From 87faebd90d5eb551a1ccf2dc56995200d93810a7 Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Fri, 7 Jan 2022 15:51:22 +0000
Subject: [PATCH] Add functionality to for adding new assets via API

---
 README.md |  4 +++-
 api.php   | 21 ++++++++++++++++++---
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index ac95f94a..d9601126 100644
--- a/README.md
+++ b/README.md
@@ -109,7 +109,9 @@
 * XML Phonebook Download - /api.php?api_key=[API_KEY]&phonebook 
 * Client Email (great for mailing lists) - /api.php?api_key=[API_KEY]&client_emails - Returns Client Name - Email Address
 * Account Balance for Client (can be integrated into multiple places for example in FreePBX Press 3 to check account balance, please enter your client ID your balance is) - /api.php?api_key=[API_KEY]&client_id=[CLIENT_ID] - Returns Account Balance
-NOTE: [API_KEY] - is auto generated when a company is created and shows up in General Settings, this can also be changed manually.
+* Add new asset for a client - /api.php?api_key=[API_KEY]&add_asset=Name&type=[Desktop|Laptop|Server]&make=Make&model=Model&serial=Serial&os=OS
+    * Required: api_key, add_asset (name)
+* NOTE: [API_KEY] - is auto generated when a company is created and shows up in General Settings, this can also be changed manually.
 
 ### Future Todo
 * MeshCentral / TacticalRMM (Export Assets Info to ITFlow, Exports common software applications to Software)
diff --git a/api.php b/api.php
index d34928f1..37de01d9 100644
--- a/api.php
+++ b/api.php
@@ -1,8 +1,6 @@
 <?php include("config.php"); ?>
 
 <?php
-//Check Key
-
 
 // Check API key is provided in GET request as 'api_key'
 if(!isset($_GET['api_key']) OR empty($_GET['api_key'])) {
@@ -41,7 +39,7 @@ if(isset($_GET['cid'])){
     $name = $row['name'];
 
     echo "$name - $cid";
-    //Alert whern call comes through
+    //Alert when call comes through
     mysqli_query($mysqli,"INSERT INTO alerts SET alert_type = 'Inbound Call', alert_message = 'Inbound call from $name - $cid', alert_date = NOW(), company_id = $company_id");
     //Log When call comes through
     mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Call', log_action = 'Inbound', log_description = 'Inbound call from $name - $cid', log_created_at = NOW(), company_id = $company_id");
@@ -185,7 +183,24 @@ if(isset($_GET['account_balance'])){
     //Log
     mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Account Balance', log_description = 'Client $client_id checked their balance which had a balance of $balance', log_created_at = NOW(), company_id = $company_id");
 
+}
 
+if(isset($_GET['add_asset']) && isset($_GET['client_id'])) {
+    $client_id = intval($_GET['client_id']);
+    $name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['add_asset'])));
+    $type = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['type'])));
+    $make = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['make'])));
+    $model = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['model'])));
+    $serial = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['serial'])));
+    $os = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['os'])));
+
+    // Add
+    mysqli_query($mysqli,"INSERT INTO assets SET asset_name = '$name', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_created_at = NOW(), asset_client_id = $client_id, company_id = $company_id");
+
+    //Logging
+    mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Asset Created', log_description = '$name', log_created_at = NOW(), company_id = $company_id");
+
+    echo "Asset added!";
 }