mirror of
https://github.com/itflow-org/itflow
synced 2026-07-23 00:40:45 +00:00
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
This commit is contained in:
johnnyq
@@ -60,11 +60,11 @@ $num_rows = mysqli_num_rows($sql);
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$provider_id = intval($row['ai_provider_id']);
|
$provider_id = intval($row['ai_provider_id']);
|
||||||
$provider_name = nullable_htmlentities($row['ai_provider_name']);
|
$provider_name = escapeHtml($row['ai_provider_name']);
|
||||||
$model_id = intval($row['ai_model_id']);
|
$model_id = intval($row['ai_model_id']);
|
||||||
$model_name = nullable_htmlentities($row['ai_model_name']);
|
$model_name = escapeHtml($row['ai_model_name']);
|
||||||
$use_case = nullable_htmlentities($row['ai_model_use_case']);
|
$use_case = escapeHtml($row['ai_model_use_case']);
|
||||||
$prompt = nl2br(nullable_htmlentities($row['ai_model_prompt']));
|
$prompt = nl2br(escapeHtml($row['ai_model_prompt']));
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -50,9 +50,9 @@ $num_rows = mysqli_num_rows($sql);
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$provider_id = intval($row['ai_provider_id']);
|
$provider_id = intval($row['ai_provider_id']);
|
||||||
$provider_name = nullable_htmlentities($row['ai_provider_name']);
|
$provider_name = escapeHtml($row['ai_provider_name']);
|
||||||
$url = nullable_htmlentities($row['ai_provider_api_url']);
|
$url = escapeHtml($row['ai_provider_api_url']);
|
||||||
$key = nullable_htmlentities($row['ai_provider_api_key']);
|
$key = escapeHtml($row['ai_provider_api_key']);
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ai_model_id') AS ai_model_count FROM ai_models WHERE ai_model_ai_provider_id = $provider_id"));
|
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ai_model_id') AS ai_model_count FROM ai_models WHERE ai_model_ai_provider_id = $provider_id"));
|
||||||
$ai_model_count = intval($row['ai_model_count']);
|
$ai_model_count = intval($row['ai_model_count']);
|
||||||
|
|||||||
@@ -33,7 +33,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search keys">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search keys">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -107,10 +107,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$api_key_id = intval($row['api_key_id']);
|
$api_key_id = intval($row['api_key_id']);
|
||||||
$api_key_name = nullable_htmlentities($row['api_key_name']);
|
$api_key_name = escapeHtml($row['api_key_name']);
|
||||||
$api_key_secret = nullable_htmlentities("************" . substr($row['api_key_secret'], -4));
|
$api_key_secret = escapeHtml("************" . substr($row['api_key_secret'], -4));
|
||||||
$api_key_created_at = nullable_htmlentities($row['api_key_created_at']);
|
$api_key_created_at = escapeHtml($row['api_key_created_at']);
|
||||||
$api_key_expire = nullable_htmlentities($row['api_key_expire']);
|
$api_key_expire = escapeHtml($row['api_key_expire']);
|
||||||
if ($api_key_expire < date("Y-m-d H:i:s")) {
|
if ($api_key_expire < date("Y-m-d H:i:s")) {
|
||||||
$api_key_expire = $api_key_expire . " (Expired)";
|
$api_key_expire = $api_key_expire . " (Expired)";
|
||||||
}
|
}
|
||||||
@@ -118,7 +118,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
if ($row['api_key_client_id'] == 0) {
|
if ($row['api_key_client_id'] == 0) {
|
||||||
$api_key_client = "<i>All Clients</i>";
|
$api_key_client = "<i>All Clients</i>";
|
||||||
} else {
|
} else {
|
||||||
$api_key_client = nullable_htmlentities($row['client_name']);
|
$api_key_client = escapeHtml($row['client_name']);
|
||||||
}
|
}
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
// Log Type Filter
|
// Log Type Filter
|
||||||
if (isset($_GET['type']) & !empty($_GET['type'])) {
|
if (isset($_GET['type']) & !empty($_GET['type'])) {
|
||||||
$log_type_query = "AND (app_log_type = '" . sanitizeInput($_GET['type']) . "')";
|
$log_type_query = "AND (app_log_type = '" . sanitizeInput($_GET['type']) . "')";
|
||||||
$type_filter = nullable_htmlentities($_GET['type']);
|
$type_filter = escapeHtml($_GET['type']);
|
||||||
} else {
|
} else {
|
||||||
// Default - any
|
// Default - any
|
||||||
$log_type_query = '';
|
$log_type_query = '';
|
||||||
@@ -19,7 +19,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) {
|
|||||||
// Log Category Filter
|
// Log Category Filter
|
||||||
if (isset($_GET['category']) & !empty($_GET['catergory'])) {
|
if (isset($_GET['category']) & !empty($_GET['catergory'])) {
|
||||||
$log_category_query = "AND (app_log_category = '" . sanitizeInput($_GET['category']) . "')";
|
$log_category_query = "AND (app_log_category = '" . sanitizeInput($_GET['category']) . "')";
|
||||||
$category_filter = nullable_htmlentities($_GET['category']);
|
$category_filter = escapeHtml($_GET['category']);
|
||||||
} else {
|
} else {
|
||||||
// Default - any
|
// Default - any
|
||||||
$log_category_query = '';
|
$log_category_query = '';
|
||||||
@@ -50,7 +50,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="col-sm-4">
|
<div class="col-sm-4">
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search app logs">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search app logs">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
@@ -67,7 +67,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
$sql_types_filter = mysqli_query($mysqli, "SELECT DISTINCT app_log_type FROM app_logs ORDER BY app_log_type ASC");
|
$sql_types_filter = mysqli_query($mysqli, "SELECT DISTINCT app_log_type FROM app_logs ORDER BY app_log_type ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_types_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_types_filter)) {
|
||||||
$log_type = nullable_htmlentities($row['app_log_type']);
|
$log_type = escapeHtml($row['app_log_type']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($type_filter == $log_type) { echo "selected"; } ?>><?php echo $log_type; ?></option>
|
<option <?php if ($type_filter == $log_type) { echo "selected"; } ?>><?php echo $log_type; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -86,7 +86,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
$sql_categories_filter = mysqli_query($mysqli, "SELECT DISTINCT app_log_category FROM app_logs ORDER BY app_log_category ASC");
|
$sql_categories_filter = mysqli_query($mysqli, "SELECT DISTINCT app_log_category FROM app_logs ORDER BY app_log_category ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
|
||||||
$log_category = nullable_htmlentities($row['app_log_category']);
|
$log_category = escapeHtml($row['app_log_category']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($category_filter == $log_category) { echo "selected"; } ?>><?php echo $log_category; ?></option>
|
<option <?php if ($category_filter == $log_category) { echo "selected"; } ?>><?php echo $log_category; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -103,9 +103,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Date range</label>
|
<label>Date range</label>
|
||||||
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
||||||
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
|
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
|
||||||
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
|
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
|
||||||
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
|
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -143,10 +143,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$log_id = intval($row['app_log_id']);
|
$log_id = intval($row['app_log_id']);
|
||||||
$log_type = nullable_htmlentities($row['app_log_type']);
|
$log_type = escapeHtml($row['app_log_type']);
|
||||||
$log_category = nullable_htmlentities($row['app_log_category']);
|
$log_category = escapeHtml($row['app_log_category']);
|
||||||
$log_details = nullable_htmlentities($row['app_log_details']);
|
$log_details = escapeHtml($row['app_log_details']);
|
||||||
$log_created_at = nullable_htmlentities($row['app_log_created_at']);
|
$log_created_at = escapeHtml($row['app_log_created_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
|
|||||||
@@ -29,7 +29,7 @@ if (isset($_GET['client']) & !empty($_GET['client'])) {
|
|||||||
// Log Type Filter
|
// Log Type Filter
|
||||||
if (isset($_GET['type']) & !empty($_GET['type'])) {
|
if (isset($_GET['type']) & !empty($_GET['type'])) {
|
||||||
$log_type_query = "AND (log_type = '" . sanitizeInput($_GET['type']) . "')";
|
$log_type_query = "AND (log_type = '" . sanitizeInput($_GET['type']) . "')";
|
||||||
$type_filter = nullable_htmlentities($_GET['type']);
|
$type_filter = escapeHtml($_GET['type']);
|
||||||
} else {
|
} else {
|
||||||
// Default - any
|
// Default - any
|
||||||
$log_type_query = '';
|
$log_type_query = '';
|
||||||
@@ -39,7 +39,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) {
|
|||||||
// Log Action Filter
|
// Log Action Filter
|
||||||
if (isset($_GET['action']) & !empty($_GET['action'])) {
|
if (isset($_GET['action']) & !empty($_GET['action'])) {
|
||||||
$log_action_query = "AND (log_action = '" . sanitizeInput($_GET['action']) . "')";
|
$log_action_query = "AND (log_action = '" . sanitizeInput($_GET['action']) . "')";
|
||||||
$action_filter = nullable_htmlentities($_GET['action']);
|
$action_filter = escapeHtml($_GET['action']);
|
||||||
} else {
|
} else {
|
||||||
// Default - any
|
// Default - any
|
||||||
$log_action_query = '';
|
$log_action_query = '';
|
||||||
@@ -73,7 +73,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-sm-4">
|
<div class="col-sm-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search audit logs">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search audit logs">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
@@ -90,7 +90,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
|
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client_filter == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client_filter == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -110,7 +110,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
|
$sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_users_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_users_filter)) {
|
||||||
$user_id = intval($row['user_id']);
|
$user_id = intval($row['user_id']);
|
||||||
$user_name = nullable_htmlentities($row['user_name']);
|
$user_name = escapeHtml($row['user_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($user_filter == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
|
<option <?php if ($user_filter == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -129,7 +129,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
$sql_types_filter = mysqli_query($mysqli, "SELECT DISTINCT log_type FROM logs ORDER BY log_type ASC");
|
$sql_types_filter = mysqli_query($mysqli, "SELECT DISTINCT log_type FROM logs ORDER BY log_type ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_types_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_types_filter)) {
|
||||||
$log_type = nullable_htmlentities($row['log_type']);
|
$log_type = escapeHtml($row['log_type']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($type_filter == $log_type) { echo "selected"; } ?>><?php echo $log_type; ?></option>
|
<option <?php if ($type_filter == $log_type) { echo "selected"; } ?>><?php echo $log_type; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -148,7 +148,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
$sql_actions_filter = mysqli_query($mysqli, "SELECT DISTINCT log_action FROM logs ORDER BY log_action ASC");
|
$sql_actions_filter = mysqli_query($mysqli, "SELECT DISTINCT log_action FROM logs ORDER BY log_action ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_actions_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_actions_filter)) {
|
||||||
$log_action = nullable_htmlentities($row['log_action']);
|
$log_action = escapeHtml($row['log_action']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($action_filter == $log_action) { echo "selected"; } ?>><?php echo $log_action; ?></option>
|
<option <?php if ($action_filter == $log_action) { echo "selected"; } ?>><?php echo $log_action; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -165,9 +165,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Date range</label>
|
<label>Date range</label>
|
||||||
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
||||||
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
|
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
|
||||||
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
|
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
|
||||||
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
|
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -227,22 +227,22 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$log_id = intval($row['log_id']);
|
$log_id = intval($row['log_id']);
|
||||||
$log_type = nullable_htmlentities($row['log_type']);
|
$log_type = escapeHtml($row['log_type']);
|
||||||
$log_action = nullable_htmlentities($row['log_action']);
|
$log_action = escapeHtml($row['log_action']);
|
||||||
$log_description = nullable_htmlentities($row['log_description']);
|
$log_description = escapeHtml($row['log_description']);
|
||||||
$log_ip = nullable_htmlentities($row['log_ip']);
|
$log_ip = escapeHtml($row['log_ip']);
|
||||||
$log_user_agent = nullable_htmlentities($row['log_user_agent']);
|
$log_user_agent = escapeHtml($row['log_user_agent']);
|
||||||
$log_user_os = getOS($log_user_agent);
|
$log_user_os = getOS($log_user_agent);
|
||||||
$log_user_browser = getWebBrowser($log_user_agent);
|
$log_user_browser = getWebBrowser($log_user_agent);
|
||||||
$log_created_at = nullable_htmlentities($row['log_created_at']);
|
$log_created_at = escapeHtml($row['log_created_at']);
|
||||||
$user_id = intval($row['user_id']);
|
$user_id = intval($row['user_id']);
|
||||||
$user_name = nullable_htmlentities($row['user_name']);
|
$user_name = escapeHtml($row['user_name']);
|
||||||
if (empty($user_name)) {
|
if (empty($user_name)) {
|
||||||
$user_name_display = "-";
|
$user_name_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$user_name_display = $user_name;
|
$user_name_display = $user_name;
|
||||||
}
|
}
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
if (empty($client_name)) {
|
if (empty($client_name)) {
|
||||||
$client_name_display = "-";
|
$client_name_display = "-";
|
||||||
|
|||||||
@@ -28,14 +28,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="card card-dark">
|
<div class="card card-dark">
|
||||||
<div class="card-header py-2">
|
<div class="card-header py-2">
|
||||||
<h3 class="card-title mt-2"><i class="fa fa-fw fa-list-ul mr-2"></i>
|
<h3 class="card-title mt-2"><i class="fa fa-fw fa-list-ul mr-2"></i>
|
||||||
<?= nullable_htmlentities(ucwords(str_replace('_', ' ', $category))); ?> Categories
|
<?= escapeHtml(ucwords(str_replace('_', ' ', $category))); ?> Categories
|
||||||
</h3>
|
</h3>
|
||||||
<?php
|
<?php
|
||||||
if (!isset($_GET['archived'])) {
|
if (!isset($_GET['archived'])) {
|
||||||
?>
|
?>
|
||||||
<div class="card-tools">
|
<div class="card-tools">
|
||||||
<button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/category/category_add.php?category=<?= nullable_htmlentities($category) ?>"><i
|
<button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/category/category_add.php?category=<?= escapeHtml($category) ?>"><i
|
||||||
class="fas fa-plus mr-2"></i>New <?= nullable_htmlentities(ucwords(str_replace('_', ' ', $category))); ?> Category</button>
|
class="fas fa-plus mr-2"></i>New <?= escapeHtml(ucwords(str_replace('_', ' ', $category))); ?> Category</button>
|
||||||
</div>
|
</div>
|
||||||
<?php
|
<?php
|
||||||
}
|
}
|
||||||
@@ -43,15 +43,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
</div>
|
</div>
|
||||||
<div class="card-body">
|
<div class="card-body">
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<input type="hidden" name="category" value="<?php echo nullable_htmlentities($category); ?>">
|
<input type="hidden" name="category" value="<?php echo escapeHtml($category); ?>">
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-sm-4 mb-2">
|
<div class="col-sm-4 mb-2">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q"
|
<input type="search" class="form-control" name="q"
|
||||||
value="<?php if (isset($q)) {
|
value="<?php if (isset($q)) {
|
||||||
echo stripslashes(nullable_htmlentities($q));
|
echo stripslashes(escapeHtml($q));
|
||||||
} ?>"
|
} ?>"
|
||||||
placeholder="Search <?= nullable_htmlentities(ucwords(str_replace('_', ' ', $category))); ?> Categories ">
|
placeholder="Search <?= escapeHtml(ucwords(str_replace('_', ' ', $category))); ?> Categories ">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -143,9 +143,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$category_id = intval($row['category_id']);
|
$category_id = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
$category_description = nullable_htmlentities($row['category_description']);
|
$category_description = escapeHtml($row['category_description']);
|
||||||
$category_color = nullable_htmlentities($row['category_color']);
|
$category_color = escapeHtml($row['category_color']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -31,7 +31,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search templates">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search templates">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-secondary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -61,28 +61,28 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$id = intval($row['contract_template_id']);
|
$id = intval($row['contract_template_id']);
|
||||||
$name = nullable_htmlentities($row['contract_template_name']);
|
$name = escapeHtml($row['contract_template_name']);
|
||||||
$type = nullable_htmlentities($row['contract_template_type']);
|
$type = escapeHtml($row['contract_template_type']);
|
||||||
$freq = nullable_htmlentities($row['contract_template_update_frequency']);
|
$freq = escapeHtml($row['contract_template_update_frequency']);
|
||||||
$sla_low_resp = nullable_htmlentities($row['sla_low_response_time']);
|
$sla_low_resp = escapeHtml($row['sla_low_response_time']);
|
||||||
$sla_med_resp = nullable_htmlentities($row['sla_medium_response_time']);
|
$sla_med_resp = escapeHtml($row['sla_medium_response_time']);
|
||||||
$sla_high_resp = nullable_htmlentities($row['sla_high_response_time']);
|
$sla_high_resp = escapeHtml($row['sla_high_response_time']);
|
||||||
$sla_low_res = nullable_htmlentities($row['sla_low_resolution_time']);
|
$sla_low_res = escapeHtml($row['sla_low_resolution_time']);
|
||||||
$sla_med_res = nullable_htmlentities($row['sla_medium_resolution_time']);
|
$sla_med_res = escapeHtml($row['sla_medium_resolution_time']);
|
||||||
$sla_high_res = nullable_htmlentities($row['sla_high_resolution_time']);
|
$sla_high_res = escapeHtml($row['sla_high_resolution_time']);
|
||||||
$hourly_rate = nullable_htmlentities($row['contract_template_hourly_rate']);
|
$hourly_rate = escapeHtml($row['contract_template_hourly_rate']);
|
||||||
$after_hours = nullable_htmlentities($row['contract_template_after_hours_hourly_rate']);
|
$after_hours = escapeHtml($row['contract_template_after_hours_hourly_rate']);
|
||||||
$support_hours = nullable_htmlentities($row['contract_template_support_hours']);
|
$support_hours = escapeHtml($row['contract_template_support_hours']);
|
||||||
$net_terms = nullable_htmlentities($row['contract_template_net_terms']);
|
$net_terms = escapeHtml($row['contract_template_net_terms']);
|
||||||
$created = nullable_htmlentities($row['contract_template_created_at']);
|
$created = escapeHtml($row['contract_template_created_at']);
|
||||||
$updated = nullable_htmlentities($row['contract_template_updated_at']);
|
$updated = escapeHtml($row['contract_template_updated_at']);
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
<td>
|
<td>
|
||||||
<a class="text-bold" href="contract_template_details.php?contract_template_id=<?php echo $id; ?>">
|
<a class="text-bold" href="contract_template_details.php?contract_template_id=<?php echo $id; ?>">
|
||||||
<i class="fas fa-fw fa-file-alt text-dark"></i> <?php echo $name; ?>
|
<i class="fas fa-fw fa-file-alt text-dark"></i> <?php echo $name; ?>
|
||||||
</a>
|
</a>
|
||||||
<div class="mt-1 text-secondary"><?php echo nullable_htmlentities($row['contract_template_description']); ?></div>
|
<div class="mt-1 text-secondary"><?php echo escapeHtml($row['contract_template_description']); ?></div>
|
||||||
</td>
|
</td>
|
||||||
<td><?php echo $type; ?></td>
|
<td><?php echo $type; ?></td>
|
||||||
<td><?php echo $freq; ?></td>
|
<td><?php echo $freq; ?></td>
|
||||||
|
|||||||
@@ -30,7 +30,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="col-sm-4 mb-2">
|
<div class="col-sm-4 mb-2">
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Links">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Links">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -74,9 +74,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$custom_link_id = intval($row['custom_link_id']);
|
$custom_link_id = intval($row['custom_link_id']);
|
||||||
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
|
$custom_link_name = escapeHtml($row['custom_link_name']);
|
||||||
$custom_link_uri = nullable_htmlentities($row['custom_link_uri']);
|
$custom_link_uri = escapeHtml($row['custom_link_uri']);
|
||||||
$custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
|
$custom_link_icon = escapeHtml($row['custom_link_icon']);
|
||||||
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
||||||
if ($custom_link_new_tab == 1 ) {
|
if ($custom_link_new_tab == 1 ) {
|
||||||
$custom_link_new_tab_display = "<i class='fas fa-fw fa-checkmark'></i>";
|
$custom_link_new_tab_display = "<i class='fas fa-fw fa-checkmark'></i>";
|
||||||
|
|||||||
@@ -31,7 +31,7 @@
|
|||||||
|
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control " name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search templates">
|
<input type="search" class="form-control " name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search templates">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-secondary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -68,12 +68,12 @@
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$document_template_id = intval($row['document_template_id']);
|
$document_template_id = intval($row['document_template_id']);
|
||||||
$document_template_name = nullable_htmlentities($row['document_template_name']);
|
$document_template_name = escapeHtml($row['document_template_name']);
|
||||||
$document_template_description = nullable_htmlentities($row['document_template_description']);
|
$document_template_description = escapeHtml($row['document_template_description']);
|
||||||
$document_template_content = nullable_htmlentities($row['document_template_content']);
|
$document_template_content = escapeHtml($row['document_template_content']);
|
||||||
$document_template_created_by_name = nullable_htmlentities($row['user_name']);
|
$document_template_created_by_name = escapeHtml($row['user_name']);
|
||||||
$document_template_created_at = nullable_htmlentities($row['document_template_created_at']);
|
$document_template_created_at = escapeHtml($row['document_template_created_at']);
|
||||||
$document_template_updated_at = nullable_htmlentities(getFallback($row['document_template_updated_at']));
|
$document_template_updated_at = escapeHtml(getFallback($row['document_template_updated_at']));
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
|
|||||||
@@ -25,11 +25,11 @@ if (mysqli_num_rows($sql_document) == 0) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql_document);
|
$row = mysqli_fetch_assoc($sql_document);
|
||||||
|
|
||||||
$document_template_name = nullable_htmlentities($row['document_template_name']);
|
$document_template_name = escapeHtml($row['document_template_name']);
|
||||||
$document_template_description = nullable_htmlentities($row['document_template_description']);
|
$document_template_description = escapeHtml($row['document_template_description']);
|
||||||
$document_template_content = $purifier->purify($row['document_template_content']);
|
$document_template_content = $purifier->purify($row['document_template_content']);
|
||||||
$document_template_created_at = nullable_htmlentities($row['document_template_created_at']);
|
$document_template_created_at = escapeHtml($row['document_template_created_at']);
|
||||||
$document_template_updated_at = nullable_htmlentities($row['document_template_updated_at']);
|
$document_template_updated_at = escapeHtml($row['document_template_updated_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
|
|||||||
@@ -33,7 +33,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="azure_client_id" placeholder="e721e3b6-01d6-50e8-7f22-c84d951a52e7" value="<?php echo nullable_htmlentities($config_azure_client_id); ?>">
|
<input type="text" class="form-control" name="azure_client_id" placeholder="e721e3b6-01d6-50e8-7f22-c84d951a52e7" value="<?php echo escapeHtml($config_azure_client_id); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
@@ -43,7 +43,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="password" class="form-control" name="azure_client_secret" placeholder="Auto-generated from App Registration" value="<?php echo nullable_htmlentities($config_azure_client_secret); ?>" autocomplete="new-password">
|
<input type="password" class="form-control" name="azure_client_secret" placeholder="Auto-generated from App Registration" value="<?php echo escapeHtml($config_azure_client_secret); ?>" autocomplete="new-password">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
<!-- Main Sidebar Container -->
|
<!-- Main Sidebar Container -->
|
||||||
<aside class="main-sidebar sidebar-dark-<?php echo nullable_htmlentities($config_theme); ?> d-print-none">
|
<aside class="main-sidebar sidebar-dark-<?php echo escapeHtml($config_theme); ?> d-print-none">
|
||||||
<a class="brand-link pb-1 mt-1" href="/agent/<?php echo $config_start_page ?>">
|
<a class="brand-link pb-1 mt-1" href="/agent/<?php echo $config_start_page ?>">
|
||||||
<p class="h6">
|
<p class="h6">
|
||||||
<i class="nav-icon fas fa-arrow-left ml-3 mr-2"></i>
|
<i class="nav-icon fas fa-arrow-left ml-3 mr-2"></i>
|
||||||
@@ -294,9 +294,9 @@
|
|||||||
);
|
);
|
||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
|
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
|
||||||
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
|
$custom_link_name = escapeHtml($row['custom_link_name']);
|
||||||
$custom_link_uri = sanitize_url($row['custom_link_uri']);
|
$custom_link_uri = sanitize_url($row['custom_link_uri']);
|
||||||
$custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
|
$custom_link_icon = escapeHtml($row['custom_link_icon']);
|
||||||
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
||||||
if ($custom_link_new_tab == 1) {
|
if ($custom_link_new_tab == 1) {
|
||||||
$target = "target='_blank' rel='noopener noreferrer'";
|
$target = "target='_blank' rel='noopener noreferrer'";
|
||||||
|
|||||||
@@ -27,7 +27,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-sm-4">
|
<div class="col-sm-4">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search mail queue">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search mail queue">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
@@ -59,9 +59,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Date range</label>
|
<label>Date range</label>
|
||||||
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
||||||
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
|
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
|
||||||
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
|
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
|
||||||
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
|
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -118,15 +118,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$email_id = intval($row['email_id']);
|
$email_id = intval($row['email_id']);
|
||||||
$email_from = nullable_htmlentities($row['email_from']);
|
$email_from = escapeHtml($row['email_from']);
|
||||||
$email_from_name = nullable_htmlentities($row['email_from_name']);
|
$email_from_name = escapeHtml($row['email_from_name']);
|
||||||
$email_recipient = nullable_htmlentities($row['email_recipient']);
|
$email_recipient = escapeHtml($row['email_recipient']);
|
||||||
$email_recipient_name = nullable_htmlentities($row['email_recipient_name']);
|
$email_recipient_name = escapeHtml($row['email_recipient_name']);
|
||||||
$email_subject = nullable_htmlentities($row['email_subject']);
|
$email_subject = escapeHtml($row['email_subject']);
|
||||||
$email_attempts = intval($row['email_attempts']);
|
$email_attempts = intval($row['email_attempts']);
|
||||||
$email_queued_at = nullable_htmlentities($row['email_queued_at']);
|
$email_queued_at = escapeHtml($row['email_queued_at']);
|
||||||
$email_failed_at = nullable_htmlentities($row['email_failed_at']);
|
$email_failed_at = escapeHtml($row['email_failed_at']);
|
||||||
$email_sent_at = nullable_htmlentities($row['email_sent_at']);
|
$email_sent_at = escapeHtml($row['email_sent_at']);
|
||||||
$email_status = intval($row['email_status']);
|
$email_status = intval($row['email_status']);
|
||||||
if ($email_status == 0) {
|
if ($email_status == 0) {
|
||||||
$email_status_display = "<div class='text-primary'>Queued</div>";
|
$email_status_display = "<div class='text-primary'>Queued</div>";
|
||||||
|
|||||||
@@ -29,7 +29,7 @@ ob_start();
|
|||||||
$sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
|
$sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
|
||||||
while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
|
while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
|
||||||
$ai_provider_id = intval($row['ai_provider_id']);
|
$ai_provider_id = intval($row['ai_provider_id']);
|
||||||
$ai_provider_name = nullable_htmlentities($row['ai_provider_name']);
|
$ai_provider_name = escapeHtml($row['ai_provider_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $ai_provider_id; ?>"><?php echo $ai_provider_name; ?></option>
|
<option value="<?php echo $ai_provider_id; ?>"><?php echo $ai_provider_name; ?></option>
|
||||||
|
|||||||
@@ -9,9 +9,9 @@ $sql = mysqli_query($mysqli, "SELECT * FROM ai_models WHERE ai_model_id = $model
|
|||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
|
$ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
|
||||||
$model_id = intval($row['ai_model_id']);
|
$model_id = intval($row['ai_model_id']);
|
||||||
$model_name = nullable_htmlentities($row['ai_model_name']);
|
$model_name = escapeHtml($row['ai_model_name']);
|
||||||
$use_case = nullable_htmlentities($row['ai_model_use_case']);
|
$use_case = escapeHtml($row['ai_model_use_case']);
|
||||||
$prompt = nullable_htmlentities($row['ai_model_prompt']);
|
$prompt = escapeHtml($row['ai_model_prompt']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
ob_start();
|
ob_start();
|
||||||
@@ -41,7 +41,7 @@ ob_start();
|
|||||||
$sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
|
$sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
|
||||||
while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
|
while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
|
||||||
$ai_provider_id = intval($row['ai_provider_id']);
|
$ai_provider_id = intval($row['ai_provider_id']);
|
||||||
$ai_provider_name = nullable_htmlentities($row['ai_provider_name']);
|
$ai_provider_name = escapeHtml($row['ai_provider_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option <?php if ($ai_provider_id = $ai_model_ai_provider_id) { echo "selected"; } ?> value="<?php echo $ai_provider_id; ?>"><?php echo $ai_provider_name; ?></option>
|
<option <?php if ($ai_provider_id = $ai_model_ai_provider_id) { echo "selected"; } ?> value="<?php echo $ai_provider_id; ?>"><?php echo $ai_provider_name; ?></option>
|
||||||
|
|||||||
@@ -7,9 +7,9 @@ $provider_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$provider_name = nullable_htmlentities($row['ai_provider_name']);
|
$provider_name = escapeHtml($row['ai_provider_name']);
|
||||||
$url = nullable_htmlentities($row['ai_provider_api_url']);
|
$url = escapeHtml($row['ai_provider_api_url']);
|
||||||
$key = nullable_htmlentities($row['ai_provider_api_key']);
|
$key = escapeHtml($row['ai_provider_api_key']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|||||||
@@ -66,7 +66,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']); ?>
|
$client_name = escapeHtml($row['client_name']); ?>
|
||||||
<option value="<?php echo $client_id; ?>"><?php echo "$client_name (Client ID: $client_id)"; ?></option>
|
<option value="<?php echo $client_id; ?>"><?php echo "$client_name (Client ID: $client_id)"; ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
</select>
|
</select>
|
||||||
|
|||||||
@@ -2,14 +2,14 @@
|
|||||||
|
|
||||||
require_once '../../../includes/modal_header.php';
|
require_once '../../../includes/modal_header.php';
|
||||||
|
|
||||||
$category = nullable_htmlentities($_GET['category'] ?? '');
|
$category = escapeHtml($_GET['category'] ?? '');
|
||||||
|
|
||||||
$category_types_array = ['Expense', 'Income', 'Referral', 'Ticket'];
|
$category_types_array = ['Expense', 'Income', 'Referral', 'Ticket'];
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<div class="modal-header bg-dark">
|
<div class="modal-header bg-dark">
|
||||||
<h5 class="modal-title"><i class="fa fa-fw fa-list-ul mr-2"></i>New <strong><?= nullable_htmlentities(ucwords(str_replace('_', ' ', $category))); ?></strong> Category</h5>
|
<h5 class="modal-title"><i class="fa fa-fw fa-list-ul mr-2"></i>New <strong><?= escapeHtml(ucwords(str_replace('_', ' ', $category))); ?></strong> Category</h5>
|
||||||
<button type="button" class="close text-white" data-dismiss="modal">
|
<button type="button" class="close text-white" data-dismiss="modal">
|
||||||
<span>×</span>
|
<span>×</span>
|
||||||
</button>
|
</button>
|
||||||
|
|||||||
@@ -7,10 +7,10 @@ $category_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
$category_description = nullable_htmlentities($row['category_description']);
|
$category_description = escapeHtml($row['category_description']);
|
||||||
$category_color = nullable_htmlentities($row['category_color']);
|
$category_color = escapeHtml($row['category_color']);
|
||||||
$category_type = nullable_htmlentities($row['category_type']);
|
$category_type = escapeHtml($row['category_type']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|||||||
@@ -11,10 +11,10 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contract_templates WHERE contract_te
|
|||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
|
|
||||||
// Assign locals
|
// Assign locals
|
||||||
$name = nullable_htmlentities($row['contract_template_name']);
|
$name = escapeHtml($row['contract_template_name']);
|
||||||
$description = nullable_htmlentities($row['contract_template_description']);
|
$description = escapeHtml($row['contract_template_description']);
|
||||||
$type = nullable_htmlentities($row['contract_template_type']);
|
$type = escapeHtml($row['contract_template_type']);
|
||||||
$renewal_frequency = nullable_htmlentities($row['contract_template_renewal_frequency']);
|
$renewal_frequency = escapeHtml($row['contract_template_renewal_frequency']);
|
||||||
$sla_low_resp = intval($row['contract_template_sla_low_response_time']);
|
$sla_low_resp = intval($row['contract_template_sla_low_response_time']);
|
||||||
$sla_med_resp = intval($row['contract_template_sla_medium_response_time']);
|
$sla_med_resp = intval($row['contract_template_sla_medium_response_time']);
|
||||||
$sla_high_resp = intval($row['contract_template_sla_high_response_time']);
|
$sla_high_resp = intval($row['contract_template_sla_high_response_time']);
|
||||||
@@ -23,9 +23,9 @@ $sla_med_res = intval($row['contract_template_sla_medium_resolution_time']);
|
|||||||
$sla_high_res = intval($row['contract_template_sla_high_resolution_time']);
|
$sla_high_res = intval($row['contract_template_sla_high_resolution_time']);
|
||||||
$hourly_rate = intval($row['contract_template_rate_standard']);
|
$hourly_rate = intval($row['contract_template_rate_standard']);
|
||||||
$after_hours = intval($row['contract_template_rate_after_hours']);
|
$after_hours = intval($row['contract_template_rate_after_hours']);
|
||||||
$support_hours = nullable_htmlentities($row['contract_template_support_hours']);
|
$support_hours = escapeHtml($row['contract_template_support_hours']);
|
||||||
$net_terms = intval($row['contract_template_net_terms']);
|
$net_terms = intval($row['contract_template_net_terms']);
|
||||||
$details = nullable_htmlentities($row['contract_template_details']);
|
$details = escapeHtml($row['contract_template_details']);
|
||||||
|
|
||||||
ob_start();
|
ob_start();
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -2,14 +2,14 @@
|
|||||||
<div class="modal-dialog">
|
<div class="modal-dialog">
|
||||||
<div class="modal-content">
|
<div class="modal-content">
|
||||||
<div class="modal-header bg-dark">
|
<div class="modal-header bg-dark">
|
||||||
<h5 class="modal-title"><i class="fa fa-fw fa-th-list mr-2"></i>Create <?php echo nullable_htmlentities($table); ?> field</h5>
|
<h5 class="modal-title"><i class="fa fa-fw fa-th-list mr-2"></i>Create <?php echo escapeHtml($table); ?> field</h5>
|
||||||
<button type="button" class="close text-white" data-dismiss="modal">
|
<button type="button" class="close text-white" data-dismiss="modal">
|
||||||
<span>×</span>
|
<span>×</span>
|
||||||
</button>
|
</button>
|
||||||
</div>
|
</div>
|
||||||
<form action="post.php" method="post" autocomplete="off">
|
<form action="post.php" method="post" autocomplete="off">
|
||||||
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
|
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
|
||||||
<input type="hidden" name="table" value="<?php echo nullable_htmlentities($table); ?>">
|
<input type="hidden" name="table" value="<?php echo escapeHtml($table); ?>">
|
||||||
|
|
||||||
<div class="modal-body">
|
<div class="modal-body">
|
||||||
|
|
||||||
|
|||||||
@@ -6,9 +6,9 @@ $custom_link_id = intval($_GET['id']);
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
|
$custom_link_name = escapeHtml($row['custom_link_name']);
|
||||||
$custom_link_uri = nullable_htmlentities($row['custom_link_uri']);
|
$custom_link_uri = escapeHtml($row['custom_link_uri']);
|
||||||
$custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
|
$custom_link_icon = escapeHtml($row['custom_link_icon']);
|
||||||
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
||||||
$custom_link_order = intval($row['custom_link_order']);
|
$custom_link_order = intval($row['custom_link_order']);
|
||||||
$custom_link_location = intval($row['custom_link_location']);
|
$custom_link_location = intval($row['custom_link_location']);
|
||||||
|
|||||||
@@ -6,9 +6,9 @@ $document_template_id = intval($_GET['id']);
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$document_template_name = nullable_htmlentities($row['document_template_name']);
|
$document_template_name = escapeHtml($row['document_template_name']);
|
||||||
$document_template_description = nullable_htmlentities($row['document_template_description']);
|
$document_template_description = escapeHtml($row['document_template_description']);
|
||||||
$document_template_content = nullable_htmlentities($row['document_template_content']);
|
$document_template_content = escapeHtml($row['document_template_content']);
|
||||||
|
|
||||||
ob_start();
|
ob_start();
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -19,16 +19,16 @@ $purifier = new HTMLPurifier($purifier_config);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
|
|
||||||
$email_from = nullable_htmlentities($row['email_from']);
|
$email_from = escapeHtml($row['email_from']);
|
||||||
$email_from_name = nullable_htmlentities($row['email_from_name']);
|
$email_from_name = escapeHtml($row['email_from_name']);
|
||||||
$email_recipient = nullable_htmlentities($row['email_recipient']);
|
$email_recipient = escapeHtml($row['email_recipient']);
|
||||||
$email_recipient_name = nullable_htmlentities($row['email_recipient_name']);
|
$email_recipient_name = escapeHtml($row['email_recipient_name']);
|
||||||
$email_subject = nullable_htmlentities($row['email_subject']);
|
$email_subject = escapeHtml($row['email_subject']);
|
||||||
$email_content = $purifier->purify($row['email_content']);
|
$email_content = $purifier->purify($row['email_content']);
|
||||||
$email_attempts = intval($row['email_attempts']);
|
$email_attempts = intval($row['email_attempts']);
|
||||||
$email_queued_at = nullable_htmlentities($row['email_queued_at']);
|
$email_queued_at = escapeHtml($row['email_queued_at']);
|
||||||
$email_failed_at = nullable_htmlentities($row['email_failed_at']);
|
$email_failed_at = escapeHtml($row['email_failed_at']);
|
||||||
$email_sent_at = nullable_htmlentities($row['email_sent_at']);
|
$email_sent_at = escapeHtml($row['email_sent_at']);
|
||||||
$email_status = intval($row['email_status']);
|
$email_status = intval($row['email_status']);
|
||||||
if ($email_status == 0) {
|
if ($email_status == 0) {
|
||||||
$email_status_display = "<div class='text-primary'>Queued</div>";
|
$email_status_display = "<div class='text-primary'>Queued</div>";
|
||||||
|
|||||||
@@ -8,8 +8,8 @@ $sql = mysqli_query($mysqli, "SELECT * FROM payment_methods WHERE payment_method
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$payment_method_id = intval($row['payment_method_id']);
|
$payment_method_id = intval($row['payment_method_id']);
|
||||||
$payment_method_name = nullable_htmlentities($row['payment_method_name']);
|
$payment_method_name = escapeHtml($row['payment_method_name']);
|
||||||
$payment_method_description = nullable_htmlentities($row['payment_method_description']);
|
$payment_method_description = escapeHtml($row['payment_method_description']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|||||||
@@ -81,7 +81,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($account_name === 'Stripe') { echo "selected"; } ?> value="<?= $account_id ?>"><?= $account_name ?></option>
|
<option <?php if ($account_name === 'Stripe') { echo "selected"; } ?> value="<?= $account_id ?>"><?= $account_name ?></option>
|
||||||
|
|
||||||
@@ -127,7 +127,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$vendor_id = intval($row['vendor_id']);
|
$vendor_id = intval($row['vendor_id']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($vendor_name === 'Stripe') { echo "selected"; } ?> value="<?= $vendor_id ?>"><?= $vendor_name ?></option>
|
<option <?php if ($vendor_name === 'Stripe') { echo "selected"; } ?> value="<?= $vendor_id ?>"><?= $vendor_name ?></option>
|
||||||
|
|
||||||
@@ -151,7 +151,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$category_id = intval($row['category_id']);
|
$category_id = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($category_name === 'Processing Fee') { echo "selected"; } ?> value="<?= $category_id ?>"><?= $category_name ?></option>
|
<option <?php if ($category_name === 'Processing Fee') { echo "selected"; } ?> value="<?= $category_id ?>"><?= $category_name ?></option>
|
||||||
|
|
||||||
|
|||||||
@@ -7,9 +7,9 @@ $provider_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$provider_name = nullable_htmlentities($row['payment_provider_name']);
|
$provider_name = escapeHtml($row['payment_provider_name']);
|
||||||
$public_key = nullable_htmlentities($row['payment_provider_public_key']);
|
$public_key = escapeHtml($row['payment_provider_public_key']);
|
||||||
$private_key = nullable_htmlentities($row['payment_provider_private_key']);
|
$private_key = escapeHtml($row['payment_provider_private_key']);
|
||||||
$account_id = intval($row['payment_provider_account']);
|
$account_id = intval($row['payment_provider_account']);
|
||||||
$threshold = floatval($row['payment_provider_threshold']);
|
$threshold = floatval($row['payment_provider_threshold']);
|
||||||
$vendor_id = intval($row['payment_provider_expense_vendor']);
|
$vendor_id = intval($row['payment_provider_expense_vendor']);
|
||||||
@@ -80,7 +80,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id_select = intval($row['account_id']);
|
$account_id_select = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($account_id === $account_id_select) { echo "selected"; } ?> value="<?= $account_id_select ?>"><?= $account_name ?></option>
|
<option <?php if ($account_id === $account_id_select) { echo "selected"; } ?> value="<?= $account_id_select ?>"><?= $account_name ?></option>
|
||||||
|
|
||||||
@@ -119,7 +119,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$vendor_id_select = intval($row['vendor_id']);
|
$vendor_id_select = intval($row['vendor_id']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($vendor_id === $vendor_id_select) { echo "selected"; } ?>
|
<option <?php if ($vendor_id === $vendor_id_select) { echo "selected"; } ?>
|
||||||
value="<?= $vendor_id_select ?>"><?= $vendor_name ?>
|
value="<?= $vendor_id_select ?>"><?= $vendor_name ?>
|
||||||
@@ -145,7 +145,7 @@ ob_start();
|
|||||||
$sql_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
|
$sql_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_category)) {
|
while ($row = mysqli_fetch_assoc($sql_category)) {
|
||||||
$category_id_select = intval($row['category_id']);
|
$category_id_select = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($category_id === $category_id_select) { echo "selected"; } ?> value="<?= $category_id_select ?>"><?= $category_name ?></option>
|
<option <?php if ($category_id === $category_id_select) { echo "selected"; } ?> value="<?= $category_id_select ?>"><?= $category_name ?></option>
|
||||||
|
|
||||||
|
|||||||
@@ -6,8 +6,8 @@ $project_template_id = intval($_GET['project_template_id']);
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$project_template_name = nullable_htmlentities($row['project_template_name']);
|
$project_template_name = escapeHtml($row['project_template_name']);
|
||||||
$project_template_description = nullable_htmlentities($row['project_template_description']);
|
$project_template_description = escapeHtml($row['project_template_description']);
|
||||||
|
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|
||||||
|
|||||||
@@ -40,7 +40,7 @@ ob_start();
|
|||||||
);
|
);
|
||||||
while ($row = mysqli_fetch_assoc($sql_ticket_templates_select)) {
|
while ($row = mysqli_fetch_assoc($sql_ticket_templates_select)) {
|
||||||
$ticket_template_id_select = intval($row['ticket_template_id']);
|
$ticket_template_id_select = intval($row['ticket_template_id']);
|
||||||
$ticket_template_name_select = nullable_htmlentities($row['ticket_template_name']);
|
$ticket_template_name_select = escapeHtml($row['ticket_template_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $ticket_template_id_select; ?>"><?php echo $ticket_template_name_select; ?></option>
|
<option value="<?php echo $ticket_template_id_select; ?>"><?php echo $ticket_template_name_select; ?></option>
|
||||||
<?php
|
<?php
|
||||||
|
|||||||
@@ -88,8 +88,8 @@ ob_start();
|
|||||||
$module_name_raw = $row_modules['module_name'];
|
$module_name_raw = $row_modules['module_name'];
|
||||||
$module_name_display = ucfirst(str_replace("module_", "", $module_name_raw));
|
$module_name_display = ucfirst(str_replace("module_", "", $module_name_raw));
|
||||||
|
|
||||||
$module_name_display_safe = nullable_htmlentities($module_name_display);
|
$module_name_display_safe = escapeHtml($module_name_display);
|
||||||
$module_description = nullable_htmlentities($row_modules['module_description']);
|
$module_description = escapeHtml($row_modules['module_description']);
|
||||||
|
|
||||||
// default for new role
|
// default for new role
|
||||||
$module_permission = 0;
|
$module_permission = 0;
|
||||||
|
|||||||
@@ -7,8 +7,8 @@ $role_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_id = $role_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_id = $role_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$role_name = nullable_htmlentities($row['role_name']);
|
$role_name = escapeHtml($row['role_name']);
|
||||||
$role_description = nullable_htmlentities($row['role_description']);
|
$role_description = escapeHtml($row['role_description']);
|
||||||
$role_admin = intval($row['role_is_admin']);
|
$role_admin = intval($row['role_is_admin']);
|
||||||
|
|
||||||
// Count number of users that have each role
|
// Count number of users that have each role
|
||||||
@@ -21,7 +21,7 @@ $user_names = [];
|
|||||||
|
|
||||||
// Fetch each row and store the user_name in the array
|
// Fetch each row and store the user_name in the array
|
||||||
while($row = mysqli_fetch_assoc($sql_users)) {
|
while($row = mysqli_fetch_assoc($sql_users)) {
|
||||||
$user_names[] = nullable_htmlentities($row['user_name']);
|
$user_names[] = escapeHtml($row['user_name']);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Convert the array of user names to a comma-separated string
|
// Convert the array of user names to a comma-separated string
|
||||||
@@ -116,9 +116,9 @@ ob_start();
|
|||||||
$sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
|
$sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
|
||||||
while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
|
while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
|
||||||
$module_id = intval($row_modules['module_id']);
|
$module_id = intval($row_modules['module_id']);
|
||||||
$module_name = nullable_htmlentities($row_modules['module_name']);
|
$module_name = escapeHtml($row_modules['module_name']);
|
||||||
$module_name_display = ucfirst(str_replace("module_","",$module_name));
|
$module_name_display = ucfirst(str_replace("module_","",$module_name));
|
||||||
$module_description = nullable_htmlentities($row_modules['module_description']);
|
$module_description = escapeHtml($row_modules['module_description']);
|
||||||
|
|
||||||
// Get permission level for module
|
// Get permission level for module
|
||||||
$module_permission_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_role_permission_level FROM user_role_permissions WHERE module_id = $module_id AND user_role_id = $role_id LIMIT 1"));
|
$module_permission_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_role_permission_level FROM user_role_permissions WHERE module_id = $module_id AND user_role_id = $role_id LIMIT 1"));
|
||||||
|
|||||||
@@ -73,7 +73,7 @@ ob_start();
|
|||||||
ORDER BY category_order ASC, category_name ASC
|
ORDER BY category_order ASC, category_name ASC
|
||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_software_types_select)) {
|
while ($row = mysqli_fetch_assoc($sql_software_types_select)) {
|
||||||
$software_type_select = nullable_htmlentities($row['category_name']);
|
$software_type_select = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option><?= $software_type_select ?></option>
|
<option><?= $software_type_select ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -6,12 +6,12 @@ $software_template_id = intval($_GET['id']);
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$software_name = nullable_htmlentities($row['software_template_name']);
|
$software_name = escapeHtml($row['software_template_name']);
|
||||||
$software_version = nullable_htmlentities($row['software_template_version']);
|
$software_version = escapeHtml($row['software_template_version']);
|
||||||
$software_description = nullable_htmlentities($row['software_template_description']);
|
$software_description = escapeHtml($row['software_template_description']);
|
||||||
$software_type = nullable_htmlentities($row['software_template_type']);
|
$software_type = escapeHtml($row['software_template_type']);
|
||||||
$software_license_type = nullable_htmlentities($row['software_template_license_type']);
|
$software_license_type = escapeHtml($row['software_template_license_type']);
|
||||||
$software_notes = nullable_htmlentities($row['software_template_notes']);
|
$software_notes = escapeHtml($row['software_template_notes']);
|
||||||
|
|
||||||
$license_types_array = array (
|
$license_types_array = array (
|
||||||
'Device',
|
'Device',
|
||||||
@@ -85,7 +85,7 @@ ob_start();
|
|||||||
ORDER BY category_order ASC, category_name ASC
|
ORDER BY category_order ASC, category_name ASC
|
||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_software_types_select)) {
|
while ($row = mysqli_fetch_assoc($sql_software_types_select)) {
|
||||||
$software_type_select = nullable_htmlentities($row['category_name']);
|
$software_type_select = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if($software_type == $software_type_select) { echo "selected"; } ?>>
|
<option <?php if($software_type == $software_type_select) { echo "selected"; } ?>>
|
||||||
<?= $software_type_select ?>
|
<?= $software_type_select ?>
|
||||||
|
|||||||
@@ -7,10 +7,10 @@ $tag_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']);
|
$tag_name = escapeHtml($row['tag_name']);
|
||||||
$tag_type = intval($row['tag_type']);
|
$tag_type = intval($row['tag_type']);
|
||||||
$tag_color = nullable_htmlentities($row['tag_color']);
|
$tag_color = escapeHtml($row['tag_color']);
|
||||||
$tag_icon = nullable_htmlentities($row['tag_icon']);
|
$tag_icon = escapeHtml($row['tag_icon']);
|
||||||
|
|
||||||
if ($tag_type == 1) {
|
if ($tag_type == 1) {
|
||||||
$tag_type_display = "Client";
|
$tag_type_display = "Client";
|
||||||
|
|||||||
@@ -6,7 +6,7 @@ $tax_id = intval($_GET['id']);
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$tax_name = nullable_htmlentities($row['tax_name']);
|
$tax_name = escapeHtml($row['tax_name']);
|
||||||
$tax_percent = floatval($row['tax_percent']);
|
$tax_percent = floatval($row['tax_percent']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
|
|||||||
@@ -6,8 +6,8 @@ $ticket_status_id = intval($_GET['id']);
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
|
$ticket_status_name = escapeHtml($row['ticket_status_name']);
|
||||||
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
|
$ticket_status_color = escapeHtml($row['ticket_status_color']);
|
||||||
$ticket_status_order = intval($row['ticket_status_order']);
|
$ticket_status_order = intval($row['ticket_status_order']);
|
||||||
$ticket_status_active = intval($row['ticket_status_active']);
|
$ticket_status_active = intval($row['ticket_status_active']);
|
||||||
|
|
||||||
|
|||||||
@@ -63,7 +63,7 @@ ob_start();
|
|||||||
$sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
|
$sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_project_templates)) {
|
while ($row = mysqli_fetch_assoc($sql_project_templates)) {
|
||||||
$project_template_id_select = intval($row['project_template_id']);
|
$project_template_id_select = intval($row['project_template_id']);
|
||||||
$project_template_name_select = nullable_htmlentities($row['project_template_name']); ?>
|
$project_template_name_select = escapeHtml($row['project_template_name']); ?>
|
||||||
<option value="<?php echo $project_template_id_select; ?>"><?php echo $project_template_name_select; ?></option>
|
<option value="<?php echo $project_template_id_select; ?>"><?php echo $project_template_name_select; ?></option>
|
||||||
|
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -7,10 +7,10 @@ $task_template_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$task_template_name = nullable_htmlentities($row['task_template_name']);
|
$task_template_name = escapeHtml($row['task_template_name']);
|
||||||
$task_template_order = intval($row['task_template_order']);
|
$task_template_order = intval($row['task_template_order']);
|
||||||
$task_template_completion_estimate = intval($row['task_template_completion_estimate']);
|
$task_template_completion_estimate = intval($row['task_template_completion_estimate']);
|
||||||
//$task_template_description = nullable_htmlentities($row['task_template_description']);
|
//$task_template_description = escapeHtml($row['task_template_description']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|||||||
@@ -78,7 +78,7 @@ ob_start();
|
|||||||
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
|
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
|
||||||
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
|
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
|
||||||
$role_id = intval($row['role_id']);
|
$role_id = intval($row['role_id']);
|
||||||
$role_name = nullable_htmlentities($row['role_name']);
|
$role_name = escapeHtml($row['role_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
|
<option value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
|
||||||
@@ -131,7 +131,7 @@ ob_start();
|
|||||||
$sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
|
$sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_client_select)) {
|
while ($row = mysqli_fetch_assoc($sql_client_select)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<li class="list-group-item">
|
<li class="list-group-item">
|
||||||
|
|||||||
@@ -7,10 +7,10 @@ $user_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$user_name = nullable_htmlentities($row['user_name']);
|
$user_name = escapeHtml($row['user_name']);
|
||||||
$user_email = nullable_htmlentities($row['user_email']);
|
$user_email = escapeHtml($row['user_email']);
|
||||||
$user_avatar = nullable_htmlentities($row['user_avatar']);
|
$user_avatar = escapeHtml($row['user_avatar']);
|
||||||
$user_initials = nullable_htmlentities(initials($user_name));
|
$user_initials = escapeHtml(initials($user_name));
|
||||||
|
|
||||||
$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
|
$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
|
||||||
WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
|
WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
|
||||||
@@ -62,7 +62,7 @@ ob_start();
|
|||||||
$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
|
$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
|
||||||
while ($row = mysqli_fetch_assoc($sql_users)) {
|
while ($row = mysqli_fetch_assoc($sql_users)) {
|
||||||
$user_id_select = intval($row['user_id']);
|
$user_id_select = intval($row['user_id']);
|
||||||
$user_name_select = nullable_htmlentities($row['user_name']);
|
$user_name_select = escapeHtml($row['user_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option value="<?= $user_id_select ?>"><?= $user_name_select ?></option>
|
<option value="<?= $user_id_select ?>"><?= $user_name_select ?></option>
|
||||||
|
|||||||
@@ -10,13 +10,13 @@ $sql = mysqli_query($mysqli, "SELECT * FROM users
|
|||||||
);
|
);
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$user_name = nullable_htmlentities($row['user_name']);
|
$user_name = escapeHtml($row['user_name']);
|
||||||
$user_email = nullable_htmlentities($row['user_email']);
|
$user_email = escapeHtml($row['user_email']);
|
||||||
$user_avatar = nullable_htmlentities($row['user_avatar']);
|
$user_avatar = escapeHtml($row['user_avatar']);
|
||||||
$user_token = nullable_htmlentities($row['user_token']);
|
$user_token = escapeHtml($row['user_token']);
|
||||||
$user_config_force_mfa = intval($row['user_config_force_mfa']);
|
$user_config_force_mfa = intval($row['user_config_force_mfa']);
|
||||||
$user_role_id = intval($row['user_role_id']);
|
$user_role_id = intval($row['user_role_id']);
|
||||||
$user_initials = nullable_htmlentities(initials($user_name));
|
$user_initials = escapeHtml(initials($user_name));
|
||||||
|
|
||||||
// Get User Client Access Permissions
|
// Get User Client Access Permissions
|
||||||
$user_client_access_sql = mysqli_query($mysqli,"SELECT client_id FROM user_client_permissions WHERE user_id = $user_id");
|
$user_client_access_sql = mysqli_query($mysqli,"SELECT client_id FROM user_client_permissions WHERE user_id = $user_id");
|
||||||
@@ -116,7 +116,7 @@ ob_start();
|
|||||||
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
|
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
|
||||||
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
|
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
|
||||||
$role_id = intval($row['role_id']);
|
$role_id = intval($row['role_id']);
|
||||||
$role_name = nullable_htmlentities($row['role_name']);
|
$role_name = escapeHtml($row['role_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option <?php if ($role_id == $user_role_id) {echo "selected";} ?> value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
|
<option <?php if ($role_id == $user_role_id) {echo "selected";} ?> value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
|
||||||
@@ -177,7 +177,7 @@ ob_start();
|
|||||||
$sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
|
$sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_client_select)) {
|
while ($row = mysqli_fetch_assoc($sql_client_select)) {
|
||||||
$client_id_select = intval($row['client_id']);
|
$client_id_select = intval($row['client_id']);
|
||||||
$client_name_select = nullable_htmlentities($row['client_name']);
|
$client_name_select = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
|
|||||||
@@ -8,9 +8,9 @@ $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $user_id AND u
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
|
$user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
|
||||||
$user_name = nullable_htmlentities($user_name);
|
$user_name = escapeHtml($user_name);
|
||||||
$user_email = nullable_htmlentities($row['user_email']);
|
$user_email = escapeHtml($row['user_email']);
|
||||||
$user_avatar = nullable_htmlentities($row['user_avatar']);
|
$user_avatar = escapeHtml($row['user_avatar']);
|
||||||
$user_initials = initials($user_name);
|
$user_initials = initials($user_name);
|
||||||
$user_role_id = intval($row['user_role_id']);
|
$user_role_id = intval($row['user_role_id']);
|
||||||
|
|
||||||
@@ -66,7 +66,7 @@ ob_start();
|
|||||||
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
|
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
|
||||||
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
|
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
|
||||||
$role_id = intval($row['role_id']);
|
$role_id = intval($row['role_id']);
|
||||||
$role_name = nullable_htmlentities($row['role_name']);
|
$role_name = escapeHtml($row['role_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option <?php if ($role_id == $user_role_id) {echo "selected";} ?> value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
|
<option <?php if ($role_id == $user_role_id) {echo "selected";} ?> value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
|
||||||
|
|||||||
@@ -33,7 +33,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Modules">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(escapeHtml($q));} ?>" placeholder="Search Modules">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -59,8 +59,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$module_id = intval($row['module_id']);
|
$module_id = intval($row['module_id']);
|
||||||
$module_name = nullable_htmlentities($row['module_name']);
|
$module_name = escapeHtml($row['module_name']);
|
||||||
$module_description = nullable_htmlentities($row['module_description']);
|
$module_description = escapeHtml($row['module_description']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -47,9 +47,9 @@ $num_rows = mysqli_num_rows($sql);
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$payment_method_id = intval($row['payment_method_id']);
|
$payment_method_id = intval($row['payment_method_id']);
|
||||||
$payment_method_name = nullable_htmlentities($row['payment_method_name']);
|
$payment_method_name = escapeHtml($row['payment_method_name']);
|
||||||
$payment_method_description = nullable_htmlentities($row['payment_method_description']);
|
$payment_method_description = escapeHtml($row['payment_method_description']);
|
||||||
$payment_method_created_at = nullable_htmlentities($row['payment_method_created_at']);
|
$payment_method_created_at = escapeHtml($row['payment_method_created_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -68,12 +68,12 @@ $num_rows = mysqli_num_rows($sql);
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$provider_id = intval($row['payment_provider_id']);
|
$provider_id = intval($row['payment_provider_id']);
|
||||||
$provider_name = nullable_htmlentities($row['payment_provider_name']);
|
$provider_name = escapeHtml($row['payment_provider_name']);
|
||||||
$provider_description = nullable_htmlentities($row['payment_provider_description']);
|
$provider_description = escapeHtml($row['payment_provider_description']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
$threshold = floatval($row['payment_provider_threshold']);
|
$threshold = floatval($row['payment_provider_threshold']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name'] ?? "Expense Disabled");
|
$vendor_name = escapeHtml($row['vendor_name'] ?? "Expense Disabled");
|
||||||
$category = nullable_htmlentities($row['category_name']);
|
$category = escapeHtml($row['category_name']);
|
||||||
$percent_fee = floatval($row['payment_provider_expense_percentage_fee']) * 100;
|
$percent_fee = floatval($row['payment_provider_expense_percentage_fee']) * 100;
|
||||||
$flat_fee = floatval($row['payment_provider_expense_flat_fee']);
|
$flat_fee = floatval($row['payment_provider_expense_flat_fee']);
|
||||||
|
|
||||||
|
|||||||
@@ -30,9 +30,9 @@ if (isset($_GET['delete_saved_payment'])) {
|
|||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$client_id = intval($row['saved_payment_client_id']);
|
$client_id = intval($row['saved_payment_client_id']);
|
||||||
$provider_id = intval($row['saved_payment_provider_id']);
|
$provider_id = intval($row['saved_payment_provider_id']);
|
||||||
$payment_provider_name = nullable_htmlentities($row['payment_provider_name']);
|
$payment_provider_name = escapeHtml($row['payment_provider_name']);
|
||||||
$saved_payment_description = nullable_htmlentities($row['saved_payment_description']);
|
$saved_payment_description = escapeHtml($row['saved_payment_description']);
|
||||||
$provider_client = nullable_htmlentities($row['payment_provider_client']);
|
$provider_client = escapeHtml($row['payment_provider_client']);
|
||||||
$payment_method = $row['saved_payment_provider_method'];
|
$payment_method = $row['saved_payment_provider_method'];
|
||||||
|
|
||||||
$private_key = $row['payment_provider_private_key'];
|
$private_key = $row['payment_provider_private_key'];
|
||||||
|
|||||||
@@ -31,7 +31,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if(isset($q)){ echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Project Templates">
|
<input type="search" class="form-control" name="q" value="<?php if(isset($q)){ echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Project Templates">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -63,9 +63,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while($row = mysqli_fetch_assoc($sql)){
|
while($row = mysqli_fetch_assoc($sql)){
|
||||||
$project_template_id = intval($row['project_template_id']);
|
$project_template_id = intval($row['project_template_id']);
|
||||||
$project_template_name = nullable_htmlentities($row['project_template_name']);
|
$project_template_name = escapeHtml($row['project_template_name']);
|
||||||
$project_template_description = nullable_htmlentities($row['project_template_description']);
|
$project_template_description = escapeHtml($row['project_template_description']);
|
||||||
$project_template_created_at = nullable_htmlentities($row['project_template_created_at']);
|
$project_template_created_at = escapeHtml($row['project_template_created_at']);
|
||||||
|
|
||||||
// Get Ticket Template Count
|
// Get Ticket Template Count
|
||||||
$sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
|
$sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
|
||||||
|
|||||||
@@ -21,10 +21,10 @@ if (isset($_GET['project_template_id'])) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql_project_templates);
|
$row = mysqli_fetch_assoc($sql_project_templates);
|
||||||
|
|
||||||
$project_template_name = nullable_htmlentities($row['project_template_name']);
|
$project_template_name = escapeHtml($row['project_template_name']);
|
||||||
$project_template_description = nullable_htmlentities($row['project_template_description']);
|
$project_template_description = escapeHtml($row['project_template_description']);
|
||||||
$project_template_created_at = date("Y-m-d", strtotime($row['project_template_created_at']));
|
$project_template_created_at = date("Y-m-d", strtotime($row['project_template_created_at']));
|
||||||
$project_template_updated_at = nullable_htmlentities($row['project_template_updated_at']);
|
$project_template_updated_at = escapeHtml($row['project_template_updated_at']);
|
||||||
|
|
||||||
// Get Associated Ticket Templates
|
// Get Associated Ticket Templates
|
||||||
$sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
|
$sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
|
||||||
@@ -145,11 +145,11 @@ if (isset($_GET['project_template_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
|
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
|
||||||
$ticket_template_id = intval($row['ticket_template_id']);
|
$ticket_template_id = intval($row['ticket_template_id']);
|
||||||
$ticket_template_order = intval($row['ticket_template_order']);
|
$ticket_template_order = intval($row['ticket_template_order']);
|
||||||
$ticket_template_name = nullable_htmlentities($row['ticket_template_name']);
|
$ticket_template_name = escapeHtml($row['ticket_template_name']);
|
||||||
$ticket_template_description = nullable_htmlentities($row['ticket_template_description']);
|
$ticket_template_description = escapeHtml($row['ticket_template_description']);
|
||||||
$ticket_template_subject = nullable_htmlentities($row['ticket_template_subject']);
|
$ticket_template_subject = escapeHtml($row['ticket_template_subject']);
|
||||||
$ticket_template_created_at = nullable_htmlentities($row['ticket_template_created_at']);
|
$ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
|
||||||
$ticket_template_updated_at = nullable_htmlentities($row['ticket_template_updated_at']);
|
$ticket_template_updated_at = escapeHtml($row['ticket_template_updated_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
@@ -194,7 +194,7 @@ if (isset($_GET['project_template_id'])) {
|
|||||||
<?php
|
<?php
|
||||||
while($row = mysqli_fetch_assoc($sql_task_templates)){
|
while($row = mysqli_fetch_assoc($sql_task_templates)){
|
||||||
$task_template_id = intval($row['task_template_id']);
|
$task_template_id = intval($row['task_template_id']);
|
||||||
$task_template_name = nullable_htmlentities($row['task_template_name']);
|
$task_template_name = escapeHtml($row['task_template_name']);
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
<td>
|
<td>
|
||||||
|
|||||||
@@ -34,7 +34,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Roles">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(escapeHtml($q));} ?>" placeholder="Search Roles">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -66,10 +66,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$role_id = intval($row['role_id']);
|
$role_id = intval($row['role_id']);
|
||||||
$role_name = nullable_htmlentities($row['role_name']);
|
$role_name = escapeHtml($row['role_name']);
|
||||||
$role_description = nullable_htmlentities($row['role_description']);
|
$role_description = escapeHtml($row['role_description']);
|
||||||
$role_admin = intval($row['role_is_admin']);
|
$role_admin = intval($row['role_is_admin']);
|
||||||
$role_archived_at = nullable_htmlentities($row['role_archived_at']);
|
$role_archived_at = escapeHtml($row['role_archived_at']);
|
||||||
|
|
||||||
// Count number of users that have each role
|
// Count number of users that have each role
|
||||||
$sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
|
$sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
|
||||||
@@ -81,7 +81,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
// Fetch each row and store the user_name in the array
|
// Fetch each row and store the user_name in the array
|
||||||
while($row = mysqli_fetch_assoc($sql_users)) {
|
while($row = mysqli_fetch_assoc($sql_users)) {
|
||||||
$user_names[] = nullable_htmlentities($row['user_name']);
|
$user_names[] = escapeHtml($row['user_name']);
|
||||||
}
|
}
|
||||||
|
|
||||||
// Convert the array of user names to a comma-separated string
|
// Convert the array of user names to a comma-separated string
|
||||||
|
|||||||
@@ -52,7 +52,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Saved Payment Methods">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(escapeHtml($q));} ?>" placeholder="Search Saved Payment Methods">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -107,13 +107,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$saved_payment_id = intval($row['saved_payment_id']);
|
$saved_payment_id = intval($row['saved_payment_id']);
|
||||||
$client_id = intval($row['saved_payment_client_id']);
|
$client_id = intval($row['saved_payment_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$provider_id = intval($row['saved_payment_provider_id']);
|
$provider_id = intval($row['saved_payment_provider_id']);
|
||||||
$provider_name = nullable_htmlentities($row['payment_provider_name']);
|
$provider_name = escapeHtml($row['payment_provider_name']);
|
||||||
$saved_payment_description = nullable_htmlentities($row['saved_payment_description']);
|
$saved_payment_description = escapeHtml($row['saved_payment_description']);
|
||||||
$provider_client = nullable_htmlentities($row['payment_provider_client']);
|
$provider_client = escapeHtml($row['payment_provider_client']);
|
||||||
$provider_payment_method = nullable_htmlentities($row['saved_payment_provider_method']);
|
$provider_payment_method = escapeHtml($row['saved_payment_provider_method']);
|
||||||
$saved_payment_created_at = nullable_htmlentities($row['saved_payment_created_at']);
|
$saved_payment_created_at = escapeHtml($row['saved_payment_created_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -6,22 +6,22 @@ $sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.c
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$company_id = intval($row['company_id']);
|
$company_id = intval($row['company_id']);
|
||||||
$company_name = nullable_htmlentities($row['company_name']);
|
$company_name = escapeHtml($row['company_name']);
|
||||||
$company_country = nullable_htmlentities($row['company_country']);
|
$company_country = escapeHtml($row['company_country']);
|
||||||
$company_address = nullable_htmlentities($row['company_address']);
|
$company_address = escapeHtml($row['company_address']);
|
||||||
$company_city = nullable_htmlentities($row['company_city']);
|
$company_city = escapeHtml($row['company_city']);
|
||||||
$company_state = nullable_htmlentities($row['company_state']);
|
$company_state = escapeHtml($row['company_state']);
|
||||||
$company_zip = nullable_htmlentities($row['company_zip']);
|
$company_zip = escapeHtml($row['company_zip']);
|
||||||
$company_phone_country_code = formatPhoneNumber($row['company_phone_country_code']);
|
$company_phone_country_code = formatPhoneNumber($row['company_phone_country_code']);
|
||||||
$company_phone = nullable_htmlentities(formatPhoneNumber($row['company_phone'], $company_phone_country_code));
|
$company_phone = escapeHtml(formatPhoneNumber($row['company_phone'], $company_phone_country_code));
|
||||||
$company_email = nullable_htmlentities($row['company_email']);
|
$company_email = escapeHtml($row['company_email']);
|
||||||
$company_website = nullable_htmlentities($row['company_website']);
|
$company_website = escapeHtml($row['company_website']);
|
||||||
$company_logo = nullable_htmlentities($row['company_logo']);
|
$company_logo = escapeHtml($row['company_logo']);
|
||||||
$company_locale = nullable_htmlentities($row['company_locale']);
|
$company_locale = escapeHtml($row['company_locale']);
|
||||||
$company_currency = nullable_htmlentities($row['company_currency']);
|
$company_currency = escapeHtml($row['company_currency']);
|
||||||
$company_tax_id = nullable_htmlentities($row['company_tax_id']);
|
$company_tax_id = escapeHtml($row['company_tax_id']);
|
||||||
|
|
||||||
$company_initials = nullable_htmlentities(initials($company_name));
|
$company_initials = escapeHtml(initials($company_name));
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
|
|||||||
@@ -28,18 +28,18 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="card card-dark">
|
<div class="card card-dark">
|
||||||
<div class="card-header py-2">
|
<div class="card-header py-2">
|
||||||
<h3 class="card-title mt-2"><i class="fa fa-fw fa-th-list mr-2"></i><?php echo nullable_htmlentities($table); ?> Fields</h3>
|
<h3 class="card-title mt-2"><i class="fa fa-fw fa-th-list mr-2"></i><?php echo escapeHtml($table); ?> Fields</h3>
|
||||||
<div class="card-tools">
|
<div class="card-tools">
|
||||||
<button type="button" class="btn btn-primary" data-toggle="modal" data-target="#createCustomFieldModal"><i class="fas fa-plus mr-2"></i>Create</button>
|
<button type="button" class="btn btn-primary" data-toggle="modal" data-target="#createCustomFieldModal"><i class="fas fa-plus mr-2"></i>Create</button>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="card-body">
|
<div class="card-body">
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<input type="hidden" name="table" value="<?php echo nullable_htmlentities($table); ?>">
|
<input type="hidden" name="table" value="<?php echo escapeHtml($table); ?>">
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-sm-4 mb-2">
|
<div class="col-sm-4 mb-2">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -68,8 +68,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$custom_field_id = intval($row['custom_field_id']);
|
$custom_field_id = intval($row['custom_field_id']);
|
||||||
$custom_field_label = nullable_htmlentities($row['custom_field_label']);
|
$custom_field_label = escapeHtml($row['custom_field_label']);
|
||||||
$custom_field_type = nullable_htmlentities($row['custom_field_type']);
|
$custom_field_type = escapeHtml($row['custom_field_type']);
|
||||||
$custom_field_location = intval($row['custom_field_location']);
|
$custom_field_location = intval($row['custom_field_location']);
|
||||||
$custom_field_order = intval($row['custom_field_order']);
|
$custom_field_order = intval($row['custom_field_order']);
|
||||||
|
|
||||||
|
|||||||
@@ -37,12 +37,12 @@ $net_terms_array = array (
|
|||||||
</div>
|
</div>
|
||||||
<select class="form-control select2" name="start_page" data-tags="true" required>
|
<select class="form-control select2" name="start_page" data-tags="true" required>
|
||||||
<?php if (!in_array($config_start_page, array_keys($start_page_select_array))) { ?>
|
<?php if (!in_array($config_start_page, array_keys($start_page_select_array))) { ?>
|
||||||
<option selected> <?php echo nullable_htmlentities($config_start_page); ?></option>
|
<option selected> <?php echo escapeHtml($config_start_page); ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
<?php foreach ($start_page_select_array as $start_page_value => $start_page_name) { ?>
|
<?php foreach ($start_page_select_array as $start_page_value => $start_page_name) { ?>
|
||||||
<option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
|
<option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
|
||||||
value="<?php echo nullable_htmlentities($start_page_value); ?>">
|
value="<?php echo escapeHtml($start_page_value); ?>">
|
||||||
<?php echo nullable_htmlentities($start_page_name); ?>
|
<?php echo escapeHtml($start_page_name); ?>
|
||||||
</option>
|
</option>
|
||||||
<?php }?>
|
<?php }?>
|
||||||
</select>
|
</select>
|
||||||
@@ -62,7 +62,7 @@ $net_terms_array = array (
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$calendar_id = intval($row['calendar_id']);
|
$calendar_id = intval($row['calendar_id']);
|
||||||
$calendar_name = nullable_htmlentities($row['calendar_name']); ?>
|
$calendar_name = escapeHtml($row['calendar_name']); ?>
|
||||||
<option <?php if ($config_default_calendar == $calendar_id) {
|
<option <?php if ($config_default_calendar == $calendar_id) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?> value="<?php echo $calendar_id; ?>"><?php echo $calendar_name; ?></option>
|
} ?> value="<?php echo $calendar_id; ?>"><?php echo $calendar_name; ?></option>
|
||||||
@@ -85,7 +85,7 @@ $net_terms_array = array (
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']); ?>
|
$account_name = escapeHtml($row['account_name']); ?>
|
||||||
<option <?php if ($config_default_transfer_from_account == $account_id) {
|
<option <?php if ($config_default_transfer_from_account == $account_id) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
||||||
@@ -108,7 +108,7 @@ $net_terms_array = array (
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']); ?>
|
$account_name = escapeHtml($row['account_name']); ?>
|
||||||
<option <?php if ($config_default_transfer_to_account == $account_id) {
|
<option <?php if ($config_default_transfer_to_account == $account_id) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
||||||
@@ -131,7 +131,7 @@ $net_terms_array = array (
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']); ?>
|
$account_name = escapeHtml($row['account_name']); ?>
|
||||||
<option <?php if ($config_default_payment_account == $account_id) {
|
<option <?php if ($config_default_payment_account == $account_id) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
||||||
@@ -156,7 +156,7 @@ $net_terms_array = array (
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']); ?>
|
$account_name = escapeHtml($row['account_name']); ?>
|
||||||
<option <?php if ($config_default_expense_account == $account_id) {
|
<option <?php if ($config_default_expense_account == $account_id) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
} ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
||||||
@@ -178,7 +178,7 @@ $net_terms_array = array (
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$payment_method = nullable_htmlentities($row['category_name']); ?>
|
$payment_method = escapeHtml($row['category_name']); ?>
|
||||||
<option <?php if ($config_default_payment_method == $payment_method) {
|
<option <?php if ($config_default_payment_method == $payment_method) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?>><?php echo $payment_method; ?></option>
|
} ?>><?php echo $payment_method; ?></option>
|
||||||
@@ -200,7 +200,7 @@ $net_terms_array = array (
|
|||||||
|
|
||||||
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$payment_method = nullable_htmlentities($row['category_name']); ?>
|
$payment_method = escapeHtml($row['category_name']); ?>
|
||||||
<option <?php if ($config_default_expense_payment_method == $payment_method) {
|
<option <?php if ($config_default_expense_payment_method == $payment_method) {
|
||||||
echo "selected";
|
echo "selected";
|
||||||
} ?>><?php echo $payment_method; ?></option>
|
} ?>><?php echo $payment_method; ?></option>
|
||||||
|
|||||||
@@ -18,7 +18,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="config_invoice_prefix" placeholder="Invoice Prefix" value="<?php echo nullable_htmlentities($config_invoice_prefix); ?>" required>
|
<input type="text" class="form-control" name="config_invoice_prefix" placeholder="Invoice Prefix" value="<?php echo escapeHtml($config_invoice_prefix); ?>" required>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
@@ -34,7 +34,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Invoice Footer</label>
|
<label>Invoice Footer</label>
|
||||||
<textarea class="form-control" rows="4" name="config_invoice_footer"><?php echo nullable_htmlentities($config_invoice_footer); ?></textarea>
|
<textarea class="form-control" rows="4" name="config_invoice_footer"><?php echo escapeHtml($config_invoice_footer); ?></textarea>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<h5>Show Tax ID On Invoices</h5>
|
<h5>Show Tax ID On Invoices</h5>
|
||||||
@@ -72,7 +72,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-bell"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-bell"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="email" class="form-control" name="config_invoice_paid_notification_email" placeholder="Address to notify for paid invoices, leave blank for none" value="<?php echo nullable_htmlentities($config_invoice_paid_notification_email); ?>">
|
<input type="email" class="form-control" name="config_invoice_paid_notification_email" placeholder="Address to notify for paid invoices, leave blank for none" value="<?php echo escapeHtml($config_invoice_paid_notification_email); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
@@ -86,7 +86,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="config_recurring_invoice_prefix" placeholder="Recurring Invoice Prefix" value="<?php echo nullable_htmlentities($config_recurring_invoice_prefix); ?>" required>
|
<input type="text" class="form-control" name="config_recurring_invoice_prefix" placeholder="Recurring Invoice Prefix" value="<?php echo escapeHtml($config_recurring_invoice_prefix); ?>" required>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|||||||
@@ -5,8 +5,8 @@ require_once "includes/inc_all_admin.php";
|
|||||||
$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
|
$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$company_locale = nullable_htmlentities($row['company_locale']);
|
$company_locale = escapeHtml($row['company_locale']);
|
||||||
$company_currency = nullable_htmlentities($row['company_currency']);
|
$company_currency = escapeHtml($row['company_currency']);
|
||||||
|
|
||||||
// Get a list of all available timezones
|
// Get a list of all available timezones
|
||||||
$timezones = DateTimeZone::listIdentifiers();
|
$timezones = DateTimeZone::listIdentifiers();
|
||||||
|
|||||||
@@ -116,7 +116,7 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label>SMTP Host</label>
|
<label>SMTP Host</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-server"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-server"></i></span></div>
|
||||||
<input type="text" class="form-control" name="config_smtp_host" placeholder="smtp.yourcompany.com" value="<?php echo nullable_htmlentities($config_smtp_host); ?>" required>
|
<input type="text" class="form-control" name="config_smtp_host" placeholder="smtp.yourcompany.com" value="<?php echo escapeHtml($config_smtp_host); ?>" required>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group col-md-3">
|
<div class="form-group col-md-3">
|
||||||
@@ -145,7 +145,7 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label id="smtp_user_label">SMTP Username</label>
|
<label id="smtp_user_label">SMTP Username</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-user"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-user"></i></span></div>
|
||||||
<input type="text" class="form-control" name="config_smtp_username" id="config_smtp_username" placeholder="usually your full email address" value="<?php echo nullable_htmlentities($config_smtp_username); ?>">
|
<input type="text" class="form-control" name="config_smtp_username" id="config_smtp_username" placeholder="usually your full email address" value="<?php echo escapeHtml($config_smtp_username); ?>">
|
||||||
</div>
|
</div>
|
||||||
<small class="form-text text-muted" id="smtp_user_hint">Leave blank if no authentication is required.</small>
|
<small class="form-text text-muted" id="smtp_user_hint">Leave blank if no authentication is required.</small>
|
||||||
</div>
|
</div>
|
||||||
@@ -153,7 +153,7 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label>SMTP Password</label>
|
<label>SMTP Password</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
|
||||||
<input type="password" class="form-control" data-toggle="password" name="config_smtp_password" placeholder="mailbox or app password" value="<?php echo nullable_htmlentities($config_smtp_password); ?>" autocomplete="new-password">
|
<input type="password" class="form-control" data-toggle="password" name="config_smtp_password" placeholder="mailbox or app password" value="<?php echo escapeHtml($config_smtp_password); ?>" autocomplete="new-password">
|
||||||
<div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
|
<div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -196,7 +196,7 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label>IMAP Host</label>
|
<label>IMAP Host</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-server"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-server"></i></span></div>
|
||||||
<input type="text" class="form-control" name="config_imap_host" placeholder="imap.yourcompany.com" value="<?php echo nullable_htmlentities($config_imap_host); ?>">
|
<input type="text" class="form-control" name="config_imap_host" placeholder="imap.yourcompany.com" value="<?php echo escapeHtml($config_imap_host); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group col-md-3">
|
<div class="form-group col-md-3">
|
||||||
@@ -225,7 +225,7 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label id="imap_user_label">IMAP Username</label>
|
<label id="imap_user_label">IMAP Username</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-user"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-user"></i></span></div>
|
||||||
<input type="text" class="form-control" name="config_imap_username" placeholder="tickets@yourcompany.com" value="<?php echo nullable_htmlentities($config_imap_username); ?>" required>
|
<input type="text" class="form-control" name="config_imap_username" placeholder="tickets@yourcompany.com" value="<?php echo escapeHtml($config_imap_username); ?>" required>
|
||||||
</div>
|
</div>
|
||||||
<small class="form-text text-muted" id="imap_user_hint">The mailbox address to monitor for incoming tickets.</small>
|
<small class="form-text text-muted" id="imap_user_hint">The mailbox address to monitor for incoming tickets.</small>
|
||||||
</div>
|
</div>
|
||||||
@@ -233,7 +233,7 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label>IMAP Password</label>
|
<label>IMAP Password</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
|
||||||
<input type="password" class="form-control" data-toggle="password" name="config_imap_password" placeholder="mailbox or app password" value="<?php echo nullable_htmlentities($config_imap_password); ?>" autocomplete="new-password">
|
<input type="password" class="form-control" data-toggle="password" name="config_imap_password" placeholder="mailbox or app password" value="<?php echo escapeHtml($config_imap_password); ?>" autocomplete="new-password">
|
||||||
<div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
|
<div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -265,14 +265,14 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label>OAuth Client ID</label>
|
<label>OAuth Client ID</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-id-badge"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-id-badge"></i></span></div>
|
||||||
<input type="text" class="form-control" name="config_mail_oauth_client_id" id="config_mail_oauth_client_id" placeholder="Application (client) ID" value="<?php echo nullable_htmlentities($config_mail_oauth_client_id ?? ''); ?>">
|
<input type="text" class="form-control" name="config_mail_oauth_client_id" id="config_mail_oauth_client_id" placeholder="Application (client) ID" value="<?php echo escapeHtml($config_mail_oauth_client_id ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group col-md-6">
|
<div class="form-group col-md-6">
|
||||||
<label>OAuth Client Secret</label>
|
<label>OAuth Client Secret</label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
|
||||||
<input type="password" class="form-control" data-toggle="password" name="config_mail_oauth_client_secret" id="config_mail_oauth_client_secret" placeholder="Client secret value" value="<?php echo nullable_htmlentities($config_mail_oauth_client_secret ?? ''); ?>" autocomplete="new-password">
|
<input type="password" class="form-control" data-toggle="password" name="config_mail_oauth_client_secret" id="config_mail_oauth_client_secret" placeholder="Client secret value" value="<?php echo escapeHtml($config_mail_oauth_client_secret ?? ''); ?>" autocomplete="new-password">
|
||||||
<div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
|
<div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -282,18 +282,18 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<label>Tenant ID <small class="text-muted">— Microsoft 365 only</small></label>
|
<label>Tenant ID <small class="text-muted">— Microsoft 365 only</small></label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-building"></i></span></div>
|
<div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-building"></i></span></div>
|
||||||
<input type="text" class="form-control" name="config_mail_oauth_tenant_id" placeholder="Directory (tenant) ID, e.g. 00000000-0000-0000-0000-000000000000" value="<?php echo nullable_htmlentities($config_mail_oauth_tenant_id ?? ''); ?>">
|
<input type="text" class="form-control" name="config_mail_oauth_tenant_id" placeholder="Directory (tenant) ID, e.g. 00000000-0000-0000-0000-000000000000" value="<?php echo escapeHtml($config_mail_oauth_tenant_id ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div class="form-row">
|
<div class="form-row">
|
||||||
<div class="form-group col-md-6">
|
<div class="form-group col-md-6">
|
||||||
<label>Refresh Token</label>
|
<label>Refresh Token</label>
|
||||||
<textarea class="form-control" name="config_mail_oauth_refresh_token" rows="2" placeholder="Paste a refresh token, or use the Connect button below to fetch one"><?php echo nullable_htmlentities($config_mail_oauth_refresh_token ?? ''); ?></textarea>
|
<textarea class="form-control" name="config_mail_oauth_refresh_token" rows="2" placeholder="Paste a refresh token, or use the Connect button below to fetch one"><?php echo escapeHtml($config_mail_oauth_refresh_token ?? ''); ?></textarea>
|
||||||
</div>
|
</div>
|
||||||
<div class="form-group col-md-6">
|
<div class="form-group col-md-6">
|
||||||
<label>Access Token <small class="text-muted">— optional</small></label>
|
<label>Access Token <small class="text-muted">— optional</small></label>
|
||||||
<textarea class="form-control" name="config_mail_oauth_access_token" rows="2" placeholder="Leave blank — auto-refreshed from the refresh token"><?php echo nullable_htmlentities($config_mail_oauth_access_token ?? ''); ?></textarea>
|
<textarea class="form-control" name="config_mail_oauth_access_token" rows="2" placeholder="Leave blank — auto-refreshed from the refresh token"><?php echo escapeHtml($config_mail_oauth_access_token ?? ''); ?></textarea>
|
||||||
<small class="form-text text-muted">Expires at: <?php echo !empty($config_mail_oauth_access_token_expires_at) ? htmlspecialchars($config_mail_oauth_access_token_expires_at) : 'n/a'; ?></small>
|
<small class="form-text text-muted">Expires at: <?php echo !empty($config_mail_oauth_access_token_expires_at) ? htmlspecialchars($config_mail_oauth_access_token_expires_at) : 'n/a'; ?></small>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -335,23 +335,23 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
<td class="align-middle">System Default<br><small class="text-muted">share links & system tasks</small></td>
|
<td class="align-middle">System Default<br><small class="text-muted">share links & system tasks</small></td>
|
||||||
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_mail_from_email" placeholder="noreply@yourcompany.com" value="<?php echo nullable_htmlentities($config_mail_from_email); ?>"></td>
|
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_mail_from_email" placeholder="noreply@yourcompany.com" value="<?php echo escapeHtml($config_mail_from_email); ?>"></td>
|
||||||
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_mail_from_name" placeholder="YourCompany" value="<?php echo nullable_htmlentities($config_mail_from_name); ?>"></td>
|
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_mail_from_name" placeholder="YourCompany" value="<?php echo escapeHtml($config_mail_from_name); ?>"></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td class="align-middle">Invoices<br><small class="text-muted">sent when emailing invoices</small></td>
|
<td class="align-middle">Invoices<br><small class="text-muted">sent when emailing invoices</small></td>
|
||||||
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_invoice_from_email" placeholder="billing@yourcompany.com" value="<?php echo nullable_htmlentities($config_invoice_from_email); ?>"></td>
|
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_invoice_from_email" placeholder="billing@yourcompany.com" value="<?php echo escapeHtml($config_invoice_from_email); ?>"></td>
|
||||||
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_invoice_from_name" placeholder="YourCompany Billing" value="<?php echo nullable_htmlentities($config_invoice_from_name); ?>"></td>
|
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_invoice_from_name" placeholder="YourCompany Billing" value="<?php echo escapeHtml($config_invoice_from_name); ?>"></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td class="align-middle">Quotes<br><small class="text-muted">sent when emailing quotes</small></td>
|
<td class="align-middle">Quotes<br><small class="text-muted">sent when emailing quotes</small></td>
|
||||||
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_quote_from_email" placeholder="sales@yourcompany.com" value="<?php echo nullable_htmlentities($config_quote_from_email); ?>"></td>
|
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_quote_from_email" placeholder="sales@yourcompany.com" value="<?php echo escapeHtml($config_quote_from_email); ?>"></td>
|
||||||
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_quote_from_name" placeholder="YourCompany Sales" value="<?php echo nullable_htmlentities($config_quote_from_name); ?>"></td>
|
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_quote_from_name" placeholder="YourCompany Sales" value="<?php echo escapeHtml($config_quote_from_name); ?>"></td>
|
||||||
</tr>
|
</tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td class="align-middle">Tickets<br><small class="text-muted">ticket creation & client replies</small></td>
|
<td class="align-middle">Tickets<br><small class="text-muted">ticket creation & client replies</small></td>
|
||||||
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_ticket_from_email" placeholder="support@yourcompany.com" value="<?php echo nullable_htmlentities($config_ticket_from_email); ?>"></td>
|
<td class="align-middle"><input type="email" class="form-control form-control-sm" name="config_ticket_from_email" placeholder="support@yourcompany.com" value="<?php echo escapeHtml($config_ticket_from_email); ?>"></td>
|
||||||
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_ticket_from_name" placeholder="YourCompany Support" value="<?php echo nullable_htmlentities($config_ticket_from_name); ?>"></td>
|
<td class="align-middle"><input type="text" class="form-control form-control-sm" name="config_ticket_from_name" placeholder="YourCompany Support" value="<?php echo escapeHtml($config_ticket_from_name); ?>"></td>
|
||||||
</tr>
|
</tr>
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
@@ -377,10 +377,10 @@ $imap_ready = $imap_standard_ready || $imap_oauth_ready;
|
|||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<select class="form-control select2" name="test_email" required>
|
<select class="form-control select2" name="test_email" required>
|
||||||
<option value="">- Select a From address -</option>
|
<option value="">- Select a From address -</option>
|
||||||
<?php if ($config_mail_from_email) { ?><option value="1"><?php echo nullable_htmlentities($config_mail_from_name); ?> (<?php echo nullable_htmlentities($config_mail_from_email); ?>)</option><?php } ?>
|
<?php if ($config_mail_from_email) { ?><option value="1"><?php echo escapeHtml($config_mail_from_name); ?> (<?php echo escapeHtml($config_mail_from_email); ?>)</option><?php } ?>
|
||||||
<?php if ($config_invoice_from_email) { ?><option value="2"><?php echo nullable_htmlentities($config_invoice_from_name); ?> (<?php echo nullable_htmlentities($config_invoice_from_email); ?>)</option><?php } ?>
|
<?php if ($config_invoice_from_email) { ?><option value="2"><?php echo escapeHtml($config_invoice_from_name); ?> (<?php echo escapeHtml($config_invoice_from_email); ?>)</option><?php } ?>
|
||||||
<?php if ($config_quote_from_email) { ?><option value="3"><?php echo nullable_htmlentities($config_quote_from_name); ?> (<?php echo nullable_htmlentities($config_quote_from_email); ?>)</option><?php } ?>
|
<?php if ($config_quote_from_email) { ?><option value="3"><?php echo escapeHtml($config_quote_from_name); ?> (<?php echo escapeHtml($config_quote_from_email); ?>)</option><?php } ?>
|
||||||
<?php if ($config_ticket_from_email) { ?><option value="4"><?php echo nullable_htmlentities($config_ticket_from_name); ?> (<?php echo nullable_htmlentities($config_ticket_from_email); ?>)</option><?php } ?>
|
<?php if ($config_ticket_from_email) { ?><option value="4"><?php echo escapeHtml($config_ticket_from_name); ?> (<?php echo escapeHtml($config_ticket_from_email); ?>)</option><?php } ?>
|
||||||
</select>
|
</select>
|
||||||
<input type="email" class="form-control" name="email_to" placeholder="recipient@example.com">
|
<input type="email" class="form-control" name="email_to" placeholder="recipient@example.com">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
|
|||||||
@@ -49,7 +49,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>White-label key</label>
|
<label>White-label key</label>
|
||||||
<textarea class="form-control" name="config_whitelabel_key" rows="2" placeholder="Enter a key to enable white-labelling the client portal"><?php echo nullable_htmlentities($config_whitelabel_key); ?></textarea>
|
<textarea class="form-control" name="config_whitelabel_key" rows="2" placeholder="Enter a key to enable white-labelling the client portal"><?php echo escapeHtml($config_whitelabel_key); ?></textarea>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<?php if ($config_whitelabel_enabled == 1 && validateWhitelabelKey($config_whitelabel_key)) {
|
<?php if ($config_whitelabel_enabled == 1 && validateWhitelabelKey($config_whitelabel_key)) {
|
||||||
|
|||||||
@@ -18,7 +18,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="config_project_prefix" placeholder="Project Prefix" value="<?php echo nullable_htmlentities($config_project_prefix); ?>" required>
|
<input type="text" class="form-control" name="config_project_prefix" placeholder="Project Prefix" value="<?php echo escapeHtml($config_project_prefix); ?>" required>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|||||||
@@ -16,7 +16,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-barcode"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="config_quote_prefix" placeholder="Quote Prefix" value="<?php echo nullable_htmlentities($config_quote_prefix); ?>" required>
|
<input type="text" class="form-control" name="config_quote_prefix" placeholder="Quote Prefix" value="<?php echo escapeHtml($config_quote_prefix); ?>" required>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
@@ -32,7 +32,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Quote Footer</label>
|
<label>Quote Footer</label>
|
||||||
<textarea class="form-control" rows="4" name="config_quote_footer"><?php echo nullable_htmlentities($config_quote_footer); ?></textarea>
|
<textarea class="form-control" rows="4" name="config_quote_footer"><?php echo escapeHtml($config_quote_footer); ?></textarea>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
@@ -41,7 +41,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-bell"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-bell"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="email" class="form-control" name="config_quote_notification_email" placeholder="Address to notify for quote accept/declines, leave blank for none" value="<?php echo nullable_htmlentities($config_quote_notification_email); ?>">
|
<input type="email" class="form-control" name="config_quote_notification_email" placeholder="Address to notify for quote accept/declines, leave blank for none" value="<?php echo escapeHtml($config_quote_notification_email); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|||||||
@@ -13,7 +13,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Login Message</label>
|
<label>Login Message</label>
|
||||||
<textarea class="form-control" name="config_login_message" rows="5" placeholder="Enter a message to be displayed on the login screen"><?php echo nullable_htmlentities($config_login_message); ?></textarea>
|
<textarea class="form-control" name="config_login_message" rows="5" placeholder="Enter a message to be displayed on the login screen"><?php echo escapeHtml($config_login_message); ?></textarea>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
@@ -24,12 +24,12 @@ require_once "includes/inc_all_admin.php";
|
|||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Login key secret value <small class="text-secondary">(This must be provided in the URL as /login.php?key=<?php echo nullable_htmlentities($config_login_key_secret)?>)</small></label>
|
<label>Login key secret value <small class="text-secondary">(This must be provided in the URL as /login.php?key=<?php echo escapeHtml($config_login_key_secret)?>)</small></label>
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="config_login_key_secret" pattern="\w{3,99}" placeholder="Something really easy for techs to remember: e.g. MYSECRET" value="<?php echo nullable_htmlentities($config_login_key_secret); ?>">
|
<input type="text" class="form-control" name="config_login_key_secret" pattern="\w{3,99}" placeholder="Something really easy for techs to remember: e.g. MYSECRET" value="<?php echo escapeHtml($config_login_key_secret); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|||||||
@@ -16,7 +16,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-life-ring"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-life-ring"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="text" class="form-control" name="config_ticket_prefix" placeholder="Ticket Prefix" value="<?php echo nullable_htmlentities($config_ticket_prefix); ?>" pattern="^[A-Za-z-]+$" title="Only letters and hyphens are allowed" required>
|
<input type="text" class="form-control" name="config_ticket_prefix" placeholder="Ticket Prefix" value="<?php echo escapeHtml($config_ticket_prefix); ?>" pattern="^[A-Za-z-]+$" title="Only letters and hyphens are allowed" required>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
@@ -76,7 +76,7 @@ require_once "includes/inc_all_admin.php";
|
|||||||
<div class="input-group-prepend">
|
<div class="input-group-prepend">
|
||||||
<span class="input-group-text"><i class="fa fa-fw fa-bell"></i></span>
|
<span class="input-group-text"><i class="fa fa-fw fa-bell"></i></span>
|
||||||
</div>
|
</div>
|
||||||
<input type="email" class="form-control" name="config_ticket_new_ticket_notification_email" placeholder="Address to notify for new tickets, leave blank for none" value="<?php echo nullable_htmlentities($config_ticket_new_ticket_notification_email); ?>">
|
<input type="email" class="form-control" name="config_ticket_new_ticket_notification_email" placeholder="Address to notify for new tickets, leave blank for none" value="<?php echo escapeHtml($config_ticket_new_ticket_notification_email); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
|||||||
@@ -30,7 +30,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if(isset($q)){ echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search License Templates">
|
<input type="search" class="form-control" name="q" value="<?php if(isset($q)){ echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search License Templates">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -70,12 +70,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while($row = mysqli_fetch_assoc($sql)){
|
while($row = mysqli_fetch_assoc($sql)){
|
||||||
$software_template_id = intval($row['software_template_id']);
|
$software_template_id = intval($row['software_template_id']);
|
||||||
$software_template_name = nullable_htmlentities($row['software_template_name']);
|
$software_template_name = escapeHtml($row['software_template_name']);
|
||||||
$software_template_version = nullable_htmlentities($row['software_template_version']);
|
$software_template_version = escapeHtml($row['software_template_version']);
|
||||||
$software_template_description = nullable_htmlentities($row['software_template_description']);
|
$software_template_description = escapeHtml($row['software_template_description']);
|
||||||
$software_template_type = nullable_htmlentities($row['software_template_type']);
|
$software_template_type = escapeHtml($row['software_template_type']);
|
||||||
$software_template_license_type = nullable_htmlentities($row['software_template_license_type']);
|
$software_template_license_type = escapeHtml($row['software_template_license_type']);
|
||||||
$software_template_notes = nullable_htmlentities($row['software_template_notes']);
|
$software_template_notes = escapeHtml($row['software_template_notes']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -51,7 +51,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="col-sm-4 mb-2">
|
<div class="col-sm-4 mb-2">
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search <?= $tag_type_display ?> Tags">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search <?= $tag_type_display ?> Tags">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -119,9 +119,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']);
|
$tag_name = escapeHtml($row['tag_name']);
|
||||||
$tag_color = nullable_htmlentities($row['tag_color']);
|
$tag_color = escapeHtml($row['tag_color']);
|
||||||
$tag_icon = nullable_htmlentities($row['tag_icon']);
|
$tag_icon = escapeHtml($row['tag_icon']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -47,7 +47,7 @@ $num_rows = mysqli_num_rows($sql);
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$tax_id = intval($row['tax_id']);
|
$tax_id = intval($row['tax_id']);
|
||||||
$tax_name = nullable_htmlentities($row['tax_name']);
|
$tax_name = escapeHtml($row['tax_name']);
|
||||||
$tax_percent = floatval($row['tax_percent']);
|
$tax_percent = floatval($row['tax_percent']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -30,7 +30,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="col-sm-4 mb-2">
|
<div class="col-sm-4 mb-2">
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Ticket Statuses">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Ticket Statuses">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -69,8 +69,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$ticket_status_id = intval($row['ticket_status_id']);
|
$ticket_status_id = intval($row['ticket_status_id']);
|
||||||
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
|
$ticket_status_name = escapeHtml($row['ticket_status_name']);
|
||||||
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
|
$ticket_status_color = escapeHtml($row['ticket_status_color']);
|
||||||
$ticket_status_active = intval($row['ticket_status_active']);
|
$ticket_status_active = intval($row['ticket_status_active']);
|
||||||
if ($ticket_status_active) {
|
if ($ticket_status_active) {
|
||||||
$ticket_status_display = "<div class='text-success text-bold'>Active</div>";
|
$ticket_status_display = "<div class='text-success text-bold'>Active</div>";
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if(isset($q)){ echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Ticket Templates">
|
<input type="search" class="form-control" name="q" value="<?php if(isset($q)){ echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Ticket Templates">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -71,10 +71,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while($row = mysqli_fetch_assoc($sql)){
|
while($row = mysqli_fetch_assoc($sql)){
|
||||||
$ticket_template_id = intval($row['ticket_template_id']);
|
$ticket_template_id = intval($row['ticket_template_id']);
|
||||||
$ticket_template_name = nullable_htmlentities($row['ticket_template_name']);
|
$ticket_template_name = escapeHtml($row['ticket_template_name']);
|
||||||
$ticket_template_description = nullable_htmlentities($row['ticket_template_description']);
|
$ticket_template_description = escapeHtml($row['ticket_template_description']);
|
||||||
$ticket_template_subject = nullable_htmlentities($row['ticket_template_subject']);
|
$ticket_template_subject = escapeHtml($row['ticket_template_subject']);
|
||||||
$ticket_template_created_at = nullable_htmlentities($row['ticket_template_created_at']);
|
$ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
|
||||||
$task_count = intval($row['task_count']);
|
$task_count = intval($row['task_count']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -25,12 +25,12 @@ if (mysqli_num_rows($sql_ticket_template) == 0) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql_ticket_template);
|
$row = mysqli_fetch_assoc($sql_ticket_template);
|
||||||
|
|
||||||
$ticket_template_name = nullable_htmlentities($row['ticket_template_name']);
|
$ticket_template_name = escapeHtml($row['ticket_template_name']);
|
||||||
$ticket_template_description = nullable_htmlentities($row['ticket_template_description']);
|
$ticket_template_description = escapeHtml($row['ticket_template_description']);
|
||||||
$ticket_template_subject = nullable_htmlentities($row['ticket_template_subject']);
|
$ticket_template_subject = escapeHtml($row['ticket_template_subject']);
|
||||||
$ticket_template_details = $purifier->purify($row['ticket_template_details']);
|
$ticket_template_details = $purifier->purify($row['ticket_template_details']);
|
||||||
$ticket_template_created_at = nullable_htmlentities($row['ticket_template_created_at']);
|
$ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
|
||||||
$ticket_template_updated_at = nullable_htmlentities($row['ticket_template_updated_at']);
|
$ticket_template_updated_at = escapeHtml($row['ticket_template_updated_at']);
|
||||||
|
|
||||||
// Get Task Templates
|
// Get Task Templates
|
||||||
$sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
|
$sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
|
||||||
@@ -92,9 +92,9 @@ $sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE
|
|||||||
<?php
|
<?php
|
||||||
while($row = mysqli_fetch_assoc($sql_task_templates)){
|
while($row = mysqli_fetch_assoc($sql_task_templates)){
|
||||||
$task_id = intval($row['task_template_id']);
|
$task_id = intval($row['task_template_id']);
|
||||||
$task_name = nullable_htmlentities($row['task_template_name']);
|
$task_name = escapeHtml($row['task_template_name']);
|
||||||
$task_completion_estimate = intval($row['task_template_completion_estimate']);
|
$task_completion_estimate = intval($row['task_template_completion_estimate']);
|
||||||
//$task_description = nullable_htmlentities($row['task_template_description']);
|
//$task_description = escapeHtml($row['task_template_description']);
|
||||||
?>
|
?>
|
||||||
<tr data-task-id="<?php echo $task_id; ?>">
|
<tr data-task-id="<?php echo $task_id; ?>">
|
||||||
<td>
|
<td>
|
||||||
|
|||||||
@@ -53,7 +53,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Users">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(escapeHtml($q));} ?>" placeholder="Search Users">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -106,8 +106,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$user_id = intval($row['user_id']);
|
$user_id = intval($row['user_id']);
|
||||||
$user_name = nullable_htmlentities($row['user_name']);
|
$user_name = escapeHtml($row['user_name']);
|
||||||
$user_email = nullable_htmlentities($row['user_email']);
|
$user_email = escapeHtml($row['user_email']);
|
||||||
$user_status = intval($row['user_status']);
|
$user_status = intval($row['user_status']);
|
||||||
if ($user_status == 2) {
|
if ($user_status == 2) {
|
||||||
$user_status_display = "<span class='text-info'>Invited</span>";
|
$user_status_display = "<span class='text-info'>Invited</span>";
|
||||||
@@ -116,8 +116,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
} else{
|
} else{
|
||||||
$user_status_display = "<span class='text-danger'>Disabled</span>";
|
$user_status_display = "<span class='text-danger'>Disabled</span>";
|
||||||
}
|
}
|
||||||
$user_avatar = nullable_htmlentities($row['user_avatar']);
|
$user_avatar = escapeHtml($row['user_avatar']);
|
||||||
$user_token = nullable_htmlentities($row['user_token']);
|
$user_token = escapeHtml($row['user_token']);
|
||||||
if(empty($user_token)) {
|
if(empty($user_token)) {
|
||||||
$mfa_status_display = "<i class='fas fa-fw fa-unlock text-danger'></i>";
|
$mfa_status_display = "<i class='fas fa-fw fa-unlock text-danger'></i>";
|
||||||
} else {
|
} else {
|
||||||
@@ -125,9 +125,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
}
|
}
|
||||||
$user_config_force_mfa = intval($row['user_config_force_mfa']);
|
$user_config_force_mfa = intval($row['user_config_force_mfa']);
|
||||||
$user_role = intval($row['user_role_id']);
|
$user_role = intval($row['user_role_id']);
|
||||||
$user_role_display = nullable_htmlentities($row['role_name']);
|
$user_role_display = escapeHtml($row['role_name']);
|
||||||
$user_archived_at = nullable_htmlentities($row['user_archived_at']);
|
$user_archived_at = escapeHtml($row['user_archived_at']);
|
||||||
$user_initials = nullable_htmlentities(initials($user_name));
|
$user_initials = escapeHtml(initials($user_name));
|
||||||
|
|
||||||
|
|
||||||
$sql_last_login = mysqli_query(
|
$sql_last_login = mysqli_query(
|
||||||
@@ -140,9 +140,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$last_login = "<span class='text-bold'>Never logged in</span>";
|
$last_login = "<span class='text-bold'>Never logged in</span>";
|
||||||
} else {
|
} else {
|
||||||
$row = mysqli_fetch_assoc($sql_last_login);
|
$row = mysqli_fetch_assoc($sql_last_login);
|
||||||
$log_created_at = nullable_htmlentities($row['log_created_at']);
|
$log_created_at = escapeHtml($row['log_created_at']);
|
||||||
$log_ip = nullable_htmlentities($row['log_ip']);
|
$log_ip = escapeHtml($row['log_ip']);
|
||||||
$log_user_agent = nullable_htmlentities($row['log_user_agent']);
|
$log_user_agent = escapeHtml($row['log_user_agent']);
|
||||||
$log_user_os = getOS($log_user_agent);
|
$log_user_os = getOS($log_user_agent);
|
||||||
$log_user_browser = getWebBrowser($log_user_agent);
|
$log_user_browser = getWebBrowser($log_user_agent);
|
||||||
$last_login = "$log_created_at<small class='text-secondary'><div class='mt-1'>$log_user_os</div><div class='mt-1'>$log_user_browser</div><div class='mt-1'><i class='fa fa-fw fa-globe'></i> $log_ip</div></small>";
|
$last_login = "$log_created_at<small class='text-secondary'><div class='mt-1'>$log_user_os</div><div class='mt-1'>$log_user_browser</div><div class='mt-1'><i class='fa fa-fw fa-globe'></i> $log_ip</div></small>";
|
||||||
|
|||||||
@@ -31,7 +31,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="card-body">
|
<div class="card-body">
|
||||||
<form autocomplete="off">
|
<form autocomplete="off">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control col-md-4" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Accounts">
|
<input type="search" class="form-control col-md-4" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Accounts">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -61,10 +61,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
$opening_balance = floatval($row['opening_balance']);
|
$opening_balance = floatval($row['opening_balance']);
|
||||||
$account_currency_code = nullable_htmlentities($row['account_currency_code']);
|
$account_currency_code = escapeHtml($row['account_currency_code']);
|
||||||
$account_notes = nullable_htmlentities($row['account_notes']);
|
$account_notes = escapeHtml($row['account_notes']);
|
||||||
|
|
||||||
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
|
$sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id");
|
||||||
$row = mysqli_fetch_assoc($sql_payments);
|
$row = mysqli_fetch_assoc($sql_payments);
|
||||||
|
|||||||
@@ -135,10 +135,10 @@ if (isset($_GET['ticket_query_views'])) {
|
|||||||
$users = array_unique($users);
|
$users = array_unique($users);
|
||||||
if (count($users) > 1) {
|
if (count($users) > 1) {
|
||||||
// Multiple viewers
|
// Multiple viewers
|
||||||
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . nullable_htmlentities(implode(", ", $users) . " are viewing this ticket.");
|
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . escapeHtml(implode(", ", $users) . " are viewing this ticket.");
|
||||||
} else {
|
} else {
|
||||||
// Single viewer
|
// Single viewer
|
||||||
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . nullable_htmlentities(implode("", $users) . " is viewing this ticket.");
|
$response['message'] = "<i class='fas fa-fw fa-eye mr-2'></i>" . escapeHtml(implode("", $users) . " is viewing this ticket.");
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
// No viewers
|
// No viewers
|
||||||
@@ -725,7 +725,7 @@ if (isset($_GET['client_duplicate_check'])) {
|
|||||||
|
|
||||||
if (mysqli_num_rows($sql_clients) > 0) {
|
if (mysqli_num_rows($sql_clients) > 0) {
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients)) {
|
while ($row = mysqli_fetch_assoc($sql_clients)) {
|
||||||
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . nullable_htmlentities($row['client_name']) . "</i> already exists.";
|
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . escapeHtml($row['client_name']) . "</i> already exists.";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -747,7 +747,7 @@ if (isset($_GET['contact_email_check'])) {
|
|||||||
$sql_contacts = mysqli_query($mysqli, "SELECT contact_email FROM contacts WHERE contact_email = '$email' LIMIT 1");
|
$sql_contacts = mysqli_query($mysqli, "SELECT contact_email FROM contacts WHERE contact_email = '$email' LIMIT 1");
|
||||||
if (mysqli_num_rows($sql_contacts) > 0) {
|
if (mysqli_num_rows($sql_contacts) > 0) {
|
||||||
while ($row = mysqli_fetch_assoc($sql_contacts)) {
|
while ($row = mysqli_fetch_assoc($sql_contacts)) {
|
||||||
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . nullable_htmlentities($row['contact_email']) . "</i> already exists.";
|
$response['message'] = "<i class='fas fa-fw fa-copy mr-2'></i> Potential duplicate: <i>" . escapeHtml($row['contact_email']) . "</i> already exists.";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -31,58 +31,58 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_type = nullable_htmlentities($row['asset_type']);
|
$asset_type = escapeHtml($row['asset_type']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_description = nullable_htmlentities($row['asset_description']);
|
$asset_description = escapeHtml($row['asset_description']);
|
||||||
$asset_make = nullable_htmlentities($row['asset_make']);
|
$asset_make = escapeHtml($row['asset_make']);
|
||||||
$asset_model = nullable_htmlentities($row['asset_model']);
|
$asset_model = escapeHtml($row['asset_model']);
|
||||||
$asset_serial = nullable_htmlentities($row['asset_serial']);
|
$asset_serial = escapeHtml($row['asset_serial']);
|
||||||
$asset_os = nullable_htmlentities($row['asset_os']);
|
$asset_os = escapeHtml($row['asset_os']);
|
||||||
$asset_uri = sanitize_url($row['asset_uri']);
|
$asset_uri = sanitize_url($row['asset_uri']);
|
||||||
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
|
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
|
||||||
$asset_uri_client = sanitize_url($row['asset_uri_client']);
|
$asset_uri_client = sanitize_url($row['asset_uri_client']);
|
||||||
$asset_status = nullable_htmlentities($row['asset_status']);
|
$asset_status = escapeHtml($row['asset_status']);
|
||||||
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
|
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
|
||||||
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
|
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
|
||||||
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
|
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
|
||||||
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
|
$asset_install_date = escapeHtml($row['asset_install_date']);
|
||||||
$asset_photo = nullable_htmlentities($row['asset_photo']);
|
$asset_photo = escapeHtml($row['asset_photo']);
|
||||||
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
|
$asset_physical_location = escapeHtml($row['asset_physical_location']);
|
||||||
$asset_notes = nullable_htmlentities($row['asset_notes']);
|
$asset_notes = escapeHtml($row['asset_notes']);
|
||||||
$asset_favorite = intval($row['asset_favorite']);
|
$asset_favorite = intval($row['asset_favorite']);
|
||||||
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
|
$asset_created_at = escapeHtml($row['asset_created_at']);
|
||||||
$asset_vendor_id = intval($row['asset_vendor_id']);
|
$asset_vendor_id = intval($row['asset_vendor_id']);
|
||||||
$asset_location_id = intval($row['asset_location_id']);
|
$asset_location_id = intval($row['asset_location_id']);
|
||||||
$asset_contact_id = intval($row['asset_contact_id']);
|
$asset_contact_id = intval($row['asset_contact_id']);
|
||||||
|
|
||||||
$asset_ip = nullable_htmlentities($row['interface_ip']);
|
$asset_ip = escapeHtml($row['interface_ip']);
|
||||||
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
|
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
|
||||||
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
|
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
|
||||||
$asset_mac = nullable_htmlentities($row['interface_mac']);
|
$asset_mac = escapeHtml($row['interface_mac']);
|
||||||
$asset_network_id = intval($row['interface_network_id']);
|
$asset_network_id = intval($row['interface_network_id']);
|
||||||
|
|
||||||
$device_icon = getAssetIcon($asset_type);
|
$device_icon = getAssetIcon($asset_type);
|
||||||
|
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
|
$contact_archived_at = escapeHtml($row['contact_archived_at']);
|
||||||
if ($contact_archived_at) {
|
if ($contact_archived_at) {
|
||||||
$contact_name_display = "<span class='text-danger' title='Archived'><s>$contact_name</s></span>";
|
$contact_name_display = "<span class='text-danger' title='Archived'><s>$contact_name</s></span>";
|
||||||
} else {
|
} else {
|
||||||
$contact_name_display = $contact_name;
|
$contact_name_display = $contact_name;
|
||||||
}
|
}
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
if (empty($location_name)) {
|
if (empty($location_name)) {
|
||||||
$location_name = "-";
|
$location_name = "-";
|
||||||
}
|
}
|
||||||
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
|
$location_archived_at = escapeHtml($row['location_archived_at']);
|
||||||
if ($location_archived_at) {
|
if ($location_archived_at) {
|
||||||
$location_name_display = "<span class='text-danger' title='Archived'><s>$location_name</s></span>";
|
$location_name_display = "<span class='text-danger' title='Archived'><s>$location_name</s></span>";
|
||||||
} else {
|
} else {
|
||||||
@@ -129,12 +129,12 @@ if (isset($_GET['asset_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
|
||||||
|
|
||||||
$asset_tag_id = intval($row['tag_id']);
|
$asset_tag_id = intval($row['tag_id']);
|
||||||
$asset_tag_name = nullable_htmlentities($row['tag_name']);
|
$asset_tag_name = escapeHtml($row['tag_name']);
|
||||||
$asset_tag_color = nullable_htmlentities($row['tag_color']);
|
$asset_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($asset_tag_color)) {
|
if (empty($asset_tag_color)) {
|
||||||
$asset_tag_color = "dark";
|
$asset_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$asset_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($asset_tag_icon)) {
|
if (empty($asset_tag_icon)) {
|
||||||
$asset_tag_icon = "tag";
|
$asset_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
@@ -528,17 +528,17 @@ if (isset($_GET['asset_id'])) {
|
|||||||
<?php while ($row = mysqli_fetch_assoc($sql_related_interfaces)) { ?>
|
<?php while ($row = mysqli_fetch_assoc($sql_related_interfaces)) { ?>
|
||||||
<?php
|
<?php
|
||||||
$interface_id = intval($row['interface_id']);
|
$interface_id = intval($row['interface_id']);
|
||||||
$interface_name = nullable_htmlentities($row['interface_name']);
|
$interface_name = escapeHtml($row['interface_name']);
|
||||||
$interface_description = nullable_htmlentities($row['interface_description']);
|
$interface_description = escapeHtml($row['interface_description']);
|
||||||
$interface_type = nullable_htmlentities($row['interface_type']);
|
$interface_type = escapeHtml($row['interface_type']);
|
||||||
$interface_mac = nullable_htmlentities($row['interface_mac']);
|
$interface_mac = escapeHtml($row['interface_mac']);
|
||||||
$interface_ip = nullable_htmlentities($row['interface_ip']);
|
$interface_ip = escapeHtml($row['interface_ip']);
|
||||||
$interface_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
|
$interface_nat_ip = escapeHtml($row['interface_nat_ip']);
|
||||||
$interface_ipv6 = nullable_htmlentities($row['interface_ipv6']);
|
$interface_ipv6 = escapeHtml($row['interface_ipv6']);
|
||||||
$interface_primary = intval($row['interface_primary']);
|
$interface_primary = intval($row['interface_primary']);
|
||||||
$network_id = intval($row['network_id']);
|
$network_id = intval($row['network_id']);
|
||||||
$network_name = nullable_htmlentities($row['network_name']);
|
$network_name = escapeHtml($row['network_name']);
|
||||||
$interface_notes = nullable_htmlentities($row['interface_notes']);
|
$interface_notes = escapeHtml($row['interface_notes']);
|
||||||
|
|
||||||
// Prepare display text
|
// Prepare display text
|
||||||
$interface_mac_display = $interface_mac ?: '-';
|
$interface_mac_display = $interface_mac ?: '-';
|
||||||
@@ -550,10 +550,10 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
// Connected interface details
|
// Connected interface details
|
||||||
$connected_asset_id = intval($row['connected_asset_id']);
|
$connected_asset_id = intval($row['connected_asset_id']);
|
||||||
$connected_asset_name = nullable_htmlentities($row['connected_asset_name']);
|
$connected_asset_name = escapeHtml($row['connected_asset_name']);
|
||||||
$connected_asset_type = nullable_htmlentities($row['connected_asset_type']);
|
$connected_asset_type = escapeHtml($row['connected_asset_type']);
|
||||||
$connected_asset_icon = getAssetIcon($connected_asset_type);
|
$connected_asset_icon = getAssetIcon($connected_asset_type);
|
||||||
$connected_interface_name = nullable_htmlentities($row['connected_interface_name']);
|
$connected_interface_name = escapeHtml($row['connected_interface_name']);
|
||||||
|
|
||||||
|
|
||||||
// Show either "-" or "AssetName - Port"
|
// Show either "-" or "AssetName - Port"
|
||||||
@@ -640,29 +640,29 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
|
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
|
||||||
$credential_id = intval($row['credential_id']);
|
$credential_id = intval($row['credential_id']);
|
||||||
$credential_name = nullable_htmlentities($row['credential_name']);
|
$credential_name = escapeHtml($row['credential_name']);
|
||||||
$credential_description = nullable_htmlentities($row['credential_description']);
|
$credential_description = escapeHtml($row['credential_description']);
|
||||||
$credential_uri = nullable_htmlentities($row['credential_uri']);
|
$credential_uri = escapeHtml($row['credential_uri']);
|
||||||
if (empty($credential_uri)) {
|
if (empty($credential_uri)) {
|
||||||
$credential_uri_display = "-";
|
$credential_uri_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$credential_uri_display = "$credential_uri<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button><a href='$credential_uri' target='_blank'><i class='fa fa-external-link-alt text-secondary'></i></a>";
|
$credential_uri_display = "$credential_uri<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button><a href='$credential_uri' target='_blank'><i class='fa fa-external-link-alt text-secondary'></i></a>";
|
||||||
}
|
}
|
||||||
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
|
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
|
||||||
if (empty($credential_username)) {
|
if (empty($credential_username)) {
|
||||||
$credential_username_display = "-";
|
$credential_username_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
|
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
|
||||||
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
|
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
|
||||||
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
||||||
if (empty($credential_otp_secret)) {
|
if (empty($credential_otp_secret)) {
|
||||||
$otp_display = "-";
|
$otp_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
|
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
|
||||||
}
|
}
|
||||||
$credential_note = nullable_htmlentities($row['credential_note']);
|
$credential_note = escapeHtml($row['credential_note']);
|
||||||
$credential_favorite = intval($row['credential_favorite']);
|
$credential_favorite = intval($row['credential_favorite']);
|
||||||
$credential_contact_id = intval($row['credential_contact_id']);
|
$credential_contact_id = intval($row['credential_contact_id']);
|
||||||
$credential_asset_id = intval($row['credential_asset_id']);
|
$credential_asset_id = intval($row['credential_asset_id']);
|
||||||
@@ -674,12 +674,12 @@ if (isset($_GET['asset_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
|
||||||
|
|
||||||
$credential_tag_id = intval($row['tag_id']);
|
$credential_tag_id = intval($row['tag_id']);
|
||||||
$credential_tag_name = nullable_htmlentities($row['tag_name']);
|
$credential_tag_name = escapeHtml($row['tag_name']);
|
||||||
$credential_tag_color = nullable_htmlentities($row['tag_color']);
|
$credential_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($credential_tag_color)) {
|
if (empty($credential_tag_color)) {
|
||||||
$credential_tag_color = "dark";
|
$credential_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$credential_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($credential_tag_icon)) {
|
if (empty($credential_tag_icon)) {
|
||||||
$credential_tag_icon = "tag";
|
$credential_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
@@ -774,15 +774,15 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_software)) {
|
while ($row = mysqli_fetch_assoc($sql_related_software)) {
|
||||||
$software_id = intval($row['software_id']);
|
$software_id = intval($row['software_id']);
|
||||||
$software_name = nullable_htmlentities($row['software_name']);
|
$software_name = escapeHtml($row['software_name']);
|
||||||
$software_version = nullable_htmlentities($row['software_version']);
|
$software_version = escapeHtml($row['software_version']);
|
||||||
$software_type = nullable_htmlentities($row['software_type']);
|
$software_type = escapeHtml($row['software_type']);
|
||||||
$software_license_type = nullable_htmlentities($row['software_license_type']);
|
$software_license_type = escapeHtml($row['software_license_type']);
|
||||||
$software_key = nullable_htmlentities($row['software_key']);
|
$software_key = escapeHtml($row['software_key']);
|
||||||
$software_seats = nullable_htmlentities($row['software_seats']);
|
$software_seats = escapeHtml($row['software_seats']);
|
||||||
$software_purchase = nullable_htmlentities($row['software_purchase']);
|
$software_purchase = escapeHtml($row['software_purchase']);
|
||||||
$software_expire = nullable_htmlentities($row['software_expire']);
|
$software_expire = escapeHtml($row['software_expire']);
|
||||||
$software_notes = nullable_htmlentities($row['software_notes']);
|
$software_notes = escapeHtml($row['software_notes']);
|
||||||
|
|
||||||
$seat_count = 0;
|
$seat_count = 0;
|
||||||
|
|
||||||
@@ -860,11 +860,11 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
|
while ($row = mysqli_fetch_assoc($sql_related_documents)) {
|
||||||
$document_id = intval($row['document_id']);
|
$document_id = intval($row['document_id']);
|
||||||
$document_name = nullable_htmlentities($row['document_name']);
|
$document_name = escapeHtml($row['document_name']);
|
||||||
$document_description = nullable_htmlentities($row['document_description']);
|
$document_description = escapeHtml($row['document_description']);
|
||||||
$document_created_by = nullable_htmlentities($row['user_name']);
|
$document_created_by = escapeHtml($row['user_name']);
|
||||||
$document_created_at = nullable_htmlentities($row['document_created_at']);
|
$document_created_at = escapeHtml($row['document_created_at']);
|
||||||
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
|
$document_updated_at = escapeHtml($row['document_updated_at']);
|
||||||
|
|
||||||
$linked_documents[] = $document_id;
|
$linked_documents[] = $document_id;
|
||||||
|
|
||||||
@@ -939,10 +939,10 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_files)) {
|
while ($row = mysqli_fetch_assoc($sql_related_files)) {
|
||||||
$file_id = intval($row['file_id']);
|
$file_id = intval($row['file_id']);
|
||||||
$file_name = nullable_htmlentities($row['file_name']);
|
$file_name = escapeHtml($row['file_name']);
|
||||||
$file_description = nullable_htmlentities($row['file_description']);
|
$file_description = escapeHtml($row['file_description']);
|
||||||
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
|
$file_reference_name = escapeHtml($row['file_reference_name']);
|
||||||
$file_ext = nullable_htmlentities($row['file_ext']);
|
$file_ext = escapeHtml($row['file_ext']);
|
||||||
if ($file_ext == 'pdf') {
|
if ($file_ext == 'pdf') {
|
||||||
$file_icon = "file-pdf";
|
$file_icon = "file-pdf";
|
||||||
} elseif ($file_ext == 'gz' || $file_ext == 'tar' || $file_ext == 'zip' || $file_ext == '7z' || $file_ext == 'rar') {
|
} elseif ($file_ext == 'gz' || $file_ext == 'tar' || $file_ext == 'zip' || $file_ext == '7z' || $file_ext == 'rar') {
|
||||||
@@ -966,7 +966,7 @@ if (isset($_GET['asset_id'])) {
|
|||||||
} else {
|
} else {
|
||||||
$file_icon = "file";
|
$file_icon = "file";
|
||||||
}
|
}
|
||||||
$file_created_at = nullable_htmlentities($row['file_created_at']);
|
$file_created_at = escapeHtml($row['file_created_at']);
|
||||||
|
|
||||||
$linked_files[] = $file_id;
|
$linked_files[] = $file_id;
|
||||||
|
|
||||||
@@ -1011,10 +1011,10 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
|
||||||
$recurring_ticket_id = intval($row['recurring_ticket_id']);
|
$recurring_ticket_id = intval($row['recurring_ticket_id']);
|
||||||
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
|
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
|
||||||
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
|
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
|
||||||
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
|
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
|
||||||
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
|
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
@@ -1090,15 +1090,15 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
|
||||||
$ticket_id = intval($row['ticket_id']);
|
$ticket_id = intval($row['ticket_id']);
|
||||||
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
|
$ticket_prefix = escapeHtml($row['ticket_prefix']);
|
||||||
$ticket_number = intval($row['ticket_number']);
|
$ticket_number = intval($row['ticket_number']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
|
$ticket_priority = escapeHtml($row['ticket_priority']);
|
||||||
$ticket_status_id = intval($row['ticket_status_id']);
|
$ticket_status_id = intval($row['ticket_status_id']);
|
||||||
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
|
$ticket_status_name = escapeHtml($row['ticket_status_name']);
|
||||||
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
|
$ticket_status_color = escapeHtml($row['ticket_status_color']);
|
||||||
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
|
$ticket_created_at = escapeHtml($row['ticket_created_at']);
|
||||||
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
|
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
|
||||||
if (empty($ticket_updated_at)) {
|
if (empty($ticket_updated_at)) {
|
||||||
if ($ticket_status_name == "Closed") {
|
if ($ticket_status_name == "Closed") {
|
||||||
$ticket_updated_at_display = "<p>Never</p>";
|
$ticket_updated_at_display = "<p>Never</p>";
|
||||||
@@ -1108,7 +1108,7 @@ if (isset($_GET['asset_id'])) {
|
|||||||
} else {
|
} else {
|
||||||
$ticket_updated_at_display = $ticket_updated_at;
|
$ticket_updated_at_display = $ticket_updated_at;
|
||||||
}
|
}
|
||||||
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
|
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
|
||||||
|
|
||||||
if ($ticket_priority == "High") {
|
if ($ticket_priority == "High") {
|
||||||
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
|
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
|
||||||
@@ -1127,7 +1127,7 @@ if (isset($_GET['asset_id'])) {
|
|||||||
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
|
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
|
$ticket_assigned_to_display = escapeHtml($row['user_name']);
|
||||||
}
|
}
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -1181,10 +1181,10 @@ if (isset($_GET['asset_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_linked_services)) {
|
while ($row = mysqli_fetch_assoc($sql_linked_services)) {
|
||||||
$service_id = intval($row['service_id']);
|
$service_id = intval($row['service_id']);
|
||||||
$service_name = nullable_htmlentities($row['service_name']);
|
$service_name = escapeHtml($row['service_name']);
|
||||||
$service_description = nullable_htmlentities($row['service_description']);
|
$service_description = escapeHtml($row['service_description']);
|
||||||
$service_category = nullable_htmlentities($row['service_category']);
|
$service_category = escapeHtml($row['service_category']);
|
||||||
$service_importance = nullable_htmlentities($row['service_importance']);
|
$service_importance = escapeHtml($row['service_importance']);
|
||||||
|
|
||||||
$linked_services[] = $service_id;
|
$linked_services[] = $service_id;
|
||||||
|
|
||||||
|
|||||||
@@ -223,12 +223,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php if ($client_url) { ?>
|
<?php if ($client_url) { ?>
|
||||||
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
|
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
<input type="hidden" name="type" value="<?php echo stripslashes(nullable_htmlentities($_GET['type'])); ?>">
|
<input type="hidden" name="type" value="<?php echo stripslashes(escapeHtml($_GET['type'])); ?>">
|
||||||
<input type="hidden" name="archived" value="<?php echo $archived; ?>">
|
<input type="hidden" name="archived" value="<?php echo $archived; ?>">
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search <?php if (!empty($_GET['type'])) { echo ucwords(stripslashes(nullable_htmlentities($_GET['type']))); } else { echo "Asset"; } ?>s">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search <?php if (!empty($_GET['type'])) { echo ucwords(stripslashes(escapeHtml($_GET['type']))); } else { echo "Asset"; } ?>s">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -250,7 +250,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -277,7 +277,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -305,7 +305,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']); ?>
|
$tag_name = escapeHtml($row['tag_name']); ?>
|
||||||
|
|
||||||
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
||||||
|
|
||||||
@@ -517,63 +517,63 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_type = nullable_htmlentities($row['asset_type']);
|
$asset_type = escapeHtml($row['asset_type']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_description = nullable_htmlentities($row['asset_description']);
|
$asset_description = escapeHtml($row['asset_description']);
|
||||||
if ($asset_description) {
|
if ($asset_description) {
|
||||||
$asset_description_display = $asset_description;
|
$asset_description_display = $asset_description;
|
||||||
} else {
|
} else {
|
||||||
$asset_description_display = "-";
|
$asset_description_display = "-";
|
||||||
}
|
}
|
||||||
$asset_make = nullable_htmlentities($row['asset_make']);
|
$asset_make = escapeHtml($row['asset_make']);
|
||||||
$asset_model = nullable_htmlentities($row['asset_model']);
|
$asset_model = escapeHtml($row['asset_model']);
|
||||||
$asset_serial = nullable_htmlentities($row['asset_serial']);
|
$asset_serial = escapeHtml($row['asset_serial']);
|
||||||
if ($asset_serial) {
|
if ($asset_serial) {
|
||||||
$asset_serial_display = "<span class='text-monospace'>$asset_serial</span>";
|
$asset_serial_display = "<span class='text-monospace'>$asset_serial</span>";
|
||||||
} else {
|
} else {
|
||||||
$asset_serial_display = "-";
|
$asset_serial_display = "-";
|
||||||
}
|
}
|
||||||
$asset_os = nullable_htmlentities($row['asset_os']);
|
$asset_os = escapeHtml($row['asset_os']);
|
||||||
$asset_ip = getFallBack(nullable_htmlentities($row['interface_ip']));
|
$asset_ip = getFallBack(escapeHtml($row['interface_ip']));
|
||||||
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
|
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
|
||||||
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
|
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
|
||||||
$asset_mac = nullable_htmlentities(getFallBack($row['interface_mac']));
|
$asset_mac = escapeHtml(getFallBack($row['interface_mac']));
|
||||||
$asset_uri = sanitize_url($row['asset_uri']);
|
$asset_uri = sanitize_url($row['asset_uri']);
|
||||||
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
|
$asset_uri_2 = sanitize_url($row['asset_uri_2']);
|
||||||
$asset_uri_client = sanitize_url($row['asset_uri_client']);
|
$asset_uri_client = sanitize_url($row['asset_uri_client']);
|
||||||
$asset_status = nullable_htmlentities($row['asset_status']);
|
$asset_status = escapeHtml($row['asset_status']);
|
||||||
$asset_purchase_reference = nullable_htmlentities($row['asset_purchase_reference']);
|
$asset_purchase_reference = escapeHtml($row['asset_purchase_reference']);
|
||||||
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
|
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
|
||||||
if ($asset_purchase_date) {
|
if ($asset_purchase_date) {
|
||||||
$asset_purchase_date_display = $asset_purchase_date;
|
$asset_purchase_date_display = $asset_purchase_date;
|
||||||
} else {
|
} else {
|
||||||
$asset_purchase_date_display = "-";
|
$asset_purchase_date_display = "-";
|
||||||
}
|
}
|
||||||
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
|
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
|
||||||
if ($asset_warranty_expire) {
|
if ($asset_warranty_expire) {
|
||||||
$asset_warranty_expire_display = $asset_warranty_expire;
|
$asset_warranty_expire_display = $asset_warranty_expire;
|
||||||
} else {
|
} else {
|
||||||
$asset_warranty_expire_display = "-";
|
$asset_warranty_expire_display = "-";
|
||||||
}
|
}
|
||||||
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
|
$asset_install_date = escapeHtml($row['asset_install_date']);
|
||||||
if ($asset_install_date) {
|
if ($asset_install_date) {
|
||||||
$asset_install_date_display = $asset_install_date;
|
$asset_install_date_display = $asset_install_date;
|
||||||
} else {
|
} else {
|
||||||
$asset_install_date_display = "-";
|
$asset_install_date_display = "-";
|
||||||
}
|
}
|
||||||
$asset_photo = nullable_htmlentities($row['asset_photo']);
|
$asset_photo = escapeHtml($row['asset_photo']);
|
||||||
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
|
$asset_physical_location = escapeHtml($row['asset_physical_location']);
|
||||||
if ($asset_physical_location) {
|
if ($asset_physical_location) {
|
||||||
$asset_physical_location_display = "<div class='text-secondary'>$asset_physical_location</div>";
|
$asset_physical_location_display = "<div class='text-secondary'>$asset_physical_location</div>";
|
||||||
} else {
|
} else {
|
||||||
$asset_physical_location_display = "";
|
$asset_physical_location_display = "";
|
||||||
}
|
}
|
||||||
$asset_notes = nullable_htmlentities($row['asset_notes']);
|
$asset_notes = escapeHtml($row['asset_notes']);
|
||||||
$asset_favorite = intval($row['asset_favorite']);
|
$asset_favorite = intval($row['asset_favorite']);
|
||||||
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
|
$asset_created_at = escapeHtml($row['asset_created_at']);
|
||||||
$asset_archived_at = nullable_htmlentities($row['asset_archived_at']);
|
$asset_archived_at = escapeHtml($row['asset_archived_at']);
|
||||||
$asset_vendor_id = intval($row['asset_vendor_id']);
|
$asset_vendor_id = intval($row['asset_vendor_id']);
|
||||||
$asset_location_id = intval($row['asset_location_id']);
|
$asset_location_id = intval($row['asset_location_id']);
|
||||||
$asset_contact_id = intval($row['asset_contact_id']);
|
$asset_contact_id = intval($row['asset_contact_id']);
|
||||||
@@ -581,24 +581,24 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
$device_icon = getAssetIcon($asset_type);
|
$device_icon = getAssetIcon($asset_type);
|
||||||
|
|
||||||
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
|
$contact_archived_at = escapeHtml($row['contact_archived_at']);
|
||||||
if ($contact_archived_at) {
|
if ($contact_archived_at) {
|
||||||
$contact_archive_display = "<span class='text-danger'>(Archived)</span>";
|
$contact_archive_display = "<span class='text-danger'>(Archived)</span>";
|
||||||
} else {
|
} else {
|
||||||
$contact_archive_display = '';
|
$contact_archive_display = '';
|
||||||
}
|
}
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
if ($contact_name) {
|
if ($contact_name) {
|
||||||
$contact_name_display = "<a class='ajax-modal' href='#' data-modal-url='modals/contact/contact_details.php?id=$asset_contact_id' data-modal-size='lg'>$contact_name $contact_archive_display</a>";
|
$contact_name_display = "<a class='ajax-modal' href='#' data-modal-url='modals/contact/contact_details.php?id=$asset_contact_id' data-modal-size='lg'>$contact_name $contact_archive_display</a>";
|
||||||
} else {
|
} else {
|
||||||
$contact_name_display = "-";
|
$contact_name_display = "-";
|
||||||
}
|
}
|
||||||
|
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
if (empty($location_name)) {
|
if (empty($location_name)) {
|
||||||
$location_name = "-";
|
$location_name = "-";
|
||||||
}
|
}
|
||||||
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
|
$location_archived_at = escapeHtml($row['location_archived_at']);
|
||||||
if ($location_archived_at) {
|
if ($location_archived_at) {
|
||||||
$location_name_display = "<div class='text-danger' title='Archived'><s>$location_name</s></div>";
|
$location_name_display = "<div class='text-danger' title='Archived'><s>$location_name</s></div>";
|
||||||
} else {
|
} else {
|
||||||
@@ -615,12 +615,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
|
||||||
|
|
||||||
$asset_tag_id = intval($row['tag_id']);
|
$asset_tag_id = intval($row['tag_id']);
|
||||||
$asset_tag_name = nullable_htmlentities($row['tag_name']);
|
$asset_tag_name = escapeHtml($row['tag_name']);
|
||||||
$asset_tag_color = nullable_htmlentities($row['tag_color']);
|
$asset_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($asset_tag_color)) {
|
if (empty($asset_tag_color)) {
|
||||||
$asset_tag_color = "dark";
|
$asset_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$asset_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($asset_tag_icon)) {
|
if (empty($asset_tag_icon)) {
|
||||||
$asset_tag_icon = "tag";
|
$asset_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -41,8 +41,8 @@ if (isset($_GET['calendar_id'])) {
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM calendars");
|
$sql = mysqli_query($mysqli, "SELECT * FROM calendars");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$calendar_id = intval($row['calendar_id']);
|
$calendar_id = intval($row['calendar_id']);
|
||||||
$calendar_name = nullable_htmlentities($row['calendar_name']);
|
$calendar_name = escapeHtml($row['calendar_name']);
|
||||||
$calendar_color = nullable_htmlentities($row['calendar_color']);
|
$calendar_color = escapeHtml($row['calendar_color']);
|
||||||
?>
|
?>
|
||||||
<div class="form-group d-flex align-items-center">
|
<div class="form-group d-flex align-items-center">
|
||||||
<i class="fas fa-fw fa-circle mr-2" style="color:<?= $calendar_color ?>;"></i><?= $calendar_name ?>
|
<i class="fas fa-fw fa-circle mr-2" style="color:<?= $calendar_color ?>;"></i><?= $calendar_name ?>
|
||||||
@@ -128,15 +128,15 @@ require_once "modals/calendar/calendar_event_add.php";
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
|
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$event_id = intval($row['event_id']);
|
$event_id = intval($row['event_id']);
|
||||||
$event_title = nullable_htmlentities($row['event_title']);
|
$event_title = escapeHtml($row['event_title']);
|
||||||
$event_description = nullable_htmlentities($row['event_description']);
|
$event_description = escapeHtml($row['event_description']);
|
||||||
$event_location = nullable_htmlentities($row['event_location']);
|
$event_location = escapeHtml($row['event_location']);
|
||||||
$event_start = nullable_htmlentities($row['event_start']);
|
$event_start = escapeHtml($row['event_start']);
|
||||||
$event_end = nullable_htmlentities($row['event_end']);
|
$event_end = escapeHtml($row['event_end']);
|
||||||
$event_repeat = nullable_htmlentities($row['event_repeat']);
|
$event_repeat = escapeHtml($row['event_repeat']);
|
||||||
$calendar_id = intval($row['calendar_id']);
|
$calendar_id = intval($row['calendar_id']);
|
||||||
$calendar_name = nullable_htmlentities($row['calendar_name']);
|
$calendar_name = escapeHtml($row['calendar_name']);
|
||||||
$calendar_color = nullable_htmlentities($row['calendar_color']);
|
$calendar_color = escapeHtml($row['calendar_color']);
|
||||||
$client_id = intval($row['event_client_id']);
|
$client_id = intval($row['event_client_id']);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -87,7 +87,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Certificates">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Certificates">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -113,7 +113,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -196,15 +196,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$certificate_id = intval($row['certificate_id']);
|
$certificate_id = intval($row['certificate_id']);
|
||||||
$certificate_name = nullable_htmlentities($row['certificate_name']);
|
$certificate_name = escapeHtml($row['certificate_name']);
|
||||||
$certificate_description = nullable_htmlentities($row['certificate_description']);
|
$certificate_description = escapeHtml($row['certificate_description']);
|
||||||
$certificate_domain = nullable_htmlentities($row['certificate_domain']);
|
$certificate_domain = escapeHtml($row['certificate_domain']);
|
||||||
$certificate_issued_by = nullable_htmlentities($row['certificate_issued_by']);
|
$certificate_issued_by = escapeHtml($row['certificate_issued_by']);
|
||||||
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
|
$certificate_expire = escapeHtml($row['certificate_expire']);
|
||||||
$certificate_created_at = nullable_htmlentities($row['certificate_created_at']);
|
$certificate_created_at = escapeHtml($row['certificate_created_at']);
|
||||||
$certificate_archived_at = nullable_htmlentities($row['certificate_archived_at']);
|
$certificate_archived_at = escapeHtml($row['certificate_archived_at']);
|
||||||
|
|
||||||
$certificate_expire_ago = timeAgo($certificate_expire);
|
$certificate_expire_ago = timeAgo($certificate_expire);
|
||||||
// Convert the expiry date to a timestamp
|
// Convert the expiry date to a timestamp
|
||||||
|
|||||||
@@ -11,8 +11,8 @@ require_once 'libs/stripe-php/init.php';
|
|||||||
// Get Stripe vars
|
// Get Stripe vars
|
||||||
$stripe_vars = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT config_stripe_enable, config_stripe_publishable, config_stripe_secret FROM settings WHERE company_id = 1"));
|
$stripe_vars = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT config_stripe_enable, config_stripe_publishable, config_stripe_secret FROM settings WHERE company_id = 1"));
|
||||||
$config_stripe_enable = intval($stripe_vars['config_stripe_enable']);
|
$config_stripe_enable = intval($stripe_vars['config_stripe_enable']);
|
||||||
$config_stripe_publishable = nullable_htmlentities($stripe_vars['config_stripe_publishable']);
|
$config_stripe_publishable = escapeHtml($stripe_vars['config_stripe_publishable']);
|
||||||
$config_stripe_secret = nullable_htmlentities($stripe_vars['config_stripe_secret']);
|
$config_stripe_secret = escapeHtml($stripe_vars['config_stripe_secret']);
|
||||||
|
|
||||||
// Get client's StripeID from database
|
// Get client's StripeID from database
|
||||||
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
|
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
|
||||||
@@ -104,10 +104,10 @@ if (!$config_stripe_enable || !$config_stripe_publishable || !$config_stripe_sec
|
|||||||
logApp("Stripe", "error", "Exception when fetching payment method info for $stripe_pm: $error");
|
logApp("Stripe", "error", "Exception when fetching payment method info for $stripe_pm: $error");
|
||||||
}
|
}
|
||||||
|
|
||||||
$card_name = nullable_htmlentities($payment_method->billing_details->name);
|
$card_name = escapeHtml($payment_method->billing_details->name);
|
||||||
$card_brand = nullable_htmlentities($payment_method->card->display_brand);
|
$card_brand = escapeHtml($payment_method->card->display_brand);
|
||||||
$card_last4 = nullable_htmlentities($payment_method->card->last4);
|
$card_last4 = escapeHtml($payment_method->card->last4);
|
||||||
$card_expires = nullable_htmlentities($payment_method->card->exp_month) . "/" . nullable_htmlentities($payment_method->card->exp_year);
|
$card_expires = escapeHtml($payment_method->card->exp_month) . "/" . escapeHtml($payment_method->card->exp_year);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
|
|||||||
@@ -235,15 +235,15 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_important_contacts)) {
|
while ($row = mysqli_fetch_assoc($sql_important_contacts)) {
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_title = nullable_htmlentities($row['contact_title']);
|
$contact_title = escapeHtml($row['contact_title']);
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$contact_photo = nullable_htmlentities($row['contact_photo']);
|
$contact_photo = escapeHtml($row['contact_photo']);
|
||||||
$contact_primary = intval($row['contact_primary']);
|
$contact_primary = intval($row['contact_primary']);
|
||||||
$contact_initials = initials($contact_name);
|
$contact_initials = initials($contact_name);
|
||||||
if ($contact_primary == 1) {
|
if ($contact_primary == 1) {
|
||||||
@@ -319,11 +319,11 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_favorite_assets)) {
|
while ($row = mysqli_fetch_assoc($sql_favorite_assets)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_type = nullable_htmlentities($row['asset_type']);
|
$asset_type = escapeHtml($row['asset_type']);
|
||||||
$asset_icon = getAssetIcon($asset_type);
|
$asset_icon = getAssetIcon($asset_type);
|
||||||
$asset_make = nullable_htmlentities($row['asset_make']);
|
$asset_make = escapeHtml($row['asset_make']);
|
||||||
$asset_model = nullable_htmlentities($row['asset_model']);
|
$asset_model = escapeHtml($row['asset_model']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -363,8 +363,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_favorite_credentials)) {
|
while ($row = mysqli_fetch_assoc($sql_favorite_credentials)) {
|
||||||
$credential_id = intval($row['credential_id']);
|
$credential_id = intval($row['credential_id']);
|
||||||
$credential_name = nullable_htmlentities($row['credential_name']);
|
$credential_name = escapeHtml($row['credential_name']);
|
||||||
$credential_description = nullable_htmlentities($row['credential_description']);
|
$credential_description = escapeHtml($row['credential_description']);
|
||||||
$credential_uri = sanitize_url($row['credential_uri']);
|
$credential_uri = sanitize_url($row['credential_uri']);
|
||||||
if (empty($credential_uri)) {
|
if (empty($credential_uri)) {
|
||||||
$credential_uri_display = "-";
|
$credential_uri_display = "-";
|
||||||
@@ -372,14 +372,14 @@ $sql_asset_retired = mysqli_query(
|
|||||||
$credential_uri_display = "<a href='$credential_uri'>" . truncate($credential_uri,40) . "</a><button class='btn btn-sm clipboardjs' type='button' title='$credential_uri' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button>";
|
$credential_uri_display = "<a href='$credential_uri'>" . truncate($credential_uri,40) . "</a><button class='btn btn-sm clipboardjs' type='button' title='$credential_uri' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$credential_uri_2 = sanitize_url($row['credential_uri_2']);
|
$credential_uri_2 = sanitize_url($row['credential_uri_2']);
|
||||||
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
|
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
|
||||||
if (empty($credential_username)) {
|
if (empty($credential_username)) {
|
||||||
$credential_username_display = "-";
|
$credential_username_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
|
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
|
||||||
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
|
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
|
||||||
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
||||||
if (empty($credential_otp_secret)) {
|
if (empty($credential_otp_secret)) {
|
||||||
$otp_display = "";
|
$otp_display = "";
|
||||||
@@ -428,32 +428,32 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_shared_items)) {
|
while ($row = mysqli_fetch_assoc($sql_shared_items)) {
|
||||||
$item_id = intval($row['item_id']);
|
$item_id = intval($row['item_id']);
|
||||||
$item_active = nullable_htmlentities($row['item_active']);
|
$item_active = escapeHtml($row['item_active']);
|
||||||
$item_key = nullable_htmlentities($row['item_key']);
|
$item_key = escapeHtml($row['item_key']);
|
||||||
$item_type = nullable_htmlentities($row['item_type']);
|
$item_type = escapeHtml($row['item_type']);
|
||||||
$item_related_id = intval($row['item_related_id']);
|
$item_related_id = intval($row['item_related_id']);
|
||||||
$item_note = nullable_htmlentities($row['item_note']);
|
$item_note = escapeHtml($row['item_note']);
|
||||||
$item_recipient = nullable_htmlentities($row['item_recipient']);
|
$item_recipient = escapeHtml($row['item_recipient']);
|
||||||
$item_views = nullable_htmlentities($row['item_views']);
|
$item_views = escapeHtml($row['item_views']);
|
||||||
$item_view_limit = nullable_htmlentities($row['item_view_limit']);
|
$item_view_limit = escapeHtml($row['item_view_limit']);
|
||||||
$item_created_at = nullable_htmlentities($row['item_created_at']);
|
$item_created_at = escapeHtml($row['item_created_at']);
|
||||||
$item_expire_at = nullable_htmlentities($row['item_expire_at']);
|
$item_expire_at = escapeHtml($row['item_expire_at']);
|
||||||
$item_expire_at_human = timeAgo($row['item_expire_at']);
|
$item_expire_at_human = timeAgo($row['item_expire_at']);
|
||||||
|
|
||||||
if ($item_type == 'Credential') {
|
if ($item_type == 'Credential') {
|
||||||
$share_item_sql = mysqli_query($mysqli, "SELECT credential_name FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id");
|
$share_item_sql = mysqli_query($mysqli, "SELECT credential_name FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id");
|
||||||
$share_item = mysqli_fetch_assoc($share_item_sql);
|
$share_item = mysqli_fetch_assoc($share_item_sql);
|
||||||
$item_name = nullable_htmlentities($share_item['credential_name']);
|
$item_name = escapeHtml($share_item['credential_name']);
|
||||||
$item_icon = "fas fa-key";
|
$item_icon = "fas fa-key";
|
||||||
} elseif ($item_type == 'Document') {
|
} elseif ($item_type == 'Document') {
|
||||||
$share_item_sql = mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = $item_related_id AND document_client_id = $client_id");
|
$share_item_sql = mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = $item_related_id AND document_client_id = $client_id");
|
||||||
$share_item = mysqli_fetch_assoc($share_item_sql);
|
$share_item = mysqli_fetch_assoc($share_item_sql);
|
||||||
$item_name = nullable_htmlentities($share_item['document_name']);
|
$item_name = escapeHtml($share_item['document_name']);
|
||||||
$item_icon = "fas fa-folder";
|
$item_icon = "fas fa-folder";
|
||||||
} elseif ($item_type == 'File') {
|
} elseif ($item_type == 'File') {
|
||||||
$share_item_sql = mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id");
|
$share_item_sql = mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id");
|
||||||
$share_item = mysqli_fetch_assoc($share_item_sql);
|
$share_item = mysqli_fetch_assoc($share_item_sql);
|
||||||
$item_name = nullable_htmlentities($share_item['file_name']);
|
$item_name = escapeHtml($share_item['file_name']);
|
||||||
$item_icon = "fas fa-paperclip";
|
$item_icon = "fas fa-paperclip";
|
||||||
}
|
}
|
||||||
?>
|
?>
|
||||||
@@ -504,8 +504,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_domains_expiring)) {
|
while ($row = mysqli_fetch_assoc($sql_domains_expiring)) {
|
||||||
$domain_id = intval($row['domain_id']);
|
$domain_id = intval($row['domain_id']);
|
||||||
$domain_name = nullable_htmlentities($row['domain_name']);
|
$domain_name = escapeHtml($row['domain_name']);
|
||||||
$domain_expire = nullable_htmlentities($row['domain_expire']);
|
$domain_expire = escapeHtml($row['domain_expire']);
|
||||||
$domain_expire_human = timeAgo($row['domain_expire']);
|
$domain_expire_human = timeAgo($row['domain_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -522,8 +522,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_certificates_expiring)) {
|
while ($row = mysqli_fetch_assoc($sql_certificates_expiring)) {
|
||||||
$certificate_id = intval($row['certificate_id']);
|
$certificate_id = intval($row['certificate_id']);
|
||||||
$certificate_name = nullable_htmlentities($row['certificate_name']);
|
$certificate_name = escapeHtml($row['certificate_name']);
|
||||||
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
|
$certificate_expire = escapeHtml($row['certificate_expire']);
|
||||||
$certificate_expire_human = timeAgo($row['certificate_expire']);
|
$certificate_expire_human = timeAgo($row['certificate_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -540,8 +540,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_asset_warranties_expiring)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_warranties_expiring)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
|
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
|
||||||
$asset_warranty_expire_human = timeAgo($row['asset_warranty_expire']);
|
$asset_warranty_expire_human = timeAgo($row['asset_warranty_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -560,8 +560,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_asset_retire)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_retire)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
|
$asset_install_date = escapeHtml($row['asset_install_date']);
|
||||||
$asset_install_date_human = timeAgo($row['asset_install_date']);
|
$asset_install_date_human = timeAgo($row['asset_install_date']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -579,8 +579,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_licenses_expiring)) {
|
while ($row = mysqli_fetch_assoc($sql_licenses_expiring)) {
|
||||||
$software_id = intval($row['software_id']);
|
$software_id = intval($row['software_id']);
|
||||||
$software_name = nullable_htmlentities($row['software_name']);
|
$software_name = escapeHtml($row['software_name']);
|
||||||
$software_expire = nullable_htmlentities($row['software_expire']);
|
$software_expire = escapeHtml($row['software_expire']);
|
||||||
$software_expire_human = timeAgo($row['software_expire']);
|
$software_expire_human = timeAgo($row['software_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -622,8 +622,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_domains_expired)) {
|
while ($row = mysqli_fetch_assoc($sql_domains_expired)) {
|
||||||
$domain_id = intval($row['domain_id']);
|
$domain_id = intval($row['domain_id']);
|
||||||
$domain_name = nullable_htmlentities($row['domain_name']);
|
$domain_name = escapeHtml($row['domain_name']);
|
||||||
$domain_expire = nullable_htmlentities($row['domain_expire']);
|
$domain_expire = escapeHtml($row['domain_expire']);
|
||||||
$domain_expire_human = timeAgo($row['domain_expire']);
|
$domain_expire_human = timeAgo($row['domain_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -640,8 +640,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_certificates_expired)) {
|
while ($row = mysqli_fetch_assoc($sql_certificates_expired)) {
|
||||||
$certificate_id = intval($row['certificate_id']);
|
$certificate_id = intval($row['certificate_id']);
|
||||||
$certificate_name = nullable_htmlentities($row['certificate_name']);
|
$certificate_name = escapeHtml($row['certificate_name']);
|
||||||
$certificate_expire = nullable_htmlentities($row['certificate_expire']);
|
$certificate_expire = escapeHtml($row['certificate_expire']);
|
||||||
$certificate_expire_human = timeAgo($row['certificate_expire']);
|
$certificate_expire_human = timeAgo($row['certificate_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -658,8 +658,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_asset_warranties_expired)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_warranties_expired)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
|
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
|
||||||
$asset_warranty_expire_human = timeAgo($row['asset_warranty_expire']);
|
$asset_warranty_expire_human = timeAgo($row['asset_warranty_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -678,8 +678,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_asset_retired)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_retired)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
|
$asset_install_date = escapeHtml($row['asset_install_date']);
|
||||||
$asset_install_date_human = timeAgo($row['asset_install_date']);
|
$asset_install_date_human = timeAgo($row['asset_install_date']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -697,8 +697,8 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_licenses_expired)) {
|
while ($row = mysqli_fetch_assoc($sql_licenses_expired)) {
|
||||||
$software_id = intval($row['software_id']);
|
$software_id = intval($row['software_id']);
|
||||||
$software_name = nullable_htmlentities($row['software_name']);
|
$software_name = escapeHtml($row['software_name']);
|
||||||
$software_expire = nullable_htmlentities($row['software_expire']);
|
$software_expire = escapeHtml($row['software_expire']);
|
||||||
$software_expire_human = timeAgo($row['software_expire']);
|
$software_expire_human = timeAgo($row['software_expire']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -734,10 +734,10 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_stale_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_stale_tickets)) {
|
||||||
$ticket_id = intval($row['ticket_id']);
|
$ticket_id = intval($row['ticket_id']);
|
||||||
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
|
$ticket_prefix = escapeHtml($row['ticket_prefix']);
|
||||||
$ticket_number = intval($row['ticket_number']);
|
$ticket_number = intval($row['ticket_number']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
|
$ticket_created_at = escapeHtml($row['ticket_created_at']);
|
||||||
$ticket_created_at_human = timeAgo($row['ticket_created_at']);
|
$ticket_created_at_human = timeAgo($row['ticket_created_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -774,7 +774,7 @@ $sql_asset_retired = mysqli_query(
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_recent_activities)) {
|
while ($row = mysqli_fetch_assoc($sql_recent_activities)) {
|
||||||
$log_created_at_time_ago = timeAgo($row['log_created_at']);
|
$log_created_at_time_ago = timeAgo($row['log_created_at']);
|
||||||
$log_description = nullable_htmlentities($row['log_description']);
|
$log_description = escapeHtml($row['log_description']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
|
|||||||
@@ -33,7 +33,7 @@ if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) {
|
|||||||
// Industry Filter
|
// Industry Filter
|
||||||
if (isset($_GET['industry']) & !empty($_GET['industry'])) {
|
if (isset($_GET['industry']) & !empty($_GET['industry'])) {
|
||||||
$industry_query = "AND (clients.client_type = '" . sanitizeInput($_GET['industry']) . "')";
|
$industry_query = "AND (clients.client_type = '" . sanitizeInput($_GET['industry']) . "')";
|
||||||
$industry_filter = nullable_htmlentities($_GET['industry']);
|
$industry_filter = escapeHtml($_GET['industry']);
|
||||||
} else {
|
} else {
|
||||||
// Default - any
|
// Default - any
|
||||||
$industry_query = '';
|
$industry_query = '';
|
||||||
@@ -43,7 +43,7 @@ if (isset($_GET['industry']) & !empty($_GET['industry'])) {
|
|||||||
// Referral Filter
|
// Referral Filter
|
||||||
if (isset($_GET['referral']) & !empty($_GET['referral'])) {
|
if (isset($_GET['referral']) & !empty($_GET['referral'])) {
|
||||||
$referral_query = "AND (clients.client_referral = '" . sanitizeInput($_GET['referral']) . "')";
|
$referral_query = "AND (clients.client_referral = '" . sanitizeInput($_GET['referral']) . "')";
|
||||||
$referral_filter = nullable_htmlentities($_GET['referral']);
|
$referral_filter = escapeHtml($_GET['referral']);
|
||||||
} else {
|
} else {
|
||||||
// Default - any
|
// Default - any
|
||||||
$referral_query = '';
|
$referral_query = '';
|
||||||
@@ -114,7 +114,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="col-md-5">
|
<div class="col-md-5">
|
||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search <?php if($leads_filter == 0){ echo "clients"; } else { echo "leads"; } ?>" autofocus>
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search <?php if($leads_filter == 0){ echo "clients"; } else { echo "leads"; } ?>" autofocus>
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
@@ -219,9 +219,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Date range</label>
|
<label>Date range</label>
|
||||||
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
||||||
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
|
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
|
||||||
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
|
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
|
||||||
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
|
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="col-md-3">
|
<div class="col-md-3">
|
||||||
@@ -239,7 +239,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']); ?>
|
$tag_name = escapeHtml($row['tag_name']); ?>
|
||||||
|
|
||||||
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
||||||
|
|
||||||
@@ -256,7 +256,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
$sql_industries_filter = mysqli_query($mysqli, "SELECT DISTINCT client_type FROM clients WHERE 1 = 1 AND client_$archive_query AND client_type != '' $leads_query ORDER BY client_type ASC");
|
$sql_industries_filter = mysqli_query($mysqli, "SELECT DISTINCT client_type FROM clients WHERE 1 = 1 AND client_$archive_query AND client_type != '' $leads_query ORDER BY client_type ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_industries_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_industries_filter)) {
|
||||||
$industry_name = nullable_htmlentities($row['client_type']);
|
$industry_name = escapeHtml($row['client_type']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($industry_name == $industry_filter) { echo "selected"; } ?>><?php echo $industry_name; ?></option>
|
<option <?php if ($industry_name == $industry_filter) { echo "selected"; } ?>><?php echo $industry_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -275,7 +275,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<?php
|
<?php
|
||||||
$sql_referrals_filter = mysqli_query($mysqli, "SELECT DISTINCT client_referral FROM clients WHERE 1 = 1 AND client_$archive_query AND client_referral != '' $leads_query ORDER BY client_referral ASC");
|
$sql_referrals_filter = mysqli_query($mysqli, "SELECT DISTINCT client_referral FROM clients WHERE 1 = 1 AND client_$archive_query AND client_referral != '' $leads_query ORDER BY client_referral ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_referrals_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_referrals_filter)) {
|
||||||
$referral_name = nullable_htmlentities($row['client_referral']);
|
$referral_name = escapeHtml($row['client_referral']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($referral_name == $referral_filter) { echo "selected"; } ?>><?php echo $referral_name; ?></option>
|
<option <?php if ($referral_name == $referral_filter) { echo "selected"; } ?>><?php echo $referral_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -330,39 +330,39 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$client_type = nullable_htmlentities($row['client_type']);
|
$client_type = escapeHtml($row['client_type']);
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_country = nullable_htmlentities($row['location_country']);
|
$location_country = escapeHtml($row['location_country']);
|
||||||
$location_address = nullable_htmlentities($row['location_address']);
|
$location_address = escapeHtml($row['location_address']);
|
||||||
$location_city = nullable_htmlentities($row['location_city']);
|
$location_city = escapeHtml($row['location_city']);
|
||||||
$location_state = nullable_htmlentities($row['location_state']);
|
$location_state = escapeHtml($row['location_state']);
|
||||||
$location_zip = nullable_htmlentities($row['location_zip']);
|
$location_zip = escapeHtml($row['location_zip']);
|
||||||
if (empty($location_address) && empty($location_city) && empty($location_state) && empty($location_zip)) {
|
if (empty($location_address) && empty($location_city) && empty($location_state) && empty($location_zip)) {
|
||||||
$location_address_display = "-";
|
$location_address_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$location_address_display = "<div class='media'><i class='fa fa-fw fa-map-marker-alt text-secondary mt-1 mr-2'></i><div class='media-body'>$location_address<div>$location_city $location_state $location_zip</div><div><small>$location_country</small></div></div></div>";
|
$location_address_display = "<div class='media'><i class='fa fa-fw fa-map-marker-alt text-secondary mt-1 mr-2'></i><div class='media-body'>$location_address<div>$location_city $location_state $location_zip</div><div><small>$location_country</small></div></div></div>";
|
||||||
}
|
}
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_title = nullable_htmlentities($row['contact_title']);
|
$contact_title = escapeHtml($row['contact_title']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$client_website = nullable_htmlentities($row['client_website']);
|
$client_website = escapeHtml($row['client_website']);
|
||||||
$client_rate = floatval($row['client_rate']);
|
$client_rate = floatval($row['client_rate']);
|
||||||
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
|
$client_currency_code = escapeHtml($row['client_currency_code']);
|
||||||
$client_net_terms = intval($row['client_net_terms']);
|
$client_net_terms = intval($row['client_net_terms']);
|
||||||
$client_tax_id_number = nullable_htmlentities($row['client_tax_id_number']);
|
$client_tax_id_number = escapeHtml($row['client_tax_id_number']);
|
||||||
$client_referral = nullable_htmlentities($row['client_referral']);
|
$client_referral = escapeHtml($row['client_referral']);
|
||||||
$client_abbreviation = nullable_htmlentities($row['client_abbreviation']);
|
$client_abbreviation = escapeHtml($row['client_abbreviation']);
|
||||||
$client_notes = nullable_htmlentities($row['client_notes']);
|
$client_notes = escapeHtml($row['client_notes']);
|
||||||
$client_created_at = date('Y-m-d', strtotime($row['client_created_at']));
|
$client_created_at = date('Y-m-d', strtotime($row['client_created_at']));
|
||||||
$client_updated_at = nullable_htmlentities($row['client_updated_at']);
|
$client_updated_at = escapeHtml($row['client_updated_at']);
|
||||||
$client_archived_at = nullable_htmlentities($row['client_archived_at']);
|
$client_archived_at = escapeHtml($row['client_archived_at']);
|
||||||
$client_is_lead = intval($row['client_lead']);
|
$client_is_lead = intval($row['client_lead']);
|
||||||
|
|
||||||
// Abbreviation
|
// Abbreviation
|
||||||
@@ -376,12 +376,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
|
$sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
|
||||||
$client_tag_id = intval($row['tag_id']);
|
$client_tag_id = intval($row['tag_id']);
|
||||||
$client_tag_name = nullable_htmlentities($row['tag_name']);
|
$client_tag_name = escapeHtml($row['tag_name']);
|
||||||
$client_tag_color = nullable_htmlentities($row['tag_color']);
|
$client_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($client_tag_color)) {
|
if (empty($client_tag_color)) {
|
||||||
$client_tag_color = "dark";
|
$client_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$client_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$client_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($client_tag_icon)) {
|
if (empty($client_tag_icon)) {
|
||||||
$client_tag_icon = "tag";
|
$client_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -31,28 +31,28 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_title = nullable_htmlentities($row['contact_title']);
|
$contact_title = escapeHtml($row['contact_title']);
|
||||||
$contact_department =nullable_htmlentities($row['contact_department']);
|
$contact_department =escapeHtml($row['contact_department']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$contact_photo = nullable_htmlentities($row['contact_photo']);
|
$contact_photo = escapeHtml($row['contact_photo']);
|
||||||
$contact_pin = nullable_htmlentities($row['contact_pin']);
|
$contact_pin = escapeHtml($row['contact_pin']);
|
||||||
$contact_initials = initials($contact_name);
|
$contact_initials = initials($contact_name);
|
||||||
$contact_notes = nullable_htmlentities($row['contact_notes']);
|
$contact_notes = escapeHtml($row['contact_notes']);
|
||||||
$contact_primary = intval($row['contact_primary']);
|
$contact_primary = intval($row['contact_primary']);
|
||||||
$contact_important = intval($row['contact_important']);
|
$contact_important = intval($row['contact_important']);
|
||||||
$contact_billing = intval($row['contact_billing']);
|
$contact_billing = intval($row['contact_billing']);
|
||||||
$contact_technical = intval($row['contact_technical']);
|
$contact_technical = intval($row['contact_technical']);
|
||||||
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
|
$contact_created_at = escapeHtml($row['contact_created_at']);
|
||||||
$contact_location_id = intval($row['contact_location_id']);
|
$contact_location_id = intval($row['contact_location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
$auth_method = nullable_htmlentities($row['user_auth_method']);
|
$auth_method = escapeHtml($row['user_auth_method']);
|
||||||
$contact_client_id = intval($row['contact_client_id']);
|
$contact_client_id = intval($row['contact_client_id']);
|
||||||
|
|
||||||
// Override Tab Title // No Sanitizing needed as this var will opnly be used in the tab title
|
// Override Tab Title // No Sanitizing needed as this var will opnly be used in the tab title
|
||||||
@@ -123,12 +123,12 @@ if (isset($_GET['contact_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
|
||||||
|
|
||||||
$contact_tag_id = intval($row['tag_id']);
|
$contact_tag_id = intval($row['tag_id']);
|
||||||
$contact_tag_name = nullable_htmlentities($row['tag_name']);
|
$contact_tag_name = escapeHtml($row['tag_name']);
|
||||||
$contact_tag_color = nullable_htmlentities($row['tag_color']);
|
$contact_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($contact_tag_color)) {
|
if (empty($contact_tag_color)) {
|
||||||
$contact_tag_color = "dark";
|
$contact_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$contact_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$contact_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($contact_tag_icon)) {
|
if (empty($contact_tag_icon)) {
|
||||||
$contact_tag_icon = "tag";
|
$contact_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
@@ -365,48 +365,48 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_assets)) {
|
while ($row = mysqli_fetch_assoc($sql_related_assets)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_type = nullable_htmlentities($row['asset_type']);
|
$asset_type = escapeHtml($row['asset_type']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_description = nullable_htmlentities($row['asset_description']);
|
$asset_description = escapeHtml($row['asset_description']);
|
||||||
$asset_make = nullable_htmlentities($row['asset_make']);
|
$asset_make = escapeHtml($row['asset_make']);
|
||||||
$asset_model = nullable_htmlentities($row['asset_model']);
|
$asset_model = escapeHtml($row['asset_model']);
|
||||||
$asset_serial = nullable_htmlentities($row['asset_serial']);
|
$asset_serial = escapeHtml($row['asset_serial']);
|
||||||
if ($asset_serial) {
|
if ($asset_serial) {
|
||||||
$asset_serial_display = $asset_serial;
|
$asset_serial_display = $asset_serial;
|
||||||
} else {
|
} else {
|
||||||
$asset_serial_display = "-";
|
$asset_serial_display = "-";
|
||||||
}
|
}
|
||||||
$asset_os = nullable_htmlentities($row['asset_os']);
|
$asset_os = escapeHtml($row['asset_os']);
|
||||||
if (empty($asset_os)) {
|
if (empty($asset_os)) {
|
||||||
$asset_os_display = "-";
|
$asset_os_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$asset_os_display = $asset_os;
|
$asset_os_display = $asset_os;
|
||||||
}
|
}
|
||||||
$asset_ip = nullable_htmlentities($row['interface_ip']);
|
$asset_ip = escapeHtml($row['interface_ip']);
|
||||||
if (empty($asset_ip)) {
|
if (empty($asset_ip)) {
|
||||||
$asset_ip_display = "-";
|
$asset_ip_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$asset_ip_display = "$asset_ip<button class='btn btn-sm' data-clipboard-text='$asset_ip'><i class='far fa-copy text-secondary'></i></button>";
|
$asset_ip_display = "$asset_ip<button class='btn btn-sm' data-clipboard-text='$asset_ip'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$asset_nat_ip = nullable_htmlentities($row['interface_nat_ip']);
|
$asset_nat_ip = escapeHtml($row['interface_nat_ip']);
|
||||||
$asset_ipv6 = nullable_htmlentities($row['interface_ipv6']);
|
$asset_ipv6 = escapeHtml($row['interface_ipv6']);
|
||||||
$asset_mac = nullable_htmlentities($row['interface_mac']);
|
$asset_mac = escapeHtml($row['interface_mac']);
|
||||||
$asset_status = nullable_htmlentities($row['asset_status']);
|
$asset_status = escapeHtml($row['asset_status']);
|
||||||
$asset_purchase_date = nullable_htmlentities($row['asset_purchase_date']);
|
$asset_purchase_date = escapeHtml($row['asset_purchase_date']);
|
||||||
$asset_warranty_expire = nullable_htmlentities($row['asset_warranty_expire']);
|
$asset_warranty_expire = escapeHtml($row['asset_warranty_expire']);
|
||||||
$asset_install_date = nullable_htmlentities($row['asset_install_date']);
|
$asset_install_date = escapeHtml($row['asset_install_date']);
|
||||||
if (empty($asset_install_date)) {
|
if (empty($asset_install_date)) {
|
||||||
$asset_install_date_display = "-";
|
$asset_install_date_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$asset_install_date_display = $asset_install_date;
|
$asset_install_date_display = $asset_install_date;
|
||||||
}
|
}
|
||||||
$asset_uri = nullable_htmlentities($row['asset_uri']);
|
$asset_uri = escapeHtml($row['asset_uri']);
|
||||||
$asset_uri_2 = nullable_htmlentities($row['asset_uri_2']);
|
$asset_uri_2 = escapeHtml($row['asset_uri_2']);
|
||||||
$asset_photo = nullable_htmlentities($row['asset_photo']);
|
$asset_photo = escapeHtml($row['asset_photo']);
|
||||||
$asset_physical_location = nullable_htmlentities($row['asset_physical_location']);
|
$asset_physical_location = escapeHtml($row['asset_physical_location']);
|
||||||
$asset_notes = nullable_htmlentities($row['asset_notes']);
|
$asset_notes = escapeHtml($row['asset_notes']);
|
||||||
$asset_favorite = intval($row['asset_favorite']);
|
$asset_favorite = intval($row['asset_favorite']);
|
||||||
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
|
$asset_created_at = escapeHtml($row['asset_created_at']);
|
||||||
$device_icon = getAssetIcon($asset_type);
|
$device_icon = getAssetIcon($asset_type);
|
||||||
|
|
||||||
// Tags
|
// Tags
|
||||||
@@ -416,12 +416,12 @@ if (isset($_GET['contact_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
|
||||||
|
|
||||||
$asset_tag_id = intval($row['tag_id']);
|
$asset_tag_id = intval($row['tag_id']);
|
||||||
$asset_tag_name = nullable_htmlentities($row['tag_name']);
|
$asset_tag_name = escapeHtml($row['tag_name']);
|
||||||
$asset_tag_color = nullable_htmlentities($row['tag_color']);
|
$asset_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($asset_tag_color)) {
|
if (empty($asset_tag_color)) {
|
||||||
$asset_tag_color = "dark";
|
$asset_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$asset_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$asset_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($asset_tag_icon)) {
|
if (empty($asset_tag_icon)) {
|
||||||
$asset_tag_icon = "tag";
|
$asset_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
@@ -537,30 +537,30 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
|
while ($row = mysqli_fetch_assoc($sql_related_credentials)) {
|
||||||
$credential_id = intval($row['credentials_credential_id']);
|
$credential_id = intval($row['credentials_credential_id']);
|
||||||
$credential_name = nullable_htmlentities($row['credential_name']);
|
$credential_name = escapeHtml($row['credential_name']);
|
||||||
$credential_description = nullable_htmlentities($row['credential_description']);
|
$credential_description = escapeHtml($row['credential_description']);
|
||||||
$credential_uri = nullable_htmlentities($row['credential_uri']);
|
$credential_uri = escapeHtml($row['credential_uri']);
|
||||||
if (empty($credential_uri)) {
|
if (empty($credential_uri)) {
|
||||||
$credential_uri_display = "-";
|
$credential_uri_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$credential_uri_display = "$credential_uri<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button><a href='$credential_uri' target='_blank'><i class='fa fa-external-link-alt text-secondary'></i></a>";
|
$credential_uri_display = "$credential_uri<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button><a href='$credential_uri' target='_blank'><i class='fa fa-external-link-alt text-secondary'></i></a>";
|
||||||
}
|
}
|
||||||
$credential_uri_2 = nullable_htmlentities($row['credential_uri_2']);
|
$credential_uri_2 = escapeHtml($row['credential_uri_2']);
|
||||||
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
|
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
|
||||||
if (empty($credential_username)) {
|
if (empty($credential_username)) {
|
||||||
$credential_username_display = "-";
|
$credential_username_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
|
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
|
||||||
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
|
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
|
||||||
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
||||||
if (empty($credential_otp_secret)) {
|
if (empty($credential_otp_secret)) {
|
||||||
$otp_display = "-";
|
$otp_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
|
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
|
||||||
}
|
}
|
||||||
$credential_note = nullable_htmlentities($row['credential_note']);
|
$credential_note = escapeHtml($row['credential_note']);
|
||||||
$credential_favorite = intval($row['credential_favorite']);
|
$credential_favorite = intval($row['credential_favorite']);
|
||||||
$credential_contact_id = intval($row['credential_contact_id']);
|
$credential_contact_id = intval($row['credential_contact_id']);
|
||||||
$credential_asset_id = intval($row['credential_asset_id']);
|
$credential_asset_id = intval($row['credential_asset_id']);
|
||||||
@@ -572,12 +572,12 @@ if (isset($_GET['contact_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
|
||||||
|
|
||||||
$credential_tag_id = intval($row['tag_id']);
|
$credential_tag_id = intval($row['tag_id']);
|
||||||
$credential_tag_name = nullable_htmlentities($row['tag_name']);
|
$credential_tag_name = escapeHtml($row['tag_name']);
|
||||||
$credential_tag_color = nullable_htmlentities($row['tag_color']);
|
$credential_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($credential_tag_color)) {
|
if (empty($credential_tag_color)) {
|
||||||
$credential_tag_color = "dark";
|
$credential_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$credential_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($credential_tag_icon)) {
|
if (empty($credential_tag_icon)) {
|
||||||
$credential_tag_icon = "tag";
|
$credential_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
@@ -674,15 +674,15 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_linked_software)) {
|
while ($row = mysqli_fetch_assoc($sql_linked_software)) {
|
||||||
$software_id = intval($row['software_id']);
|
$software_id = intval($row['software_id']);
|
||||||
$software_name = nullable_htmlentities($row['software_name']);
|
$software_name = escapeHtml($row['software_name']);
|
||||||
$software_version = nullable_htmlentities($row['software_version']);
|
$software_version = escapeHtml($row['software_version']);
|
||||||
$software_type = nullable_htmlentities($row['software_type']);
|
$software_type = escapeHtml($row['software_type']);
|
||||||
$software_license_type = nullable_htmlentities($row['software_license_type']);
|
$software_license_type = escapeHtml($row['software_license_type']);
|
||||||
$software_key = nullable_htmlentities($row['software_key']);
|
$software_key = escapeHtml($row['software_key']);
|
||||||
$software_seats = nullable_htmlentities($row['software_seats']);
|
$software_seats = escapeHtml($row['software_seats']);
|
||||||
$software_purchase = nullable_htmlentities($row['software_purchase']);
|
$software_purchase = escapeHtml($row['software_purchase']);
|
||||||
$software_expire = nullable_htmlentities($row['software_expire']);
|
$software_expire = escapeHtml($row['software_expire']);
|
||||||
$software_notes = nullable_htmlentities($row['software_notes']);
|
$software_notes = escapeHtml($row['software_notes']);
|
||||||
|
|
||||||
$seat_count = 0;
|
$seat_count = 0;
|
||||||
|
|
||||||
@@ -749,10 +749,10 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_related_recurring_tickets)) {
|
||||||
$recurring_ticket_id = intval($row['recurring_ticket_id']);
|
$recurring_ticket_id = intval($row['recurring_ticket_id']);
|
||||||
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
|
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
|
||||||
$recurring_ticket_priority = nullable_htmlentities($row['recurring_ticket_priority']);
|
$recurring_ticket_priority = escapeHtml($row['recurring_ticket_priority']);
|
||||||
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
|
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
|
||||||
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
|
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
|
||||||
?>
|
?>
|
||||||
|
|
||||||
<tr>
|
<tr>
|
||||||
@@ -829,15 +829,15 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_related_tickets)) {
|
||||||
$ticket_id = intval($row['ticket_id']);
|
$ticket_id = intval($row['ticket_id']);
|
||||||
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
|
$ticket_prefix = escapeHtml($row['ticket_prefix']);
|
||||||
$ticket_number = intval($row['ticket_number']);
|
$ticket_number = intval($row['ticket_number']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
|
$ticket_priority = escapeHtml($row['ticket_priority']);
|
||||||
$ticket_status = nullable_htmlentities($row['ticket_status']);
|
$ticket_status = escapeHtml($row['ticket_status']);
|
||||||
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
|
$ticket_status_name = escapeHtml($row['ticket_status_name']);
|
||||||
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
|
$ticket_status_color = escapeHtml($row['ticket_status_color']);
|
||||||
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
|
$ticket_created_at = escapeHtml($row['ticket_created_at']);
|
||||||
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
|
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
|
||||||
if (empty($ticket_updated_at)) {
|
if (empty($ticket_updated_at)) {
|
||||||
if ($ticket_status == "Closed") {
|
if ($ticket_status == "Closed") {
|
||||||
$ticket_updated_at_display = "<p>Never</p>";
|
$ticket_updated_at_display = "<p>Never</p>";
|
||||||
@@ -847,7 +847,7 @@ if (isset($_GET['contact_id'])) {
|
|||||||
} else {
|
} else {
|
||||||
$ticket_updated_at_display = $ticket_updated_at;
|
$ticket_updated_at_display = $ticket_updated_at;
|
||||||
}
|
}
|
||||||
$ticket_closed_at = nullable_htmlentities($row['ticket_closed_at']);
|
$ticket_closed_at = escapeHtml($row['ticket_closed_at']);
|
||||||
|
|
||||||
if ($ticket_priority == "High") {
|
if ($ticket_priority == "High") {
|
||||||
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
|
$ticket_priority_display = "<span class='p-2 badge badge-danger'>$ticket_priority</span>";
|
||||||
@@ -866,7 +866,7 @@ if (isset($_GET['contact_id'])) {
|
|||||||
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
|
$ticket_assigned_to_display = "<p class='text-danger'>Not Assigned</p>";
|
||||||
}
|
}
|
||||||
} else {
|
} else {
|
||||||
$ticket_assigned_to_display = nullable_htmlentities($row['user_name']);
|
$ticket_assigned_to_display = escapeHtml($row['user_name']);
|
||||||
}
|
}
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -918,10 +918,10 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_linked_services)) {
|
while ($row = mysqli_fetch_assoc($sql_linked_services)) {
|
||||||
$service_id = intval($row['service_id']);
|
$service_id = intval($row['service_id']);
|
||||||
$service_name = nullable_htmlentities($row['service_name']);
|
$service_name = escapeHtml($row['service_name']);
|
||||||
$service_description = nullable_htmlentities($row['service_description']);
|
$service_description = escapeHtml($row['service_description']);
|
||||||
$service_category = nullable_htmlentities($row['service_category']);
|
$service_category = escapeHtml($row['service_category']);
|
||||||
$service_importance = nullable_htmlentities($row['service_importance']);
|
$service_importance = escapeHtml($row['service_importance']);
|
||||||
|
|
||||||
$linked_services[] = $service_id;
|
$linked_services[] = $service_id;
|
||||||
|
|
||||||
@@ -977,11 +977,11 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_linked_documents)) {
|
while ($row = mysqli_fetch_assoc($sql_linked_documents)) {
|
||||||
$document_id = intval($row['document_id']);
|
$document_id = intval($row['document_id']);
|
||||||
$document_name = nullable_htmlentities($row['document_name']);
|
$document_name = escapeHtml($row['document_name']);
|
||||||
$document_description = nullable_htmlentities($row['document_description']);
|
$document_description = escapeHtml($row['document_description']);
|
||||||
$document_created_by = nullable_htmlentities($row['user_name']);
|
$document_created_by = escapeHtml($row['user_name']);
|
||||||
$document_created_at = nullable_htmlentities($row['document_created_at']);
|
$document_created_at = escapeHtml($row['document_created_at']);
|
||||||
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
|
$document_updated_at = escapeHtml($row['document_updated_at']);
|
||||||
|
|
||||||
$linked_documents[] = $document_id;
|
$linked_documents[] = $document_id;
|
||||||
|
|
||||||
@@ -1043,13 +1043,13 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_linked_files)) {
|
while ($row = mysqli_fetch_assoc($sql_linked_files)) {
|
||||||
$file_id = intval($row['file_id']);
|
$file_id = intval($row['file_id']);
|
||||||
$file_name = nullable_htmlentities($row['file_name']);
|
$file_name = escapeHtml($row['file_name']);
|
||||||
$file_description = nullable_htmlentities($row['file_description']);
|
$file_description = escapeHtml($row['file_description']);
|
||||||
$file_size = nullable_htmlentities($row['file_size']);
|
$file_size = escapeHtml($row['file_size']);
|
||||||
$file_size_KB = round($file_size / 1024);
|
$file_size_KB = round($file_size / 1024);
|
||||||
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
|
$file_reference_name = escapeHtml($row['file_reference_name']);
|
||||||
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
|
$file_mime_type = escapeHtml($row['file_mime_type']);
|
||||||
$file_created_at = nullable_htmlentities($row['file_created_at']);
|
$file_created_at = escapeHtml($row['file_created_at']);
|
||||||
|
|
||||||
$linked_files[] = $file_id;
|
$linked_files[] = $file_id;
|
||||||
|
|
||||||
@@ -1115,10 +1115,10 @@ if (isset($_GET['contact_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_related_notes)) {
|
while ($row = mysqli_fetch_assoc($sql_related_notes)) {
|
||||||
$contact_note_id = intval($row['contact_note_id']);
|
$contact_note_id = intval($row['contact_note_id']);
|
||||||
$contact_note_type = nullable_htmlentities($row['contact_note_type']);
|
$contact_note_type = escapeHtml($row['contact_note_type']);
|
||||||
$contact_note = nl2br(nullable_htmlentities($row['contact_note']));
|
$contact_note = nl2br(escapeHtml($row['contact_note']));
|
||||||
$note_by = nullable_htmlentities($row['user_name']);
|
$note_by = escapeHtml($row['user_name']);
|
||||||
$contact_note_created_at = nullable_htmlentities($row['contact_note_created_at']);
|
$contact_note_created_at = escapeHtml($row['contact_note_created_at']);
|
||||||
|
|
||||||
// Get the corresponding icon for the note type
|
// Get the corresponding icon for the note type
|
||||||
$note_type_icon = isset($note_types_array[$contact_note_type]) ? $note_types_array[$contact_note_type] : 'fa-fw fa-sticky-note'; // default icon if not found
|
$note_type_icon = isset($note_types_array[$contact_note_type]) ? $note_types_array[$contact_note_type] : 'fa-fw fa-sticky-note'; // default icon if not found
|
||||||
|
|||||||
@@ -122,7 +122,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Contacts">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Contacts">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -146,7 +146,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']); ?>
|
$tag_name = escapeHtml($row['tag_name']); ?>
|
||||||
|
|
||||||
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
||||||
|
|
||||||
@@ -171,7 +171,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -198,7 +198,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -329,37 +329,37 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_title = nullable_htmlentities($row['contact_title']);
|
$contact_title = escapeHtml($row['contact_title']);
|
||||||
if (empty($contact_title)) {
|
if (empty($contact_title)) {
|
||||||
$contact_title_display = "";
|
$contact_title_display = "";
|
||||||
} else {
|
} else {
|
||||||
$contact_title_display = "<small class='text-secondary'>$contact_title</small>";
|
$contact_title_display = "<small class='text-secondary'>$contact_title</small>";
|
||||||
}
|
}
|
||||||
$contact_department = getFallBack(nullable_htmlentities($row['contact_department']));
|
$contact_department = getFallBack(escapeHtml($row['contact_department']));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
if (empty($contact_extension)) {
|
if (empty($contact_extension)) {
|
||||||
$contact_extension_display = "";
|
$contact_extension_display = "";
|
||||||
} else {
|
} else {
|
||||||
$contact_extension_display = "<small class='text-secondary ml-1'>x$contact_extension</small>";
|
$contact_extension_display = "<small class='text-secondary ml-1'>x$contact_extension</small>";
|
||||||
}
|
}
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
if (empty($contact_phone)) {
|
if (empty($contact_phone)) {
|
||||||
$contact_phone_display = "";
|
$contact_phone_display = "";
|
||||||
} else {
|
} else {
|
||||||
$contact_phone_display = "<div><i class='fas fa-fw fa-phone mr-2'></i><a href='tel:$contact_phone'>$contact_phone$contact_extension_display</a></div>";
|
$contact_phone_display = "<div><i class='fas fa-fw fa-phone mr-2'></i><a href='tel:$contact_phone'>$contact_phone$contact_extension_display</a></div>";
|
||||||
}
|
}
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
if (empty($contact_mobile)) {
|
if (empty($contact_mobile)) {
|
||||||
$contact_mobile_display = "";
|
$contact_mobile_display = "";
|
||||||
} else {
|
} else {
|
||||||
$contact_mobile_display = "<div class='mt-2'><i class='fas fa-fw fa-mobile-alt mr-2'></i><a href='tel:$contact_mobile'>$contact_mobile</a></div>";
|
$contact_mobile_display = "<div class='mt-2'><i class='fas fa-fw fa-mobile-alt mr-2'></i><a href='tel:$contact_mobile'>$contact_mobile</a></div>";
|
||||||
}
|
}
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
if (empty($contact_email)) {
|
if (empty($contact_email)) {
|
||||||
$contact_email_display = "";
|
$contact_email_display = "";
|
||||||
} else {
|
} else {
|
||||||
@@ -369,33 +369,33 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
if (empty($contact_info_display)) {
|
if (empty($contact_info_display)) {
|
||||||
$contact_info_display = "-";
|
$contact_info_display = "-";
|
||||||
}
|
}
|
||||||
$contact_pin = nullable_htmlentities($row['contact_pin']);
|
$contact_pin = escapeHtml($row['contact_pin']);
|
||||||
$contact_photo = nullable_htmlentities($row['contact_photo']);
|
$contact_photo = escapeHtml($row['contact_photo']);
|
||||||
$contact_initials = initials($contact_name);
|
$contact_initials = initials($contact_name);
|
||||||
$contact_notes = nullable_htmlentities($row['contact_notes']);
|
$contact_notes = escapeHtml($row['contact_notes']);
|
||||||
$contact_primary = intval($row['contact_primary']);
|
$contact_primary = intval($row['contact_primary']);
|
||||||
$contact_important = intval($row['contact_important']);
|
$contact_important = intval($row['contact_important']);
|
||||||
$contact_billing = intval($row['contact_billing']);
|
$contact_billing = intval($row['contact_billing']);
|
||||||
$contact_technical = intval($row['contact_technical']);
|
$contact_technical = intval($row['contact_technical']);
|
||||||
$contact_created_at = nullable_htmlentities($row['contact_created_at']);
|
$contact_created_at = escapeHtml($row['contact_created_at']);
|
||||||
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
|
$contact_archived_at = escapeHtml($row['contact_archived_at']);
|
||||||
if ($contact_primary == 1) {
|
if ($contact_primary == 1) {
|
||||||
$contact_primary_display = "<small class='text-success'>Primary Contact</small>";
|
$contact_primary_display = "<small class='text-success'>Primary Contact</small>";
|
||||||
} else {
|
} else {
|
||||||
$contact_primary_display = false;
|
$contact_primary_display = false;
|
||||||
}
|
}
|
||||||
$contact_location_id = intval($row['contact_location_id']);
|
$contact_location_id = intval($row['contact_location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
if (empty($location_name)) {
|
if (empty($location_name)) {
|
||||||
$location_name = "<span class='text-muted'>N/A</span>";
|
$location_name = "<span class='text-muted'>N/A</span>";
|
||||||
}
|
}
|
||||||
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
|
$location_archived_at = escapeHtml($row['location_archived_at']);
|
||||||
if ($location_archived_at) {
|
if ($location_archived_at) {
|
||||||
$location_name_display = "<div class='text-danger' title='Archived'><s>$location_name</s></div>";
|
$location_name_display = "<div class='text-danger' title='Archived'><s>$location_name</s></div>";
|
||||||
} else {
|
} else {
|
||||||
$location_name_display = $location_name;
|
$location_name_display = $location_name;
|
||||||
}
|
}
|
||||||
$auth_method = nullable_htmlentities($row['user_auth_method']);
|
$auth_method = escapeHtml($row['user_auth_method']);
|
||||||
$contact_user_id = intval($row['contact_user_id']);
|
$contact_user_id = intval($row['contact_user_id']);
|
||||||
if ($contact_user_id) {
|
if ($contact_user_id) {
|
||||||
$user_exists_display = "<span class='badge badge-pill badge-dark p-1' title='User: $auth_method'><i class='fas fa-fw fa-user'></i></span>";
|
$user_exists_display = "<span class='badge badge-pill badge-dark p-1' title='User: $auth_method'><i class='fas fa-fw fa-user'></i></span>";
|
||||||
@@ -448,12 +448,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
|
||||||
|
|
||||||
$contact_tag_id = intval($row['tag_id']);
|
$contact_tag_id = intval($row['tag_id']);
|
||||||
$contact_tag_name = nullable_htmlentities($row['tag_name']);
|
$contact_tag_name = escapeHtml($row['tag_name']);
|
||||||
$contact_tag_color = nullable_htmlentities($row['tag_color']);
|
$contact_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($contact_tag_color)) {
|
if (empty($contact_tag_color)) {
|
||||||
$contact_tag_color = "dark";
|
$contact_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$contact_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$contact_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($contact_tag_icon)) {
|
if (empty($contact_tag_icon)) {
|
||||||
$contact_tag_icon = "tag";
|
$contact_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -139,7 +139,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Credentials">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Credentials">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -163,7 +163,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']); ?>
|
$tag_name = escapeHtml($row['tag_name']); ?>
|
||||||
|
|
||||||
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
||||||
|
|
||||||
@@ -182,7 +182,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
|
$sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
<option <?php if ($location_filter == $location_id) { echo "selected"; } ?> value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -209,7 +209,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -314,10 +314,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$credential_id = intval($row['c_credential_id']);
|
$credential_id = intval($row['c_credential_id']);
|
||||||
$credential_name = nullable_htmlentities($row['credential_name']);
|
$credential_name = escapeHtml($row['credential_name']);
|
||||||
$credential_description = nullable_htmlentities($row['credential_description']);
|
$credential_description = escapeHtml($row['credential_description']);
|
||||||
$credential_uri = sanitize_url($row['credential_uri']);
|
$credential_uri = sanitize_url($row['credential_uri']);
|
||||||
if (empty($credential_uri)) {
|
if (empty($credential_uri)) {
|
||||||
$credential_uri_display = "-";
|
$credential_uri_display = "-";
|
||||||
@@ -325,28 +325,28 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$credential_uri_display = "<a href='$credential_uri'>" . truncate($credential_uri,40) . "</a><button class='btn btn-sm clipboardjs' type='button' title='$credential_uri' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button>";
|
$credential_uri_display = "<a href='$credential_uri'>" . truncate($credential_uri,40) . "</a><button class='btn btn-sm clipboardjs' type='button' title='$credential_uri' data-clipboard-text='$credential_uri'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$credential_uri_2 = sanitize_url($row['credential_uri_2']);
|
$credential_uri_2 = sanitize_url($row['credential_uri_2']);
|
||||||
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
|
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
|
||||||
if (empty($credential_username)) {
|
if (empty($credential_username)) {
|
||||||
$credential_username_display = "-";
|
$credential_username_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
|
||||||
}
|
}
|
||||||
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
|
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
|
||||||
$credential_otp_secret = nullable_htmlentities($row['credential_otp_secret']);
|
$credential_otp_secret = escapeHtml($row['credential_otp_secret']);
|
||||||
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
|
||||||
if (empty($credential_otp_secret)) {
|
if (empty($credential_otp_secret)) {
|
||||||
$otp_display = "-";
|
$otp_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
|
$otp_display = "<span onmouseenter='showOTPViaCredentialID($credential_id)'><i class='far fa-clock'></i> <span id='otp_$credential_id'><i>Hover..</i></span></span>";
|
||||||
}
|
}
|
||||||
$credential_note = nullable_htmlentities($row['credential_note']);
|
$credential_note = escapeHtml($row['credential_note']);
|
||||||
$credential_created_at = nullable_htmlentities($row['credential_created_at']);
|
$credential_created_at = escapeHtml($row['credential_created_at']);
|
||||||
$credential_archived_at = nullable_htmlentities($row['credential_archived_at']);
|
$credential_archived_at = escapeHtml($row['credential_archived_at']);
|
||||||
$credential_favorite = intval($row['credential_favorite']);
|
$credential_favorite = intval($row['credential_favorite']);
|
||||||
$credential_contact_id = intval($row['credential_contact_id']);
|
$credential_contact_id = intval($row['credential_contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$credential_asset_id = intval($row['credential_asset_id']);
|
$credential_asset_id = intval($row['credential_asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
|
|
||||||
// Tags
|
// Tags
|
||||||
$credential_tag_name_display_array = array();
|
$credential_tag_name_display_array = array();
|
||||||
@@ -355,12 +355,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
|
||||||
|
|
||||||
$credential_tag_id = intval($row['tag_id']);
|
$credential_tag_id = intval($row['tag_id']);
|
||||||
$credential_tag_name = nullable_htmlentities($row['tag_name']);
|
$credential_tag_name = escapeHtml($row['tag_name']);
|
||||||
$credential_tag_color = nullable_htmlentities($row['tag_color']);
|
$credential_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($credential_tag_color)) {
|
if (empty($credential_tag_color)) {
|
||||||
$credential_tag_color = "dark";
|
$credential_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$credential_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$credential_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($credential_tag_icon)) {
|
if (empty($credential_tag_icon)) {
|
||||||
$credential_tag_icon = "tag";
|
$credential_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
@@ -403,16 +403,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
if (mysqli_num_rows($sql_shared) > 0) {
|
if (mysqli_num_rows($sql_shared) > 0) {
|
||||||
$row = mysqli_fetch_assoc($sql_shared);
|
$row = mysqli_fetch_assoc($sql_shared);
|
||||||
$item_id = intval($row['item_id']);
|
$item_id = intval($row['item_id']);
|
||||||
$item_active = nullable_htmlentities($row['item_active']);
|
$item_active = escapeHtml($row['item_active']);
|
||||||
$item_key = nullable_htmlentities($row['item_key']);
|
$item_key = escapeHtml($row['item_key']);
|
||||||
$item_type = nullable_htmlentities($row['item_type']);
|
$item_type = escapeHtml($row['item_type']);
|
||||||
$item_related_id = intval($row['item_related_id']);
|
$item_related_id = intval($row['item_related_id']);
|
||||||
$item_note = nullable_htmlentities($row['item_note']);
|
$item_note = escapeHtml($row['item_note']);
|
||||||
$item_recipient = nullable_htmlentities($row['item_recipient']);
|
$item_recipient = escapeHtml($row['item_recipient']);
|
||||||
$item_views = nullable_htmlentities($row['item_views']);
|
$item_views = escapeHtml($row['item_views']);
|
||||||
$item_view_limit = nullable_htmlentities($row['item_view_limit']);
|
$item_view_limit = escapeHtml($row['item_view_limit']);
|
||||||
$item_created_at = nullable_htmlentities($row['item_created_at']);
|
$item_created_at = escapeHtml($row['item_created_at']);
|
||||||
$item_expire_at = nullable_htmlentities($row['item_expire_at']);
|
$item_expire_at = escapeHtml($row['item_expire_at']);
|
||||||
$item_expire_at_human = timeAgo($row['item_expire_at']);
|
$item_expire_at_human = timeAgo($row['item_expire_at']);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -423,7 +423,7 @@ if ($user_config_dashboard_financial_enable == 1) {
|
|||||||
<tbody>
|
<tbody>
|
||||||
<?php while ($row = mysqli_fetch_assoc($sql_accounts)) {
|
<?php while ($row = mysqli_fetch_assoc($sql_accounts)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
$opening_balance = floatval($row['opening_balance']);
|
$opening_balance = floatval($row['opening_balance']);
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -478,11 +478,11 @@ if ($user_config_dashboard_financial_enable == 1) {
|
|||||||
</thead>
|
</thead>
|
||||||
<tbody>
|
<tbody>
|
||||||
<?php while ($row = mysqli_fetch_assoc($sql_latest_invoice_payments)) {
|
<?php while ($row = mysqli_fetch_assoc($sql_latest_invoice_payments)) {
|
||||||
$payment_date = nullable_htmlentities($row['payment_date']);
|
$payment_date = escapeHtml($row['payment_date']);
|
||||||
$payment_amount = floatval($row['payment_amount']);
|
$payment_amount = floatval($row['payment_amount']);
|
||||||
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
|
$invoice_prefix = escapeHtml($row['invoice_prefix']);
|
||||||
$invoice_number = intval($row['invoice_number']);
|
$invoice_number = intval($row['invoice_number']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
<td><?php echo $payment_date; ?></td>
|
<td><?php echo $payment_date; ?></td>
|
||||||
@@ -519,10 +519,10 @@ if ($user_config_dashboard_financial_enable == 1) {
|
|||||||
</thead>
|
</thead>
|
||||||
<tbody>
|
<tbody>
|
||||||
<?php while ($row = mysqli_fetch_assoc($sql_latest_expenses)) {
|
<?php while ($row = mysqli_fetch_assoc($sql_latest_expenses)) {
|
||||||
$expense_date = nullable_htmlentities($row['expense_date']);
|
$expense_date = escapeHtml($row['expense_date']);
|
||||||
$expense_amount = floatval($row['expense_amount']);
|
$expense_amount = floatval($row['expense_amount']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
<td><?php echo $expense_date; ?></td>
|
<td><?php echo $expense_date; ?></td>
|
||||||
@@ -711,24 +711,24 @@ if ($user_config_dashboard_technical_enable == 1) {
|
|||||||
<tbody>
|
<tbody>
|
||||||
<?php while ($row = mysqli_fetch_assoc($sql_your_tickets)) {
|
<?php while ($row = mysqli_fetch_assoc($sql_your_tickets)) {
|
||||||
$ticket_id = intval($row['ticket_id']);
|
$ticket_id = intval($row['ticket_id']);
|
||||||
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
|
$ticket_prefix = escapeHtml($row['ticket_prefix']);
|
||||||
$ticket_number = intval($row['ticket_number']);
|
$ticket_number = intval($row['ticket_number']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$ticket_priority = nullable_htmlentities($row['ticket_priority']);
|
$ticket_priority = escapeHtml($row['ticket_priority']);
|
||||||
$ticket_status_id = intval($row['ticket_status']);
|
$ticket_status_id = intval($row['ticket_status']);
|
||||||
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
|
$ticket_status_name = escapeHtml($row['ticket_status_name']);
|
||||||
$ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
|
$ticket_status_color = escapeHtml($row['ticket_status_color']);
|
||||||
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
|
$ticket_created_at = escapeHtml($row['ticket_created_at']);
|
||||||
$ticket_created_at_time_ago = timeAgo($row['ticket_created_at']);
|
$ticket_created_at_time_ago = timeAgo($row['ticket_created_at']);
|
||||||
$ticket_updated_at = nullable_htmlentities($row['ticket_updated_at']);
|
$ticket_updated_at = escapeHtml($row['ticket_updated_at']);
|
||||||
$ticket_updated_at_time_ago = timeAgo($row['ticket_updated_at']);
|
$ticket_updated_at_time_ago = timeAgo($row['ticket_updated_at']);
|
||||||
|
|
||||||
$ticket_updated_at_display = empty($ticket_updated_at) ? (empty($ticket_closed_at) ? "<p class='text-danger'>Never</p>" : "<p>Never</p>") : $ticket_updated_at_time_ago;
|
$ticket_updated_at_display = empty($ticket_updated_at) ? (empty($ticket_closed_at) ? "<p class='text-danger'>Never</p>" : "<p>Never</p>") : $ticket_updated_at_time_ago;
|
||||||
|
|
||||||
$client_id = intval($row['ticket_client_id']);
|
$client_id = intval($row['ticket_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$contact_id = intval($row['ticket_contact_id']);
|
$contact_id = intval($row['ticket_contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
if ($client_id) {
|
if ($client_id) {
|
||||||
$has_client = "&client_id=$client_id";
|
$has_client = "&client_id=$client_id";
|
||||||
} else {
|
} else {
|
||||||
|
|||||||
@@ -32,15 +32,15 @@ if (mysqli_num_rows($sql_document) == 0) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql_document);
|
$row = mysqli_fetch_assoc($sql_document);
|
||||||
|
|
||||||
$folder_name = nullable_htmlentities($row['folder_name']);
|
$folder_name = escapeHtml($row['folder_name']);
|
||||||
$document_name = nullable_htmlentities($row['document_name']);
|
$document_name = escapeHtml($row['document_name']);
|
||||||
$document_description = nullable_htmlentities($row['document_description']);
|
$document_description = escapeHtml($row['document_description']);
|
||||||
$document_content = $purifier->purify($row['document_content']);
|
$document_content = $purifier->purify($row['document_content']);
|
||||||
$document_created_by_id = intval($row['document_created_by']);
|
$document_created_by_id = intval($row['document_created_by']);
|
||||||
$document_created_by_name = nullable_htmlentities($row['user_name']);
|
$document_created_by_name = escapeHtml($row['user_name']);
|
||||||
$document_created_at = nullable_htmlentities($row['document_created_at']);
|
$document_created_at = escapeHtml($row['document_created_at']);
|
||||||
$document_updated_at = nullable_htmlentities($row['document_updated_at']);
|
$document_updated_at = escapeHtml($row['document_updated_at']);
|
||||||
$document_archived_at = nullable_htmlentities($row['document_archived_at']);
|
$document_archived_at = escapeHtml($row['document_archived_at']);
|
||||||
$document_folder_id = intval($row['document_folder_id']);
|
$document_folder_id = intval($row['document_folder_id']);
|
||||||
$document_client_visible = intval($row['document_client_visible']);
|
$document_client_visible = intval($row['document_client_visible']);
|
||||||
|
|
||||||
@@ -64,7 +64,7 @@ $page_title = $row['document_name'];
|
|||||||
while ($folder_id > 0) {
|
while ($folder_id > 0) {
|
||||||
$sql_folder = mysqli_query($mysqli, "SELECT folder_name, parent_folder FROM folders WHERE folder_id = $folder_id");
|
$sql_folder = mysqli_query($mysqli, "SELECT folder_name, parent_folder FROM folders WHERE folder_id = $folder_id");
|
||||||
if ($row_folder = mysqli_fetch_assoc($sql_folder)) {
|
if ($row_folder = mysqli_fetch_assoc($sql_folder)) {
|
||||||
$folder_name = nullable_htmlentities($row_folder['folder_name']);
|
$folder_name = escapeHtml($row_folder['folder_name']);
|
||||||
$parent_folder = intval($row_folder['parent_folder']);
|
$parent_folder = intval($row_folder['parent_folder']);
|
||||||
|
|
||||||
// Prepend the folder to the beginning of the array
|
// Prepend the folder to the beginning of the array
|
||||||
@@ -152,14 +152,14 @@ $page_title = $row['document_name'];
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_document_versions)) {
|
while ($row = mysqli_fetch_assoc($sql_document_versions)) {
|
||||||
$document_version_id = intval($row['document_version_id']);
|
$document_version_id = intval($row['document_version_id']);
|
||||||
$document_version_name = nullable_htmlentities($row['document_version_name']);
|
$document_version_name = escapeHtml($row['document_version_name']);
|
||||||
$document_version_description = nullable_htmlentities($row['document_version_description']);
|
$document_version_description = escapeHtml($row['document_version_description']);
|
||||||
if ($document_version_description ) {
|
if ($document_version_description ) {
|
||||||
$document_version_description_display = $document_version_description;
|
$document_version_description_display = $document_version_description;
|
||||||
} else {
|
} else {
|
||||||
$document_version_description_display = "-";
|
$document_version_description_display = "-";
|
||||||
}
|
}
|
||||||
$document_version_author = nullable_htmlentities($row['user_name']);
|
$document_version_author = escapeHtml($row['user_name']);
|
||||||
$document_version_created_date = date('Y-m-d', strtotime($row['document_version_created_at']));
|
$document_version_created_date = date('Y-m-d', strtotime($row['document_version_created_at']));
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -219,7 +219,7 @@ $page_title = $row['document_name'];
|
|||||||
while ($row = mysqli_fetch_assoc($sql_files)) {
|
while ($row = mysqli_fetch_assoc($sql_files)) {
|
||||||
$file_id = intval($row['file_id']);
|
$file_id = intval($row['file_id']);
|
||||||
$folder_id = intval($row['file_folder_id']);
|
$folder_id = intval($row['file_folder_id']);
|
||||||
$file_name = nullable_htmlentities($row['file_name']);
|
$file_name = escapeHtml($row['file_name']);
|
||||||
|
|
||||||
$linked_files[] = $file_id;
|
$linked_files[] = $file_id;
|
||||||
|
|
||||||
@@ -251,7 +251,7 @@ $page_title = $row['document_name'];
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_contacts)) {
|
while ($row = mysqli_fetch_assoc($sql_contacts)) {
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
|
|
||||||
$linked_contacts[] = $contact_id;
|
$linked_contacts[] = $contact_id;
|
||||||
|
|
||||||
@@ -285,7 +285,7 @@ $page_title = $row['document_name'];
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_assets)) {
|
while ($row = mysqli_fetch_assoc($sql_assets)) {
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
|
|
||||||
$linked_assets[] = $asset_id;
|
$linked_assets[] = $asset_id;
|
||||||
|
|
||||||
@@ -321,7 +321,7 @@ $page_title = $row['document_name'];
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_software)) {
|
while ($row = mysqli_fetch_assoc($sql_software)) {
|
||||||
$software_id = intval($row['software_id']);
|
$software_id = intval($row['software_id']);
|
||||||
$software_name = nullable_htmlentities($row['software_name']);
|
$software_name = escapeHtml($row['software_name']);
|
||||||
|
|
||||||
$linked_software[] = $software_id;
|
$linked_software[] = $software_id;
|
||||||
|
|
||||||
@@ -353,7 +353,7 @@ $page_title = $row['document_name'];
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_vendors)) {
|
while ($row = mysqli_fetch_assoc($sql_vendors)) {
|
||||||
$vendor_id = intval($row['vendor_id']);
|
$vendor_id = intval($row['vendor_id']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
|
|
||||||
$associated_vendors[] = $vendor_id;
|
$associated_vendors[] = $vendor_id;
|
||||||
|
|
||||||
@@ -402,10 +402,10 @@ $page_title = $row['document_name'];
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_document_versions)) {
|
while ($row = mysqli_fetch_assoc($sql_document_versions)) {
|
||||||
$document_version_id = intval($row['document_version_id']);
|
$document_version_id = intval($row['document_version_id']);
|
||||||
$document_version_name = nullable_htmlentities($row['document_version_name']);
|
$document_version_name = escapeHtml($row['document_version_name']);
|
||||||
$document_version_description = nullable_htmlentities($row['document_version_description']);
|
$document_version_description = escapeHtml($row['document_version_description']);
|
||||||
$document_version_author = nullable_htmlentities($row['user_name']);
|
$document_version_author = escapeHtml($row['user_name']);
|
||||||
$document_version_created_date = nullable_htmlentities($row['document_version_created_at']);
|
$document_version_created_date = escapeHtml($row['document_version_created_at']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<div class="mt-1 <?php if($document_id === $document_version_id){ echo "text-bold"; } ?>">
|
<div class="mt-1 <?php if($document_id === $document_version_id){ echo "text-bold"; } ?>">
|
||||||
|
|||||||
@@ -99,7 +99,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Domains">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Domains">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -125,7 +125,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -232,9 +232,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$domain_id = intval($row['domain_id']);
|
$domain_id = intval($row['domain_id']);
|
||||||
$domain_name = nullable_htmlentities($row['domain_name']);
|
$domain_name = escapeHtml($row['domain_name']);
|
||||||
$domain_description = nullable_htmlentities($row['domain_description']);
|
$domain_description = escapeHtml($row['domain_description']);
|
||||||
$domain_expire = nullable_htmlentities($row['domain_expire']);
|
$domain_expire = escapeHtml($row['domain_expire']);
|
||||||
$domain_expire_ago = timeAgo($domain_expire);
|
$domain_expire_ago = timeAgo($domain_expire);
|
||||||
// Convert the expiry date to a timestamp
|
// Convert the expiry date to a timestamp
|
||||||
$domain_expire_timestamp = strtotime($row['domain_expire'] ?? '');
|
$domain_expire_timestamp = strtotime($row['domain_expire'] ?? '');
|
||||||
@@ -257,14 +257,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$domain_webhost_id = intval($row['webhost_id']);
|
$domain_webhost_id = intval($row['webhost_id']);
|
||||||
$domain_dnshost_id = intval($row['dnshost_id']);
|
$domain_dnshost_id = intval($row['dnshost_id']);
|
||||||
$domain_mailhost_id = intval($row['mailhost_id']);
|
$domain_mailhost_id = intval($row['mailhost_id']);
|
||||||
$domain_registrar_name = nullable_htmlentities($row['registrar_name']);
|
$domain_registrar_name = escapeHtml($row['registrar_name']);
|
||||||
$domain_webhost_name = nullable_htmlentities($row['webhost_name']);
|
$domain_webhost_name = escapeHtml($row['webhost_name']);
|
||||||
$domain_dnshost_name = nullable_htmlentities($row['dnshost_name']);
|
$domain_dnshost_name = escapeHtml($row['dnshost_name']);
|
||||||
$domain_mailhost_name = nullable_htmlentities($row['mailhost_name']);
|
$domain_mailhost_name = escapeHtml($row['mailhost_name']);
|
||||||
$domain_created_at = nullable_htmlentities($row['domain_created_at']);
|
$domain_created_at = escapeHtml($row['domain_created_at']);
|
||||||
$domain_archived_at = nullable_htmlentities($row['domain_archived_at']);
|
$domain_archived_at = escapeHtml($row['domain_archived_at']);
|
||||||
$client_id = intval($row['domain_client_id']);
|
$client_id = intval($row['domain_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
// Add - if empty on the table
|
// Add - if empty on the table
|
||||||
$domain_registrar_name_display = $domain_registrar_name ? "
|
$domain_registrar_name_display = $domain_registrar_name ? "
|
||||||
<a class='ajax-modal' href='#' data-modal-url='modals/vendor/vendor_details.php?id=$domain_registrar_id'>
|
<a class='ajax-modal' href='#' data-modal-url='modals/vendor/vendor_details.php?id=$domain_registrar_id'>
|
||||||
|
|||||||
@@ -82,7 +82,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-sm-4">
|
<div class="col-sm-4">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Expenses">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Expenses">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
@@ -132,9 +132,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Date range</label>
|
<label>Date range</label>
|
||||||
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
||||||
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
|
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
|
||||||
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
|
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
|
||||||
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
|
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="col-sm-2">
|
<div class="col-sm-2">
|
||||||
@@ -148,7 +148,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_vendors_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_vendors_filter)) {
|
||||||
$vendor_id = intval($row['vendor_id']);
|
$vendor_id = intval($row['vendor_id']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($vendor_filter == $vendor_id) { echo "selected"; } ?> value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
|
<option <?php if ($vendor_filter == $vendor_id) { echo "selected"; } ?> value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -168,7 +168,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_categories_filter = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND EXISTS (SELECT 1 FROM expenses WHERE expense_category_id = category_id) ORDER BY category_name ASC");
|
$sql_categories_filter = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND EXISTS (SELECT 1 FROM expenses WHERE expense_category_id = category_id) ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
|
||||||
$category_id = intval($row['category_id']);
|
$category_id = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
|
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -188,7 +188,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_accounts_filter = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE EXISTS (SELECT 1 FROM expenses WHERE expense_account_id = account_id) ORDER BY account_name ASC");
|
$sql_accounts_filter = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE EXISTS (SELECT 1 FROM expenses WHERE expense_account_id = account_id) ORDER BY account_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_accounts_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_accounts_filter)) {
|
||||||
$account_id = intval($row['account_id']);
|
$account_id = intval($row['account_id']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($account_filter == $account_id) { echo "selected"; } ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
<option <?php if ($account_filter == $account_id) { echo "selected"; } ?> value="<?php echo $account_id; ?>"><?php echo $account_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -254,20 +254,20 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$expense_id = intval($row['expense_id']);
|
$expense_id = intval($row['expense_id']);
|
||||||
$expense_date = nullable_htmlentities($row['expense_date']);
|
$expense_date = escapeHtml($row['expense_date']);
|
||||||
$expense_amount = floatval($row['expense_amount']);
|
$expense_amount = floatval($row['expense_amount']);
|
||||||
$expense_currency_code = nullable_htmlentities($row['expense_currency_code']);
|
$expense_currency_code = escapeHtml($row['expense_currency_code']);
|
||||||
$expense_description = nullable_htmlentities($row['expense_description']);
|
$expense_description = escapeHtml($row['expense_description']);
|
||||||
$expense_receipt = nullable_htmlentities($row['expense_receipt']);
|
$expense_receipt = escapeHtml($row['expense_receipt']);
|
||||||
$expense_reference = nullable_htmlentities($row['expense_reference']);
|
$expense_reference = escapeHtml($row['expense_reference']);
|
||||||
$expense_created_at = nullable_htmlentities($row['expense_created_at']);
|
$expense_created_at = escapeHtml($row['expense_created_at']);
|
||||||
$expense_vendor_id = intval($row['expense_vendor_id']);
|
$expense_vendor_id = intval($row['expense_vendor_id']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
$expense_category_id = intval($row['expense_category_id']);
|
$expense_category_id = intval($row['expense_category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
$expense_account_id = intval($row['expense_account_id']);
|
$expense_account_id = intval($row['expense_account_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
if(empty($client_name)) {
|
if(empty($client_name)) {
|
||||||
$client_name_display = "-";
|
$client_name_display = "-";
|
||||||
} else {
|
} else {
|
||||||
|
|||||||
@@ -43,7 +43,7 @@ $breadcrumb_folder_id = $get_folder_id;
|
|||||||
while ($breadcrumb_folder_id > 0) {
|
while ($breadcrumb_folder_id > 0) {
|
||||||
$sql_folder = mysqli_query($mysqli, "SELECT folder_name, parent_folder FROM folders WHERE folder_id = $breadcrumb_folder_id AND folder_client_id = $client_id");
|
$sql_folder = mysqli_query($mysqli, "SELECT folder_name, parent_folder FROM folders WHERE folder_id = $breadcrumb_folder_id AND folder_client_id = $client_id");
|
||||||
if ($row_folder = mysqli_fetch_assoc($sql_folder)) {
|
if ($row_folder = mysqli_fetch_assoc($sql_folder)) {
|
||||||
$folder_name = nullable_htmlentities($row_folder['folder_name']);
|
$folder_name = escapeHtml($row_folder['folder_name']);
|
||||||
$parent_folder = intval($row_folder['parent_folder']);
|
$parent_folder = intval($row_folder['parent_folder']);
|
||||||
|
|
||||||
array_unshift($folder_path, [
|
array_unshift($folder_path, [
|
||||||
@@ -107,7 +107,7 @@ function display_folders($parent_folder_id, $client_id, $indent = 0, $render_roo
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_folders)) {
|
while ($row = mysqli_fetch_assoc($sql_folders)) {
|
||||||
$folder_id = intval($row['folder_id']);
|
$folder_id = intval($row['folder_id']);
|
||||||
$folder_name = nullable_htmlentities($row['folder_name']);
|
$folder_name = escapeHtml($row['folder_name']);
|
||||||
|
|
||||||
$row_files = mysqli_fetch_assoc(mysqli_query(
|
$row_files = mysqli_fetch_assoc(mysqli_query(
|
||||||
$mysqli,
|
$mysqli,
|
||||||
@@ -307,14 +307,14 @@ if ($view == 1) {
|
|||||||
// Normalize FILES into $items
|
// Normalize FILES into $items
|
||||||
while ($row = mysqli_fetch_assoc($sql_files)) {
|
while ($row = mysqli_fetch_assoc($sql_files)) {
|
||||||
$file_id = intval($row['file_id']);
|
$file_id = intval($row['file_id']);
|
||||||
$file_name = nullable_htmlentities($row['file_name']);
|
$file_name = escapeHtml($row['file_name']);
|
||||||
$file_description = nullable_htmlentities($row['file_description']);
|
$file_description = escapeHtml($row['file_description']);
|
||||||
$file_reference_name= nullable_htmlentities($row['file_reference_name']);
|
$file_reference_name= escapeHtml($row['file_reference_name']);
|
||||||
$file_ext = nullable_htmlentities($row['file_ext']);
|
$file_ext = escapeHtml($row['file_ext']);
|
||||||
$file_size = intval($row['file_size']);
|
$file_size = intval($row['file_size']);
|
||||||
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
|
$file_mime_type = escapeHtml($row['file_mime_type']);
|
||||||
$file_uploaded_by = nullable_htmlentities($row['user_name']);
|
$file_uploaded_by = escapeHtml($row['user_name']);
|
||||||
$file_created_at = nullable_htmlentities($row['file_created_at']);
|
$file_created_at = escapeHtml($row['file_created_at']);
|
||||||
$file_archived_at = $row['file_archived_at'];
|
$file_archived_at = $row['file_archived_at'];
|
||||||
|
|
||||||
// determine icon
|
// determine icon
|
||||||
@@ -360,9 +360,9 @@ if ($view == 1) {
|
|||||||
// Normalize DOCUMENTS into $items
|
// Normalize DOCUMENTS into $items
|
||||||
while ($row = mysqli_fetch_assoc($sql_documents)) {
|
while ($row = mysqli_fetch_assoc($sql_documents)) {
|
||||||
$document_id = intval($row['document_id']);
|
$document_id = intval($row['document_id']);
|
||||||
$document_name = nullable_htmlentities($row['document_name']);
|
$document_name = escapeHtml($row['document_name']);
|
||||||
$document_description = nullable_htmlentities($row['document_description']);
|
$document_description = escapeHtml($row['document_description']);
|
||||||
$document_created_by_name = nullable_htmlentities($row['user_name']);
|
$document_created_by_name = escapeHtml($row['user_name']);
|
||||||
$document_created_at = $row['document_created_at'];
|
$document_created_at = $row['document_created_at'];
|
||||||
$document_updated_at = $row['document_updated_at'];
|
$document_updated_at = $row['document_updated_at'];
|
||||||
$document_archived_at = $row['document_archived_at'];
|
$document_archived_at = $row['document_archived_at'];
|
||||||
@@ -508,7 +508,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
|
|||||||
<div class="col-md-5">
|
<div class="col-md-5">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q"
|
<input type="search" class="form-control" name="q"
|
||||||
value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>"
|
value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>"
|
||||||
placeholder="Search files and documents in <?php echo ($get_folder_id == 0 ? 'all folders' : 'current folder'); ?>">
|
placeholder="Search files and documents in <?php echo ($get_folder_id == 0 ? 'all folders' : 'current folder'); ?>">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
@@ -594,14 +594,14 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
|
|||||||
$files = [];
|
$files = [];
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$file_id = intval($row['file_id']);
|
$file_id = intval($row['file_id']);
|
||||||
$file_name = nullable_htmlentities($row['file_name']);
|
$file_name = escapeHtml($row['file_name']);
|
||||||
$file_reference_name= nullable_htmlentities($row['file_reference_name']);
|
$file_reference_name= escapeHtml($row['file_reference_name']);
|
||||||
$file_ext = nullable_htmlentities($row['file_ext']);
|
$file_ext = escapeHtml($row['file_ext']);
|
||||||
$file_size = intval($row['file_size']);
|
$file_size = intval($row['file_size']);
|
||||||
$file_size_KB = number_format($file_size / 1024);
|
$file_size_KB = number_format($file_size / 1024);
|
||||||
$file_mime_type = nullable_htmlentities($row['file_mime_type']);
|
$file_mime_type = escapeHtml($row['file_mime_type']);
|
||||||
$file_uploaded_by = nullable_htmlentities($row['user_name']);
|
$file_uploaded_by = escapeHtml($row['user_name']);
|
||||||
$file_archived_at = nullable_htmlentities($row['file_archived_at']);
|
$file_archived_at = escapeHtml($row['file_archived_at']);
|
||||||
|
|
||||||
$files[] = [
|
$files[] = [
|
||||||
'id' => $file_id,
|
'id' => $file_id,
|
||||||
@@ -743,7 +743,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
|
|||||||
$file_shared = (mysqli_num_rows($sql_shared) > 0);
|
$file_shared = (mysqli_num_rows($sql_shared) > 0);
|
||||||
if ($file_shared) {
|
if ($file_shared) {
|
||||||
$row_shared = mysqli_fetch_assoc($sql_shared);
|
$row_shared = mysqli_fetch_assoc($sql_shared);
|
||||||
$item_recipient = nullable_htmlentities($row_shared['item_recipient']);
|
$item_recipient = escapeHtml($row_shared['item_recipient']);
|
||||||
$item_expire_at_human = timeAgo($row_shared['item_expire_at']);
|
$item_expire_at_human = timeAgo($row_shared['item_expire_at']);
|
||||||
}
|
}
|
||||||
?>
|
?>
|
||||||
@@ -855,7 +855,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
|
|||||||
$doc_shared = (mysqli_num_rows($sql_shared) > 0);
|
$doc_shared = (mysqli_num_rows($sql_shared) > 0);
|
||||||
if ($doc_shared) {
|
if ($doc_shared) {
|
||||||
$row_shared = mysqli_fetch_assoc($sql_shared);
|
$row_shared = mysqli_fetch_assoc($sql_shared);
|
||||||
$item_recipient = nullable_htmlentities($row_shared['item_recipient']);
|
$item_recipient = escapeHtml($row_shared['item_recipient']);
|
||||||
$item_expire_at_human = timeAgo($row_shared['item_expire_at']);
|
$item_expire_at_human = timeAgo($row_shared['item_expire_at']);
|
||||||
}
|
}
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -147,7 +147,7 @@ if (isset($_GET['query'])) {
|
|||||||
ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
|
ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
|
||||||
);
|
);
|
||||||
|
|
||||||
$q = nullable_htmlentities($_GET['query']);
|
$q = escapeHtml($_GET['query']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|
||||||
@@ -181,10 +181,10 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients)) {
|
while ($row = mysqli_fetch_assoc($sql_clients)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
|
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
|
||||||
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
|
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
|
||||||
$client_website = nullable_htmlentities($row['client_website']);
|
$client_website = escapeHtml($row['client_website']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -227,17 +227,17 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_contacts)) {
|
while ($row = mysqli_fetch_assoc($sql_contacts)) {
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_title = nullable_htmlentities($row['contact_title']);
|
$contact_title = escapeHtml($row['contact_title']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$contact_department = nullable_htmlentities($row['contact_department']);
|
$contact_department = escapeHtml($row['contact_department']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -283,12 +283,12 @@ if (isset($_GET['query'])) {
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_vendors)) {
|
while ($row = mysqli_fetch_assoc($sql_vendors)) {
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
$vendor_description = nullable_htmlentities($row['vendor_description']);
|
$vendor_description = escapeHtml($row['vendor_description']);
|
||||||
$vendor_phone_country_code = nullable_htmlentities($row['vendor_phone_country_code']);
|
$vendor_phone_country_code = escapeHtml($row['vendor_phone_country_code']);
|
||||||
$vendor_phone = nullable_htmlentities(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
|
$vendor_phone = escapeHtml(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -330,11 +330,11 @@ if (isset($_GET['query'])) {
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_domains)) {
|
while ($row = mysqli_fetch_assoc($sql_domains)) {
|
||||||
$domain_name = nullable_htmlentities($row['domain_name']);
|
$domain_name = escapeHtml($row['domain_name']);
|
||||||
$domain_expiry = nullable_htmlentities($row['domain_expire']);
|
$domain_expiry = escapeHtml($row['domain_expire']);
|
||||||
$domain_id = intval($row['domain_id']);
|
$domain_id = intval($row['domain_id']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -373,8 +373,8 @@ if (isset($_GET['query'])) {
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_products)) {
|
while ($row = mysqli_fetch_assoc($sql_products)) {
|
||||||
$product_name = nullable_htmlentities($row['product_name']);
|
$product_name = escapeHtml($row['product_name']);
|
||||||
$product_description = nullable_htmlentities($row['product_description']);
|
$product_description = escapeHtml($row['product_description']);
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
<td><a href="products.php?q=<?php echo $q ?>"><?php echo $product_name; ?></a></td>
|
<td><a href="products.php?q=<?php echo $q ?>"><?php echo $product_name; ?></a></td>
|
||||||
@@ -413,9 +413,9 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_documents)) {
|
while ($row = mysqli_fetch_assoc($sql_documents)) {
|
||||||
$document_id = intval($row['document_id']);
|
$document_id = intval($row['document_id']);
|
||||||
$document_name = nullable_htmlentities($row['document_name']);
|
$document_name = escapeHtml($row['document_name']);
|
||||||
$client_id = intval($row['document_client_id']);
|
$client_id = intval($row['document_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -458,13 +458,13 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_files)) {
|
while ($row = mysqli_fetch_assoc($sql_files)) {
|
||||||
$file_id = intval($row['file_id']);
|
$file_id = intval($row['file_id']);
|
||||||
$file_name = nullable_htmlentities($row['file_name']);
|
$file_name = escapeHtml($row['file_name']);
|
||||||
$file_reference_name = nullable_htmlentities($row['file_reference_name']);
|
$file_reference_name = escapeHtml($row['file_reference_name']);
|
||||||
$file_description = nullable_htmlentities($row['file_description']);
|
$file_description = escapeHtml($row['file_description']);
|
||||||
$folder_id = intval($row['folder_id']);
|
$folder_id = intval($row['folder_id']);
|
||||||
$folder_name = nullable_htmlentities($row['folder_name']);
|
$folder_name = escapeHtml($row['folder_name']);
|
||||||
$client_id = intval($row['file_client_id']);
|
$client_id = intval($row['file_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -509,11 +509,11 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_tickets)) {
|
||||||
$ticket_id = intval($row['ticket_id']);
|
$ticket_id = intval($row['ticket_id']);
|
||||||
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
|
$ticket_prefix = escapeHtml($row['ticket_prefix']);
|
||||||
$ticket_number = intval($row['ticket_number']);
|
$ticket_number = intval($row['ticket_number']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
|
$ticket_status_name = escapeHtml($row['ticket_status_name']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$client_id = intval($row['ticket_client_id']);
|
$client_id = intval($row['ticket_client_id']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -559,10 +559,10 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_recurring_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_recurring_tickets)) {
|
||||||
$recurring_ticket_id = intval($row['recurring_ticket_id']);
|
$recurring_ticket_id = intval($row['recurring_ticket_id']);
|
||||||
$recurring_ticket_subject = nullable_htmlentities($row['recurring_ticket_subject']);
|
$recurring_ticket_subject = escapeHtml($row['recurring_ticket_subject']);
|
||||||
$recurring_ticket_frequency = nullable_htmlentities($row['recurring_ticket_frequency']);
|
$recurring_ticket_frequency = escapeHtml($row['recurring_ticket_frequency']);
|
||||||
$recurring_ticket_next_run = nullable_htmlentities($row['recurring_ticket_next_run']);
|
$recurring_ticket_next_run = escapeHtml($row['recurring_ticket_next_run']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
@@ -608,13 +608,13 @@ if (isset($_GET['query'])) {
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_credentials)) {
|
while ($row = mysqli_fetch_assoc($sql_credentials)) {
|
||||||
$credential_name = nullable_htmlentities($row['credential_name']);
|
$credential_name = escapeHtml($row['credential_name']);
|
||||||
$credential_description = nullable_htmlentities($row['credential_description']);
|
$credential_description = escapeHtml($row['credential_description']);
|
||||||
$credential_client_id = intval($row['credential_client_id']);
|
$credential_client_id = intval($row['credential_client_id']);
|
||||||
$credential_username = nullable_htmlentities(decryptCredentialEntry($row['credential_username']));
|
$credential_username = escapeHtml(decryptCredentialEntry($row['credential_username']));
|
||||||
$credential_password = nullable_htmlentities(decryptCredentialEntry($row['credential_password']));
|
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -661,13 +661,13 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_quotes)) {
|
while ($row = mysqli_fetch_assoc($sql_quotes)) {
|
||||||
$quote_id = intval($row['quote_id']);
|
$quote_id = intval($row['quote_id']);
|
||||||
$quote_prefix = nullable_htmlentities($row['quote_prefix']);
|
$quote_prefix = escapeHtml($row['quote_prefix']);
|
||||||
$quote_number = intval($row['quote_number']);
|
$quote_number = intval($row['quote_number']);
|
||||||
$quote_amount = floatval($row['quote_amount']);
|
$quote_amount = floatval($row['quote_amount']);
|
||||||
$quote_currency_code = nullable_htmlentities($row['quote_currency_code']);
|
$quote_currency_code = escapeHtml($row['quote_currency_code']);
|
||||||
$quote_status = nullable_htmlentities($row['quote_status']);
|
$quote_status = escapeHtml($row['quote_status']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -712,13 +712,13 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_invoices)) {
|
while ($row = mysqli_fetch_assoc($sql_invoices)) {
|
||||||
$invoice_id = intval($row['invoice_id']);
|
$invoice_id = intval($row['invoice_id']);
|
||||||
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
|
$invoice_prefix = escapeHtml($row['invoice_prefix']);
|
||||||
$invoice_number = intval($row['invoice_number']);
|
$invoice_number = intval($row['invoice_number']);
|
||||||
$invoice_amount = floatval($row['invoice_amount']);
|
$invoice_amount = floatval($row['invoice_amount']);
|
||||||
$invoice_currency_code = nullable_htmlentities($row['invoice_currency_code']);
|
$invoice_currency_code = escapeHtml($row['invoice_currency_code']);
|
||||||
$invoice_status = nullable_htmlentities($row['invoice_status']);
|
$invoice_status = escapeHtml($row['invoice_status']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -764,39 +764,39 @@ if (isset($_GET['query'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_assets)) {
|
while ($row = mysqli_fetch_assoc($sql_assets)) {
|
||||||
$client_id = intval($row['asset_client_id']);
|
$client_id = intval($row['asset_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$asset_id = intval($row['asset_id']);
|
$asset_id = intval($row['asset_id']);
|
||||||
$asset_type = nullable_htmlentities($row['asset_type']);
|
$asset_type = escapeHtml($row['asset_type']);
|
||||||
$asset_name = nullable_htmlentities($row['asset_name']);
|
$asset_name = escapeHtml($row['asset_name']);
|
||||||
$asset_description = nullable_htmlentities($row['asset_description']);
|
$asset_description = escapeHtml($row['asset_description']);
|
||||||
if (empty($asset_description)) {
|
if (empty($asset_description)) {
|
||||||
$asset_description_display = "-";
|
$asset_description_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$asset_description_display = $asset_description;
|
$asset_description_display = $asset_description;
|
||||||
}
|
}
|
||||||
$asset_make = nullable_htmlentities($row['asset_make']);
|
$asset_make = escapeHtml($row['asset_make']);
|
||||||
$asset_model = nullable_htmlentities($row['asset_model']);
|
$asset_model = escapeHtml($row['asset_model']);
|
||||||
$asset_serial = nullable_htmlentities($row['asset_serial']);
|
$asset_serial = escapeHtml($row['asset_serial']);
|
||||||
if (empty($asset_serial)) {
|
if (empty($asset_serial)) {
|
||||||
$asset_serial_display = "-";
|
$asset_serial_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$asset_serial_display = $asset_serial;
|
$asset_serial_display = $asset_serial;
|
||||||
}
|
}
|
||||||
$asset_uri = nullable_htmlentities($row['asset_uri']);
|
$asset_uri = escapeHtml($row['asset_uri']);
|
||||||
$asset_status = nullable_htmlentities($row['asset_status']);
|
$asset_status = escapeHtml($row['asset_status']);
|
||||||
$asset_created_at = nullable_htmlentities($row['asset_created_at']);
|
$asset_created_at = escapeHtml($row['asset_created_at']);
|
||||||
$asset_location_id = intval($row['asset_location_id']);
|
$asset_location_id = intval($row['asset_location_id']);
|
||||||
$asset_contact_id = intval($row['asset_contact_id']);
|
$asset_contact_id = intval($row['asset_contact_id']);
|
||||||
$device_icon = getAssetIcon($asset_type);
|
$device_icon = getAssetIcon($asset_type);
|
||||||
|
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_id = nullable_htmlentities($row['contact_id']);
|
$contact_id = escapeHtml($row['contact_id']);
|
||||||
if (empty($contact_name)) {
|
if (empty($contact_name)) {
|
||||||
$contact_name_display = "-";
|
$contact_name_display = "-";
|
||||||
}else{
|
}else{
|
||||||
$contact_name_display = "<a href='contact_details.php?client_id=$client_id&contact_id=$contact_id'>$contact_name</a>";
|
$contact_name_display = "<a href='contact_details.php?client_id=$client_id&contact_id=$contact_id'>$contact_name</a>";
|
||||||
}
|
}
|
||||||
$contact_archived_at = nullable_htmlentities($row['contact_archived_at']);
|
$contact_archived_at = escapeHtml($row['contact_archived_at']);
|
||||||
if (empty($contact_archived_at)) {
|
if (empty($contact_archived_at)) {
|
||||||
$contact_archived_display = "";
|
$contact_archived_display = "";
|
||||||
} else {
|
} else {
|
||||||
@@ -853,11 +853,11 @@ if (isset($_GET['query'])) {
|
|||||||
echo '</div></div>';
|
echo '</div></div>';
|
||||||
}
|
}
|
||||||
|
|
||||||
$ticket_prefix = nullable_htmlentities($row['ticket_prefix']);
|
$ticket_prefix = escapeHtml($row['ticket_prefix']);
|
||||||
$ticket_number = intval($row['ticket_number']);
|
$ticket_number = intval($row['ticket_number']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$client_id = intval($row['ticket_client_id']);
|
$client_id = intval($row['ticket_client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
|
|
||||||
// Output the ticket header
|
// Output the ticket header
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -1,5 +1,5 @@
|
|||||||
<!-- Main Sidebar Container -->
|
<!-- Main Sidebar Container -->
|
||||||
<aside class="main-sidebar sidebar-dark-<?php echo nullable_htmlentities($config_theme); ?> d-print-none">
|
<aside class="main-sidebar sidebar-dark-<?php echo escapeHtml($config_theme); ?> d-print-none">
|
||||||
|
|
||||||
<a class="brand-link pb-1 mt-1" href="/agent/clients.php">
|
<a class="brand-link pb-1 mt-1" href="/agent/clients.php">
|
||||||
<p class="h5">
|
<p class="h5">
|
||||||
|
|||||||
@@ -32,38 +32,38 @@ if (isset($_GET['client_id'])) {
|
|||||||
} else {
|
} else {
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$client_is_lead = intval($row['client_lead']);
|
$client_is_lead = intval($row['client_lead']);
|
||||||
$client_type = nullable_htmlentities($row['client_type']);
|
$client_type = escapeHtml($row['client_type']);
|
||||||
$client_website = nullable_htmlentities($row['client_website']);
|
$client_website = escapeHtml($row['client_website']);
|
||||||
$client_referral = nullable_htmlentities($row['client_referral']);
|
$client_referral = escapeHtml($row['client_referral']);
|
||||||
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
|
$client_currency_code = escapeHtml($row['client_currency_code']);
|
||||||
$client_net_terms = intval($row['client_net_terms']);
|
$client_net_terms = intval($row['client_net_terms']);
|
||||||
$client_tax_id_number = nullable_htmlentities($row['client_tax_id_number']);
|
$client_tax_id_number = escapeHtml($row['client_tax_id_number']);
|
||||||
$client_abbreviation = nullable_htmlentities($row['client_abbreviation']);
|
$client_abbreviation = escapeHtml($row['client_abbreviation']);
|
||||||
$client_rate = floatval($row['client_rate']);
|
$client_rate = floatval($row['client_rate']);
|
||||||
$client_notes = nullable_htmlentities($row['client_notes']);
|
$client_notes = escapeHtml($row['client_notes']);
|
||||||
$client_created_at = nullable_htmlentities($row['client_created_at']);
|
$client_created_at = escapeHtml($row['client_created_at']);
|
||||||
$client_archived_at = nullable_htmlentities($row['client_archived_at']);
|
$client_archived_at = escapeHtml($row['client_archived_at']);
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
$contact_title = nullable_htmlentities($row['contact_title']);
|
$contact_title = escapeHtml($row['contact_title']);
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$contact_primary = intval($row['contact_primary']);
|
$contact_primary = intval($row['contact_primary']);
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
$location_address = nullable_htmlentities($row['location_address']);
|
$location_address = escapeHtml($row['location_address']);
|
||||||
$location_city = nullable_htmlentities($row['location_city']);
|
$location_city = escapeHtml($row['location_city']);
|
||||||
$location_state = nullable_htmlentities($row['location_state']);
|
$location_state = escapeHtml($row['location_state']);
|
||||||
$location_zip = nullable_htmlentities($row['location_zip']);
|
$location_zip = escapeHtml($row['location_zip']);
|
||||||
$location_country = nullable_htmlentities($row['location_country']);
|
$location_country = escapeHtml($row['location_country']);
|
||||||
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
|
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
|
||||||
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
|
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
|
||||||
$location_primary = intval($row['location_primary']);
|
$location_primary = intval($row['location_primary']);
|
||||||
|
|
||||||
// Tab Title // No Sanitizing needed
|
// Tab Title // No Sanitizing needed
|
||||||
@@ -77,12 +77,12 @@ if (isset($_GET['client_id'])) {
|
|||||||
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
|
||||||
|
|
||||||
$client_tag_id = intval($row['tag_id']);
|
$client_tag_id = intval($row['tag_id']);
|
||||||
$client_tag_name = nullable_htmlentities($row['tag_name']);
|
$client_tag_name = escapeHtml($row['tag_name']);
|
||||||
$client_tag_color = nullable_htmlentities($row['tag_color']);
|
$client_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($client_tag_color)) {
|
if (empty($client_tag_color)) {
|
||||||
$client_tag_color = "dark";
|
$client_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$client_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$client_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($client_tag_icon)) {
|
if (empty($client_tag_icon)) {
|
||||||
$client_tag_icon = "tag";
|
$client_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,9 +1,9 @@
|
|||||||
<!-- Main Sidebar Container -->
|
<!-- Main Sidebar Container -->
|
||||||
<aside class="main-sidebar sidebar-dark-<?php echo nullable_htmlentities($config_theme); ?> d-print-none">
|
<aside class="main-sidebar sidebar-dark-<?php echo escapeHtml($config_theme); ?> d-print-none">
|
||||||
|
|
||||||
<a class="brand-link" href="/agent/dashboard.php">
|
<a class="brand-link" href="/agent/dashboard.php">
|
||||||
<div class="brand-image"></div>
|
<div class="brand-image"></div>
|
||||||
<span class="brand-text h4"><?php echo nullable_htmlentities($session_company_name); ?></span>
|
<span class="brand-text h4"><?php echo escapeHtml($session_company_name); ?></span>
|
||||||
</a>
|
</a>
|
||||||
|
|
||||||
<!-- Sidebar -->
|
<!-- Sidebar -->
|
||||||
@@ -205,9 +205,9 @@
|
|||||||
);
|
);
|
||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
|
while ($row = mysqli_fetch_assoc($sql_custom_links)) {
|
||||||
$custom_link_name = nullable_htmlentities($row['custom_link_name']);
|
$custom_link_name = escapeHtml($row['custom_link_name']);
|
||||||
$custom_link_uri = sanitize_url($row['custom_link_uri']);
|
$custom_link_uri = sanitize_url($row['custom_link_uri']);
|
||||||
$custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
|
$custom_link_icon = escapeHtml($row['custom_link_icon']);
|
||||||
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
$custom_link_new_tab = intval($row['custom_link_new_tab']);
|
||||||
if ($custom_link_new_tab == 1) {
|
if ($custom_link_new_tab == 1) {
|
||||||
$target = "target='_blank' rel='noopener noreferrer'";
|
$target = "target='_blank' rel='noopener noreferrer'";
|
||||||
|
|||||||
@@ -39,35 +39,35 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$invoice_id = intval($row['invoice_id']);
|
$invoice_id = intval($row['invoice_id']);
|
||||||
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
|
$invoice_prefix = escapeHtml($row['invoice_prefix']);
|
||||||
$invoice_number = intval($row['invoice_number']);
|
$invoice_number = intval($row['invoice_number']);
|
||||||
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
|
$invoice_scope = escapeHtml($row['invoice_scope']);
|
||||||
$invoice_status = nullable_htmlentities($row['invoice_status']);
|
$invoice_status = escapeHtml($row['invoice_status']);
|
||||||
$invoice_date = nullable_htmlentities($row['invoice_date']);
|
$invoice_date = escapeHtml($row['invoice_date']);
|
||||||
$invoice_due = nullable_htmlentities($row['invoice_due']);
|
$invoice_due = escapeHtml($row['invoice_due']);
|
||||||
$invoice_amount = floatval($row['invoice_amount']);
|
$invoice_amount = floatval($row['invoice_amount']);
|
||||||
$invoice_discount = floatval($row['invoice_discount_amount']);
|
$invoice_discount = floatval($row['invoice_discount_amount']);
|
||||||
$invoice_credit = floatval($row['invoice_credit_amount']);
|
$invoice_credit = floatval($row['invoice_credit_amount']);
|
||||||
$invoice_currency_code = nullable_htmlentities($row['invoice_currency_code']);
|
$invoice_currency_code = escapeHtml($row['invoice_currency_code']);
|
||||||
$invoice_note = nullable_htmlentities($row['invoice_note']);
|
$invoice_note = escapeHtml($row['invoice_note']);
|
||||||
$invoice_url_key = nullable_htmlentities($row['invoice_url_key']);
|
$invoice_url_key = escapeHtml($row['invoice_url_key']);
|
||||||
$invoice_created_at = nullable_htmlentities($row['invoice_created_at']);
|
$invoice_created_at = escapeHtml($row['invoice_created_at']);
|
||||||
$category_id = intval($row['invoice_category_id']);
|
$category_id = intval($row['invoice_category_id']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$location_address = nullable_htmlentities($row['location_address']);
|
$location_address = escapeHtml($row['location_address']);
|
||||||
$location_city = nullable_htmlentities($row['location_city']);
|
$location_city = escapeHtml($row['location_city']);
|
||||||
$location_state = nullable_htmlentities($row['location_state']);
|
$location_state = escapeHtml($row['location_state']);
|
||||||
$location_zip = nullable_htmlentities($row['location_zip']);
|
$location_zip = escapeHtml($row['location_zip']);
|
||||||
$location_country = nullable_htmlentities($row['location_country']);
|
$location_country = escapeHtml($row['location_country']);
|
||||||
$contact_email = nullable_htmlentities($row['contact_email']);
|
$contact_email = escapeHtml($row['contact_email']);
|
||||||
$contact_phone_country_code = nullable_htmlentities($row['contact_phone_country_code']);
|
$contact_phone_country_code = escapeHtml($row['contact_phone_country_code']);
|
||||||
$contact_phone = nullable_htmlentities(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
$contact_phone = escapeHtml(formatPhoneNumber($row['contact_phone'], $contact_phone_country_code));
|
||||||
$contact_extension = nullable_htmlentities($row['contact_extension']);
|
$contact_extension = escapeHtml($row['contact_extension']);
|
||||||
$contact_mobile_country_code = nullable_htmlentities($row['contact_mobile_country_code']);
|
$contact_mobile_country_code = escapeHtml($row['contact_mobile_country_code']);
|
||||||
$contact_mobile = nullable_htmlentities(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
$contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_mobile_country_code));
|
||||||
$client_website = nullable_htmlentities($row['client_website']);
|
$client_website = escapeHtml($row['client_website']);
|
||||||
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
|
$client_currency_code = escapeHtml($row['client_currency_code']);
|
||||||
$client_net_terms = intval($row['client_net_terms']);
|
$client_net_terms = intval($row['client_net_terms']);
|
||||||
if ($client_net_terms == 0) {
|
if ($client_net_terms == 0) {
|
||||||
$client_net_terms = $config_default_net_terms;
|
$client_net_terms = $config_default_net_terms;
|
||||||
@@ -80,23 +80,23 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$company_id = intval($row['company_id']);
|
$company_id = intval($row['company_id']);
|
||||||
$company_name = nullable_htmlentities($row['company_name']);
|
$company_name = escapeHtml($row['company_name']);
|
||||||
$company_country = nullable_htmlentities($row['company_country']);
|
$company_country = escapeHtml($row['company_country']);
|
||||||
$company_address = nullable_htmlentities($row['company_address']);
|
$company_address = escapeHtml($row['company_address']);
|
||||||
$company_city = nullable_htmlentities($row['company_city']);
|
$company_city = escapeHtml($row['company_city']);
|
||||||
$company_state = nullable_htmlentities($row['company_state']);
|
$company_state = escapeHtml($row['company_state']);
|
||||||
$company_zip = nullable_htmlentities($row['company_zip']);
|
$company_zip = escapeHtml($row['company_zip']);
|
||||||
$company_phone_country_code = nullable_htmlentities($row['company_phone_country_code']);
|
$company_phone_country_code = escapeHtml($row['company_phone_country_code']);
|
||||||
$company_phone = nullable_htmlentities(formatPhoneNumber($row['company_phone'], $company_phone_country_code));
|
$company_phone = escapeHtml(formatPhoneNumber($row['company_phone'], $company_phone_country_code));
|
||||||
$company_email = nullable_htmlentities($row['company_email']);
|
$company_email = escapeHtml($row['company_email']);
|
||||||
$company_website = nullable_htmlentities($row['company_website']);
|
$company_website = escapeHtml($row['company_website']);
|
||||||
$company_tax_id = nullable_htmlentities($row['company_tax_id']);
|
$company_tax_id = escapeHtml($row['company_tax_id']);
|
||||||
if ($config_invoice_show_tax_id && !empty($company_tax_id)) {
|
if ($config_invoice_show_tax_id && !empty($company_tax_id)) {
|
||||||
$company_tax_id_display = "Tax ID: $company_tax_id";
|
$company_tax_id_display = "Tax ID: $company_tax_id";
|
||||||
} else {
|
} else {
|
||||||
$company_tax_id_display = "";
|
$company_tax_id_display = "";
|
||||||
}
|
}
|
||||||
$company_logo = nullable_htmlentities($row['company_logo']);
|
$company_logo = escapeHtml($row['company_logo']);
|
||||||
|
|
||||||
$sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
|
$sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
|
||||||
|
|
||||||
@@ -399,13 +399,13 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_invoice_items)) {
|
while ($row = mysqli_fetch_assoc($sql_invoice_items)) {
|
||||||
$item_id = intval($row['item_id']);
|
$item_id = intval($row['item_id']);
|
||||||
$item_name = nullable_htmlentities($row['item_name']);
|
$item_name = escapeHtml($row['item_name']);
|
||||||
$item_description = nullable_htmlentities($row['item_description']);
|
$item_description = escapeHtml($row['item_description']);
|
||||||
$item_quantity = floatval($row['item_quantity']);
|
$item_quantity = floatval($row['item_quantity']);
|
||||||
$item_price = floatval($row['item_price']);
|
$item_price = floatval($row['item_price']);
|
||||||
$item_tax = floatval($row['item_tax']);
|
$item_tax = floatval($row['item_tax']);
|
||||||
$item_total = floatval($row['item_total']);
|
$item_total = floatval($row['item_total']);
|
||||||
$item_created_at = nullable_htmlentities($row['item_created_at']);
|
$item_created_at = escapeHtml($row['item_created_at']);
|
||||||
$tax_id = intval($row['item_tax_id']);
|
$tax_id = intval($row['item_tax_id']);
|
||||||
$item_product_id = intval($row['item_product_id']);
|
$item_product_id = intval($row['item_product_id']);
|
||||||
$total_tax = $item_tax + $total_tax;
|
$total_tax = $item_tax + $total_tax;
|
||||||
@@ -473,7 +473,7 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
|
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($taxes_sql)) {
|
while ($row = mysqli_fetch_assoc($taxes_sql)) {
|
||||||
$tax_id = intval($row['tax_id']);
|
$tax_id = intval($row['tax_id']);
|
||||||
$tax_name = nullable_htmlentities($row['tax_name']);
|
$tax_name = escapeHtml($row['tax_name']);
|
||||||
$tax_percent = floatval($row['tax_percent']);
|
$tax_percent = floatval($row['tax_percent']);
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $tax_id; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>
|
<option value="<?php echo $tax_id; ?>"><?php echo "$tax_name $tax_percent%"; ?></option>
|
||||||
@@ -566,7 +566,7 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<hr class="d-none d-print-block mt-5">
|
<hr class="d-none d-print-block mt-5">
|
||||||
<div class="d-none d-print-block text-center text-secondary"><?php echo nl2br(nullable_htmlentities($config_invoice_footer)); ?></div>
|
<div class="d-none d-print-block text-center text-secondary"><?php echo nl2br(escapeHtml($config_invoice_footer)); ?></div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="row d-print-none mb-3">
|
<div class="row d-print-none mb-3">
|
||||||
@@ -597,8 +597,8 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_history)) {
|
while ($row = mysqli_fetch_assoc($sql_history)) {
|
||||||
$history_created_at = $row['history_created_at'];
|
$history_created_at = $row['history_created_at'];
|
||||||
$history_status = nullable_htmlentities($row['history_status']);
|
$history_status = escapeHtml($row['history_status']);
|
||||||
$history_description = nullable_htmlentities($row['history_description']);
|
$history_description = escapeHtml($row['history_description']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -645,11 +645,11 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_payments)) {
|
while ($row = mysqli_fetch_assoc($sql_payments)) {
|
||||||
$payment_id = intval($row['payment_id']);
|
$payment_id = intval($row['payment_id']);
|
||||||
$payment_date = nullable_htmlentities($row['payment_date']);
|
$payment_date = escapeHtml($row['payment_date']);
|
||||||
$payment_amount = floatval($row['payment_amount']);
|
$payment_amount = floatval($row['payment_amount']);
|
||||||
$payment_currency_code = nullable_htmlentities($row['payment_currency_code']);
|
$payment_currency_code = escapeHtml($row['payment_currency_code']);
|
||||||
$payment_reference = nullable_htmlentities($row['payment_reference']);
|
$payment_reference = escapeHtml($row['payment_reference']);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<tr>
|
<tr>
|
||||||
@@ -709,8 +709,8 @@ if (isset($_GET['invoice_id'])) {
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_tickets)) {
|
while ($row = mysqli_fetch_assoc($sql_tickets)) {
|
||||||
$ticket_id = intval($row['ticket_id']);
|
$ticket_id = intval($row['ticket_id']);
|
||||||
$ticket_created_at = nullable_htmlentities($row['ticket_created_at']);
|
$ticket_created_at = escapeHtml($row['ticket_created_at']);
|
||||||
$ticket_subject = nullable_htmlentities($row['ticket_subject']);
|
$ticket_subject = escapeHtml($row['ticket_subject']);
|
||||||
$ticket_total_time_worked = floatval($row['total_time_worked']);
|
$ticket_total_time_worked = floatval($row['total_time_worked']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
@@ -181,7 +181,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="card-body">
|
<div class="card-body">
|
||||||
<form class="mb-4" autocomplete="off">
|
<form class="mb-4" autocomplete="off">
|
||||||
<input type="hidden" name="status" value="<?php if (isset($_GET['status'])) { echo nullable_htmlentities($_GET['status']); } ?>">
|
<input type="hidden" name="status" value="<?php if (isset($_GET['status'])) { echo escapeHtml($_GET['status']); } ?>">
|
||||||
<?php if ($client_url) { ?>
|
<?php if ($client_url) { ?>
|
||||||
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
|
<input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
@@ -189,7 +189,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="col-sm-4">
|
<div class="col-sm-4">
|
||||||
<div class="form-group mb-md-0">
|
<div class="form-group mb-md-0">
|
||||||
<div class="input-group">
|
<div class="input-group">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Invoices">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(escapeHtml($q));} ?>" placeholder="Search Invoices">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
<button class="btn btn-secondary" type="button" data-toggle="collapse" data-target="#advancedFilter"><i class="fas fa-filter"></i></button>
|
||||||
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
<button class="btn btn-primary"><i class="fa fa-search"></i></button>
|
||||||
@@ -206,7 +206,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
$sql_categories_filter = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND EXISTS (SELECT 1 FROM invoices WHERE invoice_category_id = category_id) ORDER BY category_name ASC");
|
$sql_categories_filter = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND EXISTS (SELECT 1 FROM invoices WHERE invoice_category_id = category_id) ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
|
||||||
$category_id = intval($row['category_id']);
|
$category_id = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
|
<option <?php if ($category_filter == $category_id) { echo "selected"; } ?> value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -246,9 +246,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
<div class="form-group">
|
<div class="form-group">
|
||||||
<label>Date range</label>
|
<label>Date range</label>
|
||||||
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
<input type="text" id="dateFilter" class="form-control" autocomplete="off">
|
||||||
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
|
<input type="hidden" name="canned_date" id="canned_date" value="<?php echo escapeHtml($_GET['canned_date']) ?? ''; ?>">
|
||||||
<input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
|
<input type="hidden" name="dtf" id="dtf" value="<?php echo escapeHtml($dtf ?? ''); ?>">
|
||||||
<input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
|
<input type="hidden" name="dtt" id="dtt" value="<?php echo escapeHtml($dtt ?? ''); ?>">
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -317,33 +317,33 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$invoice_id = intval($row['invoice_id']);
|
$invoice_id = intval($row['invoice_id']);
|
||||||
$invoice_prefix = nullable_htmlentities($row['invoice_prefix']);
|
$invoice_prefix = escapeHtml($row['invoice_prefix']);
|
||||||
$invoice_number = nullable_htmlentities($row['invoice_number']);
|
$invoice_number = escapeHtml($row['invoice_number']);
|
||||||
$invoice_scope = nullable_htmlentities($row['invoice_scope']);
|
$invoice_scope = escapeHtml($row['invoice_scope']);
|
||||||
if (empty($invoice_scope)) {
|
if (empty($invoice_scope)) {
|
||||||
$invoice_scope_display = "-";
|
$invoice_scope_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$invoice_scope_display = $invoice_scope;
|
$invoice_scope_display = $invoice_scope;
|
||||||
}
|
}
|
||||||
$invoice_status = nullable_htmlentities($row['invoice_status']);
|
$invoice_status = escapeHtml($row['invoice_status']);
|
||||||
$invoice_date = nullable_htmlentities($row['invoice_date']);
|
$invoice_date = escapeHtml($row['invoice_date']);
|
||||||
$invoice_due = nullable_htmlentities($row['invoice_due']);
|
$invoice_due = escapeHtml($row['invoice_due']);
|
||||||
$invoice_discount = floatval($row['invoice_discount_amount']);
|
$invoice_discount = floatval($row['invoice_discount_amount']);
|
||||||
$invoice_amount = floatval($row['invoice_amount']);
|
$invoice_amount = floatval($row['invoice_amount']);
|
||||||
$invoice_currency_code = nullable_htmlentities($row['invoice_currency_code']);
|
$invoice_currency_code = escapeHtml($row['invoice_currency_code']);
|
||||||
$invoice_created_at = nullable_htmlentities($row['invoice_created_at']);
|
$invoice_created_at = escapeHtml($row['invoice_created_at']);
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$category_id = intval($row['category_id']);
|
$category_id = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
$client_currency_code = nullable_htmlentities($row['client_currency_code']);
|
$client_currency_code = escapeHtml($row['client_currency_code']);
|
||||||
$client_net_terms = intval($row['client_net_terms']);
|
$client_net_terms = intval($row['client_net_terms']);
|
||||||
if ($client_net_terms == 0) {
|
if ($client_net_terms == 0) {
|
||||||
$client_net_terms = $config_default_net_terms;
|
$client_net_terms = $config_default_net_terms;
|
||||||
}
|
}
|
||||||
$recurring_invoice_id = intval($row['recurring_invoice_id']);
|
$recurring_invoice_id = intval($row['recurring_invoice_id']);
|
||||||
$recurring_invoice_prefix = nullable_htmlentities($row['recurring_invoice_prefix']);
|
$recurring_invoice_prefix = escapeHtml($row['recurring_invoice_prefix']);
|
||||||
$recurring_invoice_number = nullable_htmlentities($row['recurring_invoice_number']);
|
$recurring_invoice_number = escapeHtml($row['recurring_invoice_number']);
|
||||||
if($recurring_invoice_id) {
|
if($recurring_invoice_id) {
|
||||||
$recurring_invoice_display = "<i class='fas fa-fw fa-redo-alt text-secondary mr-1'></i><a href='recurring_invoice.php?recurring_invoice_id=$recurring_invoice_id'>$recurring_invoice_prefix$recurring_invoice_number</a>";
|
$recurring_invoice_display = "<i class='fas fa-fw fa-redo-alt text-secondary mr-1'></i><a href='recurring_invoice.php?recurring_invoice_id=$recurring_invoice_id'>$recurring_invoice_prefix$recurring_invoice_number</a>";
|
||||||
} else {
|
} else {
|
||||||
|
|||||||
@@ -109,7 +109,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
<div class="col-md-4">
|
<div class="col-md-4">
|
||||||
<div class="input-group mb-3 mb-md-0">
|
<div class="input-group mb-3 mb-md-0">
|
||||||
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Locations">
|
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Locations">
|
||||||
<div class="input-group-append">
|
<div class="input-group-append">
|
||||||
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
|
||||||
</div>
|
</div>
|
||||||
@@ -132,7 +132,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_filter)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']); ?>
|
$tag_name = escapeHtml($row['tag_name']); ?>
|
||||||
|
|
||||||
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
<option value="<?php echo $tag_id ?>" <?php if (isset($_GET['tags']) && is_array($_GET['tags']) && in_array($tag_id, $_GET['tags'])) { echo 'selected'; } ?>> <?php echo $tag_name ?> </option>
|
||||||
|
|
||||||
@@ -159,7 +159,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
?>
|
?>
|
||||||
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
<option <?php if ($client == $client_id) { echo "selected"; } ?> value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
|
||||||
<?php
|
<?php
|
||||||
@@ -260,39 +260,39 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$client_id = intval($row['client_id']);
|
$client_id = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']);
|
$client_name = escapeHtml($row['client_name']);
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
$location_description = nullable_htmlentities($row['location_description']);
|
$location_description = escapeHtml($row['location_description']);
|
||||||
$location_country = nullable_htmlentities($row['location_country']);
|
$location_country = escapeHtml($row['location_country']);
|
||||||
$location_address = nullable_htmlentities($row['location_address']);
|
$location_address = escapeHtml($row['location_address']);
|
||||||
$location_city = nullable_htmlentities($row['location_city']);
|
$location_city = escapeHtml($row['location_city']);
|
||||||
$location_state = nullable_htmlentities($row['location_state']);
|
$location_state = escapeHtml($row['location_state']);
|
||||||
$location_zip = nullable_htmlentities($row['location_zip']);
|
$location_zip = escapeHtml($row['location_zip']);
|
||||||
$location_phone_country_code = nullable_htmlentities($row['location_phone_country_code']);
|
$location_phone_country_code = escapeHtml($row['location_phone_country_code']);
|
||||||
$location_phone = nullable_htmlentities(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
|
$location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
|
||||||
if (empty($location_phone)) {
|
if (empty($location_phone)) {
|
||||||
$location_phone_display = "-";
|
$location_phone_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$location_phone_display = $location_phone;
|
$location_phone_display = $location_phone;
|
||||||
}
|
}
|
||||||
$location_fax_country_code = nullable_htmlentities($row['location_fax_country_code']);
|
$location_fax_country_code = escapeHtml($row['location_fax_country_code']);
|
||||||
$location_fax = nullable_htmlentities(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
|
$location_fax = escapeHtml(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
|
||||||
if ($location_fax) {
|
if ($location_fax) {
|
||||||
$location_fax_display = "<div class='text-secondary'>Fax: $location_fax</div>";
|
$location_fax_display = "<div class='text-secondary'>Fax: $location_fax</div>";
|
||||||
} else {
|
} else {
|
||||||
$location_fax_display = '';
|
$location_fax_display = '';
|
||||||
}
|
}
|
||||||
$location_hours = nullable_htmlentities($row['location_hours']);
|
$location_hours = escapeHtml($row['location_hours']);
|
||||||
if (empty($location_hours)) {
|
if (empty($location_hours)) {
|
||||||
$location_hours_display = "-";
|
$location_hours_display = "-";
|
||||||
} else {
|
} else {
|
||||||
$location_hours_display = $location_hours;
|
$location_hours_display = $location_hours;
|
||||||
}
|
}
|
||||||
$location_photo = nullable_htmlentities($row['location_photo']);
|
$location_photo = escapeHtml($row['location_photo']);
|
||||||
$location_notes = nullable_htmlentities($row['location_notes']);
|
$location_notes = escapeHtml($row['location_notes']);
|
||||||
$location_created_at = nullable_htmlentities($row['location_created_at']);
|
$location_created_at = escapeHtml($row['location_created_at']);
|
||||||
$location_archived_at = nullable_htmlentities($row['location_archived_at']);
|
$location_archived_at = escapeHtml($row['location_archived_at']);
|
||||||
$location_contact_id = intval($row['location_contact_id']);
|
$location_contact_id = intval($row['location_contact_id']);
|
||||||
$location_primary = intval($row['location_primary']);
|
$location_primary = intval($row['location_primary']);
|
||||||
if ( $location_primary == 1 ) {
|
if ( $location_primary == 1 ) {
|
||||||
@@ -309,12 +309,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
|
|||||||
while ($row = mysqli_fetch_assoc($sql_location_tags)) {
|
while ($row = mysqli_fetch_assoc($sql_location_tags)) {
|
||||||
|
|
||||||
$location_tag_id = intval($row['tag_id']);
|
$location_tag_id = intval($row['tag_id']);
|
||||||
$location_tag_name = nullable_htmlentities($row['tag_name']);
|
$location_tag_name = escapeHtml($row['tag_name']);
|
||||||
$location_tag_color = nullable_htmlentities($row['tag_color']);
|
$location_tag_color = escapeHtml($row['tag_color']);
|
||||||
if (empty($location_tag_color)) {
|
if (empty($location_tag_color)) {
|
||||||
$location_tag_color = "dark";
|
$location_tag_color = "dark";
|
||||||
}
|
}
|
||||||
$location_tag_icon = nullable_htmlentities($row['tag_icon']);
|
$location_tag_icon = escapeHtml($row['tag_icon']);
|
||||||
if (empty($location_tag_icon)) {
|
if (empty($location_tag_icon)) {
|
||||||
$location_tag_icon = "tag";
|
$location_tag_icon = "tag";
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -7,8 +7,8 @@ $account_id = intval($_GET['id']);
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
|
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
|
||||||
|
|
||||||
$row = mysqli_fetch_assoc($sql);
|
$row = mysqli_fetch_assoc($sql);
|
||||||
$account_name = nullable_htmlentities($row['account_name']);
|
$account_name = escapeHtml($row['account_name']);
|
||||||
$account_notes = nullable_htmlentities($row['account_notes']);
|
$account_notes = escapeHtml($row['account_notes']);
|
||||||
|
|
||||||
// Generate the HTML form content using output buffering.
|
// Generate the HTML form content using output buffering.
|
||||||
ob_start();
|
ob_start();
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
|
|||||||
|
|
||||||
$client_id = intval($_GET['client_id'] ?? 0);
|
$client_id = intval($_GET['client_id'] ?? 0);
|
||||||
$contact_id = intval($_GET['contact_id'] ?? 0);
|
$contact_id = intval($_GET['contact_id'] ?? 0);
|
||||||
$type = nullable_htmlentities(ucwords($_GET['type']) ?? '');
|
$type = escapeHtml(ucwords($_GET['type']) ?? '');
|
||||||
|
|
||||||
if ($client_id) {
|
if ($client_id) {
|
||||||
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
|
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
|
||||||
@@ -87,7 +87,7 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_client_select)) {
|
while ($row = mysqli_fetch_assoc($sql_client_select)) {
|
||||||
$client_id_select = intval($row['client_id']);
|
$client_id_select = intval($row['client_id']);
|
||||||
$client_name = nullable_htmlentities($row['client_name']); ?>
|
$client_name = escapeHtml($row['client_name']); ?>
|
||||||
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
|
<option <?php if ($client_id == $client_id_select) { echo "selected"; } ?> value="<?= $client_id_select ?>"><?= $client_name ?></option>
|
||||||
|
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
@@ -201,7 +201,7 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_location_select)) {
|
while ($row = mysqli_fetch_assoc($sql_location_select)) {
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?= $location_id ?>"><?= $location_name ?></option>
|
<option value="<?= $location_id ?>"><?= $location_name ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
@@ -234,7 +234,7 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_contact_select)) {
|
while ($row = mysqli_fetch_assoc($sql_contact_select)) {
|
||||||
$contact_id_select = intval($row['contact_id']);
|
$contact_id_select = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
?>
|
?>
|
||||||
<option
|
<option
|
||||||
<?php if ($contact_id == $contact_id_select) {
|
<?php if ($contact_id == $contact_id_select) {
|
||||||
@@ -266,7 +266,7 @@ ob_start();
|
|||||||
ORDER BY category_order ASC, category_name ASC
|
ORDER BY category_order ASC, category_name ASC
|
||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
|
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
|
||||||
$asset_status_select = nullable_htmlentities($row['category_name']);
|
$asset_status_select = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option><?= $asset_status_select ?></option>
|
<option><?= $asset_status_select ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
@@ -290,8 +290,8 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_network_select)) {
|
while ($row = mysqli_fetch_assoc($sql_network_select)) {
|
||||||
$network_id = intval($row['network_id']);
|
$network_id = intval($row['network_id']);
|
||||||
$network_name = nullable_htmlentities($row['network_name']);
|
$network_name = escapeHtml($row['network_name']);
|
||||||
$network = nullable_htmlentities($row['network']);
|
$network = escapeHtml($row['network']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option value="<?= $network_id ?>"><?= $network_name ?> - <?= $network ?></option>
|
<option value="<?= $network_id ?>"><?= $network_name ?> - <?= $network ?></option>
|
||||||
@@ -395,7 +395,7 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_vendor_select)) {
|
while ($row = mysqli_fetch_assoc($sql_vendor_select)) {
|
||||||
$vendor_id = intval($row['vendor_id']);
|
$vendor_id = intval($row['vendor_id']);
|
||||||
$vendor_name = nullable_htmlentities($row['vendor_name']);
|
$vendor_name = escapeHtml($row['vendor_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
|
<option value="<?php echo $vendor_id; ?>"><?php echo $vendor_name; ?></option>
|
||||||
|
|
||||||
@@ -497,7 +497,7 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
|
||||||
$tag_id = intval($row['tag_id']);
|
$tag_id = intval($row['tag_id']);
|
||||||
$tag_name = nullable_htmlentities($row['tag_name']);
|
$tag_name = escapeHtml($row['tag_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?= $tag_id ?>"><?= $tag_name ?></option>
|
<option value="<?= $tag_id ?>"><?= $tag_name ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -68,7 +68,7 @@ ob_start();
|
|||||||
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
|
$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Ticket' AND category_archived_at IS NULL ORDER BY category_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_categories)) {
|
while ($row = mysqli_fetch_assoc($sql_categories)) {
|
||||||
$category_id = intval($row['category_id']);
|
$category_id = intval($row['category_id']);
|
||||||
$category_name = nullable_htmlentities($row['category_name']);
|
$category_name = escapeHtml($row['category_name']);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
|
<option value="<?php echo $category_id; ?>"><?php echo $category_name; ?></option>
|
||||||
@@ -98,7 +98,7 @@ ob_start();
|
|||||||
);
|
);
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$user_id = intval($row['user_id']);
|
$user_id = intval($row['user_id']);
|
||||||
$user_name = nullable_htmlentities($row['user_name']); ?>
|
$user_name = escapeHtml($row['user_name']); ?>
|
||||||
<option <?php if ($session_user_id == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
|
<option <?php if ($session_user_id == $user_id) { echo "selected"; } ?> value="<?php echo $user_id; ?>"><?php echo $user_name; ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
</select>
|
</select>
|
||||||
@@ -118,7 +118,7 @@ ob_start();
|
|||||||
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
|
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_projects)) {
|
while ($row = mysqli_fetch_assoc($sql_projects)) {
|
||||||
$project_id_select = intval($row['project_id']);
|
$project_id_select = intval($row['project_id']);
|
||||||
$project_name_select = nullable_htmlentities($row['project_name']); ?>
|
$project_name_select = escapeHtml($row['project_name']); ?>
|
||||||
<option value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
|
<option value="<?php echo $project_id_select; ?>"><?php echo $project_name_select; ?></option>
|
||||||
|
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$contact_id = intval($row['contact_id']);
|
$contact_id = intval($row['contact_id']);
|
||||||
$contact_name = nullable_htmlentities($row['contact_name']);
|
$contact_name = escapeHtml($row['contact_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $contact_id; ?>"><?php echo $contact_name; ?></option>
|
<option value="<?php echo $contact_id; ?>"><?php echo $contact_name; ?></option>
|
||||||
|
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ ob_start();
|
|||||||
$sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
|
$sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql)) {
|
while ($row = mysqli_fetch_assoc($sql)) {
|
||||||
$location_id = intval($row['location_id']);
|
$location_id = intval($row['location_id']);
|
||||||
$location_name = nullable_htmlentities($row['location_name']);
|
$location_name = escapeHtml($row['location_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
<option value="<?php echo $location_id; ?>"><?php echo $location_name; ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -40,7 +40,7 @@ ob_start();
|
|||||||
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
|
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
|
||||||
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
|
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
|
||||||
$tag_id_select = intval($row['tag_id']);
|
$tag_id_select = intval($row['tag_id']);
|
||||||
$tag_name_select = nullable_htmlentities($row['tag_name']);
|
$tag_name_select = escapeHtml($row['tag_name']);
|
||||||
?>
|
?>
|
||||||
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
|
<option value="<?php echo $tag_id_select; ?>"><?php echo $tag_name_select; ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -38,7 +38,7 @@ ob_start();
|
|||||||
ORDER BY category_order ASC, category_name ASC
|
ORDER BY category_order ASC, category_name ASC
|
||||||
");
|
");
|
||||||
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
|
while ($row = mysqli_fetch_assoc($sql_interface_types_select)) {
|
||||||
$asset_status_select = nullable_htmlentities($row['category_name']);
|
$asset_status_select = escapeHtml($row['category_name']);
|
||||||
?>
|
?>
|
||||||
<option><?= $asset_status_select ?></option>
|
<option><?= $asset_status_select ?></option>
|
||||||
<?php } ?>
|
<?php } ?>
|
||||||
|
|||||||
@@ -42,7 +42,7 @@ ob_start();
|
|||||||
|
|
||||||
while ($row = mysqli_fetch_assoc($clients_sql)) {
|
while ($row = mysqli_fetch_assoc($clients_sql)) {
|
||||||
$client_id_select = intval($row["client_id"]);
|
$client_id_select = intval($row["client_id"]);
|
||||||
$client_name_select = nullable_htmlentities($row["client_name"]);
|
$client_name_select = escapeHtml($row["client_name"]);
|
||||||
?>
|
?>
|
||||||
<option value='<?php echo $client_id_select; ?>'><?php echo $client_name_select; ?></option>
|
<option value='<?php echo $client_id_select; ?>'><?php echo $client_name_select; ?></option>
|
||||||
<?php
|
<?php
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user