name']);
}
?>
<tr>
@@ -687,10 +687,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
?>
<tr>
<td class="text-bold"><?= $recurring_ticket_subject ?></td>
@@ -723,11 +723,11 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_linked_software)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_version = nullable_htmlentities($row['software_version']);
$software_type = nullable_htmlentities($row['software_type']);
$software_key = nullable_htmlentities($row['software_key']);
$software_seats = nullable_htmlentities($row['software_seats']);
$software_name = escapeHtml($row['software_name']);
$software_version = escapeHtml($row['software_version']);
$software_type = escapeHtml($row['software_type']);
$software_key = escapeHtml($row['software_key']);
$software_seats = escapeHtml($row['software_seats']);
$seat_count = 0;
@@ -776,11 +776,11 @@ ob_start();
<?php
while ($row = mysqli_fetch_assoc($sql_linked_documents)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_created_by = nullable_htmlentities($row['user_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_created_by = escapeHtml($row['user_name']);
$document_created_at = escapeHtml($row['document_created_at']);
$document_updated_at = escapeHtml($row['document_updated_at']);
$linked_documents[] = $document_id;
?>
@@ -821,13 +821,13 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_linked_files)) {
$file_name = nullable_htmlentities($row['file_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_size = nullable_htmlentities($row['file_size']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_size = escapeHtml($row['file_size']);
$file_size_KB = round($file_size / 1024);
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
$file_created_at = nullable_htmlentities($row['file_created_at']);
$file_reference_name = escapeHtml($row['file_reference_name']);
$file_mime_type = escapeHtml($row['file_mime_type']);
$file_created_at = escapeHtml($row['file_created_at']);
$linked_files[] = intval($row['file_id']);
?>
@@ -864,10 +864,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($sql_related_notes)) {
$contact_note_type = nullable_htmlentities($row['contact_note_type']);
$contact_note = nullable_htmlentities($row['contact_note']);
$note_by = nullable_htmlentities($row['user_name']);
$contact_note_created_at = nullable_htmlentities($row['contact_note_created_at']);
$contact_note_type = escapeHtml($row['contact_note_type']);
$contact_note = escapeHtml($row['contact_note']);
$note_by = escapeHtml($row['user_name']);
$contact_note_created_at = escapeHtml($row['contact_note_created_at']);
$note_type_icon = isset($note_types_array[$contact_note_type]) ? $note_types_array[$contact_note_type] : 'fa-fw fa-sticky-note';
?>

36
agent/modals/contact/contact_edit.php
View File

@@ -14,27 +14,27 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['contact_client_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_title = nullable_htmlentities($row['contact_title']);
$contact_department = nullable_htmlentities($row['contact_department']);
$contact_extension = nullable_htmlentities($row['contact_extension']);
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_pin = nullable_htmlentities($row['contact_pin']);
$contact_photo = nullable_htmlentities($row['contact_photo']);
$contact_name = escapeHtml($row['contact_name']);
$contact_title = escapeHtml($row['contact_title']);
$contact_department = escapeHtml($row['contact_department']);
$contact_extension = escapeHtml($row['contact_extension']);
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
$contact_email = escapeHtml($row['contact_email']);
$contact_pin = escapeHtml($row['contact_pin']);
$contact_photo = escapeHtml($row['contact_photo']);
$contact_initials = initials($contact_name);
$contact_notes = nullable_htmlentities($row['contact_notes']);
$contact_notes = escapeHtml($row['contact_notes']);
$contact_primary = intval($row['contact_primary']);
$contact_important = intval($row['contact_important']);
$contact_billing = intval($row['contact_billing']);
$contact_technical = intval($row['contact_technical']);
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_created_at = escapeHtml($row['contact_created_at']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
$contact_location_id = intval($row['contact_location_id']);
$auth_method = nullable_htmlentities($row['user_auth_method']);
$auth_method = escapeHtml($row['user_auth_method']);
$contact_user_id = intval($row['contact_user_id']);
// Tags
@@ -177,8 +177,8 @@ ob_start();
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $contact_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = nullable_htmlentities($row['location_name']);
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_name_select = escapeHtml($row['location_name']);
$location_archived_at = escapeHtml($row['location_archived_at']);
if ($location_archived_at) {
$location_name_select_display = "($location_name_select) - ARCHIVED";
} else {
@@ -321,7 +321,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $contact_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

4
agent/modals/contact/contact_link_asset.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
ob_start();
@@ -46,7 +46,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_assets_select)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
?>
<option value="<?php echo $asset_id ?>"><?php echo $asset_name; ?></option>
<?php

4
agent/modals/contact/contact_link_credential.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -47,7 +47,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_credentials_select)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
?>
<option value="<?php echo $credential_id ?>"><?php echo $credential_name; ?></option>
<?php

4
agent/modals/contact/contact_link_document.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -50,7 +50,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_documents_select)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
?>
<option value="<?php echo $document_id ?>"><?php echo $document_name; ?></option>
<?php

6
agent/modals/contact/contact_link_file.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -52,8 +52,8 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>
<?php

4
agent/modals/contact/contact_link_service.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -49,7 +49,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_services_select)) {
$service_id = intval($row['service_id']);
$service_name = nullable_htmlentities($row['service_name']);
$service_name = escapeHtml($row['service_name']);
?>
<option value="<?php echo $service_id ?>"><?php echo $service_name; ?></option>
<?php

4
agent/modals/contact/contact_link_software.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts
");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Generate the HTML form content using output buffering.
@@ -51,7 +51,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_software_select)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
?>
<option value="<?php echo $software_id ?>"><?php echo $software_name; ?></option>
<?php

4
agent/modals/contact/contact_note_add.php
View File

@@ -6,7 +6,7 @@ $contact_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT contact_name FROM contacts WHERE contact_id = $contact_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
ob_start();
@@ -40,7 +40,7 @@ ob_start();
ORDER BY category_order ASC, category_name ASC
");
while ($row = mysqli_fetch_assoc($sql_contact_note_types_select)) {
$contact_note_type_select = nullable_htmlentities($row['category_name']);
$contact_note_type_select = escapeHtml($row['category_name']);
?>
<option><?= $contact_note_type_select ?></option>
<?php } ?>

10
agent/modals/credential/credential_add.php
View File

@@ -57,7 +57,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -170,7 +170,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id_select = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option
<?php if ($contact_id == $contact_id_select) { echo "selected"; } ?>
@@ -197,8 +197,8 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN locations on asset_location_id = location_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$asset_id_select = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_location = nullable_htmlentities($row['location_name']);
$asset_name = escapeHtml($row['asset_name']);
$asset_location = escapeHtml($row['location_name']);
$asset_display_string = $asset_name;
if (!empty($asset_location)) {
@@ -236,7 +236,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/credential/credential_bulk_assign_tags.php
View File

@@ -39,7 +39,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

28
agent/modals/credential/credential_edit.php
View File

@@ -10,18 +10,18 @@ $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $c
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['credential_client_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_uri_2 = nullable_htmlentities($row['credential_uri_2']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
$credential_uri_2 = escapeHtml($row['credential_uri_2']);
$credential_uri_link = sanitize_url($row['credential_uri']);
$credential_uri_2_link = sanitize_url($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_created_at = nullable_htmlentities($row['credential_created_at']);
$credential_archived_at = nullable_htmlentities($row['credential_archived_at']);
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_note = escapeHtml($row['credential_note']);
$credential_created_at = escapeHtml($row['credential_created_at']);
$credential_archived_at = escapeHtml($row['credential_archived_at']);
$credential_favorite = intval($row['credential_favorite']);
$credential_contact_id = intval($row['credential_contact_id']);
$credential_asset_id = intval($row['credential_asset_id']);
@@ -190,7 +190,7 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_name_select = escapeHtml($row['contact_name']);
?>
<option <?php if ($credential_contact_id == $contact_id_select) { echo "selected"; } ?> value="<?php echo $contact_id_select; ?>"><?php echo $contact_name_select; ?></option>
<?php } ?>
@@ -211,8 +211,8 @@ ob_start();
$sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, location_name FROM assets LEFT JOIN locations on asset_location_id = location_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id_select = intval($row['asset_id']);
$asset_name_select = nullable_htmlentities($row['asset_name']);
$asset_location_select = nullable_htmlentities($row['location_name']);
$asset_name_select = escapeHtml($row['asset_name']);
$asset_location_select = escapeHtml($row['location_name']);
$asset_select_display_string = $asset_name_select;
if (!empty($asset_location_select)) {
@@ -247,7 +247,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $credential_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

18
agent/modals/credential/credential_view.php
View File

@@ -10,21 +10,21 @@ $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $c
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['credential_client_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_uri = nullable_htmlentities($row['credential_uri']);
$credential_uri_2 = nullable_htmlentities($row['credential_uri_2']);
$credential_username = nullable_htmlentities(decryptLoginEntry($row['credential_username']));
$credential_password = nullable_htmlentities(decryptLoginEntry($row['credential_password']));
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_uri = escapeHtml($row['credential_uri']);
$credential_uri_2 = escapeHtml($row['credential_uri_2']);
$credential_username = escapeHtml(decryptLoginEntry($row['credential_username']));
$credential_password = escapeHtml(decryptLoginEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) {
$otp_display = "-";
} else {
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
}
$credential_note = nullable_htmlentities($row['credential_note']);
$credential_created_at = nullable_htmlentities($row['credential_created_at']);
$credential_note = escapeHtml($row['credential_note']);
$credential_created_at = escapeHtml($row['credential_created_at']);
enforceClientAccess();

4
agent/modals/document/document_add_file_relation.php
View File

@@ -25,8 +25,8 @@
WHERE file_client_id = $client_id ORDER BY folder_name ASC, file_name ASC");
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>

4
agent/modals/document/document_add_from_template.php
View File

@@ -34,7 +34,7 @@ ob_start();
$sql_document_templates = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_archived_at IS NULL ORDER BY document_template_name ASC");
while ($row = mysqli_fetch_assoc($sql_document_templates)) {
$document_template_id = intval($row['document_template_id']);
$document_template_name = nullable_htmlentities($row['document_template_name']);
$document_template_name = escapeHtml($row['document_template_name']);
?>
<option value="<?php echo $document_template_id ?>"><?php echo $document_template_name; ?></option>
<?php
@@ -76,7 +76,7 @@ ob_start();
$sql_folders = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_client_id = $client_id ORDER BY folder_name ASC");
while ($row = mysqli_fetch_assoc($sql_folders)) {
$folder_id = intval($row['folder_id']);
$folder_name = nullable_htmlentities($row['folder_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option <?php if (isset($_GET['folder_id']) && $_GET['folder_id'] == $folder_id) echo "selected"; ?> value="<?php echo $folder_id ?>"><?php echo $folder_name; ?></option>
<?php

2
agent/modals/document/document_bulk_move.php
View File

@@ -43,7 +43,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = array(
'folder_id' => intval($row['folder_id']),
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder' => intval($row['parent_folder']),
'children' => array()
);

6
agent/modals/document/document_edit.php
View File

@@ -9,9 +9,9 @@ $document_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_description = nullable_htmlentities($row['document_description']);
$document_content = nullable_htmlentities($row['document_content']);
$document_name = escapeHtml($row['document_name']);
$document_description = escapeHtml($row['document_description']);
$document_content = escapeHtml($row['document_content']);
$document_folder_id = intval($row['document_folder_id']);
$document_client_visible = intval($row['document_client_visible']);
$client_id = intval($row['document_client_id']);

2
agent/modals/document/document_edit_visibility.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$document_client_visible = intval($row['document_client_visible']);
$client_id = intval($row['document_client_id']);

4
agent/modals/document/document_link_asset.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -51,7 +51,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_assets_select)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
?>
<option value="<?= $asset_id ?>"><?= $asset_name ?></option>

4
agent/modals/document/document_link_contact.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -51,7 +51,7 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_contacts_select)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option value="<?= $contact_id ?>"><?= $contact_name ?></option>

6
agent/modals/document/document_link_file.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -53,8 +53,8 @@ ob_start();
");
while ($row = mysqli_fetch_assoc($sql_files_select)) {
$file_id = intval($row['file_id']);
$file_name = nullable_htmlentities($row['file_name']);
$folder_name = nullable_htmlentities($row['folder_name']);
$file_name = escapeHtml($row['file_name']);
$folder_name = escapeHtml($row['folder_name']);
?>
<option value="<?php echo $file_id ?>"><?php echo "$folder_name/$file_name"; ?></option>

4
agent/modals/document/document_link_software.php
View File

@@ -10,7 +10,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents
");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -52,7 +52,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_software_select)) {
$software_id = intval($row['software_id']);
$software_name = nullable_htmlentities($row['software_name']);
$software_name = escapeHtml($row['software_name']);
?>
<option value="<?= $software_id ?>"><?= $software_name ?></option>

6
agent/modals/document/document_move.php
View File

@@ -8,8 +8,8 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $docum
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_folder_id = nullable_htmlentities($row['document_folder_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_folder_id = escapeHtml($row['document_folder_id']);
$document_name = escapeHtml($row['document_name']);
enforceClientAccess();
@@ -45,7 +45,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = array(
'folder_id' => intval($row['folder_id']),
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder' => intval($row['parent_folder']),
'children' => array()
);

2
agent/modals/document/document_rename.php
View File

@@ -8,7 +8,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $docum
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
enforceClientAccess();

2
agent/modals/document/document_version_view.php
View File

@@ -15,7 +15,7 @@ $document_version_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM document_versions LEFT JOIN documents ON document_id = document_version_document_id WHERE document_version_id = $document_version_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_version_name = nullable_htmlentities($row['document_version_name']);
$document_version_name = escapeHtml($row['document_version_name']);
$document_version_content = $purifier->purify($row['document_version_content']);
$client_id = intval($row['document_client_id']);

2
agent/modals/document/document_view.php
View File

@@ -15,7 +15,7 @@ $document_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$document_content = $purifier->purify($row['document_content']);
$client_id = intval($row['document_client_id']);

10
agent/modals/domain/domain_add.php
View File

@@ -51,7 +51,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -98,7 +98,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>
@@ -119,7 +119,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>
@@ -140,7 +140,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>
@@ -161,7 +161,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
<?php } ?>

30
agent/modals/domain/domain_edit.php
View File

@@ -9,21 +9,21 @@ $domain_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = $domain_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_description = nullable_htmlentities($row['domain_description']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_description = escapeHtml($row['domain_description']);
$domain_expire = escapeHtml($row['domain_expire']);
$domain_registrar = intval($row['domain_registrar']);
$domain_webhost = intval($row['domain_webhost']);
$domain_dnshost = intval($row['domain_dnshost']);
$domain_mailhost = intval($row['domain_mailhost']);
$domain_ip = nullable_htmlentities($row['domain_ip']);
$domain_name_servers = nullable_htmlentities($row['domain_name_servers']);
$domain_mail_servers = nullable_htmlentities($row['domain_mail_servers']);
$domain_txt = nullable_htmlentities($row['domain_txt']);
$domain_raw_whois = nullable_htmlentities($row['domain_raw_whois']);
$domain_notes = nullable_htmlentities($row['domain_notes']);
$domain_created_at = nullable_htmlentities($row['domain_created_at']);
$domain_archived_at = nullable_htmlentities($row['domain_archived_at']);
$domain_ip = escapeHtml($row['domain_ip']);
$domain_name_servers = escapeHtml($row['domain_name_servers']);
$domain_mail_servers = escapeHtml($row['domain_mail_servers']);
$domain_txt = escapeHtml($row['domain_txt']);
$domain_raw_whois = escapeHtml($row['domain_raw_whois']);
$domain_notes = escapeHtml($row['domain_notes']);
$domain_created_at = escapeHtml($row['domain_created_at']);
$domain_archived_at = escapeHtml($row['domain_archived_at']);
$client_id = intval($row['domain_client_id']);
$history_sql = mysqli_query($mysqli, "SELECT * FROM domain_history WHERE domain_history_domain_id = $domain_id");
@@ -261,10 +261,10 @@ ob_start();
<tbody>
<?php
while ($row = mysqli_fetch_assoc($history_sql)) {
$domain_modified_at = nullable_htmlentities($row['domain_history_modified_at']);
$domain_field = nullable_htmlentities($row['domain_history_column']);
$domain_before_value = nullable_htmlentities($row['domain_history_old_value']);
$domain_after_value = nullable_htmlentities($row['domain_history_new_value']);
$domain_modified_at = escapeHtml($row['domain_history_modified_at']);
$domain_field = escapeHtml($row['domain_history_column']);
$domain_before_value = escapeHtml($row['domain_history_old_value']);
$domain_after_value = escapeHtml($row['domain_history_new_value']);
?>
<tr>
<td><?php echo $domain_modified_at; ?></td>

8
agent/modals/expense/expense_add.php
View File

@@ -53,7 +53,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
@@ -93,7 +93,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
@@ -138,7 +138,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -172,7 +172,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?= $client_id_select ?>"><?= $client_name ?></option>

2
agent/modals/expense/expense_bulk_edit_account.php
View File

@@ -34,7 +34,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");

2
agent/modals/expense/expense_bulk_edit_category.php
View File

@@ -40,7 +40,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

2
agent/modals/expense/expense_bulk_edit_client.php
View File

@@ -39,7 +39,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>

20
agent/modals/expense/expense_copy.php
View File

@@ -7,13 +7,13 @@ $expense_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);
@@ -71,7 +71,7 @@ ob_start();
$sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts)) {
$account_id_select = intval($row['account_id']);
$account_name_select = nullable_htmlentities($row['account_name']);
$account_name_select = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id_select");
@@ -109,7 +109,7 @@ ob_start();
$sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($expense_vendor_id == $vendor_id_select) { ?> selected <?php } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>
<?php
@@ -151,7 +151,7 @@ ob_start();
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id_select = intval($row['category_id']);
$category_name_select = nullable_htmlentities($row['category_name']);
$category_name_select = escapeHtml($row['category_name']);
?>
<option <?php if ($expense_category_id == $category_id_select) { ?> selected <?php } ?> value="<?php echo $category_id_select; ?>"><?php echo $category_name_select; ?></option>
<?php
@@ -179,7 +179,7 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
$client_name_select = escapeHtml($row['client_name']);
?>
<option <?php if ($expense_client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>

26
agent/modals/expense/expense_edit.php
View File

@@ -11,19 +11,19 @@ $sql = mysqli_query($mysqli, "SELECT * FROM expenses
);
$row = mysqli_fetch_assoc($sql);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);
$client_id = intval($row['expense_client_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$category_name = nullable_htmlentities($row['category_name']);
$vendor_name = escapeHtml($row['vendor_name']);
$category_name = escapeHtml($row['category_name']);
if ($client_id) {
enforceClientAccess();
@@ -82,9 +82,9 @@ ob_start();
$sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance, account_archived_at FROM accounts WHERE (account_archived_at > '$expense_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts)) {
$account_id_select = intval($row['account_id']);
$account_name_select = nullable_htmlentities($row['account_name']);
$account_name_select = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$account_archived_at = nullable_htmlentities($row['account_archived_at']);
$account_archived_at = escapeHtml($row['account_archived_at']);
if (empty($account_archived_at)) {
$account_archived_display = "";
} else {
@@ -127,7 +127,7 @@ ob_start();
$sql_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND (vendor_archived_at > '$expense_created_at' OR vendor_archived_at IS NULL) ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_select)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = nullable_htmlentities($row['vendor_name']);
$vendor_name_select = escapeHtml($row['vendor_name']);
?>
<option <?php if ($expense_vendor_id == $vendor_id_select) { ?> selected <?php } ?> value="<?php echo $vendor_id_select; ?>"><?php echo $vendor_name_select; ?></option>
<?php
@@ -172,7 +172,7 @@ ob_start();
$sql_select = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND (category_archived_at > '$expense_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_select)) {
$category_id_select = intval($row['category_id']);
$category_name_select = nullable_htmlentities($row['category_name']);
$category_name_select = escapeHtml($row['category_name']);
?>
<option <?php if ($expense_category_id == $category_id_select) { ?> selected <?php } ?> value="<?php echo $category_id_select; ?>"><?php echo $category_name_select; ?></option>
<?php
@@ -206,7 +206,7 @@ ob_start();
$sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id_select = intval($row['client_id']);
$client_name_select = nullable_htmlentities($row['client_name']);
$client_name_select = escapeHtml($row['client_name']);
?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?php echo $client_id_select; ?>"><?php echo $client_name_select; ?></option>

6
agent/modals/expense/expense_export.php
View File

@@ -30,7 +30,7 @@ ob_start();
$sql_accounts_filter = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql_accounts_filter)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
?>
<option <?php if ($account_filter == $account_id) { echo "selected"; } ?> value="<?= $account_id ?>"><?= $account_name ?></option>
<?php
@@ -54,7 +54,7 @@ ob_start();
$sql_vendors_filter = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = 0 ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors_filter)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
?>
<option <?php if ($vendor_filter == $vendor_id) { echo "selected"; } ?> value="<?= $vendor_id ?>"><?= $vendor_name ?></option>
<?php
@@ -78,7 +78,7 @@ ob_start();
$sql_categories_filter = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?= $category_id ?>"><?= $category_name ?></option>
<?php

12
agent/modals/expense/expense_refund.php
View File

@@ -7,13 +7,13 @@ $expense_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$expense_date = nullable_htmlentities($row['expense_date']);
$expense_date = escapeHtml($row['expense_date']);
$expense_amount = floatval($row['expense_amount']);
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
$expense_description = nullable_htmlentities($row['expense_description']);
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
$expense_reference = nullable_htmlentities($row['expense_reference']);
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
$expense_currency_code = escapeHtml($row['expense_currency_code']);
$expense_description = escapeHtml($row['expense_description']);
$expense_receipt = escapeHtml($row['expense_receipt']);
$expense_reference = escapeHtml($row['expense_reference']);
$expense_created_at = escapeHtml($row['expense_created_at']);
$expense_vendor_id = intval($row['expense_vendor_id']);
$expense_category_id = intval($row['expense_category_id']);
$expense_account_id = intval($row['expense_account_id']);

2
agent/modals/file/file_bulk_move.php
View File

@@ -70,7 +70,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = [
'folder_id' => (int)$row['folder_id'],
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder'=> (int)$row['parent_folder'],
'children' => []
];

4
agent/modals/file/file_link_asset.php
View File

@@ -28,7 +28,7 @@
);
while ($row = mysqli_fetch_assoc($sql_assets_select)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
?>
<option value="<?php echo $asset_id ?>"><?php echo $asset_name; ?></option>
@@ -50,7 +50,7 @@
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
$linked_assets[] = $asset_id;

8
agent/modals/file/file_move.php
View File

@@ -8,9 +8,9 @@ $sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $file_id LIMIT
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['file_client_id']);
$file_folder_id = nullable_htmlentities($row['file_folder_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_ext = nullable_htmlentities($row['file_ext']);
$file_folder_id = escapeHtml($row['file_folder_id']);
$file_name = escapeHtml($row['file_name']);
$file_ext = escapeHtml($row['file_ext']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";
} elseif ($file_ext == 'gz' || $file_ext == 'tar' || $file_ext == 'zip' || $file_ext == '7z' || $file_ext == 'rar') {
@@ -69,7 +69,7 @@ ob_start();
while ($row = mysqli_fetch_assoc($sql_all_folders)) {
$folders[$row['folder_id']] = array(
'folder_id' => intval($row['folder_id']),
'folder_name' => nullable_htmlentities($row['folder_name']),
'folder_name' => escapeHtml($row['folder_name']),
'parent_folder' => intval($row['parent_folder']),
'children' => array()
);

6
agent/modals/file/file_rename.php
View File

@@ -7,9 +7,9 @@ $sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $file_id LIMIT
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['file_client_id']);
$file_name = nullable_htmlentities($row['file_name']);
$file_description = nullable_htmlentities($row['file_description']);
$file_ext = nullable_htmlentities($row['file_description']);
$file_name = escapeHtml($row['file_name']);
$file_description = escapeHtml($row['file_description']);
$file_ext = escapeHtml($row['file_description']);
if ($file_ext == 'pdf') {
$file_icon = "file-pdf";

2
agent/modals/folder/folder_add.php
View File

@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
$client_id = intval($_GET['client_id'] ?? 0);
$current_folder_id = intval($_GET['current_folder_id'] ?? 0);
$folder_name = nullable_htmlentities(getFieldByID('folders', $current_folder_id, 'folder_name') ?? '/');
$folder_name = escapeHtml(getFieldByID('folders', $current_folder_id, 'folder_name') ?? '/');
enforceClientAccess();

2
agent/modals/folder/folder_rename.php
View File

@@ -7,7 +7,7 @@ $folder_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_id = $folder_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$folder_name = nullable_htmlentities($row['folder_name']);
$folder_name = escapeHtml($row['folder_name']);
$client_id = intval($row['folder_client_id']);
enforceClientAccess();

4
agent/modals/invoice/invoice_add.php
View File

@@ -35,7 +35,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>
<option value="<?php echo $client_id_select; ?>"><?php echo "$client_name"; ?></option>
@@ -71,7 +71,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

6
agent/modals/invoice/invoice_add_ticket.php
View File

@@ -20,10 +20,10 @@
</thead>
<?php while ($row = mysqli_fetch_assoc($sql_tickets_billable)) {
$ticket_id = intval($row['ticket_id']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_number = intval($row['ticket_number']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_status = nullable_htmlentities($row['ticket_status']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_status = escapeHtml($row['ticket_status']);
switch ($ticket_status) {
case 'Closed':

2
agent/modals/invoice/invoice_bulk_edit_category.php
View File

@@ -35,7 +35,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

4
agent/modals/invoice/invoice_copy.php
View File

@@ -7,9 +7,9 @@ $invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$client_id = intval($row['invoice_client_id']);
enforceClientAccess();

14
agent/modals/invoice/invoice_edit.php
View File

@@ -7,16 +7,16 @@ $invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
$invoice_date = nullable_htmlentities($row['invoice_date']);
$invoice_due = nullable_htmlentities($row['invoice_due']);
$invoice_scope = escapeHtml($row['invoice_scope']);
$invoice_date = escapeHtml($row['invoice_date']);
$invoice_due = escapeHtml($row['invoice_due']);
$invoice_discount = floatval($row['invoice_discount_amount']);
$invoice_created_at = nullable_htmlentities($row['invoice_created_at']);
$invoice_created_at = escapeHtml($row['invoice_created_at']);
$category_id = intval($row['invoice_category_id']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
enforceClientAccess();
@@ -69,7 +69,7 @@ ob_start();
$sql_income_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql_income_category)) {
$category_id_select = intval($row['category_id']);
$category_name_select = nullable_htmlentities($row['category_name']);
$category_name_select = escapeHtml($row['category_name']);
?>
<option <?php if ($category_id == $category_id_select) {
echo "selected";

8
agent/modals/invoice/invoice_item_edit.php
View File

@@ -6,11 +6,11 @@ $item_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoice_items LEFT JOIN invoices ON invoice_id = item_invoice_id WHERE item_id = $item_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$item_name = nullable_htmlentities($row['item_name']);
$item_description = nullable_htmlentities($row['item_description']);
$item_name = escapeHtml($row['item_name']);
$item_description = escapeHtml($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_created_at = nullable_htmlentities($row['item_created_at']);
$item_created_at = escapeHtml($row['item_created_at']);
$tax_id = intval($row['item_tax_id']);
$product_id = intval($row['item_product_id']);
$client_id = intval($row['invoice_client_id']);
@@ -88,7 +88,7 @@ ob_start();
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id_select = intval($row['tax_id']);
$tax_name = nullable_htmlentities($row['tax_name']);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);
?>
<option <?php if ($tax_id_select == $tax_id) { echo "selected"; } ?> value="<?php echo $tax_id_select; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>

2
agent/modals/invoice/invoice_recurring_add.php
View File

@@ -7,7 +7,7 @@ $invoice_id = intval($_GET['invoice_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);

6
agent/modals/location/location_add.php
View File

@@ -58,7 +58,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
<?php } ?>
@@ -174,7 +174,7 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id = $row['contact_id'];
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
?>
<option value="<?php echo $contact_id; ?>"><?php echo $contact_name; ?></option>
<?php } ?>
@@ -249,7 +249,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

2
agent/modals/location/location_bulk_assign_tags.php
View File

@@ -39,7 +39,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
<?php } ?>

38
agent/modals/location/location_edit.php
View File

@@ -7,23 +7,23 @@ $location_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $location_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$location_name = nullable_htmlentities($row['location_name']);
$location_description = nullable_htmlentities($row['location_description']);
$location_country = nullable_htmlentities($row['location_country']);
$location_address = nullable_htmlentities($row['location_address']);
$location_city = nullable_htmlentities($row['location_city']);
$location_state = nullable_htmlentities($row['location_state']);
$location_zip = nullable_htmlentities($row['location_zip']);
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
$location_name = escapeHtml($row['location_name']);
$location_description = escapeHtml($row['location_description']);
$location_country = escapeHtml($row['location_country']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);
$location_zip = escapeHtml($row['location_zip']);
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
//$location_extension = intval($row['location_extension']);
$location_fax_country_code = nullable_htmlentities($row['location_fax_country_code']);
$location_fax = nullable_htmlentities(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
$location_hours = nullable_htmlentities($row['location_hours']);
$location_photo = nullable_htmlentities($row['location_photo']);
$location_notes = nullable_htmlentities($row['location_notes']);
$location_created_at = nullable_htmlentities($row['location_created_at']);
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
$location_fax_country_code = escapeHtml($row['location_fax_country_code']);
$location_fax = escapeHtml(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
$location_hours = escapeHtml($row['location_hours']);
$location_photo = escapeHtml($row['location_photo']);
$location_notes = escapeHtml($row['location_notes']);
$location_created_at = escapeHtml($row['location_created_at']);
$location_archived_at = escapeHtml($row['location_archived_at']);
$location_contact_id = intval($row['location_contact_id']);
$client_id = intval($row['location_client_id']);
$location_primary = intval($row['location_primary']);
@@ -187,8 +187,8 @@ ob_start();
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE (contact_archived_at > '$location_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_archived_at ASC, contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = nullable_htmlentities($row['contact_name']);
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
$contact_name_select = escapeHtml($row['contact_name']);
$contact_archived_at = escapeHtml($row['contact_archived_at']);
if (empty($contact_archived_at)) {
$contact_archived_display = "";
} else {
@@ -268,7 +268,7 @@ ob_start();
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = nullable_htmlentities($row['tag_name']);
$tag_name_select = escapeHtml($row['tag_name']);
?>
<option value="<?php echo $tag_id_select; ?>" <?php if (in_array($tag_id_select, $location_tag_id_array)) { echo "selected"; } ?>><?php echo $tag_name_select; ?></option>
<?php } ?>

4
agent/modals/network/network_add.php
View File

@@ -57,7 +57,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id_select = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
<?php } ?>
@@ -81,7 +81,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$location_id_select = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option <?php if ($location_id == $location_id_select) { echo "selected"; } ?> value="<?php echo $location_id_select; ?>"><?php echo $location_name; ?></option>

18
agent/modals/network/network_edit.php
View File

@@ -9,15 +9,15 @@ $network_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $network_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$network_name = nullable_htmlentities($row['network_name']);
$network_description = nullable_htmlentities($row['network_description']);
$network_name = escapeHtml($row['network_name']);
$network_description = escapeHtml($row['network_description']);
$network_vlan = intval($row['network_vlan']);
$network = nullable_htmlentities($row['network']);
$network_gateway = nullable_htmlentities($row['network_gateway']);
$network_primary_dns = nullable_htmlentities($row['network_primary_dns']);
$network_secondary_dns = nullable_htmlentities($row['network_secondary_dns']);
$network_dhcp_range = nullable_htmlentities($row['network_dhcp_range']);
$network_notes = nullable_htmlentities($row['network_notes']);
$network = escapeHtml($row['network']);
$network_gateway = escapeHtml($row['network_gateway']);
$network_primary_dns = escapeHtml($row['network_primary_dns']);
$network_secondary_dns = escapeHtml($row['network_secondary_dns']);
$network_dhcp_range = escapeHtml($row['network_dhcp_range']);
$network_notes = escapeHtml($row['network_notes']);
$network_location_id = intval($row['network_location_id']);
$client_id = intval($row['network_client_id']);
@@ -72,7 +72,7 @@ ob_start();
$locations_sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id");
while ($row = mysqli_fetch_assoc($locations_sql)) {
$location_id = intval($row['location_id']);
$location_name = nullable_htmlentities($row['location_name']);
$location_name = escapeHtml($row['location_name']);
?>
<option value="<?= $location_id ?>" <?php if ($location_id == $network_location_id) { echo "selected"; } ?>>
<?= $location_name ?>

2
agent/modals/payment/invoice_apply_credit.php
View File

@@ -9,7 +9,7 @@ $sql = mysqli_query($mysqli, "SELECT invoice_prefix, invoice_number, invoice_cli
");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);

16
agent/modals/payment/payment_add.php
View File

@@ -15,14 +15,14 @@ $sql = mysqli_query(
$row = mysqli_fetch_assoc($sql);
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$client_name = escapeHtml($row['client_name']);
$client_currency_code = escapeHtml($row['client_currency_code']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
//Add up all the payments for the invoice and get the total amount paid to the invoice
@@ -95,9 +95,9 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$account_currency = nullable_htmlentities($row['account_currency_code']);
$account_currency = escapeHtml($row['account_currency_code']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
$row = mysqli_fetch_assoc($sql_payments);
@@ -138,7 +138,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$payment_method_name = nullable_htmlentities($row['payment_method_name']);
$payment_method_name = escapeHtml($row['payment_method_name']);
?>
<option <?php if ($config_default_payment_method == $payment_method_name) { echo "selected"; } ?>><?php echo $payment_method_name; ?></option>

12
agent/modals/payment/payment_bulk_add.php
View File

@@ -12,10 +12,10 @@ $sql = mysqli_query(
);
$row = mysqli_fetch_assoc($sql);
$client_name = nullable_htmlentities($row['client_name']);
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$client_name = escapeHtml($row['client_name']);
$client_currency_code = escapeHtml($row['client_currency_code']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
//Add up all the payments for the invoice and get the total amount paid to the invoice
$sql_invoice_amounts = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS invoice_amounts FROM invoices WHERE invoice_client_id = $client_id AND invoice_status != 'Draft' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable'");
@@ -98,7 +98,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
@@ -140,7 +140,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$payment_method_name = nullable_htmlentities($row['payment_method_name']);
$payment_method_name = escapeHtml($row['payment_method_name']);
?>
<option <?php if ($config_default_payment_method == $payment_method_name) { echo "selected"; } ?>><?php echo $payment_method_name; ?></option>

10
agent/modals/payment/payment_edit.php
View File

@@ -7,10 +7,10 @@ $payment_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM payments LEFT JOIN invoices ON invoice_id = payment_invoice_id WHERE payment_id = $payment_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$payment_date = nullable_htmlentities($row['payment_date']);
$payment_method = nullable_htmlentities($row['payment_method']);
$payment_date = escapeHtml($row['payment_date']);
$payment_method = escapeHtml($row['payment_method']);
$payment_amount = floatval($row['payment_amount']);
$payment_reference = nullable_htmlentities($row['payment_reference']);
$payment_reference = escapeHtml($row['payment_reference']);
$payment_account_id = intval($row['payment_account_id']);
$client_id = intval($row['invoice_client_id']);
@@ -75,7 +75,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = nullable_htmlentities($row['account_name']);
$account_name = escapeHtml($row['account_name']);
$opening_balance = floatval($row['opening_balance']);
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
@@ -117,7 +117,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$payment_method_name = nullable_htmlentities($row['payment_method_name']);
$payment_method_name = escapeHtml($row['payment_method_name']);
?>
<option <?php if ($payment_method == $payment_method_name) { echo "selected"; } ?>><?= $payment_method_name ?></option>

4
agent/modals/payment/payment_saved_method_add.php
View File

@@ -7,7 +7,7 @@ $invoice_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']);
$client_id = intval($row['invoice_client_id']);
@@ -44,7 +44,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id ORDER BY saved_payment_description ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$saved_payment_id = intval($row['saved_payment_id']);
$saved_payment_description = nullable_htmlentities($row['saved_payment_description']);
$saved_payment_description = escapeHtml($row['saved_payment_description']);
?>
<option value="<?= $saved_payment_id ?>"><?= $saved_payment_description ?></option>

6
agent/modals/product/product_add.php
View File

@@ -2,7 +2,7 @@
require_once '../../../includes/modal_header.php';
$type = nullable_htmlentities($_GET['type'] ?? '');
$type = escapeHtml($_GET['type'] ?? '');
if ($type == 'product') {
$type_icon = "fa-box-open";
} else {
@@ -70,7 +70,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
@@ -114,7 +114,7 @@ ob_start();
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id = intval($row['tax_id']);
$tax_name = nullable_htmlentities($row['tax_name']);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);
?>
<option value="<?php echo $tax_id; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>

2
agent/modals/product/product_bulk_edit_category.php
View File

@@ -35,7 +35,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

16
agent/modals/product/product_edit.php
View File

@@ -7,13 +7,13 @@ $product_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM products WHERE product_id = $product_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$product_name = nullable_htmlentities($row['product_name']);
$product_type = nullable_htmlentities($row['product_type']);
$product_description = nullable_htmlentities($row['product_description']);
$product_code = nullable_htmlentities($row['product_code']);
$product_location = nullable_htmlentities($row['product_location']);
$product_name = escapeHtml($row['product_name']);
$product_type = escapeHtml($row['product_type']);
$product_description = escapeHtml($row['product_description']);
$product_code = escapeHtml($row['product_code']);
$product_location = escapeHtml($row['product_location']);
$product_price = floatval($row['product_price']);
$product_created_at = nullable_htmlentities($row['product_created_at']);
$product_created_at = escapeHtml($row['product_created_at']);
$category_id = intval($row['product_category_id']);
$product_tax_id = intval($row['product_tax_id']);
@@ -54,7 +54,7 @@ ob_start();
$sql_select = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$product_created_at' OR category_archived_at IS NULL)");
while ($row = mysqli_fetch_assoc($sql_select)) {
$category_id_select = intval($row['category_id']);
$category_name_select = nullable_htmlentities($row['category_name']);
$category_name_select = escapeHtml($row['category_name']);
?>
<option <?php if ($category_id == $category_id_select) { echo "selected"; } ?> value="<?php echo $category_id_select; ?>"><?php echo $category_name_select; ?></option>
<?php
@@ -97,7 +97,7 @@ ob_start();
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$product_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id_select = intval($row['tax_id']);
$tax_name = nullable_htmlentities($row['tax_name']);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);
?>
<option <?php if ($tax_id_select == $product_tax_id) { echo "selected"; } ?> value="<?php echo $tax_id_select; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>

Some files were not shown because too many files have changed in this diff Show More