AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-24 09:20:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:10:45 -04:00
parent d62b6e2ae7
commit 7bc47a58fe
338 changed files with 3057 additions and 3057 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
agent/modals/service/service_add.php
View File

@@ -60,7 +60,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']); ?>
$client_name = escapeHtml($row['client_name']); ?>
<option <?php if ($client_id == isset($_GET['client'])) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
<?php } ?>
@@ -141,7 +141,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
echo "<option value=\"$contact_id\">$contact_name</option>";
}
?>
@@ -155,7 +155,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
echo "<option value=\"$vendor_id\">$vendor_name</option>";
}
?>
@@ -169,7 +169,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
echo "<option value=\"$document_id\">$document_name</option>";
}
?>
@@ -189,7 +189,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_name = escapeHtml($row['asset_name']);
echo "<option value=\"$asset_id\">$asset_name</option>";
}
?>
@@ -203,7 +203,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_archived_at IS NULL AND credential_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
echo "<option value=\"$credential_id\">$credential_name</option>";
}
?>
@@ -217,7 +217,7 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_name = escapeHtml($row['domain_name']);
echo "<option value=\"$domain_id\">$domain_name</option>";
}
?>
@@ -231,8 +231,8 @@ ob_start();
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_archived_at IS NULL AND certificate_client_id = $client_id");
while ($row = mysqli_fetch_assoc($sql)) {
$cert_id = intval($row['certificate_id']);
$cert_name = nullable_htmlentities($row['certificate_name']);
$cert_domain = nullable_htmlentities($row['certificate_domain']);
$cert_name = escapeHtml($row['certificate_name']);
$cert_domain = escapeHtml($row['certificate_domain']);
echo "<option value=\"$cert_id\">$cert_name ($cert_domain)</option>";
}
?>

42
agent/modals/service/service_details.php
View File

@@ -6,15 +6,15 @@ $service_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM services WHERE service_id = $service_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$service_name = nullable_htmlentities($row['service_name']);
$service_description = nullable_htmlentities($row['service_description']);
$service_category = nullable_htmlentities($row['service_category']);
$service_importance = nullable_htmlentities($row['service_importance']);
$service_backup = nullable_htmlentities($row['service_backup']);
$service_notes = nullable_htmlentities($row['service_notes']);
$service_created_at = nullable_htmlentities($row['service_created_at']);
$service_updated_at = nullable_htmlentities($row['service_updated_at']);
$service_review_due = nullable_htmlentities($row['service_review_due']);
$service_name = escapeHtml($row['service_name']);
$service_description = escapeHtml($row['service_description']);
$service_category = escapeHtml($row['service_category']);
$service_importance = escapeHtml($row['service_importance']);
$service_backup = escapeHtml($row['service_backup']);
$service_notes = escapeHtml($row['service_notes']);
$service_created_at = escapeHtml($row['service_created_at']);
$service_updated_at = escapeHtml($row['service_updated_at']);
$service_review_due = escapeHtml($row['service_review_due']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();
@@ -121,8 +121,8 @@ ob_start();
mysqli_data_seek($sql_assets, 0);
while ($row = mysqli_fetch_assoc($sql_assets)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$ip = !empty($row['interface_ip']) ? '(' . nullable_htmlentities($row['interface_ip']) . ')' : '';
$asset_name = escapeHtml($row['asset_name']);
$ip = !empty($row['interface_ip']) ? '(' . escapeHtml($row['interface_ip']) . ')' : '';
echo "<li><a class='ajax-modal' href='#' data-modal-size='lg' data-modal-url='modals/asset/asset_details.php?id=$asset_id'>$asset_name</a>$ip</li>";
}
echo "</ul>";
@@ -136,7 +136,7 @@ ob_start();
mysqli_data_seek($sql_assets, 0);
while ($row = mysqli_fetch_assoc($sql_assets)) {
if (!empty($row['network_name'])) {
$network_data = nullable_htmlentities($row["network_name"]) . ':' . nullable_htmlentities($row["network_vlan"]);
$network_data = escapeHtml($row["network_name"]) . ':' . escapeHtml($row["network_vlan"]);
$networks[] = $network_data;
}
}
@@ -161,7 +161,7 @@ ob_start();
mysqli_data_seek($sql_assets, 0);
while ($row = mysqli_fetch_assoc($sql_assets)) {
if (!empty($row['location_name'])) {
$location_names[] = nullable_htmlentities($row['location_name']);
$location_names[] = escapeHtml($row['location_name']);
}
}
$location_names = array_unique($location_names);
@@ -182,7 +182,7 @@ ob_start();
mysqli_data_seek($sql_domains, 0);
while ($row = mysqli_fetch_assoc($sql_domains)) {
if (!empty($row['domain_name'])) {
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_name = escapeHtml($row['domain_name']);
echo "<li><a href='domains.php?client_id=$client_id&q=$domain_name'>$domain_name</a></li>";
}
}
@@ -197,8 +197,8 @@ ob_start();
mysqli_data_seek($sql_certificates, 0);
while ($row = mysqli_fetch_assoc($sql_certificates)) {
if (!empty($row['certificate_name'])) {
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_domain = nullable_htmlentities($row['certificate_domain']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_domain = escapeHtml($row['certificate_domain']);
echo "<li><a href='certificates.php?client_id=$client_id&q=$certificate_name'>$certificate_name ($certificate_domain)</a></li>";
}
}
@@ -222,7 +222,7 @@ ob_start();
mysqli_data_seek($sql_vendors, 0);
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_name = escapeHtml($row['vendor_name']);
echo "<li><a class='ajax-modal' href='#' data-modal-size='lg' data-modal-url='modals/vendor/vendor_details.php?id=$vendor_id'>$vendor_name</a></li>";
}
echo "</ul>";
@@ -236,7 +236,7 @@ ob_start();
mysqli_data_seek($sql_contacts, 0);
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_name = escapeHtml($row['contact_name']);
echo "<li><a href='#' class='ajax-modal' data-modal-size='lg' data-modal-url='modals/contact/contact_details.php?id=$contact_id'>$contact_name</a></li>";
}
echo "</ul>";
@@ -250,7 +250,7 @@ ob_start();
// Credentials linked to assets
mysqli_data_seek($sql_assets, 0);
while ($row = mysqli_fetch_assoc($sql_assets)) {
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
if (!empty($credential_name)) {
echo "<li><a href='credentials.php?client_id=$client_id&q=$credential_name'>$credential_name</a></li>";
}
@@ -258,7 +258,7 @@ ob_start();
// Explicitly linked credentials
mysqli_data_seek($sql_credentials, 0);
while ($row = mysqli_fetch_assoc($sql_credentials)) {
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_name = escapeHtml($row['credential_name']);
if (!empty($credential_name)) {
echo "<li><a href='credentials.php?client_id=$client_id&q=$credential_name'>$credential_name</a></li>";
}
@@ -300,7 +300,7 @@ ob_start();
mysqli_data_seek($sql_docs, 0);
while ($row = mysqli_fetch_assoc($sql_docs)) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
echo "<li><a class='ajax-modal' href='#' data-modal-size='lg' data-modal-url='modals/document/document_view.php?id=$document_id'>$document_name</a></li>";
}
echo "</ul>";

32
agent/modals/service/service_edit.php
View File

@@ -7,15 +7,15 @@ $service_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM services WHERE service_id = $service_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$service_name = nullable_htmlentities($row['service_name']);
$service_description = nullable_htmlentities($row['service_description']);
$service_category = nullable_htmlentities($row['service_category']);
$service_importance = nullable_htmlentities($row['service_importance']);
$service_backup = nullable_htmlentities($row['service_backup']);
$service_notes = nullable_htmlentities($row['service_notes']);
$service_created_at = nullable_htmlentities($row['service_created_at']);
$service_updated_at = nullable_htmlentities($row['service_updated_at']);
$service_review_due = nullable_htmlentities($row['service_review_due']);
$service_name = escapeHtml($row['service_name']);
$service_description = escapeHtml($row['service_description']);
$service_category = escapeHtml($row['service_category']);
$service_importance = escapeHtml($row['service_importance']);
$service_backup = escapeHtml($row['service_backup']);
$service_notes = escapeHtml($row['service_notes']);
$service_created_at = escapeHtml($row['service_created_at']);
$service_updated_at = escapeHtml($row['service_updated_at']);
$service_review_due = escapeHtml($row['service_review_due']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();
@@ -195,7 +195,7 @@ ob_start();
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$contact_id = intval($row_all['contact_id']);
$contact_name = nullable_htmlentities($row_all['contact_name']);
$contact_name = escapeHtml($row_all['contact_name']);
if (in_array($contact_id, $selected_ids)) {
echo "<option value=\"$contact_id\" selected>$contact_name</option>";
@@ -217,7 +217,7 @@ ob_start();
$sql_all = mysqli_query($mysqli, "SELECT * FROM vendors WHERE (vendor_archived_at > '$service_created_at' OR vendor_archived_at IS NULL) AND vendor_client_id = $client_id");
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$vendor_id = intval($row_all['vendor_id']);
$vendor_name = nullable_htmlentities($row_all['vendor_name']);
$vendor_name = escapeHtml($row_all['vendor_name']);
if (in_array($vendor_id, $selected_ids)) {
echo "<option value=\"$vendor_id\" selected>$vendor_name</option>";
@@ -239,7 +239,7 @@ ob_start();
$sql_all = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id");
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$document_id = intval($row_all['document_id']);
$document_name = nullable_htmlentities($row_all['document_name']);
$document_name = escapeHtml($row_all['document_name']);
if (in_array($document_id, $selected_ids)) {
echo "<option value=\"$document_id\" selected>$document_name</option>";
@@ -269,7 +269,7 @@ ob_start();
$sql_all = mysqli_query($mysqli, "SELECT * FROM assets WHERE (asset_archived_at > '$service_created_at' OR asset_archived_at IS NULL) AND asset_client_id = $client_id");
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$asset_id = intval($row_all['asset_id']);
$asset_name = nullable_htmlentities($row_all['asset_name']);
$asset_name = escapeHtml($row_all['asset_name']);
if (in_array($asset_id, $selected_ids)) {
echo "<option value=\"$asset_id\" selected>$asset_name</option>";
@@ -291,7 +291,7 @@ ob_start();
$sql_all = mysqli_query($mysqli, "SELECT * FROM credentials WHERE (credential_archived_at > '$service_created_at' OR credential_archived_at IS NULL) AND credential_client_id = $client_id");
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$credential_id = intval($row_all['credential_id']);
$credential_name = nullable_htmlentities($row_all['credential_name']);
$credential_name = escapeHtml($row_all['credential_name']);
if (in_array($credential_id, $selected_ids)) {
echo "<option value=\"$credential_id\" selected>$credential_name</option>";
@@ -313,7 +313,7 @@ ob_start();
$sql_all = mysqli_query($mysqli, "SELECT * FROM domains WHERE (domain_archived_at > '$service_created_at' OR domain_archived_at IS NULL) AND domain_client_id = $client_id");
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$domain_id = intval($row_all['domain_id']);
$domain_name = nullable_htmlentities($row_all['domain_name']);
$domain_name = escapeHtml($row_all['domain_name']);
if (in_array($domain_id, $selected_ids)) {
echo "<option value=\"$domain_id\" selected>$domain_name</option>";
@@ -335,7 +335,7 @@ ob_start();
$sql_all = mysqli_query($mysqli, "SELECT * FROM certificates WHERE (certificate_archived_at > '$service_created_at' OR certificate_archived_at IS NULL) AND certificate_client_id = $client_id");
while ($row_all = mysqli_fetch_assoc($sql_all)) {
$cert_id = intval($row_all['certificate_id']);
$cert_name = nullable_htmlentities($row_all['certificate_name']);
$cert_name = escapeHtml($row_all['certificate_name']);
if (in_array($cert_id, $selected_ids)) {
echo "<option value=\"$cert_id\" selected>$cert_name</option>";