AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:10:45 -04:00
parent d62b6e2ae7
commit 7bc47a58fe
338 changed files with 3057 additions and 3057 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
agent/reports/budget.php
View File

@@ -66,7 +66,7 @@ $monthlyTotals = array_fill(1, 12, 0); // Initialize monthly totals for each mo
if ($categories->num_rows > 0) {
while($category = $categories->fetch_assoc()) {
echo "<tr>";
echo "<td>" . nullable_htmlentities($category['category_name']) . "</td>";
echo "<td>" . escapeHtml($category['category_name']) . "</td>";
$categoryTotal = 0;
for ($month = 1; $month <= 12; $month++) {
// Fetch the monthly budget for this category for 2022

20
agent/reports/client_ticket_time_detail.php
View File

@@ -123,7 +123,7 @@ $result = $stmt->get_result();
<div class="card-header bg-dark py-2">
<h3 class="card-title mt-2">
<i class="fas fa-fw fa-life-ring mr-2"></i>
Client Time Detail Audit Report (<?php echo nullable_htmlentities($from); ?> to <?php echo nullable_htmlentities($to); ?>)
Client Time Detail Audit Report (<?php echo escapeHtml($from); ?> to <?php echo escapeHtml($to); ?>)
<?php if ($billable_only) { ?>
<span class="badge badge-success ml-2">Billable Only</span>
<?php } ?>
@@ -141,12 +141,12 @@ $result = $stmt->get_result();
<div class="row">
<div class="col-md-3 mb-2">
<label class="mb-1">From</label>
<input type="date" class="form-control" name="from" value="<?php echo nullable_htmlentities($from); ?>">
<input type="date" class="form-control" name="from" value="<?php echo escapeHtml($from); ?>">
</div>
<div class="col-md-3 mb-2">
<label class="mb-1">To</label>
<input type="date" class="form-control" name="to" value="<?php echo nullable_htmlentities($to); ?>">
<input type="date" class="form-control" name="to" value="<?php echo escapeHtml($to); ?>">
</div>
<div class="col-md-3 mb-2">
@@ -235,12 +235,12 @@ $result = $stmt->get_result();
$had_rows = true;
$client_id = (int)$r['client_id'];
$client_name_html = nullable_htmlentities($r['client_name']);
$client_name_html = escapeHtml($r['client_name']);
$ticket_id = (int)$r['ticket_id'];
$ticket_prefix = nullable_htmlentities($r['ticket_prefix']);
$ticket_prefix = escapeHtml($r['ticket_prefix']);
$ticket_number = (int)$r['ticket_number'];
$ticket_subject_html = nullable_htmlentities($r['ticket_subject']);
$ticket_subject_html = escapeHtml($r['ticket_subject']);
$reply_created_at = $r['ticket_reply_created_at'];
$reply_seconds = (int)$r['reply_time_seconds'];
@@ -254,7 +254,7 @@ $result = $stmt->get_result();
$reply_content_clean = strip_tags($reply_content_raw);
$reply_content_clean = str_replace(["\r\n", "\r"], "\n", $reply_content_clean);
$reply_content_clean = preg_replace("/\n{3,}/", "\n\n", $reply_content_clean);
$reply_content_html = nl2br(nullable_htmlentities(trim($reply_content_clean)));
$reply_content_html = nl2br(escapeHtml(trim($reply_content_clean)));
// Close out previous client if client changed
if ($current_client_id !== null && $client_id !== $current_client_id) {
@@ -303,7 +303,7 @@ $result = $stmt->get_result();
// Ticket label
$display_ticket = trim($ticket_prefix . $ticket_number);
if ($display_ticket === '') $display_ticket = (string)$ticket_number;
$ticket_label_html = nullable_htmlentities($display_ticket) . " - " . $ticket_subject_html;
$ticket_label_html = escapeHtml($display_ticket) . " - " . $ticket_subject_html;
// Ticket changed: close previous ticket subtotal
if ($current_ticket_id !== null && $ticket_id !== $current_ticket_id) {
@@ -340,7 +340,7 @@ $result = $stmt->get_result();
<tr>
<td class="pl-4 text-muted">
<i class="far fa-clock mr-1"></i>
<?php echo nullable_htmlentities(date('Y-m-d g:i A', strtotime($reply_created_at))); ?>
<?php echo escapeHtml(date('Y-m-d g:i A', strtotime($reply_created_at))); ?>
<div class="mt-1 text-body" style="white-space: normal;">
<?php echo $reply_content_html; ?>
</div>
@@ -404,7 +404,7 @@ $result = $stmt->get_result();
<small class="text-muted p-2">
This report shows only ticket replies with time worked within the selected date range.
“Billable (hrs)” is calculated by rounding each reply up to the nearest <?php echo (int)$billing_increment_minutes; ?> minutes (<?php echo nullable_htmlentities($billing_increment_key); ?> hours),
“Billable (hrs)” is calculated by rounding each reply up to the nearest <?php echo (int)$billing_increment_minutes; ?> minutes (<?php echo escapeHtml($billing_increment_key); ?> hours),
then summing those rounded values for ticket/client/grand totals.
<br>
Reply content is displayed under each reply timestamp.

2
agent/reports/clients_with_balance.php
View File

@@ -61,7 +61,7 @@ enforceUserPermission('module_financial');
<?php
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$balance = floatval($row['balance']);
?>

8
agent/reports/credential_rotation.php
View File

@@ -47,11 +47,11 @@ $passwords_not_rotated_sql = mysqli_query($mysqli,
while ($row = mysqli_fetch_assoc($passwords_not_rotated_sql)) {
$credential_id = intval($row['credential_id']);
$credential_name = nullable_htmlentities($row['credential_name']);
$credential_description = nullable_htmlentities($row['credential_description']);
$credential_password_changed = nullable_htmlentities($row['credential_password_changed_at']);
$credential_name = escapeHtml($row['credential_name']);
$credential_description = escapeHtml($row['credential_description']);
$credential_password_changed = escapeHtml($row['credential_password_changed_at']);
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
?>

2
agent/reports/expense_summary.php
View File

@@ -69,7 +69,7 @@ $largest_expense_month = 0;
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']); ?>
$category_name = escapeHtml($row['category_name']); ?>
<tr>
<td><?php echo $category_name; ?></td>
<?php

4
agent/reports/includes/reports_side_nav.php
View File

@@ -120,9 +120,9 @@
);
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
$custom_link_name = escapeHtml($row['custom_link_name']);
$custom_link_uri = sanitize_url($row['custom_link_uri']);
$custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
$custom_link_icon = escapeHtml($row['custom_link_icon']);
$custom_link_new_tab = intval($row['custom_link_new_tab']);
if ($custom_link_new_tab == 1) {
$target = "target='_blank' rel='noopener noreferrer'";

2
agent/reports/income_by_client.php
View File

@@ -71,7 +71,7 @@ $sql_payment_years = mysqli_query($mysqli, "SELECT DISTINCT YEAR(payment_date) A
<?php
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$amount_paid = floatval($row['amount_paid']);
?>

2
agent/reports/income_summary.php
View File

@@ -73,7 +73,7 @@ $largest_income_month = 0;
<tbody>
<?php while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']); ?>
$category_name = escapeHtml($row['category_name']); ?>
<tr>
<td><?php echo $category_name; ?></td>
<?php

4
agent/reports/profit_loss.php
View File

@@ -67,7 +67,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE
<?php
while ($row = mysqli_fetch_assoc($sql_categories_income)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<tr>
@@ -274,7 +274,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE
<?php
while ($row = mysqli_fetch_assoc($sql_categories_expense)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<tr>

2
agent/reports/recurring_by_client.php
View File

@@ -39,7 +39,7 @@ $sql = mysqli_query($mysqli, "
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
$recurring_monthly_total = floatval($row['recurring_monthly_total']);
$recurring_total = $recurring_total + $recurring_monthly_total;
?>

4
agent/reports/tax_summary.php
View File

@@ -9,7 +9,7 @@ $year = isset($_GET['year']) ? intval($_GET['year']) : date('Y');
$view = isset($_GET['view']) ? $_GET['view'] : 'quarterly';
$currency_row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT company_currency FROM companies WHERE company_id = 1"));
$company_currency = nullable_htmlentities($currency_row['company_currency']);
$company_currency = escapeHtml($currency_row['company_currency']);
// GET unique years from expenses, payments and revenues
$sql_all_years = mysqli_query($mysqli, "SELECT DISTINCT(YEAR(item_created_at)) AS all_years FROM invoice_items ORDER BY all_years DESC");
@@ -82,7 +82,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT `tax_name` FROM `taxes`");
$tax_name = sanitizeInput($tax_name_raw);
echo "<tr>";
echo "<td>" . nullable_htmlentities($tax_name_raw) . "</td>";
echo "<td>" . escapeHtml($tax_name_raw) . "</td>";
if ($view == 'monthly') {

8
agent/reports/ticket_by_client.php
View File

@@ -118,7 +118,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients
<?php
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Calculate total tickets raised in period
$sql_ticket_raised_count = mysqli_query($mysqli, "SELECT COUNT(ticket_id) AS ticket_raised_count FROM tickets WHERE YEAR(ticket_created_at) = $year AND ticket_client_id = $client_id");
@@ -154,7 +154,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients
// Calculate total time tracked towards tickets in the period
$sql_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) as total_time FROM ticket_replies LEFT JOIN tickets ON tickets.ticket_id = ticket_replies.ticket_reply_ticket_id WHERE YEAR(ticket_created_at) = $year AND ticket_client_id = $client_id AND ticket_reply_time_worked IS NOT NULL");
$row = mysqli_fetch_assoc($sql_time);
$ticket_total_time_worked = nullable_htmlentities($row['total_time']);
$ticket_total_time_worked = escapeHtml($row['total_time']);
if ($ticket_raised_count > 0 || $ticket_resolved_count > 0) {
@@ -240,7 +240,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients
mysqli_data_seek($sql_clients, 0); // Reset
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Calculate total tickets raised in period
$sql_ticket_raised_count = mysqli_query($mysqli, "SELECT COUNT(ticket_id) AS ticket_raised_count FROM tickets WHERE YEAR(ticket_created_at) = $year AND MONTH(ticket_created_at) = $month AND ticket_client_id = $client_id");
@@ -276,7 +276,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients
// Calculate total time tracked towards tickets in the period
$sql_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) as total_time FROM ticket_replies LEFT JOIN tickets ON tickets.ticket_id = ticket_replies.ticket_reply_ticket_id WHERE YEAR(ticket_created_at) = $year AND MONTH(ticket_created_at) = $month AND ticket_client_id = $client_id AND ticket_reply_time_worked IS NOT NULL");
$row = mysqli_fetch_assoc($sql_time);
$ticket_total_time_worked = nullable_htmlentities($row['total_time']);
$ticket_total_time_worked = escapeHtml($row['total_time']);
if ($ticket_raised_count > 0 || $ticket_resolved_count > 0) {

2
agent/reports/tickets_unbilled.php
View File

@@ -89,7 +89,7 @@ $rows = 0;
<?php
while ($row = mysqli_fetch_assoc($sql_clients)) {
$client_id = intval($row['client_id']);
$client_name = nullable_htmlentities($row['client_name']);
$client_name = escapeHtml($row['client_name']);
// Calculate total tickets raised in period
$sql_ticket_raised_count = mysqli_query(

4
agent/reports/time_by_tech.php
View File

@@ -110,7 +110,7 @@ $sql_users = mysqli_query($mysqli, "
while ($agent_row = mysqli_fetch_assoc($sql_users)) {
$user_id = intval($agent_row['user_id']);
$user_name = nullable_htmlentities($agent_row['user_name']);
$user_name = escapeHtml($agent_row['user_name']);
// Get tickets in period that are still assigned to the technician/agent
$sql_ticket_count = mysqli_query($mysqli, "SELECT COUNT(ticket_id) AS ticket_count FROM tickets WHERE YEAR(ticket_created_at) = $year AND ticket_assigned_to = $user_id");
@@ -150,7 +150,7 @@ $sql_users = mysqli_query($mysqli, "
// Calculate total time tracked towards tickets in the period (for this agent)
$sql_time = mysqli_query($mysqli, "SELECT SEC_TO_TIME(SUM(TIME_TO_SEC(ticket_reply_time_worked))) as total_time FROM ticket_replies LEFT JOIN tickets ON tickets.ticket_id = ticket_replies.ticket_reply_ticket_id WHERE YEAR(ticket_created_at) = $year AND ticket_reply_by = $user_id AND ticket_reply_time_worked IS NOT NULL");
$row = mysqli_fetch_assoc($sql_time);
$ticket_total_time_worked = nullable_htmlentities($row['total_time']);
$ticket_total_time_worked = escapeHtml($row['total_time']);
?>