AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:10:45 -04:00
parent d62b6e2ae7
commit 7bc47a58fe
338 changed files with 3057 additions and 3057 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
client/assets.php
View File

@@ -45,16 +45,16 @@ $assets_sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON
<?php
while ($row = mysqli_fetch_assoc($assets_sql)) {
$asset_id = intval($row['asset_id']);
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_description = nullable_htmlentities($row['asset_description']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_make = nullable_htmlentities($row['asset_make']);
$asset_model = nullable_htmlentities($row['asset_model']);
$asset_serial = nullable_htmlentities($row['asset_serial']);
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date'] ?? "-");
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire'] ?? "-");
$assigned_to = nullable_htmlentities($row['contact_name'] ?? "-");
$asset_status = nullable_htmlentities($row['asset_status']);
$asset_name = escapeHtml($row['asset_name']);
$asset_description = escapeHtml($row['asset_description']);
$asset_type = escapeHtml($row['asset_type']);
$asset_make = escapeHtml($row['asset_make']);
$asset_model = escapeHtml($row['asset_model']);
$asset_serial = escapeHtml($row['asset_serial']);
$asset_purchase_date = escapeHtml($row['asset_purchase_date'] ?? "-");
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire'] ?? "-");
$assigned_to = escapeHtml($row['contact_name'] ?? "-");
$asset_status = escapeHtml($row['asset_status']);
$asset_uri_client = sanitize_url($row['asset_uri_client']);
?>

8
client/certificates.php
View File

@@ -34,10 +34,10 @@ $certificates_sql = mysqli_query($mysqli, "SELECT certificate_id, certificate_na
<?php
while ($row = mysqli_fetch_assoc($certificates_sql)) {
$certificate_name = nullable_htmlentities($row['certificate_name']);
$certificate_domain = nullable_htmlentities($row['certificate_domain']);
$certificate_issued_by = nullable_htmlentities($row['certificate_issued_by']);
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
$certificate_name = escapeHtml($row['certificate_name']);
$certificate_domain = escapeHtml($row['certificate_domain']);
$certificate_issued_by = escapeHtml($row['certificate_issued_by']);
$certificate_expire = escapeHtml($row['certificate_expire']);
?>

10
client/contact_edit.php
View File

@@ -32,12 +32,12 @@ $row = mysqli_fetch_assoc($sql_contact);
if ($row) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_primary = intval($row['contact_primary']);
$contact_technical = intval($row['contact_technical']);
$contact_billing = intval($row['contact_billing']);
$contact_auth_method = nullable_htmlentities($row['user_auth_method']);
$contact_auth_method = escapeHtml($row['user_auth_method']);
} else {
header("Location: post.php?logout");
exit();
@@ -66,7 +66,7 @@ if ($row) {
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
</div>
<input type="text" class="form-control" name="contact_name" value="<?php echo nullable_htmlentities($contact_name) ?>" required maxlength="200">
<input type="text" class="form-control" name="contact_name" value="<?php echo escapeHtml($contact_name) ?>" required maxlength="200">
</div>
</div>
@@ -76,7 +76,7 @@ if ($row) {
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-envelope"></i></span>
</div>
<input type="email" class="form-control" name="contact_email" value="<?php echo nullable_htmlentities($contact_email) ?>" required maxlength="200">
<input type="email" class="form-control" name="contact_email" value="<?php echo escapeHtml($contact_email) ?>" required maxlength="200">
</div>
</div>

4
client/contacts.php
View File

@@ -42,8 +42,8 @@ $contacts_sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, contact_
<?php
while ($row = mysqli_fetch_assoc($contacts_sql)) {
$contact_id = intval($row['contact_id']);
$contact_name = nullable_htmlentities($row['contact_name']);
$contact_email = nullable_htmlentities($row['contact_email']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_primary = intval($row['contact_primary']);
$contact_technical = intval($row['contact_technical']);
$contact_billing = intval($row['contact_billing']);

10
client/document.php
View File

@@ -39,9 +39,9 @@ $row = mysqli_fetch_assoc($sql_document);
if ($row) {
$document_id = intval($row['document_id']);
$document_name = nullable_htmlentities($row['document_name']);
$document_name = escapeHtml($row['document_name']);
$document_content = $purifier->purify($row['document_content']);
$document_description = nullable_htmlentities($row['document_description']);
$document_description = escapeHtml($row['document_description']);
} else {
header("Location: post.php?logout");
exit();
@@ -75,11 +75,11 @@ $sql_files = mysqli_query($mysqli,
if (mysqli_num_rows($sql_files) > 0) {
$file_row = mysqli_fetch_assoc($sql_files);
$file_id = intval($file_row['file_id']);
$file_name = nullable_htmlentities($file_row['file_name']);
$file_reference_name = nullable_htmlentities($file_row['file_reference_name']);
$file_name = escapeHtml($file_row['file_name']);
$file_reference_name = escapeHtml($file_row['file_reference_name']);
$file_ext = strtolower($file_row['file_ext']);
$file_size = intval($file_row['file_size']);
$file_mime_type = nullable_htmlentities($file_row['file_mime_type']);
$file_mime_type = escapeHtml($file_row['file_mime_type']);
$file_size_formatted = formatBytes($file_size);
$file_path = "../uploads/clients/$session_client_id/$file_reference_name";

6
client/documents.php
View File

@@ -47,9 +47,9 @@ $documents_sql = mysqli_query($mysqli, "SELECT document_id, document_name, docum
<?php
while ($row = mysqli_fetch_assoc($documents_sql)) {
$document_id = intval($row['document_id']);
$folder_name = nullable_htmlentities($row['folder_name']);
$document_name = nullable_htmlentities($row['document_name']);
$document_created_at = nullable_htmlentities($row['document_created_at']);
$folder_name = escapeHtml($row['folder_name']);
$document_name = escapeHtml($row['document_name']);
$document_created_at = escapeHtml($row['document_created_at']);
?>

4
client/domains.php
View File

@@ -32,8 +32,8 @@ $domains_sql = mysqli_query($mysqli, "SELECT domain_id, domain_name, domain_expi
<?php
while ($row = mysqli_fetch_assoc($domains_sql)) {
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_expire = escapeHtml($row['domain_expire']);
?>

2
client/includes/footer.php
View File

@@ -13,7 +13,7 @@
<p class="text-center">
<?php
echo nullable_htmlentities($session_company_name);
echo escapeHtml($session_company_name);
if (!$config_whitelabel_enabled) {
echo '<br><small class="text-muted">Powered by ITFlow</small>';
}

14
client/includes/header.php
View File

@@ -12,7 +12,7 @@ header("X-Frame-Options: DENY"); // Legacy
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title><?php echo nullable_htmlentities($session_company_name); ?> | Client Portal</title>
<title><?php echo escapeHtml($session_company_name); ?> | Client Portal</title>
<!-- Tell the browser to be responsive to screen width -->
<meta name="viewport" content="width=device-width, initial-scale=1">
@@ -35,7 +35,7 @@ header("X-Frame-Options: DENY"); // Legacy
<nav class="navbar navbar-expand-lg navbar-dark bg-dark">
<div class="container">
<a class="navbar-brand" href="index.php"><?php echo nullable_htmlentities($session_company_name); ?></a>
<a class="navbar-brand" href="index.php"><?php echo escapeHtml($session_company_name); ?></a>
<button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarSupportedContent">
<span class="navbar-toggler-icon"></span>
</button>
@@ -85,8 +85,8 @@ header("X-Frame-Options: DENY"); // Legacy
);
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
$custom_link_uri = nullable_htmlentities($row['custom_link_uri']);
$custom_link_name = escapeHtml($row['custom_link_name']);
$custom_link_uri = escapeHtml($row['custom_link_uri']);
$custom_link_new_tab = intval($row['custom_link_new_tab']);
if ($custom_link_new_tab == 1) {
$target = "target='_blank' rel='noopener noreferrer'";
@@ -107,7 +107,7 @@ header("X-Frame-Options: DENY"); // Legacy
<ul class="nav navbar-nav pull-right">
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle" href="#" id="navbarDropdown" role="button" data-toggle="dropdown">
<?php echo stripslashes(nullable_htmlentities($session_contact_name)); ?>
<?php echo stripslashes(escapeHtml($session_contact_name)); ?>
</a>
<div class="dropdown-menu">
<a class="dropdown-item" href="/client/profile.php"><i class="fas fa-fw fa-user mr-2"></i>Account</a>
@@ -142,7 +142,7 @@ header("X-Frame-Options: DENY"); // Legacy
<?php if ($session_company_logo) { ?>
<img height="48" width="142" class="img-fluid float-right" src="<?php echo "/uploads/settings/$session_company_logo"; ?>">
<?php } ?>
<h4>Welcome, <strong><?php echo stripslashes(nullable_htmlentities($session_contact_name)); ?></strong>!</h4>
<h4>Welcome, <strong><?php echo stripslashes(escapeHtml($session_contact_name)); ?></strong>!</h4>
</div>
</div>
<hr>
@@ -155,7 +155,7 @@ header("X-Frame-Options: DENY"); // Legacy
}
?>
<div class="alert alert-<?php echo $_SESSION['alert_type']; ?>" id="alert">
<?php echo nullable_htmlentities($_SESSION['alert_message']); ?>
<?php echo escapeHtml($_SESSION['alert_message']); ?>
<button class='close' data-dismiss='alert'>&times;</button>
</div>
<?php

8
client/index.php
View File

@@ -228,8 +228,8 @@ if ($session_contact_primary == 1 || $session_contact_is_technical_contact) {
while ($row = mysqli_fetch_assoc($sql_domains_expiring)) {
$domain_id = intval($row['domain_id']);
$domain_name = nullable_htmlentities($row['domain_name']);
$domain_expire = nullable_htmlentities($row['domain_expire']);
$domain_name = escapeHtml($row['domain_name']);
$domain_expire = escapeHtml($row['domain_expire']);
$domain_expire_human = timeAgo($row['domain_expire']);
?>
@@ -266,8 +266,8 @@ if ($session_contact_primary == 1 || $session_contact_is_technical_contact) {
<?php
while ($row = mysqli_fetch_assoc($sql_assigned_assets)) {
$asset_name = nullable_htmlentities($row['asset_name']);
$asset_type = nullable_htmlentities($row['asset_type']);
$asset_name = escapeHtml($row['asset_name']);
$asset_type = escapeHtml($row['asset_type']);
$asset_uri_client = sanitize_url($row['asset_uri_client']);

12
client/invoices.php
View File

@@ -38,14 +38,14 @@ $invoices_sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_clie
<?php
while ($row = mysqli_fetch_assoc($invoices_sql)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
$invoice_status = nullable_htmlentities($row['invoice_status']);
$invoice_date = nullable_htmlentities($row['invoice_date']);
$invoice_due = nullable_htmlentities($row['invoice_due']);
$invoice_scope = escapeHtml($row['invoice_scope']);
$invoice_status = escapeHtml($row['invoice_status']);
$invoice_date = escapeHtml($row['invoice_date']);
$invoice_due = escapeHtml($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = nullable_htmlentities($row['invoice_url_key']);
$invoice_url_key = escapeHtml($row['invoice_url_key']);
if (empty($invoice_scope)) {
$invoice_scope_display = "-";

6
client/login_reset.php
View File

@@ -175,7 +175,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title><?php echo nullable_htmlentities($company_name_display); ?> | Password Reset</title>
<title><?php echo escapeHtml($company_name_display); ?> | Password Reset</title>
<!-- Tell the browser to be responsive to screen width -->
<meta name="viewport" content="width=device-width, initial-scale=1">
@@ -199,7 +199,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
<body class="hold-transition login-page">
<div class="login-box">
<div class="login-logo"><b><?php echo nullable_htmlentities($company_name_display); ?></b> <br>Password Reset</h2></div>
<div class="login-logo"><b><?php echo escapeHtml($company_name_display); ?></b> <br>Password Reset</h2></div>
<div class="card">
<div class="card-body login-card-body">
@@ -269,7 +269,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
<?php
// Show feedback from session
if (!empty($_SESSION['login_message'])) {
echo nullable_htmlentities($_SESSION['login_message']);
echo escapeHtml($_SESSION['login_message']);
unset($_SESSION['login_message']);
}
?>

16
client/post.php
View File

@@ -199,9 +199,9 @@ if (isset($_GET['approve_ticket_task'])) {
$approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'"));
$task_name = nullable_htmlentities($approval_row['task_name']);
$scope = nullable_htmlentities($approval_row['approval_scope']);
$type = nullable_htmlentities($approval_row['approval_type']);
$task_name = escapeHtml($approval_row['task_name']);
$scope = escapeHtml($approval_row['approval_scope']);
$type = escapeHtml($approval_row['approval_type']);
$required_user = intval($approval_row['approval_required_user_id']);
$created_by = intval($approval_row['approval_created_by']);
$ticket_id = intval($approval_row['task_ticket_id']);
@@ -718,7 +718,7 @@ if (isset($_POST['create_stripe_customer'])) {
}
$stripe_provider_id = intval($stripe_provider['payment_provider_id']);
$stripe_secret_key = nullable_htmlentities($stripe_provider['payment_provider_private_key']);
$stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);
if (empty($stripe_secret_key)) {
flash_alert("Stripe credentials missing. Please contact support.", 'danger');
@@ -809,7 +809,7 @@ if (isset($_GET['create_stripe_checkout'])) {
}
$stripe_provider_id = intval($stripe_provider['payment_provider_id']);
$stripe_secret_key = nullable_htmlentities($stripe_provider['payment_provider_private_key']);
$stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);
if (empty($stripe_secret_key)) {
http_response_code(400);
@@ -878,7 +878,7 @@ if (isset($_GET['stripe_save_card'])) {
}
$stripe_provider_id = intval($stripe_provider['payment_provider_id']);
$stripe_secret_key = nullable_htmlentities($stripe_provider['payment_provider_private_key']);
$stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);
if (empty($stripe_secret_key)) {
flash_alert("Stripe credentials missing.", 'danger');
@@ -1011,7 +1011,7 @@ if (isset($_GET['delete_saved_payment'])) {
}
$stripe_provider_id = intval($stripe_provider['payment_provider_id']);
$stripe_secret_key = nullable_htmlentities($stripe_provider['payment_provider_private_key']);
$stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);
if (empty($stripe_secret_key)) {
flash_alert("Stripe credentials are missing.", 'danger');
@@ -1037,7 +1037,7 @@ if (isset($_GET['delete_saved_payment'])) {
$payment_method_id = sanitizeInput($saved_payment['saved_payment_provider_method']);
$saved_payment_id = intval($saved_payment['saved_payment_id']);
$saved_payment_description = nullable_htmlentities($saved_payment['saved_payment_description']);
$saved_payment_description = escapeHtml($saved_payment['saved_payment_description']);
try {
// Initialize Stripe

2
client/profile.php
View File

@@ -12,7 +12,7 @@ require_once 'includes/inc_all.php';
<h2>Profile</h2>
<p>Name: <?php echo stripslashes(nullable_htmlentities($session_contact_name)); ?></p>
<p>Name: <?php echo stripslashes(escapeHtml($session_contact_name)); ?></p>
<p>Email: <?php echo $session_contact_email ?></p>
<p>PIN: <?php echo $session_contact_pin ?></p>
<p>Client: <?php echo $session_client_name ?></p>

10
client/quotes.php
View File

@@ -36,13 +36,13 @@ $quotes_sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_client_id
<?php
while ($row = mysqli_fetch_assoc($quotes_sql)) {
$quote_id = intval($row['quote_id']);
$quote_prefix = nullable_htmlentities($row['quote_prefix']);
$quote_prefix = escapeHtml($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$quote_scope = nullable_htmlentities($row['quote_scope']);
$quote_status = nullable_htmlentities($row['quote_status']);
$quote_date = nullable_htmlentities($row['quote_date']);
$quote_scope = escapeHtml($row['quote_scope']);
$quote_status = escapeHtml($row['quote_status']);
$quote_date = escapeHtml($row['quote_date']);
$quote_amount = floatval($row['quote_amount']);
$quote_url_key = nullable_htmlentities($row['quote_url_key']);
$quote_url_key = escapeHtml($row['quote_url_key']);
if (empty($quote_scope)) {
$quote_scope_display = "-";

14
client/recurring_invoices.php
View File

@@ -25,7 +25,7 @@ $recurring_invoices_sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice
$payment_provider_sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1");
$row = mysqli_fetch_assoc($payment_provider_sql);
$payment_provider_id = intval($row['payment_provider_id']);
$payment_provider_name = nullable_htmlentities($row['payment_provider_name']);
$payment_provider_name = escapeHtml($row['payment_provider_name']);
$payment_provider_threshold = floatval($row['payment_provider_threshold']);
?>
@@ -52,12 +52,12 @@ $payment_provider_threshold = floatval($row['payment_provider_threshold']);
<?php
while ($row = mysqli_fetch_assoc($recurring_invoices_sql)) {
$recurring_invoice_id = intval($row['recurring_invoice_id']);
$recurring_invoice_prefix = nullable_htmlentities($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeHtml($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$recurring_invoice_scope = nullable_htmlentities($row['recurring_invoice_scope']);
$recurring_invoice_status = nullable_htmlentities($row['recurring_invoice_status']);
$recurring_invoice_next_date = nullable_htmlentities($row['recurring_invoice_next_date']);
$recurring_invoice_frequency = nullable_htmlentities($row['recurring_invoice_frequency']);
$recurring_invoice_scope = escapeHtml($row['recurring_invoice_scope']);
$recurring_invoice_status = escapeHtml($row['recurring_invoice_status']);
$recurring_invoice_next_date = escapeHtml($row['recurring_invoice_next_date']);
$recurring_invoice_frequency = escapeHtml($row['recurring_invoice_frequency']);
$recurring_invoice_amount = floatval($row['recurring_invoice_amount']);
$recurring_payment_id = intval($row['recurring_payment_id']);
$recurring_payment_recurring_invoice_id = intval($row['recurring_payment_recurring_invoice_id']);
@@ -88,7 +88,7 @@ $payment_provider_threshold = floatval($row['payment_provider_threshold']);
<?php
while ($row = mysqli_fetch_assoc($sql)) {
$saved_payment_id = intval($row['saved_payment_id']);
$saved_payment_description = nullable_htmlentities($row['saved_payment_description']);
$saved_payment_description = escapeHtml($row['saved_payment_description']);
?>
<option <?php if ($recurring_payment_saved_payment_id == $saved_payment_id) { echo "selected"; } ?> value="<?php echo $saved_payment_id; ?>"><?php echo $saved_payment_description; ?></option>

14
client/saved_payment_methods.php
View File

@@ -26,8 +26,8 @@ if (!$stripe_provider) {
}
$stripe_provider_id = intval($stripe_provider['payment_provider_id']);
$stripe_public_key = nullable_htmlentities($stripe_provider['payment_provider_public_key']);
$stripe_secret_key = nullable_htmlentities($stripe_provider['payment_provider_private_key']);
$stripe_public_key = escapeHtml($stripe_provider['payment_provider_public_key']);
$stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']);
// Get client's Stripe customer ID
$stripe_customer_query = mysqli_query($mysqli, "
@@ -90,7 +90,7 @@ if (!$stripe_public_key || !$stripe_secret_key) {
foreach ($saved_methods as $method) {
$stripe_pm_id = $method['saved_payment_provider_method'];
$description = nullable_htmlentities($method['saved_payment_description']);
$description = escapeHtml($method['saved_payment_description']);
$payment_icon = "fas fa-credit-card"; // default icon
if (strpos($description, "visa") !== false) {
$payment_icon = "fab fa-cc-visa";
@@ -103,10 +103,10 @@ if (!$stripe_public_key || !$stripe_secret_key) {
}
$pm = $stripe->paymentMethods->retrieve($stripe_pm_id, []);
$brand = nullable_htmlentities($pm->card->brand);
$last4 = nullable_htmlentities($pm->card->last4);
$exp_month = nullable_htmlentities($pm->card->exp_month);
$exp_year = nullable_htmlentities($pm->card->exp_year);
$brand = escapeHtml($pm->card->brand);
$last4 = escapeHtml($pm->card->last4);
$exp_month = escapeHtml($pm->card->exp_month);
$exp_year = escapeHtml($pm->card->exp_year);
echo "<li><i class='$payment_icon fa-2x mr-2'></i>$brand x<strong>$last4</strong> | Exp. $exp_month/$exp_year";
echo " – <a class='text-danger' href='post.php?delete_saved_payment={$method['saved_payment_id']}&csrf_token={$_SESSION['csrf_token']}'>Remove</a></li>";

40
client/ticket.php
View File

@@ -38,17 +38,17 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
if ($ticket_row) {
$ticket_prefix = nullable_htmlentities($ticket_row['ticket_prefix']);
$ticket_prefix = escapeHtml($ticket_row['ticket_prefix']);
$ticket_number = intval($ticket_row['ticket_number']);
$ticket_status = nullable_htmlentities($ticket_row['ticket_status_name']);
$ticket_priority = nullable_htmlentities($ticket_row['ticket_priority']);
$ticket_subject = nullable_htmlentities($ticket_row['ticket_subject']);
$ticket_status = escapeHtml($ticket_row['ticket_status_name']);
$ticket_priority = escapeHtml($ticket_row['ticket_priority']);
$ticket_subject = escapeHtml($ticket_row['ticket_subject']);
$ticket_details = $purifier->purify($ticket_row['ticket_details']);
$ticket_assigned_to = nullable_htmlentities($ticket_row['user_name']);
$ticket_resolved_at = nullable_htmlentities($ticket_row['ticket_resolved_at']);
$ticket_closed_at = nullable_htmlentities($ticket_row['ticket_closed_at']);
$ticket_feedback = nullable_htmlentities($ticket_row['ticket_feedback']);
$ticket_category = nullable_htmlentities($ticket_row['category_name']);
$ticket_assigned_to = escapeHtml($ticket_row['user_name']);
$ticket_resolved_at = escapeHtml($ticket_row['ticket_resolved_at']);
$ticket_closed_at = escapeHtml($ticket_row['ticket_closed_at']);
$ticket_feedback = escapeHtml($ticket_row['ticket_feedback']);
$ticket_category = escapeHtml($ticket_row['category_name']);
// Get Ticket Attachments (not associated with a specific reply)
$sql_ticket_attachments = mysqli_query(
@@ -129,8 +129,8 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
<?php
while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_attachments)) {
$name = nullable_htmlentities($ticket_attachment['ticket_attachment_name']);
$ref_name = nullable_htmlentities($ticket_attachment['ticket_attachment_reference_name']);
$name = escapeHtml($ticket_attachment['ticket_attachment_name']);
$ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='../uploads/tickets/$ticket_id/$ref_name'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
}
?>
@@ -150,9 +150,9 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
while ($approvals = mysqli_fetch_assoc($sql_task_approvals)) {
$task_id = intval($approvals['task_id']);
$approval_id = intval($approvals['approval_id']);
$task_name = nullable_htmlentities($approvals['task_name']);
$approval_type = nullable_htmlentities($approvals['approval_type']);
$approval_url_key = nullable_htmlentities($approvals['approval_url_key']);
$task_name = escapeHtml($approvals['task_name']);
$approval_type = escapeHtml($approvals['approval_type']);
$approval_url_key = escapeHtml($approvals['approval_url_key']);
$contact_can_approve = false; // Default
@@ -261,18 +261,18 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
while ($row = mysqli_fetch_assoc($sql)) {
$ticket_reply_id = intval($row['ticket_reply_id']);
$ticket_reply = $purifier->purify($row['ticket_reply']);
$ticket_reply_created_at = nullable_htmlentities($row['ticket_reply_created_at']);
$ticket_reply_updated_at = nullable_htmlentities($row['ticket_reply_updated_at']);
$ticket_reply_created_at = escapeHtml($row['ticket_reply_created_at']);
$ticket_reply_updated_at = escapeHtml($row['ticket_reply_updated_at']);
$ticket_reply_by = intval($row['ticket_reply_by']);
$ticket_reply_type = $row['ticket_reply_type'];
if ($ticket_reply_type == "Client") {
$ticket_reply_by_display = nullable_htmlentities($row['contact_name']);
$ticket_reply_by_display = escapeHtml($row['contact_name']);
$user_initials = initials($row['contact_name']);
$user_avatar = $row['contact_photo'];
$avatar_link = "../uploads/clients/$session_client_id/$user_avatar";
} else {
$ticket_reply_by_display = nullable_htmlentities($row['user_name']);
$ticket_reply_by_display = escapeHtml($row['user_name']);
$user_id = intval($row['user_id']);
$user_avatar = $row['user_avatar'];
$user_initials = initials($row['user_name']);
@@ -321,8 +321,8 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
<?php
while ($ticket_attachment = mysqli_fetch_assoc($sql_ticket_reply_attachments)) {
$name = nullable_htmlentities($ticket_attachment['ticket_attachment_name']);
$ref_name = nullable_htmlentities($ticket_attachment['ticket_attachment_reference_name']);
$name = escapeHtml($ticket_attachment['ticket_attachment_name']);
$ref_name = escapeHtml($ticket_attachment['ticket_attachment_reference_name']);
echo "<hr><i class='fas fa-fw fa-paperclip text-secondary mr-1'></i>$name | <a href='../uploads/tickets/$ticket_id/$ref_name' download='$name'><i class='fas fa-fw fa-download mr-1'></i>Download</a> | <a target='_blank' href='../uploads/tickets/$ticket_id/$ref_name'><i class='fas fa-fw fa-external-link-alt mr-1'></i>View</a>";
}
?>

2
client/ticket_add.php
View File

@@ -67,7 +67,7 @@ $sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, asset_type FRO
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_id = intval($row['category_id']);
$category_name = nullable_htmlentities($row['category_name']);
$category_name = escapeHtml($row['category_name']);
?>
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>

8
client/ticket_view_all.php
View File

@@ -55,11 +55,11 @@ $all_tickets = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_nu
<?php
while ($row = mysqli_fetch_assoc($all_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_status = nullable_htmlentities($row['ticket_status_name']);
$ticket_contact_name = nullable_htmlentities($row['contact_name']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_status = escapeHtml($row['ticket_status_name']);
$ticket_contact_name = escapeHtml($row['contact_name']);
echo "<tr>";
echo "<td> <a href='ticket.php?id=$ticket_id'> $ticket_prefix$ticket_number</a></td>";

6
client/tickets.php
View File

@@ -60,10 +60,10 @@ $total_tickets = intval($row['total_tickets']);
<?php
while ($row = mysqli_fetch_assoc($contact_tickets)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
$ticket_prefix = escapeHtml($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
$ticket_status = nullable_htmlentities($row['ticket_status_name']);
$ticket_subject = escapeHtml($row['ticket_subject']);
$ticket_status = escapeHtml($row['ticket_status_name']);
?>
<tr>

20
client/unpaid_invoices.php
View File

@@ -67,8 +67,8 @@ $balance = $invoice_amounts - $amount_paid;
<?php
while ($row = mysqli_fetch_assoc($sql_saved_payment_methods)) {
$saved_payment_id = intval($row['saved_payment_id']);
$saved_payment_description = nullable_htmlentities($row['saved_payment_description']);
$payment_provider_name = nullable_htmlentities($row['payment_provider_name']);
$saved_payment_description = escapeHtml($row['saved_payment_description']);
$payment_provider_name = escapeHtml($row['payment_provider_name']);
?>
<a class="dropdown-item confirm-link" href="post.php?add_payment_by_provider=<?php echo $saved_payment_provider_id; ?>&invoice_id=<?php echo $invoice_id; ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>"><?php echo "$payment_provider_name | $saved_payment_description"; ?></a>
@@ -98,14 +98,14 @@ $balance = $invoice_amounts - $amount_paid;
<?php
while ($row = mysqli_fetch_assoc($invoices_sql)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
$invoice_status = nullable_htmlentities($row['invoice_status']);
$invoice_date = nullable_htmlentities($row['invoice_date']);
$invoice_due = nullable_htmlentities($row['invoice_due']);
$invoice_scope = escapeHtml($row['invoice_scope']);
$invoice_status = escapeHtml($row['invoice_status']);
$invoice_date = escapeHtml($row['invoice_date']);
$invoice_due = escapeHtml($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = nullable_htmlentities($row['invoice_url_key']);
$invoice_url_key = escapeHtml($row['invoice_url_key']);
if (empty($invoice_scope)) {
$invoice_scope_display = "-";
@@ -170,7 +170,7 @@ $balance = $invoice_amounts - $amount_paid;
<?php
while ($row = mysqli_fetch_assoc($sql_saved_payment_methods)) {
$saved_payment_id = intval($row['saved_payment_id']);
$saved_payment_description = nullable_htmlentities($row['saved_payment_description']);
$saved_payment_description = escapeHtml($row['saved_payment_description']);
$payment_icon = "fas fa-credit-card"; // default icon
if (strpos($saved_payment_description, "visa") !== false) {
$payment_icon = "fab fa-cc-visa";
@@ -181,7 +181,7 @@ $balance = $invoice_amounts - $amount_paid;
} elseif (strpos($saved_payment_description, "discover") !== false) {
$payment_icon = "fab fa-cc-discover";
}
$payment_provider_name = nullable_htmlentities($row['payment_provider_name']);
$payment_provider_name = escapeHtml($row['payment_provider_name']);
?>
<a class="dropdown-item confirm-link"