diff --git a/accounts.php b/accounts.php index 61216bee..c0018c16 100644 --- a/accounts.php +++ b/accounts.php @@ -27,7 +27,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/ajax.php b/ajax.php index 52c5d5c6..39a88a6b 100644 --- a/ajax.php +++ b/ajax.php @@ -110,7 +110,7 @@ if (isset($_GET['merge_ticket_get_json_details'])) { $merge_into_ticket_number = intval($_GET['merge_into_ticket_number']); - $sql = mysqli_query($mysqli, "SELECT * FROM tickets + $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_number, ticket_prefix, ticket_subject, ticket_priority, ticket_status, client_name, contact_name FROM tickets LEFT JOIN clients ON ticket_client_id = client_id LEFT JOIN contacts ON ticket_contact_id = contact_id WHERE ticket_number = '$merge_into_ticket_number' AND tickets.company_id = '$session_company_id'"); @@ -120,7 +120,8 @@ if (isset($_GET['merge_ticket_get_json_details'])) { } else { //Return ticket, client and contact details for the given ticket number $response = mysqli_fetch_array($sql); - echo json_encode($response); + $response = array_map('htmlentities', $response); + echo json_encode( $response); } } @@ -190,10 +191,10 @@ if (isset($_GET['ticket_query_views'])) { $users = array_unique($users); if (count($users) > 1) { // Multiple viewers - $response['message'] = implode(", ", $users) . " are viewing this ticket."; + $response['message'] = htmlentities(implode(", ", $users) . " are viewing this ticket."); } else { // Single viewer - $response['message'] = implode("", $users) . " is viewing this ticket."; + $response['message'] = htmlentities(implode("", $users) . " is viewing this ticket."); } } else { // No viewers @@ -221,19 +222,19 @@ if (isset($_GET['share_generate_link'])) { if ($item_type == "Document") { $row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = '$item_id' AND document_client_id = '$client_id' LIMIT 1")); - $item_name = $row['document_name']; + $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['document_name'])); } if ($item_type == "File") { $row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = '$item_id' AND file_client_id = '$client_id' LIMIT 1")); - $item_name = $row['file_name']; + $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['file_name'])); } if ($item_type == "Login") { $login = mysqli_query($mysqli, "SELECT login_name, login_password FROM logins WHERE login_id = '$item_id' AND login_client_id = '$client_id' LIMIT 1"); $row = mysqli_fetch_array($login); - $item_name = $row['login_name']; + $item_name = strip_tags(mysqli_real_escape_string($mysqli, $row['login_name'])); // Decrypt & re-encrypt password for sharing $login_password_cleartext = decryptLoginEntry($row['login_password']); diff --git a/api/v1/clients/read.php b/api/v1/clients/read.php index c77b82ea..af5577e5 100644 --- a/api/v1/clients/read.php +++ b/api/v1/clients/read.php @@ -11,7 +11,7 @@ if (isset($_GET['client_id'])) { // Specific client via name (single) elseif (isset($_GET['client_name'])) { - $name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_GET['client_name']))); + $name = mysqli_real_escape_string($mysqli, $_GET['client_name']); $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_name = '$name' AND client_id LIKE '$client_id' AND company_id = '$company_id'"); } diff --git a/api/v1/contacts/read.php b/api/v1/contacts/read.php index c15b1493..19acda88 100644 --- a/api/v1/contacts/read.php +++ b/api/v1/contacts/read.php @@ -11,7 +11,7 @@ if (isset($_GET['contact_id'])) { // Specific contact via email (single) elseif (isset($_GET['contact_email'])) { - $email = trim(strip_tags(mysqli_real_escape_string($mysqli, $_GET['contact_email']))); + $email = mysqli_real_escape_string($mysqli, $_GET['contact_email']); $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id LIKE '$client_id' AND company_id = '$company_id'"); } diff --git a/api/v1/software/read.php b/api/v1/software/read.php index ca26185d..0b09d9a0 100644 --- a/api/v1/software/read.php +++ b/api/v1/software/read.php @@ -9,10 +9,10 @@ if (isset($_GET['software_id'])) { $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id' AND company_id = '$company_id'"); } -// Specific software via License ID -if (isset($_GET['software_license'])) { - $license = mysqli_real_escape_string($mysqli, $_GET['software_license']); - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_license_type = '$license' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); +// Specific software via key +if (isset($_GET['software_key'])) { + $key = mysqli_real_escape_string($mysqli, $_GET['software_license']); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); } // Software by name diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index 5b85055e..fceeaa7c 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -73,10 +73,10 @@ if (isset($api_key)) { if (mysqli_num_rows($sql) !== 1) { // Invalid Key header(WORDING_UNAUTHORIZED); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = 'Incorrect or expired Key', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW()"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = 'Incorrect or expired key', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW()"); $return_arr['success'] = "False"; - $return_arr['message'] = "API Key authentication failure or expired."; + $return_arr['message'] = "Authentication failed. API key is invalid or has expired."; header(WORDING_UNAUTHORIZED); echo json_encode($return_arr); @@ -88,7 +88,7 @@ if (isset($api_key)) { // Set client ID, company ID & key name $row = mysqli_fetch_array($sql); - $api_key_name = $row['api_key_name']; + $api_key_name = htmlentities($row['api_key_name']); $client_id = $row['api_key_client_id']; $company_id = $row['company_id']; diff --git a/api_key_add_modal.php b/api_key_add_modal.php index 9253d568..4f6aa795 100644 --- a/api_key_add_modal.php +++ b/api_key_add_modal.php @@ -65,7 +65,7 @@ $key = bin2hex(random_bytes(78)); $sql = mysqli_query($mysqli,"SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while($row = mysqli_fetch_array($sql)){ $client_id = $row['client_id']; - $client_name = $row['client_name']; + $client_name = htmlentities($row['client_name']); ?> diff --git a/assets.php b/assets.php deleted file mode 100644 index 772673ee..00000000 --- a/assets.php +++ /dev/null @@ -1,160 +0,0 @@ - $sb, 'o' => $o))); - -$sql = mysqli_query($mysqli,"SELECT SQL_CALC_FOUND_ROWS * FROM assets LEFT JOIN clients ON asset_client_id = client_id - WHERE (asset_name LIKE '%$q%' OR asset_type LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' - OR asset_ip LIKE '%$q%' OR asset_mac LIKE '%$q%' OR client_name LIKE '%$q%') - AND DATE(asset_created_at) BETWEEN '$dtf' AND '$dtt' - AND assets.company_id = $session_company_id - ORDER BY $sb $o LIMIT $record_from, $record_to" -); - -$num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); - -?> - -
-
-

Client Assets

-
-
-
- -
- -
-
-
- -
- - -
-
-
-
-
" id="advancedFilter"> -
-
-
- - -
-
-
-
- - -
-
-
-
- -
-
- - "> - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeMakeModelSerialClient
-
- -
-
- - - -
- +
diff --git a/check_login.php b/check_login.php index 1597527b..e24efb6a 100644 --- a/check_login.php +++ b/check_login.php @@ -32,7 +32,7 @@ $session_user_id = $_SESSION['user_id']; $sql = mysqli_query($mysqli,"SELECT * FROM users, user_settings WHERE users.user_id = user_settings.user_id AND users.user_id = $session_user_id"); $row = mysqli_fetch_array($sql); -$session_name = $row['user_name']; +$session_name = mysqli_real_escape_string($mysqli, $row['user_name']); $session_email = $row['user_email']; $session_avatar = $row['user_avatar']; $session_token = $row['user_token']; diff --git a/client_assets.php b/client_assets.php index 9f919f4b..3891e1d8 100644 --- a/client_assets.php +++ b/client_assets.php @@ -86,7 +86,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- s"> + s">
diff --git a/client_certificates.php b/client_certificates.php index 4de3f655..79eb96be 100644 --- a/client_certificates.php +++ b/client_certificates.php @@ -33,7 +33,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_contact_details_modal.php b/client_contact_details_modal.php index 58cf6ca6..749ac31b 100644 --- a/client_contact_details_modal.php +++ b/client_contact_details_modal.php @@ -105,7 +105,7 @@ while($row = mysqli_fetch_array($sql_related_tickets)){ $ticket_id = $row['ticket_id']; - $ticket_prefix = $row['ticket_prefix']; + $ticket_prefix = htmlentities($row['ticket_prefix']); $ticket_number = $row['ticket_number']; $ticket_subject = htmlentities($row['ticket_subject']); diff --git a/client_contacts.php b/client_contacts.php index eeb82d08..73ce0327 100644 --- a/client_contacts.php +++ b/client_contacts.php @@ -56,7 +56,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_documents.php b/client_documents.php index 244e58ad..dbb952bb 100644 --- a/client_documents.php +++ b/client_documents.php @@ -130,7 +130,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_domains.php b/client_domains.php index 10bb382f..14ace448 100644 --- a/client_domains.php +++ b/client_domains.php @@ -34,7 +34,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_invoices.php b/client_invoices.php index 65e23cbd..69915877 100644 --- a/client_invoices.php +++ b/client_invoices.php @@ -41,7 +41,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_locations.php b/client_locations.php index f063aa64..b849c196 100644 --- a/client_locations.php +++ b/client_locations.php @@ -47,7 +47,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_logins.php b/client_logins.php index 43416cf0..f0ef1cca 100644 --- a/client_logins.php +++ b/client_logins.php @@ -34,7 +34,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_logs.php b/client_logs.php index 8816067d..1b591255 100644 --- a/client_logs.php +++ b/client_logs.php @@ -40,7 +40,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_networks.php b/client_networks.php index eea103c9..fbf785f3 100644 --- a/client_networks.php +++ b/client_networks.php @@ -35,7 +35,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_payments.php b/client_payments.php index 32ce2214..a95d6a97 100644 --- a/client_payments.php +++ b/client_payments.php @@ -39,7 +39,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_print.php b/client_print.php deleted file mode 100644 index e55bf2db..00000000 --- a/client_print.php +++ /dev/null @@ -1,769 +0,0 @@ - - - - - -
    -
  1. - Clients -
    2. -
  2. - -
    3. -
  3. Print
    4. -
- - - -
-
- - - - - - - - - - - - - -
DocumentIT DocumentationDate
Prepared ByConfidential
-
-
-
-
-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Address - -
- -
Primary Contact
Phone
Mobile
Email
Website
Net Terms Day
-
-
-
-
- Table of Contents -
-
- -
-
-
-
- - - 0){ ?> - -
-

Contacts ()

- - - - - - - - - - - - 2){ - $contact_phone = substr($row['contact_phone'],0,3)."-".substr($row['contact_phone'],3,3)."-".substr($row['contact_phone'],6,4); - } - $contact_extension = $row['contact_extension']; - if(!empty($contact_extension)){ - $contact_extension = "x$contact_extension"; - } - $contact_mobile = $row['contact_mobile']; - if(strlen($contact_mobile)>2){ - $contact_mobile = substr($row['contact_mobile'],0,3)."-".substr($row['contact_mobile'],3,3)."-".substr($row['contact_mobile'],6,4); - } - $contact_email = $row['contact_email']; - - ?> - - - - - - - - - - - -
NameTitleEmailPhoneMobile
-
- - - 0){ ?> -

Locations ()

- - - - - - - - - - 2){ - $location_phone = substr($row['location_phone'],0,3)."-".substr($row['location_phone'],3,3)."-".substr($row['location_phone'],6,4); - } - - ?> - - - - - - - - - -
LocationAddressPhone
$location_city $location_state $location_zip"; ?>
- - - - 0){ ?> -

Assets ()

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
TypeNameMakeModelSerialOSIPMACPurchase DateWarranty Expire
- - - - 0){ ?> -

Vendors ()

- - - - - - - - - - - - - - 2){ - $vendor_phone = substr($row['vendor_phone'],0,3)."-".substr($row['vendor_phone'],3,3)."-".substr($row['vendor_phone'],6,4); - } - $vendor_email = $row['vendor_email']; - $vendor_website = $row['vendor_website']; - - ?> - - - - - - - - - - - - - -
VendorDescriptionContact NamePhoneEmailWebsiteAccount Number
- - - - 0){ ?> -

Logins ()

- - - - - - - - - - - - - - - - - - - - - - -
NameURL/HostUsernamePassword
- - - - 0){ ?> -

Networks ()

- - - - - - - - - - - - - - - - - - - - - - - -
NamevLANNetworkGatewayDHCP Range
- - - - 0){ ?> -

Domains ()

- - - - - - - - - - - - - - - - - - - - - - - -
DomainRegistrarWebhostExpire
- - - - 0){ ?> -

Software ()

- - - - - - - - - - - - - - - - - - - -
SoftwareTypeLicense
- - - - 0){ ?> -

Invoices ()

- - - - - - - - - - - - - - - - - - - - - - - - -
NumberAmountDateDueStatus
$
- - - - 0){ ?> -

Payments ()

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Date ReceivedDate DueInvoiceInvoice AmountAmount PayedInvoice BalancePayment MethodCheck #
$$$
- - - - 0){ ?> -

Quotes ()

- - - - - - - - - - - - - - - - - - - - - - -
NumberAmountDateStatus
$
- - - - 0){ ?> -

Recurring Invoices ()

- - - - - - - - - - - - - - - - - - - - - - - - -
FrequencyCreatedLast SentNext DateStatus
ly
- - - - 0){ ?> -

Documents ()

-
- - -
-
-

- - - - - - - - -
- +
diff --git a/client_recurring_invoices.php b/client_recurring_invoices.php index 523d8c11..41932b22 100644 --- a/client_recurring_invoices.php +++ b/client_recurring_invoices.php @@ -35,7 +35,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_scheduled_tickets.php b/client_scheduled_tickets.php index bb2392b4..b0c192be 100644 --- a/client_scheduled_tickets.php +++ b/client_scheduled_tickets.php @@ -38,7 +38,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
- +
diff --git a/client_service_view_modal.php b/client_service_view_modal.php index c6676728..aadc7b1a 100644 --- a/client_service_view_modal.php +++ b/client_service_view_modal.php @@ -41,7 +41,7 @@ } ?> - @@ -69,18 +69,16 @@ if(!empty($networks)){ ?>
Networks
    - $network[0] (VLAN $network[1])"; + $network = explode(":", $network); + echo "
  • $network[0] (VLAN $network[1])
    • "; } - // Not showing/haven't added explicitly linked networks - can't see a need for a network that doesn't have an asset on it? - // Can add at a later date if there is a use case for this ?>
- @@ -110,7 +108,7 @@ $location"; + echo "
  • $location
    • "; } ?> @@ -284,14 +282,14 @@ } ?> - - - - + + + +
    +
    -
    -
    \ No newline at end of file +
    \ No newline at end of file diff --git a/client_services.php b/client_services.php index 774ee229..679d6dde 100644 --- a/client_services.php +++ b/client_services.php @@ -34,7 +34,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/client_shared_items.php b/client_shared_items.php index b99df38e..c5fc9d6e 100644 --- a/client_shared_items.php +++ b/client_shared_items.php @@ -42,7 +42,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/client_software.php b/client_software.php index 71c21061..9fa941b3 100644 --- a/client_software.php +++ b/client_software.php @@ -35,7 +35,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/client_test.php b/client_test.php deleted file mode 100644 index 17719195..00000000 --- a/client_test.php +++ /dev/null @@ -1,9 +0,0 @@ - - - - - \ No newline at end of file diff --git a/client_tickets.php b/client_tickets.php index d83a96c1..77996b3e 100644 --- a/client_tickets.php +++ b/client_tickets.php @@ -45,7 +45,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/client_trips.php b/client_trips.php index 48d52e06..deaf15f3 100644 --- a/client_trips.php +++ b/client_trips.php @@ -52,7 +52,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/client_vendors.php b/client_vendors.php index c01cf6a7..dd2c78d4 100644 --- a/client_vendors.php +++ b/client_vendors.php @@ -45,7 +45,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/clients.php b/clients.php index 99f2403c..3d8c42b9 100644 --- a/clients.php +++ b/clients.php @@ -119,7 +119,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/companies.php b/companies.php index f6bb7d5e..ca3964ca 100644 --- a/companies.php +++ b/companies.php @@ -32,7 +32,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/cron.php b/cron.php index 62065466..aaca58bb 100644 --- a/cron.php +++ b/cron.php @@ -1,5 +1,5 @@ - - + + @@ -58,10 +58,10 @@ while($row = mysqli_fetch_array($sql_companies)){ while($row = mysqli_fetch_array($sql)){ $domain_id = $row['domain_id']; - $domain_name = $row['domain_name']; + $domain_name = mysqli_real_escape_string($mysqli,$row['domain_name']); $domain_expire = $row['domain_expire']; $client_id = $row['client_id']; - $client_name = $row['client_name']; + $client_name = mysqli_real_escape_string($mysqli,$row['client_name']); mysqli_query($mysqli,"INSERT INTO notifications SET notification_type = 'Domain', notification = 'Domain $domain_name for $client_name will expire in $day Days on $domain_expire', notification_timestamp = NOW(), notification_client_id = $client_id, company_id = $company_id"); @@ -75,7 +75,7 @@ while($row = mysqli_fetch_array($sql_companies)){ foreach($certificateAlertArray as $day){ - //Get Domains Expiring + //Get Certs Expiring $sql = mysqli_query($mysqli,"SELECT * FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_expire = CURDATE() + INTERVAL $day DAY @@ -84,11 +84,11 @@ while($row = mysqli_fetch_array($sql_companies)){ while($row = mysqli_fetch_array($sql)){ $certificate_id = $row['certificate_id']; - $certificate_name = $row['certificate_name']; + $certificate_name = mysqli_real_escape_string($mysqli,$row['certificate_name']); $certificate_domain = $row['certificate_domain']; $certificate_expire = $row['certificate_expire']; $client_id = $row['client_id']; - $client_name = $row['client_name']; + $client_name = mysqli_real_escape_string($mysqli,$row['client_name']); mysqli_query($mysqli,"INSERT INTO notifications SET notification_type = 'Certificate', notification = 'Certificate $certificate_name for $client_name will expire in $day Days on $certificate_expire', notification_timestamp = NOW(), notification_client_id = $client_id, company_id = $company_id"); @@ -111,10 +111,10 @@ while($row = mysqli_fetch_array($sql_companies)){ while($row = mysqli_fetch_array($sql)){ $asset_id = $row['asset_id']; - $asset_name = $row['asset_name']; + $asset_name = mysqli_real_escape_string($mysqli,$row['asset_name']); $asset_warranty_expire = $row['asset_warranty_expire']; $client_id = $row['client_id']; - $client_name = $row['client_name']; + $client_name = mysqli_real_escape_string($mysqli,$row['client_name']); mysqli_query($mysqli,"INSERT INTO notifications SET notification_type = 'Asset', notification = 'Asset $asset_name warranty for $client_name will expire in $day Days on $asset_warranty_expire', notification_timestamp = NOW(), notification_client_id = $client_id, company_id = $company_id"); @@ -134,8 +134,8 @@ while($row = mysqli_fetch_array($sql_companies)){ if(mysqli_num_rows($sql_scheduled_tickets) > 0){ while($row = mysqli_fetch_array($sql_scheduled_tickets)){ $schedule_id = $row['scheduled_ticket_id']; - $subject = $row['scheduled_ticket_subject']; - $details = $row['scheduled_ticket_details']; + $subject = mysqli_real_escape_string($mysqli,$row['scheduled_ticket_subject']); + $details = mysqli_real_escape_string($mysqli,$row['scheduled_ticket_details']); $priority = $row['scheduled_ticket_priority']; $frequency = strtolower($row['scheduled_ticket_frequency']); $created_id = $row['scheduled_ticket_created_by']; @@ -225,7 +225,7 @@ while($row = mysqli_fetch_array($sql_companies)){ $invoice_amount = $row['invoice_amount']; $invoice_currency_code = $row['invoice_currency_code']; $client_id = $row['client_id']; - $client_name = $row['client_name']; + $client_name = mysqli_real_escape_string($mysqli,$row['client_name']); $contact_name = $row['contact_name']; $contact_email = $row['contact_email']; diff --git a/expenses.php b/expenses.php index 196ec06a..b2358396 100644 --- a/expenses.php +++ b/expenses.php @@ -83,7 +83,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/guest_download_file.php b/guest_download_file.php index b3d8c253..46c114bf 100644 --- a/guest_download_file.php +++ b/guest_download_file.php @@ -44,7 +44,7 @@ if(isset($_GET['id']) && isset($_GET['key'])){ exit("No file."); } - $file_name = $file_row['file_name']; + $file_name = strip_tags(mysqli_real_escape_string($mysqli, $file_row['file_name'])); $file_ext = $file_row['file_ext']; $file_reference_name = $file_row['file_reference_name']; $client_id = $file_row['file_client_id']; @@ -54,7 +54,7 @@ if(isset($_GET['id']) && isset($_GET['key'])){ // Display file as download $mime_type = mime_content_type($file_path); header('Content-type: '.$mime_type); - header('Content-Disposition: attachment; filename=download.' .$file_ext); + header('Content-Disposition: attachment; filename=download.' . $file_ext); readfile($file_path); // Update file view count @@ -62,7 +62,7 @@ if(isset($_GET['id']) && isset($_GET['key'])){ mysqli_query($mysqli, "UPDATE shared_items SET item_views = '$new_item_views' WHERE item_id = '$item_id'"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Downloaded shared file via link - Item ID: $item_id', log_client_id = '$client_id', log_created_at = NOW(), log_ip = '$ip', log_user_agent = '$user_agent', company_id = '1'"); + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Downloaded shared file $file_name via link', log_client_id = '$client_id', log_created_at = NOW(), log_ip = '$ip', log_user_agent = '$user_agent', company_id = '1'"); } \ No newline at end of file diff --git a/guest_pay_invoice.php b/guest_pay_invoice.php index 10c992ec..dd97f9b6 100644 --- a/guest_pay_invoice.php +++ b/guest_pay_invoice.php @@ -1,5 +1,8 @@ - diff --git a/inc_all_settings.php b/inc_all_settings.php index d41672b6..ae21679b 100644 --- a/inc_all_settings.php +++ b/inc_all_settings.php @@ -4,12 +4,7 @@ include("config.php"); include_once("functions.php"); include("check_login.php"); -if($session_user_role != 3){ - $_SESSION['alert_type'] = "danger"; - $_SESSION['alert_message'] = "You are not permitted to do that!"; - header("Location: index.php"); - exit(); -} +validateAdminRole(); include("header.php"); include("top_nav.php"); diff --git a/invoices.php b/invoices.php index 99dfc925..c909687d 100644 --- a/invoices.php +++ b/invoices.php @@ -205,7 +205,7 @@
    - +
    diff --git a/login.php b/login.php index 88a5c64b..ffe4e853 100644 --- a/login.php +++ b/login.php @@ -59,12 +59,12 @@ if(isset($_POST['login'])){ // User variables $token = $row['user_token']; - $user_name = $row['user_name']; + $user_name = strip_tags(mysqli_real_escape_string($mysqli, $row['user_name'])); $user_id = $row['user_id']; // Session info - $_SESSION['user_id'] = $row['user_id']; - $_SESSION['user_name'] = $row['user_name']; + $_SESSION['user_id'] = $user_id; + $_SESSION['user_name'] = $user_name; $_SESSION['user_role'] = $row['user_role']; $_SESSION['csrf_token'] = bin2hex(random_bytes(78)); diff --git a/logs.php b/logs.php index c0195480..d122509b 100644 --- a/logs.php +++ b/logs.php @@ -75,7 +75,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/notifications_dismissed.php b/notifications_dismissed.php index e7ac7974..2537bd68 100644 --- a/notifications_dismissed.php +++ b/notifications_dismissed.php @@ -44,7 +44,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/payments.php b/payments.php index 0d529e1c..0595198d 100644 --- a/payments.php +++ b/payments.php @@ -78,7 +78,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/portal/check_login.php b/portal/check_login.php index e0a6cfe1..bcb5a523 100644 --- a/portal/check_login.php +++ b/portal/check_login.php @@ -36,10 +36,10 @@ $session_company_id = $_SESSION['company_id']; $contact_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$session_contact_id' AND contact_client_id = '$session_client_id'"); $contact = mysqli_fetch_array($contact_sql); -$session_contact_name = $contact['contact_name']; +$session_contact_name = strip_tags(mysqli_real_escape_string($mysqli,$contact['contact_name'])); $session_contact_initials = initials($session_contact_name); -$session_contact_title = $contact['contact_title']; -$session_contact_email = $contact['contact_email']; +$session_contact_title = strip_tags(mysqli_real_escape_string($mysqli,$contact['contact_title'])); +$session_contact_email = strip_tags(mysqli_real_escape_string($mysqli,$contact['contact_email'])); $session_contact_photo = $contact['contact_photo']; // Get client info diff --git a/portal/index.php b/portal/index.php index 50f5858c..9f20d98e 100644 --- a/portal/index.php +++ b/portal/index.php @@ -86,11 +86,17 @@ $total_tickets = $row['total_tickets']; "; - echo " $ticket[ticket_prefix]$ticket[ticket_number]"; - echo " $ticket[ticket_subject]"; - echo "$ticket[ticket_status]"; + echo " $ticket_prefix$ticket_number"; + echo " $ticket_subject"; + echo "$ticket_status"; echo ""; } ?> diff --git a/portal/login.php b/portal/login.php index bf25864b..b3ef5f66 100644 --- a/portal/login.php +++ b/portal/login.php @@ -24,7 +24,7 @@ $user_agent = strip_tags(mysqli_real_escape_string($mysqli, $_SERVER['HTTP_USER_ $sql_settings = mysqli_query($mysqli, "SELECT config_azure_client_id FROM settings WHERE company_id = '1'"); $settings = mysqli_fetch_array($sql_settings); -$client_id = $settings['config_azure_client_id']; +$azure_client_id = $settings['config_azure_client_id']; $company_sql = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = '1'"); $company_results = mysqli_fetch_array($company_sql); @@ -131,7 +131,7 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login'])) { + if (!empty($azure_client_id)) { ?>
    diff --git a/portal/login_reset.php b/portal/login_reset.php index d78cdec3..e9cf0888 100644 --- a/portal/login_reset.php +++ b/portal/login_reset.php @@ -51,7 +51,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $company = $row['company_id']; if ($row['contact_email'] == $email) { - $token = key32gen(); + $token = bin2hex(random_bytes(78)); $url = "https://$config_base_url/portal/login_reset.php?email=$email&token=$token&client=$client"; mysqli_query($mysqli, "UPDATE contacts SET contact_password_reset_token = '$token' WHERE contact_id = $id LIMIT 1"); mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Modify', log_description = 'Sent a portal password reset e-mail for $email.', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_client_id = $client, company_id = $company"); @@ -59,7 +59,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { // Send reset email $subject = "Password reset for $company_name ITFlow Portal"; - $body = "Hello, $name

    Someone (probably you) has requested a new password for your account on $company_name's ITFlow Client Portal.

    Please click here to reset your password.

    Alternatively, copy and paste this URL into your browser: $url

    If you didn't request this change, you can safely ignore this email.

    ~
    $company_name
    Support Department
    $config_mail_from_email"; + $body = "Hello, $name

    Someone (probably you) has requested a new password for your account on $company_name's ITFlow Client Portal.

    Please click here to reset your password.

    Alternatively, copy and paste this URL into your browser:
    $url

    If you didn't request this change, you can safely ignore this email.

    ~
    $company_name
    Support Department
    $config_mail_from_email"; $mail = sendSingleEmail($config_smtp_host, $config_smtp_username, $config_smtp_password, $config_smtp_encryption, $config_smtp_port, $config_mail_from_email, $config_mail_from_name, diff --git a/portal/ticket.php b/portal/ticket.php index 1e50b74c..918d7cca 100644 --- a/portal/ticket.php +++ b/portal/ticket.php @@ -15,18 +15,28 @@ if (isset($_GET['id']) && intval($_GET['id'])) { $ticket_sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_client_id = '$session_client_id' AND ticket_contact_id = '$session_contact_id'"); } - $ticket = mysqli_fetch_array($ticket_sql); + $ticket_row = mysqli_fetch_array($ticket_sql); + + if ($ticket_row) { + + $ticket_prefix = htmlentities($ticket_row['ticket_prefix']); + $ticket_number = $ticket_row['ticket_number']; + $ticket_status = htmlentities($ticket_row['ticket_status']); + $ticket_priority = htmlentities($ticket_row['ticket_priority']); + $ticket_subject = htmlentities($ticket_row['ticket_subject']); + $ticket_details = $ticket_row['ticket_details']; + $ticket_feedback = htmlentities($ticket_row['ticket_feedback']); + - if ($ticket) { ?>
    diff --git a/quotes.php b/quotes.php index e3b4bd99..317beedd 100644 --- a/quotes.php +++ b/quotes.php @@ -79,7 +79,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/recurring_invoices.php b/recurring_invoices.php index 83249d98..46ac3695 100644 --- a/recurring_invoices.php +++ b/recurring_invoices.php @@ -79,7 +79,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/revenues.php b/revenues.php index 4bb36508..496cdad3 100644 --- a/revenues.php +++ b/revenues.php @@ -79,7 +79,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/scheduled_tickets.php b/scheduled_tickets.php index aad30880..7340a650 100644 --- a/scheduled_tickets.php +++ b/scheduled_tickets.php @@ -34,7 +34,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +
    diff --git a/settings_api.php b/settings_api.php index a5a6557d..4ea26769 100644 --- a/settings_api.php +++ b/settings_api.php @@ -29,7 +29,7 @@
    - +
    diff --git a/settings_backup.php b/settings_backup.php index 632b6ad6..312e1fe3 100644 --- a/settings_backup.php +++ b/settings_backup.php @@ -18,6 +18,7 @@
    +
    diff --git a/settings_tags.php b/settings_tags.php index 5634f28b..e86685b3 100644 --- a/settings_tags.php +++ b/settings_tags.php @@ -51,7 +51,7 @@ $colors_diff = array_diff($colors_array,$colors_used_array);
    - +
    diff --git a/test_client_header.php b/test_client_header.php deleted file mode 100644 index d67c127c..00000000 --- a/test_client_header.php +++ /dev/null @@ -1,293 +0,0 @@ - - - - - - - -

    Nothing to see here

    "; - }else{ - - $row = mysqli_fetch_array($sql); - $client_name = $row['client_name']; - $client_type = $row['client_type']; - $client_website = $row['client_website']; - $client_referral = $row['client_referral']; - $client_currency_code = $row['client_currency_code']; - $client_net_terms = $row['client_net_terms']; - if($client_net_terms == 0){ - $client_net_terms = $config_default_net_terms; - } - $client_notes = $row['client_notes']; - $client_created_at = $row['client_created_at']; - $primary_contact = $row['primary_contact']; - $primary_location = $row['primary_location']; - $contact_id = $row['contact_id']; - $contact_name = $row['contact_name']; - $contact_title = $row['contact_title']; - $contact_email = $row['contact_email']; - $contact_phone = $row['contact_phone']; - $contact_extension = $row['contact_extension']; - $contact_mobile = $row['contact_mobile']; - $location_id = $row['location_id']; - $location_name = $row['location_name']; - $location_address = $row['location_address']; - $location_city = $row['location_city']; - $location_state = $row['location_state']; - $location_zip = $row['location_zip']; - $location_country = $row['location_country']; - $location_phone = $row['location_phone']; - - //Client Tags - - $client_tag_name_display_array = array(); - $client_tag_id_array = array(); - $sql_client_tags = mysqli_query($mysqli,"SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_tags.client_id = $client_id"); - while($row = mysqli_fetch_array($sql_client_tags)){ - - $client_tag_id = $row['tag_id']; - $client_tag_name = $row['tag_name']; - $client_tag_color = $row['tag_color']; - $client_tag_icon = $row['tag_icon']; - if(empty($client_tag_icon)){ - $client_tag_icon = "tag"; - } - - $client_tag_id_array[] = $client_tag_id; - $client_tag_name_display_array[] = "$client_tag_name "; - } - $client_tags_display = " " . implode('', $client_tag_name_display_array); - - //Add up all the payments for the invoice and get the total amount paid to the invoice - $sql_invoice_amounts = mysqli_query($mysqli,"SELECT SUM(invoice_amount) AS invoice_amounts FROM invoices WHERE invoice_client_id = $client_id AND invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Cancelled'"); - $row = mysqli_fetch_array($sql_invoice_amounts); - - $invoice_amounts = $row['invoice_amounts']; - - $sql_amount_paid = mysqli_query($mysqli,"SELECT SUM(payment_amount) AS amount_paid FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_client_id = $client_id"); - $row = mysqli_fetch_array($sql_amount_paid); - - $amount_paid = $row['amount_paid']; - - $balance = $invoice_amounts - $amount_paid; - - //Badge Counts - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('contact_id') AS num FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id")); - $num_contacts = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('location_id') AS num FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id")); - $num_locations = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('asset_id') AS num FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id")); - $num_assets = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_status != 'Closed' AND ticket_client_id = $client_id")); - $num_active_tickets = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('service_id') AS num FROM services WHERE service_client_id = $client_id")); - $num_services = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('vendor_id') AS num FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id")); - $num_vendors = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('login_id') AS num FROM logins WHERE login_archived_at IS NULL AND login_client_id = $client_id")); - $num_logins = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('network_id') AS num FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id")); - $num_networks = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('domain_id') AS num FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id")); - $num_domains = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('certificate_id') AS num FROM certificates WHERE certificate_archived_at IS NULL AND certificate_client_id = $client_id")); - $num_certificates = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('software_id') AS num FROM software WHERE software_archived_at IS NULL AND software_client_id = $client_id")); - $num_software = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_archived_at IS NULL AND invoice_client_id = $client_id")); - $num_invoices = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('quote_id') AS num FROM quotes WHERE quote_archived_at IS NULL AND quote_client_id = $client_id")); - $num_quotes = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('recurring_id') AS num FROM recurring WHERE recurring_archived_at IS NULL AND recurring_client_id = $client_id")); - $num_recurring = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('payment_id') AS num FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_client_id = $client_id")); - $num_payments = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('file_id') AS num FROM files WHERE file_archived_at IS NULL AND file_client_id = $client_id")); - $num_files = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('document_id') AS num FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id")); - $num_documents = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('event_id') AS num FROM events WHERE event_client_id = $client_id")); - $num_events = $row['num']; - - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('trip_id') AS num FROM trips WHERE trip_archived_at IS NULL AND trip_client_id = $client_id")); - $num_trips = $row['num']; - -?> - - - - - -
    -
    -
    -
    -

    - - " target="_blank"> -
    -
    -     - - - -
    - - - -
    - - - - -
    -
    -

    Contact

    - - -
    - - - -
    - - - - - x - -
    - - - - -
    - -
    -

    Billing

    -
    Paid
    -
    Balance
    float-right">
    -
    Net Terms
    Days
    -
    - - -
    -

    Support

    -
    Open Tickets
    -
    - -
    - -
    - -
    - Print - Export PDF
    (without passwords)     - Export PDF
    (with passwords)     -
    - Edit -
    - Archive -
    - Delete -
    -
    - -
    -
    -
    -
    - - \ No newline at end of file diff --git a/client.js b/test_stripe_client.js similarity index 100% rename from client.js rename to test_stripe_client.js diff --git a/guest_checkout.php b/test_stripe_guest_checkout.php similarity index 93% rename from guest_checkout.php rename to test_stripe_guest_checkout.php index 1e7deaab..0c7709ba 100644 --- a/guest_checkout.php +++ b/test_stripe_guest_checkout.php @@ -1,4 +1,7 @@ - - + diff --git a/tickets.php b/tickets.php index d7cdb78d..d04b1ef5 100644 --- a/tickets.php +++ b/tickets.php @@ -176,7 +176,7 @@ $user_active_assigned_tickets = $row['total_tickets_assigned'];
    diff --git a/trips.php b/trips.php index 36175ec4..7354583d 100644 --- a/trips.php +++ b/trips.php @@ -84,7 +84,7 @@
    - +
    diff --git a/user_profile.php b/user_profile.php index cb101d5c..b0b07736 100644 --- a/user_profile.php +++ b/user_profile.php @@ -22,7 +22,6 @@ $sql_recent_logs = mysqli_query($mysqli,"SELECT * FROM logs -
    @@ -96,6 +95,7 @@ $sql_recent_logs = mysqli_query($mysqli,"SELECT * FROM logs

    2-Factor Authentication

    +

    You have not setup 2FA, click on enable to setup 2FA.

    diff --git a/users.php b/users.php index bc4b92d0..5269ca8b 100644 --- a/users.php +++ b/users.php @@ -37,7 +37,7 @@
    - +
    diff --git a/vendors.php b/vendors.php index a39d6ed8..502320a5 100644 --- a/vendors.php +++ b/vendors.php @@ -56,7 +56,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()"));
    - +