AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 01:27:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add clientScopeSql helper for client-scoped list queries

Browse Source
This commit is contained in:
johnnyq
2026-08-06 11:25:11 -04:00
parent 49a3c2d266
commit 83383599a1
3 changed files with 37 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
agent/reports/credential_rotation.php
View File

@@ -16,6 +16,7 @@ $passwords_not_rotated_sql = mysqli_query($mysqli,
FROM credentials
LEFT JOIN clients ON credential_client_id = client_id
WHERE DATE(credential_password_changed_at) < DATE_SUB(CURDATE(), INTERVAL $days DAY)
" . clientScopeSql('credential_client_id') . "
ORDER BY client_name"
);

20
api/v1/enforce_api_rbac.php
View File

@@ -45,24 +45,10 @@ function apiUserCanAccessClient($client_id) {
}
// Client-scope SQL fragment for a read query, from the user's allow / deny lists.
// Admin and unrestricted users get no restriction. Column-aware, so it works on any
// resource. Returns " AND ..." or "" (used after a "WHERE 1=1" anchor).
// Thin wrapper over clientScopeSql() in functions/auth.php so the API and the UI share one
// implementation. Kept under the api* name because every endpoint already calls it.
function apiClientScopeSql($column) {
global $session_is_admin, $client_access_array, $client_deny_array;
if ($session_is_admin) {
return '';
}
if (empty($client_access_array) && empty($client_deny_array)) {
return ''; // unrestricted user - all clients
}
$sql = '';
if (!empty($client_access_array)) {
$sql .= " AND $column IN (" . implode(',', array_map('intval', $client_access_array)) . ")";
}
if (!empty($client_deny_array)) {
$sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
}
return $sql;
return clientScopeSql($column);
}
// --- Every key must be tied to a user (legacy keys were removed in the 2.4.7 migration) ---

33
functions/auth.php
View File

@@ -62,6 +62,39 @@ function enforceUserPermission($module, $check_access_level = 1) {
}
}
// Client-scope SQL fragment for a list query, built from the signed-in user's allow / deny lists.
// Admin and unrestricted users get no restriction. This is the list-level counterpart to
// enforceClientAccess(), which gates a single record.
//
// Column-aware on purpose: it scopes on the resource's OWN client column rather than a joined
// clients.client_id, so a row with no client (column = 0) is judged on its real value instead of
// becoming NULL through a LEFT JOIN and silently dropping out of the result set.
//
// Returns " AND ..." or "" - append it after a WHERE clause (add "WHERE 1=1" if there isn't one).
function clientScopeSql($column) {
global $session_is_admin, $client_access_array, $client_deny_array;
if ($session_is_admin) {
return '';
}
if (empty($client_access_array) && empty($client_deny_array)) {
return ''; // Unrestricted user - all clients
}
$sql = '';
if (!empty($client_access_array)) {
$sql .= " AND $column IN (" . implode(',', array_map('intval', $client_access_array)) . ")";
}
if (!empty($client_deny_array)) {
$sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
}
return $sql;
}
function enforceClientAccess($client_id = null) {
global $mysqli, $session_user_id, $session_is_admin, $session_name;