AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-17 13:05:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent client portal contacts from editing their own contact record

Browse Source
This commit is contained in:
johnnyq
2026-07-25 17:28:57 -04:00
parent 04bf3c234f
commit 887063394a
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
client/post.php
View File

@@ -452,6 +452,11 @@ if (isset($_POST['edit_contact'])) {
} }
$contact_id = intval($_POST['contact_id']); $contact_id = intval($_POST['contact_id']);
// A contact cannot edit their own record - that would let them change their own roles
if ($contact_id === $session_contact_id) {
flashAlert("You cannot edit your own contact record", 'danger');
redirect('contacts.php');
}
$contact_name = escapeSql($_POST['contact_name']); $contact_name = escapeSql($_POST['contact_name']);
$contact_email = escapeSql($_POST['contact_email']); $contact_email = escapeSql($_POST['contact_email']);
$contact_technical = intval($_POST['contact_technical'] ?? 0); $contact_technical = intval($_POST['contact_technical'] ?? 0);
@@ -483,16 +488,16 @@ if (isset($_POST['edit_contact'])) {
} }
// Update contact // Update contact
mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_user_id = $contact_user_id WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contact_archived_at IS NULL AND contact_primary = 0"); mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$contact_name', contact_email = '$contact_email', contact_billing = $contact_billing, contact_technical = $contact_technical, contact_user_id = $contact_user_id WHERE contact_id = $contact_id AND contact_client_id = $session_client_id AND contact_archived_at IS NULL AND contact_primary = 0 AND contact_id != $session_contact_id");
logAudit("Contact", "Edit", "Client contact $session_contact_name edited contact $contact_name in the client portal", $session_client_id, $contact_id); logAudit("Contact", "Edit", "Client contact $session_contact_name edited contact $contact_name in the client portal", $session_client_id, $contact_id);
flashAlert("Contact $contact_name updated"); flashAlert("Contact $contact_name updated");
redirect('contacts.php');
triggerCustomAction('contact_update', $contact_id); triggerCustomAction('contact_update', $contact_id);
redirect('contacts.php');
} }
if (isset($_GET['add_payment_by_provider'])) { if (isset($_GET['add_payment_by_provider'])) {