AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 09:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1294 from itflow-org/develop

Browse Source 
Develop to Master for point release
This commit is contained in:
Johnny
2026-08-08 14:15:55 -04:00
committed by GitHub
parent ccaa45b0ae b903ee02fe
commit 89b080b430
346 changed files with 2280 additions and 1462 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
CHANGELOG.md
View File

@@ -2,6 +2,37 @@
This file documents all notable changes made to ITFlow.
## [26.08.1] Maint Release
### Upgrading to 26.08.1
Update the files from Settings > Update as normal. This release moves the database to 2.6.7 and the web updater completes it for you — the command line step that 26.08 required is not needed again.
### Breaking Changes and Notes
- Client access: agents with restricted client access now see records that have no client assigned. Previously this varied by page — unassigned tickets and projects were visible, unassigned expenses and credentials were not. It is now consistent everywhere.
### Bug Fixes
- Setup: fixed the wizard closing itself after the first user, which left new 26.08 installs stuck in a redirect loop between `/setup` and `/login.php`.
- API: tightened client scoping on the expense read and record update endpoints.
- Income: revenue rows now respect restricted client access.
- Client PDF Export: fixed the export producing a CSV file, and each section is now gated on the module that owns it.
- AI: fixed model creation, per-use-case model selection, configurable temperature, and error reporting.
- Ticket: system-generated replies no longer record time worked that was never worked.
- Ticket: fixed an error when scheduling a ticket.
- Ticket: cancelling a schedule now cancels the calendar event on the recipient's calendar.
- Ticket: history no longer records a status change when the status did not change.
- Recurring Ticket: bulk priority changes no longer deny access to agents who are not administrators.
- Contact: deleting a contact now removes the linked portal user, and anonymizing now redacts the phone number.
- Calendar: fixed event deletion.
### New Features & Updates
- Performance: queries now select only the columns they use instead of `SELECT *`, cutting memory use and query time across the app and especially in the crons.
- Performance: removed client joins that were only there for scoping — side nav badge counts are significantly faster.
- Client scoping: added a `clientScopeSql()` helper so list queries scope on the owning column instead of a joined `clients.client_id`.
- Contributing: documented the column-selection and client-scoping conventions.
## [26.08]
### Upgrading to 26.08

51
CONTRIBUTING.md
View File

@@ -74,6 +74,10 @@ if (isset($_POST['edit_ticket_priority'])) {
### The `_model.php` pattern
Files named `agent/post/*_model.php` hold shared field collection/sanitization logic used by both the create and edit blocks of a module (e.g. `asset_model.php` is included by both `add_asset` and `edit_asset`). If create and edit share more than a couple of fields, use this pattern rather than duplicating. Model files carry the same `FROM_POST_HANDLER` guard and are excluded from the dispatcher's auto-load.
**`_model.php` is a reserved suffix.** The exclusion is a filename match, so a *handler* named `*_model.php` is silently never loaded — its form posts, nothing claims the request, and the user gets a blank page with no error anywhere. This is what happened to `admin/post/ai_model.php`, which is why the AI Models handler is now `admin/post/ai_models.php`. Name entity handlers around the suffix (`ai_models.php`, `users.php`, `api_keys.php`).
A POST that reaches the end of `admin/post.php` or `agent/post.php` without a handler claiming it is logged to App Logs as a `Request` warning, which is the fastest way to spot this class of mistake.
---
@@ -171,7 +175,25 @@ Everywhere else — anything under `agent/post/` — the call belongs in the blo
### 4. Client scoping is enforced, not assumed.
After loading a record, call `enforceClientAccess()` (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it — including the "skip if the record has no client" case.
A user can be restricted to a subset of clients through `user_client_permissions`. Enforcing that has two halves, and a page usually needs both.
**One record — `enforceClientAccess()`.** After loading a record, call it (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it.
**A list — `clientScopeSql()`.** Any query returning more than one row appends the fragment for that resource's own client column:
```php
$sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_description
FROM expenses
WHERE expense_archived_at IS NULL
" . clientScopeSql('expense_client_id') . "
ORDER BY expense_date DESC");
```
It returns `" AND ..."` or `""`, so it needs a `WHERE` to hang off — add `WHERE 1=1` if the query has no other condition. It is column-aware and takes an alias fine (`clientScopeSql('t.ticket_client_id')`). The API calls the same helper through the `apiClientScopeSql()` wrapper.
Scope on the resource's **own** column, not on a joined `clients.client_id`. Joining `clients` just to scope makes the filter depend on the join: with a `LEFT JOIN`, a row whose client column is `0` produces `NULL`, and `NULL IN (...)` is neither true nor false, so the row silently vanishes. If the query joins `clients` for `client_name`, keep the join for that — but still scope on the owning column.
**Records with no client (`0`) stay visible to restricted users.** `clientScopeSql()` emits `IN (0,...)` deliberately. Client restrictions partition *client* data, and a record belonging to no client is not any client's data to withhold. Do not hand-roll a variant that drops the `0` — the tree had accumulated several before this helper existed, disagreeing with each other, and reconciling them is what surfaced the inconsistency.
### 5. Escape on output.
@@ -206,8 +228,29 @@ Per [SECURITY.md](SECURITY.md) — never in a public issue.
---
## Conventions
**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous and is why queries can `SELECT *` across joins safely. New tables must follow it.
**Only technician-entered time is time worked.** `ticket_replies.ticket_reply_time_worked` is billable labour and feeds ticket totals, the technician and client time reports, project totals, invoicing and the API. A reply the *system* writes — assignment, priority change, merge, close, invoice/quote created, schedule edited, task completed or reopened — is an audit trail, not work, and records `'00:00:00'`. Only a value the technician actually typed goes in that column. Task completion estimates are planning information and stay on the task; they are never converted into time worked. `agent/ticket.php` hides the clock badge on a reply whose time is exactly `00:00:00`, so a zero renders as no time rather than as "0m".
**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous, so a `SELECT *` across joins is never *wrong*. New tables must follow it.
**Select the columns you use, not `*`.** Unambiguous is not the same as cheap. `SELECT *` across three joined tables fetches every column of all three, including the `*_notes` and `*_details` TEXT columns, and throws away whatever the page never renders. A search result list that shows five fields was pulling sixty. List the columns instead:
```php
$sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_number, ticket_subject, client_name
FROM tickets
LEFT JOIN clients ON ticket_client_id = client_id
WHERE ticket_archived_at IS NULL
" . clientScopeSql('ticket_client_id') . "");
```
Two things follow from that:
- A query whose result only feeds `mysqli_num_rows()` needs no columns at all — write `SELECT 1`. Do not select a primary key "just in case": if the query joins two tables that both carry that column name, an unqualified `SELECT ticket_template_id` is an ambiguous-column error.
- Keep the join even when no column of the joined table survives into the `SELECT`, if the join is doing work — supplying a `WHERE` term, an `ORDER BY`, or the client column you scope on. Dropping a join is a separate decision from trimming the column list.
The trade is real and worth stating: `SELECT *` picks up new columns for free, an explicit list does not. Add a column to a table and every query that needs it must be updated by hand, and the failure mode is a blank field or a PHP 8 undefined-key warning rather than an error. That is the price of not fetching data nobody reads, and the project has decided to pay it on anything that loops or touches a TEXT column.
The exception is `api/v1/*/read.php`. Those endpoints hand the whole row to `read_output.php`, which serialises it straight into the JSON response — there the row *is* the output contract, so `SELECT *` is correct and trimming it would silently drop fields from every consumer.
The prefix is the entity name, which is usually but not always the singular of the table name. Where a table is named for its container rather than its row, the prefix follows the row: `calendar_events` → `event_*`, `asset_interfaces` → `interface_*`, `invoice_items` / `quote_items` → `item_*`, `rack_units` → `unit_*`, `user_roles` → `role_*`, `product_stock` → `stock_*`. Pick the prefix your columns will read best as and use it for every column in the table.
@@ -224,6 +267,8 @@ A single update run applies every pending migration in order, stopping at the fi
**After acting, log and notify.** State changes call `logAudit($type, $action, $description, $client_id, $entity_id)` for the audit trail. User-facing events may also call `appNotify()`. Fire `triggerCustomAction()` where a site might reasonably want a hook. Then call `flashAlert($message, $type)` and `redirect()` (defaults to the referer) rather than setting session keys or `header()` manually.
**Function names (post-rename).** Helpers were renamed for clarity in 2026; the old names **no longer exist** — code calling them fatals. If you're rebasing an old PR or following an old tutorial, translate: `sanitizeInput` → `escapeSql`, `nullable_htmlentities` → `escapeHtml`, `logAction` → `logAudit`, `flash_alert` → `flashAlert`, `customAction` → `triggerCustomAction`, `encryptLoginEntry`/`decryptLoginEntry` → `encryptCredentialEntry`/`decryptCredentialEntry`, `strtoAZaz09` → `toAlphanumeric`, `fetchUpdates` → `checkForUpdates`, `sanitize_url` → `escapeUrl`.
One removed **variable** deserves its own warning: the old `$access_permission_query` global is gone, replaced by `clientScopeSql()` (security rule 4). Unlike a removed function, it does not fatal — an undefined variable interpolates as an empty string, so a rebased query keeps running with **no client scoping at all**. Grep for it before rebasing anything that touches a list query.
**Helpers that fetch data return it raw.** If you add a `getXById()`-style helper, return the column value untouched and let callers escape it (security rule 1). Validating what the helper interpolates into its *own* query — table and column names, the id — is still the helper's job; that is query construction, not output escaping, and the two are not the same thing.

3
admin/ai_models.php
View File

@@ -6,7 +6,8 @@ $order = "ASC";
require_once "includes/inc_all_admin.php";
$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
$sql = mysqli_query($mysqli, "SELECT ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_provider_id,
ai_provider_name FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
$num_rows = mysqli_num_rows($sql);

2
admin/ai_providers.php
View File

@@ -6,7 +6,7 @@ $order = "ASC";
require_once "includes/inc_all_admin.php";
$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers ORDER BY $sort $order");
$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_id, ai_provider_name FROM ai_providers ORDER BY $sort $order");
$num_rows = mysqli_num_rows($sql);

2
admin/api_keys.php
View File

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
"SELECT SQL_CALC_FOUND_ROWS api_key_created_at, api_key_expire, api_key_id, api_key_name, api_key_secret, user_name FROM api_keys
LEFT JOIN users on api_key_user_id = user_id
WHERE (api_key_name LIKE '%$q%')
ORDER BY $sort $order LIMIT $record_from, $record_to"

2
admin/app_logs.php
View File

@@ -28,7 +28,7 @@ if (isset($_GET['category']) & !empty($_GET['catergory'])) {
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM app_logs
"SELECT SQL_CALC_FOUND_ROWS app_log_category, app_log_created_at, app_log_details, app_log_id, app_log_type FROM app_logs
WHERE (app_log_type LIKE '%$q%' OR app_log_category LIKE '%$q%' OR app_log_details LIKE '%$q%')
AND DATE(app_log_created_at) BETWEEN '$dtf' AND '$dtt'
$log_type_query

7
admin/audit_logs.php
View File

@@ -48,7 +48,8 @@ if (isset($_GET['action']) & !empty($_GET['action'])) {
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM logs
"SELECT SQL_CALC_FOUND_ROWS client_id, client_name, log_action, log_created_at, log_description, log_entity_id, log_id,
log_ip, log_type, log_user_agent, user_id, user_name FROM logs
LEFT JOIN users ON log_user_id = user_id
LEFT JOIN clients ON log_client_id = client_id
WHERE (log_type LIKE '%$q%' OR log_action LIKE '%$q%' OR log_description LIKE '%$q%' OR log_ip LIKE '%$q%' OR log_user_agent LIKE '%$q%' OR user_name LIKE '%$q%' OR client_name LIKE '%$q%')
@@ -87,7 +88,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<option value="">- All Clients -</option>
<?php
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
$sql_clients_filter = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
$client_id = intval($row['client_id']);
$client_name = escapeHtml($row['client_name']);
@@ -107,7 +108,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<option value="">- All Users -</option>
<?php
$sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
$sql_users_filter = mysqli_query($mysqli, "SELECT user_id, user_name FROM users ORDER BY user_name ASC");
while ($row = mysqli_fetch_assoc($sql_users_filter)) {
$user_id = intval($row['user_id']);
$user_name = escapeHtml($row['user_name']);

3
admin/backup.php
View File

@@ -19,7 +19,8 @@ $cron_is_running = $cron_last_dispatch_at !== null && (time() - strtotime($cron_
$backup_job = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_enabled, cron_job_daily_at FROM cron_jobs WHERE cron_job_name = 'backup'"));
$backups = mysqli_query($mysqli, "SELECT * FROM backups ORDER BY backup_created_at DESC LIMIT 100");
$backups = mysqli_query($mysqli, "SELECT backup_created_at, backup_error, backup_id, backup_size, backup_source, backup_status,
backup_type FROM backups ORDER BY backup_created_at DESC LIMIT 100");
$pending_count = intval(mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS c FROM backups WHERE backup_status IN ('Pending','Running')"))['c']);

2
admin/backup_download.php
View File

@@ -23,7 +23,7 @@ if (!isset($_GET['backup_id'])) {
$backup_id = intval($_GET['backup_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT backup_file_name FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
if (mysqli_num_rows($sql) !== 1) {
http_response_code(404);

2
admin/categories.php
View File

@@ -15,7 +15,7 @@ if (isset($_GET['category'])) {
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM categories
"SELECT SQL_CALC_FOUND_ROWS category_color, category_description, category_id, category_name FROM categories
WHERE category_name LIKE '%$q%'
AND category_type = '$category'
AND category_$archive_query

18
admin/contract_templates.php
View File

@@ -63,15 +63,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$id = intval($row['contract_template_id']);
$name = escapeHtml($row['contract_template_name']);
$type = escapeHtml($row['contract_template_type']);
$freq = escapeHtml($row['contract_template_update_frequency']);
$sla_low_resp = escapeHtml($row['sla_low_response_time']);
$sla_med_resp = escapeHtml($row['sla_medium_response_time']);
$sla_high_resp = escapeHtml($row['sla_high_response_time']);
$sla_low_res = escapeHtml($row['sla_low_resolution_time']);
$sla_med_res = escapeHtml($row['sla_medium_resolution_time']);
$sla_high_res = escapeHtml($row['sla_high_resolution_time']);
$hourly_rate = escapeHtml($row['contract_template_hourly_rate']);
$after_hours = escapeHtml($row['contract_template_after_hours_hourly_rate']);
$freq = escapeHtml($row['contract_template_renewal_frequency']);
$sla_low_resp = escapeHtml($row['contract_template_sla_low_response_time']);
$sla_med_resp = escapeHtml($row['contract_template_sla_medium_response_time']);
$sla_high_resp = escapeHtml($row['contract_template_sla_high_response_time']);
$sla_low_res = escapeHtml($row['contract_template_sla_low_resolution_time']);
$sla_med_res = escapeHtml($row['contract_template_sla_medium_resolution_time']);
$sla_high_res = escapeHtml($row['contract_template_sla_high_resolution_time']);
$hourly_rate = escapeHtml($row['contract_template_rate_standard']);
$after_hours = escapeHtml($row['contract_template_rate_after_hours']);
$support_hours = escapeHtml($row['contract_template_support_hours']);
$net_terms = escapeHtml($row['contract_template_net_terms']);
$created = escapeHtml($row['contract_template_created_at']);

2
admin/cron.php
View File

@@ -22,7 +22,7 @@ foreach (cronJobRegistry() as $job) {
$cron_jobs[$job['name']]['row'] = null;
}
$sql = mysqli_query($mysqli, "SELECT * FROM cron_jobs");
$sql = mysqli_query($mysqli, "SELECT cron_job_name FROM cron_jobs");
while ($job_row = mysqli_fetch_assoc($sql)) {
if (isset($cron_jobs[$job_row['cron_job_name']])) {
$cron_jobs[$job_row['cron_job_name']]['row'] = $job_row;

3
admin/custom_links.php
View File

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM custom_links
"SELECT SQL_CALC_FOUND_ROWS custom_link_icon, custom_link_id, custom_link_location, custom_link_name,
custom_link_new_tab, custom_link_order, custom_link_uri FROM custom_links
WHERE custom_link_name LIKE '%$q%'
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

2
admin/database_updates/2.3.1.php
View File

@@ -8,7 +8,7 @@
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
// Migrate Payment Methods from Categories Table to new payment_methods table
$sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
$sql_categories = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_name = escapeSql($row['category_name']);

18
admin/database_updates/2.6.7.php Normal file
View File

@@ -0,0 +1,18 @@
<?php
/*
* ITFlow - Database update to version 2.6.7 (from 2.6.6)
* Included by admin/database_updates.php - do not access directly
*/
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
// The AI endpoints used to send a hardcoded temperature (0.5, or 0.3 for ticket
// summaries). Newer OpenAI models accept nothing but their own default and reject
// the request outright, which surfaced as "Failed to get a response from the AI API".
//
// Temperature is now per-model and optional: NULL means don't send the parameter
// at all, which is the setting that works on every provider. Existing rows get
// NULL so they stop sending it.
mysqli_query($mysqli, "ALTER TABLE `ai_models` ADD COLUMN IF NOT EXISTS `ai_model_temperature` decimal(3,2) DEFAULT NULL AFTER `ai_model_use_case`");

3
admin/document_template.php
View File

@@ -15,7 +15,8 @@ if (isset($_GET['document_template_id'])) {
$document_template_id = intval($_GET['document_template_id']);
}
$sql_document = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
$sql_document = mysqli_query($mysqli, "SELECT document_template_content, document_template_created_at, document_template_description,
document_template_name, document_template_updated_at FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
if (mysqli_num_rows($sql_document) == 0) {
echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";

3
admin/document_templates.php
View File

@@ -8,7 +8,8 @@
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM document_templates
"SELECT SQL_CALC_FOUND_ROWS document_template_content, document_template_created_at, document_template_description,
document_template_id, document_template_name, document_template_updated_at, user_name FROM document_templates
LEFT JOIN users ON document_template_created_by = user_id
WHERE user_name LIKE '%$q%' OR document_template_name LIKE '%$q%'
ORDER BY $sort $order LIMIT $record_from, $record_to"

2
admin/includes/side_nav.php
View File

@@ -314,7 +314,7 @@
</li>
<?php
$sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links
$sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links
WHERE custom_link_location = 4 AND custom_link_archived_at IS NULL
ORDER BY custom_link_order ASC, custom_link_name ASC"
);

3
admin/mail_queue.php
View File

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM email_queue
"SELECT SQL_CALC_FOUND_ROWS email_attempts, email_failed_at, email_from, email_from_name, email_id, email_queued_at,
email_recipient, email_recipient_name, email_sent_at, email_status, email_subject FROM email_queue
WHERE (email_id LIKE '%$q%' OR email_from LIKE '%$q%' OR email_from_name LIKE '%$q%' OR email_recipient LIKE '%$q%' OR email_recipient_name LIKE '%$q%' OR email_subject LIKE '%$q%')
AND DATE(email_queued_at) BETWEEN '$dtf' AND '$dtt'
ORDER BY $sort $order LIMIT $record_from, $record_to"

13
admin/modals/ai/ai_model_add.php
View File

@@ -26,7 +26,7 @@ ob_start();
<select class="form-control select2" name="provider" required>
<option value="">- Select an AI Provider -</option>
<?php
$sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
$sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
$ai_provider_id = intval($row['ai_provider_id']);
$ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -62,6 +62,17 @@ ob_start();
</div>
</div>
<div class="form-group">
<label>Temperature</label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
</div>
<input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="" placeholder="Provider default">
</div>
<small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
</div>
<div class="form-group">
<textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"></textarea>
</div>

15
admin/modals/ai/ai_model_edit.php
View File

@@ -4,13 +4,14 @@ require_once '../../includes/modal_header.php';
$model_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT ai_model_ai_provider_id, ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_model_temperature FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
$model_id = intval($row['ai_model_id']);
$model_name = escapeHtml($row['ai_model_name']);
$use_case = escapeHtml($row['ai_model_use_case']);
$temperature = escapeHtml($row['ai_model_temperature']);
$prompt = escapeHtml($row['ai_model_prompt']);
// Generate the HTML form content using output buffering.
@@ -38,7 +39,7 @@ ob_start();
<select class="form-control select2" name="provider" required>
<option value="">- Select an AI Provider -</option>
<?php
$sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
$sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
$ai_provider_id = intval($row['ai_provider_id']);
$ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -74,6 +75,16 @@ ob_start();
</div>
</div>
<div class="form-group">
<label>Temperature</label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
</div>
<input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="<?= $temperature ?>" placeholder="Provider default">
</div>
<small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
</div>
<div class="form-group">
<textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"><?= $prompt ?></textarea>
</div>

2
admin/modals/ai/ai_provider_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$provider_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_name FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$provider_name = escapeHtml($row['ai_provider_name']);

2
admin/modals/api/api_key_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$api_key_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT api_key_expire, api_key_name, api_key_user_id FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$api_key_name = escapeHtml($row['api_key_name']);
$api_key_expire = escapeHtml($row['api_key_expire']);

2
admin/modals/category/category_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$category_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT category_color, category_description, category_name, category_type FROM categories WHERE category_id = $category_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$category_name = escapeHtml($row['category_name']);

8
admin/modals/contract_template/contract_template_edit.php
View File

@@ -7,7 +7,13 @@ $contract_types_array = ['Fully Managed', 'Partialy Managed', 'Break/Fix'];
$update_frequency_array = ['Manual', 'Annually', '2 Year', '3 Year', '5 Year', '7 Year'];
// Fetch existing template
$sql = mysqli_query($mysqli, "SELECT * FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT contract_template_description, contract_template_details, contract_template_name,
contract_template_net_terms, contract_template_rate_after_hours,
contract_template_rate_standard, contract_template_renewal_frequency,
contract_template_sla_high_resolution_time, contract_template_sla_high_response_time,
contract_template_sla_low_resolution_time, contract_template_sla_low_response_time,
contract_template_sla_medium_resolution_time, contract_template_sla_medium_response_time,
contract_template_support_hours, contract_template_type FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
// Assign locals

3
admin/modals/cron/cron_edit.php
View File

@@ -5,7 +5,8 @@ require_once '../../../includes/cron_jobs.php';
$cron_job_id = intval($_GET['id']);
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_daily_at, cron_job_enabled, cron_job_interval_minutes, cron_job_name,
cron_job_schedule FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
$registry = cronJobRegistryByName();
$job = $registry[$row['cron_job_name']] ?? null;

3
admin/modals/custom_link/custom_link_edit.php
View File

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
$custom_link_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_location, custom_link_name, custom_link_new_tab,
custom_link_order, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$custom_link_name = escapeHtml($row['custom_link_name']);
$custom_link_uri = escapeHtml($row['custom_link_uri']);

2
admin/modals/document_template/document_template_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$document_template_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT document_template_content, document_template_description, document_template_name FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$document_template_name = escapeHtml($row['document_template_name']);
$document_template_description = escapeHtml($row['document_template_description']);

4
admin/modals/mail_queue/mail_queue_message_view.php
View File

@@ -12,7 +12,9 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting
$purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
$purifier = new HTMLPurifier($purifier_config);
$sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT email_attempts, email_content, email_failed_at, email_from, email_from_name,
email_queued_at, email_recipient, email_recipient_name, email_sent_at, email_status,
email_subject FROM email_queue WHERE email_id = $email_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$email_from = escapeHtml($row['email_from']);

2
admin/modals/payment_method/payment_method_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$payment_method_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT payment_method_description, payment_method_id, payment_method_name FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$payment_method_id = intval($row['payment_method_id']);

4
admin/modals/payment_provider/payment_provider_edit.php
View File

@@ -4,7 +4,9 @@ require_once '../../includes/modal_header.php';
$provider_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_expense_category,
payment_provider_expense_vendor, payment_provider_name, payment_provider_private_key,
payment_provider_public_key, payment_provider_threshold FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$provider_name = escapeHtml($row['payment_provider_name']);

2
admin/modals/project_template/project_template_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$project_template_id = intval($_GET['project_template_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT project_template_description, project_template_name FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$project_template_name = escapeHtml($row['project_template_name']);
$project_template_description = escapeHtml($row['project_template_description']);

2
admin/modals/role/role_add.php
View File

@@ -79,7 +79,7 @@ ob_start();
<?php
// Enumerate modules
$sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
$sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
$module_id = intval($row_modules['module_id']);

4
admin/modals/role/role_edit.php
View File

@@ -15,7 +15,7 @@ $role_admin = intval($row['role_is_admin']);
$sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
$role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
$sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
// Initialize an empty array to hold user names
$user_names = [];
@@ -113,7 +113,7 @@ ob_start();
<?php
// Enumerate modules
$sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
$sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
$module_id = intval($row_modules['module_id']);
$module_name = escapeHtml($row_modules['module_name']);

2
admin/modals/sla/sla_edit.php
View File

@@ -3,7 +3,7 @@ require_once '../../includes/modal_header.php';
$sla_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM slas WHERE sla_id = $sla_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT sla_description, sla_name, sla_resolution_minutes, sla_response_minutes FROM slas WHERE sla_id = $sla_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$sla_name = escapeHtml($row['sla_name']);
$sla_description = escapeHtml($row['sla_description']);

3
admin/modals/software_template/software_template_edit.php
View File

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
$software_template_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT software_template_description, software_template_license_type, software_template_name,
software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$software_name = escapeHtml($row['software_template_name']);
$software_version = escapeHtml($row['software_template_version']);

2
admin/modals/tag/tag_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$tag_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_name, tag_type FROM tags WHERE tag_id = $tag_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$tag_name = escapeHtml($row['tag_name']);

2
admin/modals/tax/tax_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$tax_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT tax_name, tax_percent FROM taxes WHERE tax_id = $tax_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$tax_name = escapeHtml($row['tax_name']);
$tax_percent = floatval($row['tax_percent']);

3
admin/modals/ticket_status/ticket_status_edit.php
View File

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
$ticket_status_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT ticket_status_active, ticket_status_color, ticket_status_name, ticket_status_order,
ticket_status_pauses_sla FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$ticket_status_name = escapeHtml($row['ticket_status_name']);
$ticket_status_color = escapeHtml($row['ticket_status_color']);

2
admin/modals/ticket_template/ticket_template_add.php
View File

@@ -60,7 +60,7 @@ ob_start();
<option value="0">- No -</option>
<?php
$sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
$sql_project_templates = mysqli_query($mysqli, "SELECT project_template_id, project_template_name FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
while ($row = mysqli_fetch_assoc($sql_project_templates)) {
$project_template_id_select = intval($row['project_template_id']);
$project_template_name_select = escapeHtml($row['project_template_name']); ?>

2
admin/modals/ticket_template/ticket_template_task_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$task_template_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_name, task_template_order FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$task_template_name = escapeHtml($row['task_template_name']);

4
admin/modals/user/user_add.php
View File

@@ -75,7 +75,7 @@ ob_start();
<select class="form-control select2" name="role" required>
<option value="">- Role -</option>
<?php
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
$sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
$role_id = intval($row['role_id']);
$role_name = escapeHtml($row['role_name']);
@@ -138,7 +138,7 @@ ob_start();
<tbody>
<?php
$sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
$sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_select)) {
$client_id = intval($row['client_id']);
$client_name = escapeHtml($row['client_name']);

8
admin/modals/user/user_archive.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$user_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name FROM users WHERE users.user_id = $user_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$user_name = escapeHtml($row['user_name']);
@@ -12,13 +12,13 @@ $user_email = escapeHtml($row['user_email']);
$user_avatar = escapeHtml($row['user_avatar']);
$user_initials = escapeHtml(initials($user_name));
$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
$sql_related_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets
WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
$ticket_count = mysqli_num_rows($sql_related_tickets);
// Related Recurring Tickets Query
$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT 1 FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
$recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
@@ -59,7 +59,7 @@ ob_start();
<select class="form-control select2" name="ticket_assign" required>
<option value="0">No one</option>
<?php
$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
$sql_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_users)) {
$user_id_select = intval($row['user_id']);
$user_name_select = escapeHtml($row['user_name']);

6
admin/modals/user/user_edit.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$user_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM users
$sql = mysqli_query($mysqli, "SELECT user_avatar, user_config_force_mfa, user_email, user_name, user_role_id, user_token FROM users
LEFT JOIN user_settings ON users.user_id = user_settings.user_id
WHERE users.user_id = $user_id LIMIT 1"
);
@@ -119,7 +119,7 @@ ob_start();
</div>
<select class="form-control select2" name="role" required>
<?php
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
$sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
$role_id = intval($row['role_id']);
$role_name = escapeHtml($row['role_name']);
@@ -190,7 +190,7 @@ ob_start();
<tbody>
<?php
$sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
$sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_select)) {
$client_id_select = intval($row['client_id']);
$client_name_select = escapeHtml($row['client_name']);

4
admin/modals/user/user_restore.php
View File

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
$user_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name, user_role_id FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
@@ -63,7 +63,7 @@ ob_start();
</div>
<select class="form-control select2" name="role" required>
<?php
$sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
$sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_user_roles)) {
$role_id = intval($row['role_id']);
$role_name = escapeHtml($row['role_name']);

5
admin/modals/vendor_template/vendor_template_edit.php
View File

@@ -4,7 +4,10 @@ require_once '../../includes/modal_header.php';
$vendor_template_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
vendor_template_description, vendor_template_email, vendor_template_extension,
vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone,
vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$vendor_name = escapeHtml($row['vendor_template_name']);
$vendor_description = escapeHtml($row['vendor_template_description']);

2
admin/modules.php
View File

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM modules
"SELECT SQL_CALC_FOUND_ROWS module_description, module_id, module_name FROM modules
WHERE (module_name LIKE '%$q%' OR module_description LIKE '%$q%')
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

3
admin/payment_methods.php
View File

@@ -6,7 +6,8 @@ $order = "ASC";
require_once "includes/inc_all_admin.php";
$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY $sort $order");
$sql = mysqli_query($mysqli, "SELECT payment_method_created_at, payment_method_description, payment_method_id,
payment_method_name FROM payment_methods ORDER BY $sort $order");
$num_rows = mysqli_num_rows($sql);

3
admin/payment_providers.php
View File

@@ -6,7 +6,8 @@ $order = "ASC";
require_once "includes/inc_all_admin.php";
$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers
$sql = mysqli_query($mysqli, "SELECT account_name, category_name, payment_provider_description, payment_provider_id,
payment_provider_name, payment_provider_threshold, vendor_name FROM payment_providers
LEFT JOIN accounts ON payment_provider_account = account_id
LEFT JOIN vendors ON payment_provider_expense_vendor = vendor_id
LEFT JOIN categories ON payment_provider_expense_category = category_id

14
admin/post.php
View File

@@ -10,7 +10,11 @@ require_once __DIR__ . "/../includes/check_login.php";
// Only allow running post files via inclusion (prevents people/bots poking them directly)
define('FROM_POST_HANDLER', true);
// Load all admin module POST logic
// Load all admin module POST logic.
// *_model.php is a RESERVED suffix: those files are not handlers, they are inline
// field-parsing fragments that read $_POST at include time, so the glob must not
// pull them in. A handler named *_model.php is silently never loaded - name entity
// handlers around it (admin/post/ai_models.php, not ai_model.php).
if (!empty($session_is_admin)) {
foreach (glob(__DIR__ . "/post/*.php") as $admin_module) {
if (!str_ends_with($admin_module, '_model.php')) {
@@ -22,3 +26,11 @@ if (!empty($session_is_admin)) {
// Logout is shared between portals
require_once __DIR__ . "/../post/logout.php";
require_once __DIR__ . "/../post/misc.php";
// Every handler above exits or redirects, so getting here means no handler claimed
// the request - a blank page and no trace of why. Log it; the usual cause is a
// handler file that never loaded.
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$unhandled = implode(', ', array_slice(array_keys($_POST), 0, 10));
logApp('Request', 'warning', "Unhandled POST to admin/post.php - no handler matched. Fields: $unhandled");
}

20
admin/post/ai_model.php → admin/post/ai_models.php
View File

@@ -1,7 +1,7 @@
<?php
/*
* ITFlow - GET/POST request handler for AI Models ('ai_model')
* ITFlow - GET/POST request handler for AI Models ('ai_models')
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -15,9 +15,17 @@ if (isset($_POST['add_ai_model'])) {
$prompt = escapeSql($_POST['prompt']);
$use_case = escapeSql($_POST['use_case']);
mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id");
// Blank means "send no temperature at all" - the only setting that works on every
// provider. Anything else rides as a numeric literal, so no quoting.
$temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
$ai_model_id = mysqli_insert_id($mysqli);
mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature, ai_model_ai_provider_id = $provider_id");
if (!mysqli_affected_rows($mysqli)) {
logApp('AI', 'error', 'Failed to create AI Model ' . $model . ': ' . mysqli_error($mysqli));
flashAlert("AI Model <strong>$model</strong> could not be created - see Admin > App Logs", 'error');
redirect();
}
logAudit("AI Model", "Create", "$session_name created AI Model $model");
@@ -36,7 +44,11 @@ if (isset($_POST['edit_ai_model'])) {
$prompt = escapeSql($_POST['prompt']);
$use_case = escapeSql($_POST['use_case']);
mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id");
// Blank means "send no temperature at all" - the only setting that works on every
// provider. Anything else rides as a numeric literal, so no quoting.
$temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature WHERE ai_model_id = $model_id");
logAudit("AI Model", "Edit", "$session_name edited AI Model $model");

10
admin/post/users.php
View File

@@ -54,7 +54,7 @@ if (isset($_POST['add_user'])) {
// Create Settings
mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa");
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$sql = mysqli_query($mysqli,"SELECT company_name FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = escapeSql($row['company_name']);
@@ -328,7 +328,7 @@ if (isset($_POST['restore_user'])) {
}
if (isset($_POST['export_users'])) {
if (isExportRequest('export_users')) {
validateCSRFToken();
@@ -355,7 +355,7 @@ if (isset($_POST['export_users'])) {
$sql = mysqli_query(
$mysqli,
"SELECT * FROM users
"SELECT user_status FROM users
LEFT JOIN user_roles ON user_role_id = role_id
WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
AND user_type = 1
@@ -402,7 +402,7 @@ if (isset($_POST['ir_reset_user_password'])) {
// Confirm logged-in user password, for security
$admin_password = $_POST['admin_password'];
$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id");
$sql = mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id");
$userRow = mysqli_fetch_assoc($sql);
if (!password_verify($admin_password, $userRow['user_password'])) {
@@ -411,7 +411,7 @@ if (isset($_POST['ir_reset_user_password'])) {
}
// Get agents/users, other than the current user
$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
$sql_users = mysqli_query($mysqli, "SELECT user_email, user_id FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
// Reset passwords
while ($row = mysqli_fetch_assoc($sql_users)) {

9
admin/project_template.php
View File

@@ -8,7 +8,8 @@ if (isset($_GET['project_template_id'])) {
$sql_project_templates = mysqli_query(
$mysqli,
"SELECT * FROM project_templates
"SELECT project_template_created_at, project_template_description, project_template_name,
project_template_updated_at FROM project_templates
WHERE project_template_id = $project_template_id LIMIT 1"
);
@@ -27,7 +28,9 @@ if (isset($_GET['project_template_id'])) {
$project_template_updated_at = escapeHtml($row['project_template_updated_at']);
// Get Associated Ticket Templates
$sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
$sql_ticket_templates = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description,
project_template_ticket_templates.ticket_template_id, ticket_template_name,
ticket_template_order, ticket_template_subject, ticket_template_updated_at FROM ticket_templates, project_template_ticket_templates
WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
AND project_template_ticket_templates.project_template_id = $project_template_id
ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -35,7 +38,7 @@ if (isset($_GET['project_template_id'])) {
// Get All Task Templates
$sql_task_templates = mysqli_query($mysqli,
"SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
"SELECT task_template_id, task_template_name FROM ticket_templates, task_templates, project_template_ticket_templates
WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
AND project_template_ticket_templates.project_template_id = $project_template_id
AND ticket_templates.ticket_template_id = task_template_ticket_template_id

7
admin/project_templates.php
View File

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM project_templates
"SELECT SQL_CALC_FOUND_ROWS project_template_created_at, project_template_description, project_template_id,
project_template_name FROM project_templates
WHERE (project_template_name LIKE '%$q%' OR project_template_description LIKE '%$q%')
AND project_template_archived_at IS NULL
ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -68,7 +69,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$project_template_created_at = escapeHtml($row['project_template_created_at']);
// Get Ticket Template Count
$sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
$sql_ticket_templates = mysqli_query($mysqli, "SELECT 1 FROM ticket_templates, project_template_ticket_templates
WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
AND project_template_ticket_templates.project_template_id = $project_template_id
ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -76,7 +77,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
// Get Tasks Template Count
$sql_task_templates = mysqli_query($mysqli,
"SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
"SELECT 1 FROM ticket_templates, task_templates, project_template_ticket_templates
WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
AND project_template_ticket_templates.project_template_id = $project_template_id
AND ticket_templates.ticket_template_id = task_template_ticket_template_id

2
admin/roles.php
View File

@@ -75,7 +75,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
$role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
$sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
// Initialize an empty array to hold user names
$user_names = [];

4
admin/settings_company.php
View File

@@ -2,7 +2,9 @@
require_once "includes/inc_all_admin.php";
$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
$sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_currency, company_email,
settings.company_id, company_locale, company_logo, company_name, company_phone,
company_phone_country_code, company_state, company_tax_id, company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_id = intval($row['company_id']);

14
admin/settings_default.php
View File

@@ -59,7 +59,7 @@ $net_terms_array = array (
<option value="0">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
$sql = mysqli_query($mysqli, "SELECT calendar_id, calendar_name FROM calendars ORDER BY calendar_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$calendar_id = intval($row['calendar_id']);
$calendar_name = escapeHtml($row['calendar_name']); ?>
@@ -82,7 +82,7 @@ $net_terms_array = array (
<option value="0">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = escapeHtml($row['account_name']); ?>
@@ -105,7 +105,7 @@ $net_terms_array = array (
<option value="0">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = escapeHtml($row['account_name']); ?>
@@ -128,7 +128,7 @@ $net_terms_array = array (
<option value="0">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = escapeHtml($row['account_name']); ?>
@@ -153,7 +153,7 @@ $net_terms_array = array (
<option value="0">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
$sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$account_id = intval($row['account_id']);
$account_name = escapeHtml($row['account_name']); ?>
@@ -176,7 +176,7 @@ $net_terms_array = array (
<option value="">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
$sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$payment_method = escapeHtml($row['category_name']); ?>
<option <?php if ($config_default_payment_method == $payment_method) {
@@ -198,7 +198,7 @@ $net_terms_array = array (
<option value="">- None -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
$sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$payment_method = escapeHtml($row['category_name']); ?>
<option <?php if ($config_default_expense_payment_method == $payment_method) {

2
admin/settings_localization.php
View File

@@ -2,7 +2,7 @@
require_once "includes/inc_all_admin.php";
$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
$sql = mysqli_query($mysqli,"SELECT company_currency, company_locale FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_locale = escapeHtml($row['company_locale']);

3
admin/sla.php
View File

@@ -12,7 +12,8 @@ $config_sla_warning_percent = intval($row['config_sla_warning_percent']);
$config_sla_notification_email = escapeHtml($row['config_sla_notification_email']);
// SLA plans (active first)
$sql_slas = mysqli_query($mysqli, "SELECT * FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
$sql_slas = mysqli_query($mysqli, "SELECT sla_archived_at, sla_description, sla_id, sla_name, sla_resolution_minutes,
sla_response_minutes FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
// Active plans for the assignment dropdowns
$active_slas = [];

4
admin/software_templates.php
View File

@@ -8,7 +8,9 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM software_templates
"SELECT SQL_CALC_FOUND_ROWS software_template_description, software_template_id, software_template_license_type,
software_template_name, software_template_notes, software_template_type,
software_template_version FROM software_templates
WHERE software_template_name LIKE '%$q%' OR software_template_type LIKE '%$q%'
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

2
admin/tags.php
View File

@@ -26,7 +26,7 @@ $tag_type_display = $tag_types[$type_filter]['label'] ?? 'Unknown';
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM tags
"SELECT SQL_CALC_FOUND_ROWS tag_color, tag_icon, tag_id, tag_name FROM tags
WHERE tag_name LIKE '%$q%'
AND tag_type = $type_filter
ORDER BY $sort $order LIMIT $record_from, $record_to"

2
admin/tax_rates.php
View File

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT * FROM taxes
"SELECT tax_id, tax_name, tax_percent FROM taxes
WHERE tax_archived_at IS NULL
ORDER BY $sort $order"
);

3
admin/ticket_statuses.php
View File

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM ticket_statuses
"SELECT SQL_CALC_FOUND_ROWS ticket_status_active, ticket_status_color, ticket_status_id, ticket_status_name,
ticket_status_pauses_sla FROM ticket_statuses
WHERE ticket_status_name LIKE '%$q%'
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

5
admin/ticket_template.php
View File

@@ -15,7 +15,8 @@ if (isset($_GET['ticket_template_id'])) {
$ticket_template_id = intval($_GET['ticket_template_id']);
}
$sql_ticket_template = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
$sql_ticket_template = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description, ticket_template_details,
ticket_template_name, ticket_template_subject, ticket_template_updated_at FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
if (mysqli_num_rows($sql_ticket_template) == 0) {
echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
@@ -33,7 +34,7 @@ $ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
$ticket_template_updated_at = escapeHtml($row['ticket_template_updated_at']);
// Get Task Templates
$sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
$sql_task_templates = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_id, task_template_name FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
?>

7
admin/users.php
View File

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM users
"SELECT SQL_CALC_FOUND_ROWS role_name, user_archived_at, user_avatar, user_config_force_mfa, user_email,
user_settings.user_id, user_name, user_role_id, user_status, user_token FROM users
LEFT JOIN user_roles ON user_role_id = role_id
LEFT JOIN user_settings ON users.user_id = user_settings.user_id
WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
@@ -132,7 +133,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$sql_last_login = mysqli_query(
$mysqli,
"SELECT * FROM logs
"SELECT log_created_at, log_ip, log_user_agent FROM logs
WHERE log_user_id = $user_id AND log_type = 'Login'
ORDER BY log_id DESC LIMIT 1"
);
@@ -155,7 +156,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$client_access_array[] = intval($row['client_id']);
}
$sql_remember_tokens = mysqli_query($mysqli, "SELECT * FROM remember_tokens WHERE remember_token_user_id = $user_id");
$sql_remember_tokens = mysqli_query($mysqli, "SELECT 1 FROM remember_tokens WHERE remember_token_user_id = $user_id");
$remember_token_count = mysqli_num_rows($sql_remember_tokens);

5
admin/vendor_templates.php
View File

@@ -8,7 +8,10 @@ require_once "includes/inc_all_admin.php";
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM vendor_templates
"SELECT SQL_CALC_FOUND_ROWS vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
vendor_template_description, vendor_template_email, vendor_template_extension,
vendor_template_hours, vendor_template_id, vendor_template_name, vendor_template_notes,
vendor_template_phone, vendor_template_sla, vendor_template_website FROM vendor_templates
WHERE vendor_template_name LIKE '%$q%' OR vendor_template_description LIKE '%$q%' OR vendor_template_account_number LIKE '%$q%' OR vendor_template_website LIKE '%$q%' OR vendor_template_contact_name LIKE '%$q%' OR vendor_template_email LIKE '%$q%' OR vendor_template_phone LIKE '%$phone_query%' ORDER BY $sort $order LIMIT $record_from, $record_to"
);

2
agent/accounts.php
View File

@@ -11,7 +11,7 @@ enforceUserPermission('module_financial');
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM accounts
"SELECT SQL_CALC_FOUND_ROWS account_currency_code, account_id, account_name, account_notes, opening_balance FROM accounts
WHERE (account_name LIKE '%$q%')
AND account_archived_at IS NULL
ORDER BY $sort $order LIMIT $record_from, $record_to"

193
agent/ajax.php
View File

@@ -239,7 +239,7 @@ if (isset($_GET['share_generate_link'])) {
$url = "https://$config_base_url/guest/guest_view_item.php?id=$share_id&key=$item_key";
}
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$sql = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -294,7 +294,7 @@ if (isset($_GET['get_active_clients'])) {
$mysqli,
"SELECT client_id, client_name FROM clients
WHERE client_archived_at IS NULL
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_accessed_at DESC"
);
@@ -320,7 +320,7 @@ if (isset($_GET['get_client_contacts'])) {
"SELECT contact_id, contact_name, contact_title, contact_email, contact_primary, contact_important, contact_technical FROM contacts
LEFT JOIN clients on contact_client_id = client_id
WHERE contacts.contact_archived_at IS NULL AND contact_client_id = $client_id
$access_permission_query
" . clientScopeSql('contact_client_id') . "
ORDER BY contact_primary DESC, contact_technical DESC, contact_important DESC, contact_name"
);
@@ -350,7 +350,7 @@ if (isset($_GET['get_client_assets'])) {
LEFT JOIN clients on asset_client_id = client_id
LEFT JOIN contacts ON contact_id = asset_contact_id
WHERE assets.asset_archived_at IS NULL AND asset_client_id = $client_id
$access_permission_query
" . clientScopeSql('asset_client_id') . "
ORDER BY asset_type ASC, asset_favorite DESC, asset_name"
);
@@ -379,7 +379,7 @@ if (isset($_GET['get_client_locations'])) {
"SELECT location_id, location_name FROM locations
LEFT JOIN clients on location_client_id = client_id
WHERE locations.location_archived_at IS NULL AND location_client_id = $client_id
$access_permission_query
" . clientScopeSql('location_client_id') . "
ORDER BY location_primary DESC, location_name ASC"
);
@@ -408,7 +408,7 @@ if (isset($_GET['get_client_vendors'])) {
"SELECT vendor_id, vendor_name FROM vendors
LEFT JOIN clients on vendor_client_id = client_id
WHERE vendors.vendor_archived_at IS NULL AND vendor_client_id = $client_id
$access_permission_query
" . clientScopeSql('vendor_client_id') . "
ORDER BY vendor_name ASC"
);
@@ -437,7 +437,7 @@ if (isset($_GET['get_client_projects'])) {
"SELECT project_id, project_name FROM projects
LEFT JOIN clients on project_client_id = client_id
WHERE projects.project_archived_at IS NULL AND projects.project_completed_at IS NULL AND project_client_id = $client_id
$access_permission_query
" . clientScopeSql('project_client_id') . "
ORDER BY project_name ASC"
);
@@ -564,7 +564,6 @@ if (isset($_POST['update_kanban_ticket'])) {
// Get details
$ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_status_name, ticket_assigned_to, ticket_url_key, ticket_client_id FROM tickets
LEFT JOIN clients ON ticket_client_id = client_id
LEFT JOIN contacts ON ticket_contact_id = contact_id
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
WHERE ticket_id = $ticket_id
@@ -838,127 +837,88 @@ if (isset($_GET['ai_reword'])) {
header('Content-Type: application/json');
$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
// The reword button sits on every TinyMCE instance, so the ticket editor asks for
// the Tickets model and everything else gets General. Anything unrecognised is
// treated as General rather than trusted into the query.
$use_case = ($_GET['use_case'] ?? '') === 'Tickets' ? 'Tickets' : 'General';
$row = mysqli_fetch_assoc($sql);
$model_name = $row['ai_model_name'];
$promptText = $row['ai_model_prompt'];
$url = $row['ai_provider_api_url'];
$key = $row['ai_provider_api_key'];
$model = getAiModel($use_case);
if (!$model) {
echo json_encode(['error' => aiModelMissingError($use_case)]);
exit;
}
// Collecting the input data from the AJAX request.
$inputJSON = file_get_contents('php://input');
$input = json_decode($inputJSON, TRUE); // Convert JSON into array.
$userText = $input['text'];
$userText = $input['text'] ?? '';
// Preparing the data for the OpenAI Chat API request.
$data = [
"model" => "$model_name", // Specify the model
"messages" => [
["role" => "system", "content" => $promptText],
["role" => "user", "content" => $userText],
],
"temperature" => 0.5
];
// Initialize cURL session to the OpenAI Chat API.
$ch = curl_init("$url");
// Set cURL options for the request.
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Authorization: Bearer ' . $key,
$result = callAiApi($model, [
["role" => "system", "content" => $model['ai_model_prompt']],
["role" => "user", "content" => $userText],
]);
// Execute the cURL session and capture the response.
$response = curl_exec($ch);
curl_close($ch);
// Decode the JSON response.
$responseData = json_decode($response, true);
// Check if the response contains the expected data and return it.
if (isset($responseData['choices'][0]['message']['content'])) {
// Get the response content.
$content = $responseData['choices'][0]['message']['content'];
// Clean any leading "html" word or other unwanted text at the beginning.
$content = preg_replace('/^html/i', '', $content); // Remove any occurrence of 'html' at the start
// Clean the response content to remove backticks or code block markers.
$cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
// Trim any leading/trailing whitespace.
$cleanedContent = trim($cleanedContent);
// Return the cleaned response.
echo json_encode(['rewordedText' => $cleanedContent]);
} else {
// Handle errors or unexpected response structure.
echo json_encode(['rewordedText' => 'Failed to get a response from the AI API.']);
// Report failures as an error, never as reworded text - the editor writes
// rewordedText straight back over the user's content
if (!$result['ok']) {
echo json_encode(['error' => $result['error']]);
exit;
}
$content = $result['content'];
// Clean any leading "html" word or other unwanted text at the beginning.
$content = preg_replace('/^html/i', '', $content); // Remove any occurrence of 'html' at the start
// Clean the response content to remove backticks or code block markers.
$cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
// Trim any leading/trailing whitespace.
$cleanedContent = trim($cleanedContent);
echo json_encode(['rewordedText' => $cleanedContent]);
}
if (isset($_GET['ai_create_document_template'])) {
// get_ai_document_template.php
enforceUserPermission('module_support');
header('Content-Type: text/html; charset=UTF-8');
$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$model_name = $row['ai_model_name'];
$url = $row['ai_provider_api_url'];
$key = $row['ai_provider_api_key'];
$prompt = $_POST['prompt'] ?? '';
// Basic validation
if(empty($prompt)){
if (empty($prompt)) {
echo "No prompt provided.";
exit;
}
$model = getAiModel('Documentation');
if (!$model) {
echo escapeHtml(aiModelMissingError('Documentation'));
exit;
}
// Prepare prompt
$system_message = "You are a helpful IT documentation assistant. You will create a well-structured HTML template for IT documentation based on a given prompt. Include headings, subheadings, bullet points, and possibly tables for clarity. No Lorem Ipsum, use realistic placeholders and professional language.";
$user_message = "Create an HTML formatted IT documentation template based on the following request:\n\n\"$prompt\"\n\nThe template should be structured, professional, and useful for IT staff. Include relevant sections, instructions, prerequisites, and best practices.";
$post_data = [
"model" => "$model_name",
"messages" => [
["role" => "system", "content" => $system_message],
["role" => "user", "content" => $user_message]
],
"temperature" => 0.5
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Authorization: Bearer ' . $key
$result = callAiApi($model, [
["role" => "system", "content" => $system_message],
["role" => "user", "content" => $user_message]
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo "Error: " . curl_error($ch);
if (!$result['ok']) {
echo "<p>" . escapeHtml($result['error']) . "</p>";
exit;
}
curl_close($ch);
$response_data = json_decode($response, true);
$template = $response_data['choices'][0]['message']['content'] ?? "<p>No content returned from AI.</p>";
// Print the generated HTML template directly
echo $template;
echo $result['content'];
}
if (isset($_GET['ai_ticket_summary'])) {
@@ -967,12 +927,12 @@ if (isset($_GET['ai_ticket_summary'])) {
header('Content-Type: text/html; charset=UTF-8');
$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
$model = getAiModel('Tickets');
$row = mysqli_fetch_assoc($sql);
$model_name = $row['ai_model_name'];
$url = $row['ai_provider_api_url'];
$key = $row['ai_provider_api_key'];
if (!$model) {
echo escapeHtml(aiModelMissingError('Tickets'));
exit;
}
// Retrieve the ticket_id from POST
$ticket_id = intval($_POST['ticket_id']);
@@ -1049,38 +1009,17 @@ if (isset($_GET['ai_ticket_summary'])) {
If any part of the ticket or replies is unclear or ambiguous, mention it in the summary and suggest if further clarification is needed.
";
// Prepare the POST data
$post_data = [
"model" => "$model_name",
"messages" => [
["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
["role" => "user", "content" => $prompt]
],
"temperature" => 0.3
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Authorization: Bearer ' . $key
$result = callAiApi($model, [
["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
["role" => "user", "content" => $prompt]
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo "Error: " . curl_error($ch);
if (!$result['ok']) {
echo "<p>" . escapeHtml($result['error']) . "</p>";
exit;
}
curl_close($ch);
$response_data = json_decode($response, true);
$summary = $response_data['choices'][0]['message']['content'] ?? "No summary available.";
echo $summary; // nl2br to convert newlines to <br>, htmlspecialchars to prevent XSS
echo $result['content'];
}
// Stops people trying to use sub-domains in the domains tracker

30
agent/asset.php
View File

@@ -14,7 +14,15 @@ if (isset($_GET['client_id'])) {
if (isset($_GET['asset_id'])) {
$asset_id = intval($_GET['asset_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets
$sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
asset_os, asset_photo, asset_physical_location, asset_purchase_date,
asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
contact_archived_at, contact_email, contact_extension, contact_mobile,
contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
location_archived_at, location_name FROM assets
LEFT JOIN clients ON client_id = asset_client_id
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
@@ -114,7 +122,7 @@ if (isset($_GET['asset_id'])) {
$recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
// Related Documents
$sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
$sql_related_documents = mysqli_query($mysqli, "SELECT 1 FROM asset_documents
LEFT JOIN documents ON asset_documents.document_id = documents.document_id
WHERE asset_documents.asset_id = $asset_id
AND document_archived_at IS NULL
@@ -125,7 +133,7 @@ if (isset($_GET['asset_id'])) {
// Tags - many to many relationship
$asset_tag_name_display_array = array();
$asset_tag_id_array = array();
$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
@@ -186,7 +194,7 @@ if (isset($_GET['asset_id'])) {
$interface_count = mysqli_num_rows($sql_related_interfaces);
// Related Files
$sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
$sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_name FROM asset_files
LEFT JOIN files ON asset_files.file_id = files.file_id
WHERE asset_files.asset_id = $asset_id
AND file_archived_at IS NULL
@@ -206,7 +214,8 @@ if (isset($_GET['asset_id'])) {
}
// Related Documents
$sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents, documents
$sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
document_updated_at, user_name FROM asset_documents, documents
LEFT JOIN users ON document_created_by = user_id
WHERE asset_documents.asset_id = $asset_id
AND asset_documents.document_id = documents.document_id
@@ -243,7 +252,9 @@ if (isset($_GET['asset_id'])) {
// Related Software Query
$sql_related_software = mysqli_query(
$mysqli,
"SELECT * FROM software_assets
"SELECT software_expire, software_assets.software_id, software_key, software_license_type,
software_name, software_notes, software_purchase, software_seats, software_type,
software_version FROM software_assets
LEFT JOIN software ON software_assets.software_id = software.software_id
WHERE software_assets.asset_id = $asset_id
AND software_archived_at IS NULL
@@ -253,7 +264,8 @@ if (isset($_GET['asset_id'])) {
$software_count = mysqli_num_rows($sql_related_software);
// Linked Services
$sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_assets, services
$sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_assets.service_id, service_importance,
service_name FROM service_assets, services
WHERE service_assets.asset_id = $asset_id
AND service_assets.service_id = services.service_id
ORDER BY service_name ASC"
@@ -263,7 +275,7 @@ if (isset($_GET['asset_id'])) {
$linked_services = array();
// Notes - 1 to many relationship
$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
$sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_id, asset_note_type, user_name FROM asset_notes
LEFT JOIN users ON asset_note_created_by = user_id
WHERE asset_note_asset_id = $asset_id
AND asset_note_archived_at IS NULL
@@ -690,7 +702,7 @@ if (isset($_GET['asset_id'])) {
// Tags
$credential_tag_name_display_array = array();
$credential_tag_id_array = array();
$sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
$sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);

19
agent/assets.php
View File

@@ -124,7 +124,7 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, "
LEFT JOIN tags ON tag_id = asset_tag_tag_id
WHERE $archive_query
$tag_query
$access_permission_query
" . clientScopeSql('asset_client_id') . "
$client_query
GROUP BY asset_id
) AS filtered_assets;
@@ -150,7 +150,14 @@ $other_count = intval($row['other_count']);
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM assets
"SELECT SQL_CALC_FOUND_ROWS asset_archived_at, asset_contact_id, asset_created_at, asset_description, asset_favorite,
asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
contact_archived_at, contact_name, interface_ip, interface_ipv6, interface_mac,
interface_nat_ip, interface_network_id, location_archived_at, location_name, tag_color,
tag_icon, tag_id, tag_name FROM assets
LEFT JOIN clients ON asset_client_id = client_id
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
@@ -161,7 +168,7 @@ $sql = mysqli_query(
$tag_query
AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR interface_mac LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
AND ($type_query)
$access_permission_query
" . clientScopeSql('asset_client_id') . "
$location_query
$expire_query
$client_query
@@ -288,7 +295,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
FROM clients
JOIN assets ON asset_client_id = client_id
WHERE $archive_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_name ASC
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -634,13 +641,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$location_name_display = $location_name;
}
$sql_credentials = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_asset_id = $asset_id");
$sql_credentials = mysqli_query($mysqli, "SELECT 1 FROM credentials WHERE credential_asset_id = $asset_id");
$credential_count = mysqli_num_rows($sql_credentials);
// Tags
$asset_tag_name_display_array = array();
$asset_tag_id_array = array();
$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);

31
agent/calendar.php
View File

@@ -38,7 +38,7 @@ if (isset($_GET['calendar_id'])) {
</div>
<div class="card-body">
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM calendars");
$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_feed_key, calendar_id, calendar_name FROM calendars");
while ($row = mysqli_fetch_assoc($sql)) {
$calendar_id = intval($row['calendar_id']);
$calendar_name = escapeHtml($row['calendar_name']);
@@ -135,7 +135,8 @@ if (isset($_GET['calendar_id'])) {
require_once "modals/calendar/calendar_event_add.php";
//loop through IDs and create a modal for each
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_client_id, event_description, event_end,
event_id, event_location, event_repeat, event_start, event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['event_id']);
$event_title = escapeHtml($row['event_title']);
@@ -303,7 +304,8 @@ while ($row = mysqli_fetch_assoc($sql)) {
},
events: [
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_all_day, event_id, event_repeat,
event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
// Repeating events are stored as a single row, so the occurrences have to
// be materialised here - the bundled FullCalendar build has no rrule
@@ -341,7 +343,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
}
// Invoices Created
$sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query $access_permission_query");
$sql = mysqli_query($mysqli, "SELECT invoice_date, invoice_id, invoice_number, invoice_prefix, invoice_scope FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query " . clientScopeSql('clients.client_id') . "");
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['invoice_id']);
$scope = strval($row['invoice_scope']);
@@ -356,7 +358,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
}
// Quotes Created
$sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query $access_permission_query");
$sql = mysqli_query($mysqli, "SELECT quote_date, quote_id, quote_number, quote_prefix, quote_scope FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query " . clientScopeSql('clients.client_id') . "");
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['quote_id']);
$event_title = json_encode($row['quote_prefix'] . $row['quote_number'] . " " . $row['quote_scope']);
@@ -366,11 +368,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
}
// Tickets Created
$sql = mysqli_query($mysqli, "SELECT * FROM clients
$sql = mysqli_query($mysqli, "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_status,
ticket_status_name, ticket_subject, user_name FROM clients
LEFT JOIN tickets ON client_id = ticket_client_id
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
LEFT JOIN users ON ticket_assigned_to = user_id
$client_query $access_permission_query"
$client_query " . clientScopeSql('clients.client_id') . ""
);
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['ticket_id']);
@@ -401,10 +404,11 @@ while ($row = mysqli_fetch_assoc($sql)) {
}
// Recurring Tickets
$sql = mysqli_query($mysqli, "SELECT * FROM clients
$sql = mysqli_query($mysqli, "SELECT client_id, recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
recurring_ticket_subject, user_name FROM clients
LEFT JOIN recurring_tickets ON client_id = recurring_ticket_client_id
LEFT JOIN users ON recurring_ticket_assigned_to = user_id
$client_query $access_permission_query"
$client_query " . clientScopeSql('clients.client_id') . ""
);
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['recurring_ticket_id']);
@@ -425,11 +429,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
}
// Tickets Scheduled
$sql = mysqli_query($mysqli, "SELECT * FROM clients
$sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_number, ticket_prefix, ticket_schedule, ticket_status_name,
ticket_subject, user_name FROM clients
LEFT JOIN tickets ON client_id = ticket_client_id
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
LEFT JOIN users ON ticket_assigned_to = user_id
$client_query $access_permission_query AND ticket_schedule IS NOT NULL"
$client_query " . clientScopeSql('clients.client_id') . " AND ticket_schedule IS NOT NULL"
);
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['ticket_id']);
@@ -460,7 +465,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
}
// Vendors Added Created
$sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query $access_permission_query");
$sql = mysqli_query($mysqli, "SELECT client_id, vendor_created_at, vendor_id, vendor_name FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query " . clientScopeSql('clients.client_id') . "");
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['vendor_id']);
$client_id = intval($row['client_id']);
@@ -472,7 +477,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
if (!isset($_GET['client_id'])) {
//Clients Added
$sql = mysqli_query($mysqli, "SELECT * FROM clients");
$sql = mysqli_query($mysqli, "SELECT client_created_at, client_id, client_name FROM clients");
while ($row = mysqli_fetch_assoc($sql)) {
$event_id = intval($row['client_id']);
$event_title = json_encode("Client: '" . $row['client_name'] . "' created");

8
agent/certificates.php
View File

@@ -61,11 +61,13 @@ if (!$client_url) {
}
}
$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM certificates
$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS certificate_archived_at, certificate_created_at, certificate_description,
certificate_domain, certificate_expire, certificate_id, certificate_issued_by,
certificate_name, client_id, client_name FROM certificates
LEFT JOIN clients ON client_id = certificate_client_id
WHERE $archive_query
AND (certificate_name LIKE '%$q%' OR certificate_domain LIKE '%$q%' OR certificate_description LIKE '%$q%' OR certificate_issued_by LIKE '%$q%' OR client_name LIKE '%$q%')
$access_permission_query
" . clientScopeSql('certificate_client_id') . "
$client_query
$expire_query
ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -122,7 +124,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
FROM clients
JOIN certificates ON certificate_client_id = client_id
WHERE $archive_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_name ASC
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {

36
agent/client_overview.php
View File

@@ -4,7 +4,7 @@ require_once "includes/inc_all_client.php";
$sql_recent_activities = mysqli_query(
$mysqli,
"SELECT * FROM logs
"SELECT log_created_at, log_description FROM logs
WHERE log_client_id = $client_id
ORDER BY log_created_at DESC
LIMIT 5"
@@ -12,7 +12,9 @@ $sql_recent_activities = mysqli_query(
$sql_important_contacts = mysqli_query(
$mysqli,
"SELECT * FROM contacts
"SELECT contact_email, contact_extension, contact_id, contact_mobile, contact_mobile_country_code,
contact_name, contact_phone, contact_phone_country_code, contact_photo, contact_primary,
contact_title FROM contacts
WHERE contact_client_id = $client_id
AND (contact_important = 1
OR contact_billing = 1
@@ -25,7 +27,7 @@ $sql_important_contacts = mysqli_query(
$sql_favorite_assets = mysqli_query(
$mysqli,
"SELECT * FROM assets
"SELECT asset_id, asset_make, asset_model, asset_name, asset_type FROM assets
WHERE asset_client_id = $client_id
AND asset_favorite = 1
AND asset_archived_at IS NULL
@@ -34,7 +36,8 @@ $sql_favorite_assets = mysqli_query(
$sql_favorite_credentials = mysqli_query(
$mysqli,
"SELECT * FROM credentials
"SELECT credential_description, credential_id, credential_name, credential_otp_secret,
credential_uri, credential_uri_2, credential_username FROM credentials
WHERE credential_client_id = $client_id
AND credential_favorite = 1
AND credential_archived_at IS NULL
@@ -60,7 +63,8 @@ $sql_recent_credentials = mysqli_query(
$sql_shared_items = mysqli_query(
$mysqli,
"SELECT * FROM shared_items
"SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
item_related_id, item_type, item_view_limit, item_views FROM shared_items
WHERE item_client_id = $client_id
AND item_active = 1
ORDER BY item_created_at ASC
@@ -74,7 +78,7 @@ $sql_shared_items = mysqli_query(
// Stale Tickets
$sql_stale_tickets = mysqli_query(
$mysqli,
"SELECT * FROM tickets
"SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_subject FROM tickets
WHERE ticket_client_id = $client_id
AND ticket_updated_at < CURRENT_DATE - INTERVAL 7 DAY
AND ticket_resolved_At IS NULL
@@ -87,7 +91,7 @@ $sql_stale_tickets = mysqli_query(
// Get Domains Expiring
$sql_domains_expiring = mysqli_query(
$mysqli,
"SELECT * FROM domains
"SELECT domain_expire, domain_id, domain_name FROM domains
WHERE domain_client_id = $client_id
AND domain_expire IS NOT NULL
AND domain_archived_at IS NULL
@@ -99,7 +103,7 @@ $sql_domains_expiring = mysqli_query(
// Get Certificates Expiring
$sql_certificates_expiring = mysqli_query(
$mysqli,
"SELECT * FROM certificates
"SELECT certificate_expire, certificate_id, certificate_name FROM certificates
WHERE certificate_client_id = $client_id
AND certificate_expire IS NOT NULL
AND certificate_archived_at IS NULL
@@ -111,7 +115,7 @@ $sql_certificates_expiring = mysqli_query(
// Get Licenses Expiring
$sql_licenses_expiring = mysqli_query(
$mysqli,
"SELECT * FROM software
"SELECT software_expire, software_id, software_name FROM software
WHERE software_client_id = $client_id
AND software_expire IS NOT NULL
AND software_archived_at IS NULL
@@ -123,7 +127,7 @@ $sql_licenses_expiring = mysqli_query(
// Get Asset Warranties Expiring
$sql_asset_warranties_expiring = mysqli_query(
$mysqli,
"SELECT * FROM assets
"SELECT asset_id, asset_name, asset_warranty_expire FROM assets
WHERE asset_client_id = $client_id
AND asset_warranty_expire IS NOT NULL
AND asset_archived_at IS NULL
@@ -135,7 +139,7 @@ $sql_asset_warranties_expiring = mysqli_query(
// Get Assets Retiring 7 Year
$sql_asset_retire = mysqli_query(
$mysqli,
"SELECT * FROM assets
"SELECT asset_id, asset_install_date, asset_name FROM assets
WHERE asset_client_id = $client_id
AND asset_install_date IS NOT NULL
AND asset_archived_at IS NULL
@@ -151,7 +155,7 @@ $sql_asset_retire = mysqli_query(
// Get Domains Expired
$sql_domains_expired = mysqli_query(
$mysqli,
"SELECT * FROM domains
"SELECT domain_expire, domain_id, domain_name FROM domains
WHERE domain_client_id = $client_id
AND domain_expire IS NOT NULL
AND domain_archived_at IS NULL
@@ -162,7 +166,7 @@ $sql_domains_expired = mysqli_query(
// Get Certificates Expired
$sql_certificates_expired = mysqli_query(
$mysqli,
"SELECT * FROM certificates
"SELECT certificate_expire, certificate_id, certificate_name FROM certificates
WHERE certificate_client_id = $client_id
AND certificate_expire IS NOT NULL
AND certificate_archived_at IS NULL
@@ -173,7 +177,7 @@ $sql_certificates_expired = mysqli_query(
// Get Licenses Expired
$sql_licenses_expired = mysqli_query(
$mysqli,
"SELECT * FROM software
"SELECT software_expire, software_id, software_name FROM software
WHERE software_client_id = $client_id
AND software_expire IS NOT NULL
AND software_archived_at IS NULL
@@ -184,7 +188,7 @@ $sql_licenses_expired = mysqli_query(
// Get Asset Warranties Expired
$sql_asset_warranties_expired = mysqli_query(
$mysqli,
"SELECT * FROM assets
"SELECT asset_id, asset_name, asset_warranty_expire FROM assets
WHERE asset_client_id = $client_id
AND asset_warranty_expire IS NOT NULL
AND asset_archived_at IS NULL
@@ -195,7 +199,7 @@ $sql_asset_warranties_expired = mysqli_query(
// Get Retired Assets
$sql_asset_retired = mysqli_query(
$mysqli,
"SELECT * FROM assets
"SELECT asset_id, asset_install_date, asset_name FROM assets
WHERE asset_client_id = $client_id
AND asset_install_date IS NOT NULL
AND asset_archived_at IS NULL

4
agent/clients.php
View File

@@ -67,7 +67,7 @@ $sql = mysqli_query(
AND client_$archive_query
AND DATE(client_created_at) BETWEEN '$dtf' AND '$dtt'
$leads_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
$tag_query
$industry_query
$referral_query
@@ -369,7 +369,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
// Client Tags
$client_tag_name_display_array = array();
$client_tag_id_array = array();
$sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
$sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
$client_tag_id = intval($row['tag_id']);
$client_tag_name = escapeHtml($row['tag_name']);

39
agent/contact.php
View File

@@ -14,7 +14,11 @@ if (isset($_GET['client_id'])) {
if (isset($_GET['contact_id'])) {
$contact_id = intval($_GET['contact_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM contacts
$sql = mysqli_query($mysqli, "SELECT client_id, client_name, contact_billing, contact_client_id, contact_created_at,
contact_department, contact_email, contact_extension, contact_important,
contact_location_id, contact_mobile, contact_mobile_country_code, contact_name,
contact_notes, contact_phone, contact_phone_country_code, contact_photo, contact_pin,
contact_primary, contact_technical, contact_title, location_name, user_auth_method FROM contacts
LEFT JOIN clients ON client_id = contact_client_id
LEFT JOIN locations ON location_id = contact_location_id
LEFT JOIN users ON user_id = contact_user_id
@@ -64,7 +68,11 @@ if (isset($_GET['contact_id'])) {
}
// Related Assets Query - 1 to 1 relationship
$sql_related_assets = mysqli_query($mysqli, "SELECT * FROM assets
$sql_related_assets = mysqli_query($mysqli, "SELECT asset_created_at, asset_description, asset_favorite, asset_id, asset_install_date,
asset_make, asset_model, asset_name, asset_notes, asset_os, asset_photo,
asset_physical_location, asset_purchase_date, asset_serial, asset_status, asset_type,
asset_uri, asset_uri_2, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
interface_nat_ip, tag_color, tag_icon, tag_id, tag_name FROM assets
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
LEFT JOIN asset_tags ON asset_tag_asset_id = asset_id
LEFT JOIN tags ON tag_id = asset_tag_tag_id
@@ -75,7 +83,9 @@ if (isset($_GET['contact_id'])) {
$asset_count = mysqli_num_rows($sql_related_assets);
// Linked Software Licenses
$sql_linked_software = mysqli_query($mysqli, "SELECT * FROM software_contacts, software
$sql_linked_software = mysqli_query($mysqli, "SELECT software_expire, software_contacts.software_id, software_key, software_license_type,
software_name, software_notes, software_purchase, software_seats, software_type,
software_version FROM software_contacts, software
WHERE software_contacts.contact_id = $contact_id
AND software_contacts.software_id = software.software_id
AND software_archived_at IS NULL
@@ -102,14 +112,17 @@ if (isset($_GET['contact_id'])) {
$credential_count = mysqli_num_rows($sql_related_credentials);
// Related Tickets Query - 1 to 1 relationship
$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
$sql_related_tickets = mysqli_query($mysqli, "SELECT ticket_assigned_to, ticket_closed_at, ticket_created_at, ticket_id, ticket_number,
ticket_prefix, ticket_priority, ticket_status, ticket_status_color, ticket_status_name,
ticket_subject, ticket_updated_at, user_name FROM tickets
LEFT JOIN users ON ticket_assigned_to = user_id
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
WHERE ticket_contact_id = $contact_id ORDER BY ticket_id DESC");
$ticket_count = mysqli_num_rows($sql_related_tickets);
// Related Recurring Tickets Query
$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
WHERE recurring_ticket_contact_id = $contact_id
ORDER BY recurring_ticket_next_run DESC"
);
@@ -119,7 +132,7 @@ if (isset($_GET['contact_id'])) {
// Tags - many to many relationship
$contact_tag_name_display_array = array();
$contact_tag_id_array = array();
$sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
$sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
$contact_tag_id = intval($row['tag_id']);
@@ -139,7 +152,7 @@ if (isset($_GET['contact_id'])) {
$contact_tags_display = implode('', $contact_tag_name_display_array);
// Notes - 1 to 1 relationship
$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
$sql_related_notes = mysqli_query($mysqli, "SELECT contact_note, contact_note_created_at, contact_note_id, contact_note_type, user_name FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
$note_count = mysqli_num_rows($sql_related_notes);
// Note type icons, read from the categories list so the seeded icons
@@ -151,7 +164,8 @@ if (isset($_GET['contact_id'])) {
}
// Linked Services
$sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_contacts, services
$sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_contacts.service_id, service_importance,
service_name FROM service_contacts, services
WHERE service_contacts.contact_id = $contact_id
AND service_contacts.service_id = services.service_id
ORDER BY service_name ASC"
@@ -161,7 +175,8 @@ if (isset($_GET['contact_id'])) {
$linked_services = array();
// Linked Documents
$sql_linked_documents = mysqli_query($mysqli, "SELECT * FROM contact_documents, documents
$sql_linked_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
document_updated_at, user_name FROM contact_documents, documents
LEFT JOIN users ON document_created_by = user_id
WHERE contact_documents.contact_id = $contact_id
AND contact_documents.document_id = documents.document_id
@@ -173,7 +188,7 @@ if (isset($_GET['contact_id'])) {
$linked_documents = array();
// Linked Files
$sql_linked_files = mysqli_query($mysqli, "SELECT * FROM contact_files, files
$sql_linked_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, files.file_id, file_mime_type, file_name, file_size FROM contact_files, files
WHERE contact_files.contact_id = $contact_id
AND contact_files.file_id = files.file_id
AND file_archived_at IS NULL
@@ -420,7 +435,7 @@ if (isset($_GET['contact_id'])) {
// Tags
$asset_tag_name_display_array = array();
$asset_tag_id_array = array();
$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
@@ -574,7 +589,7 @@ if (isset($_GET['contact_id'])) {
// Tags
$credential_tag_name_display_array = array();
$credential_tag_id_array = array();
$sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
$sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);

6
agent/contacts.php
View File

@@ -74,7 +74,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS contacts.*, clients.*,
WHERE $archive_query
$tag_query
AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
$access_permission_query
" . clientScopeSql('contact_client_id') . "
$client_query
$location_query
GROUP BY contact_id
@@ -193,7 +193,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
FROM clients
JOIN contacts ON contact_client_id = client_id
WHERE $archive_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_name ASC
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -444,7 +444,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
// Tags
$contact_tag_name_display_array = array();
$contact_tag_id_array = array();
$sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
$sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
$contact_tag_id = intval($row['tag_id']);

11
agent/credentials.php
View File

@@ -90,7 +90,7 @@ $sql = mysqli_query(
$tag_query
AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
$location_query
$access_permission_query
" . clientScopeSql('credential_client_id') . "
$client_query
GROUP BY c.credential_id
ORDER BY c.credential_favorite DESC, $sort $order LIMIT $record_from, $record_to"
@@ -179,7 +179,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<option value="">- All Asset Locations -</option>
<?php
$sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
$sql_locations_filter = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
$location_id = intval($row['location_id']);
$location_name = escapeHtml($row['location_name']);
@@ -204,7 +204,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
FROM clients
JOIN credentials ON credential_client_id = client_id
WHERE $archive_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_name ASC
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -349,7 +349,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
// Tags
$credential_tag_name_display_array = array();
$credential_tag_id_array = array();
$sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
$sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);
@@ -389,7 +389,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
// Check if shared
$sql_shared = mysqli_query(
$mysqli,
"SELECT * FROM shared_items
"SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
item_related_id, item_type, item_view_limit, item_views FROM shared_items
WHERE item_client_id = $client_id
AND item_active = 1
AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)

12
agent/dashboard.php
View File

@@ -16,7 +16,7 @@ if (isset($_GET['enable_technical'])) {
}
// Fetch User Dashboard Settings
$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT * FROM user_settings WHERE user_id = $session_user_id");
$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT user_config_dashboard_financial_enable, user_config_dashboard_technical_enable FROM user_settings WHERE user_id = $session_user_id");
$row = mysqli_fetch_assoc($sql_user_dashboard_settings);
$user_config_dashboard_financial_enable = intval($row['user_config_dashboard_financial_enable']);
$user_config_dashboard_technical_enable = intval($row['user_config_dashboard_technical_enable']);
@@ -117,17 +117,17 @@ if ($user_config_dashboard_financial_enable == 1) {
$profit = $total_income - $total_expenses;
$sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
$sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
$sql_latest_invoice_payments = mysqli_query($mysqli, "
SELECT * FROM payments
SELECT client_name, invoice_number, invoice_prefix, payment_amount, payment_date FROM payments
JOIN invoices ON payment_invoice_id = invoice_id
JOIN clients ON invoice_client_id = client_id
ORDER BY payment_id DESC LIMIT 5
");
$sql_latest_expenses = mysqli_query($mysqli, "
SELECT * FROM expenses
SELECT category_name, expense_amount, expense_date, vendor_name FROM expenses
JOIN vendors ON expense_vendor_id = vendor_id
JOIN categories ON expense_category_id = category_id
ORDER BY expense_id DESC LIMIT 5
@@ -599,7 +599,9 @@ if ($user_config_dashboard_technical_enable == 1) {
$expiring_asset_warranties = $sql_asset_warranty_expiring['expiring_asset_warranties'];
$sql_your_tickets = mysqli_query($mysqli, "
SELECT * FROM tickets
SELECT client_name, contact_name, ticket_client_id, ticket_contact_id, ticket_created_at,
ticket_id, ticket_number, ticket_prefix, ticket_priority, ticket_status,
ticket_status_color, ticket_status_name, ticket_subject, ticket_updated_at FROM tickets
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
LEFT JOIN clients ON ticket_client_id = client_id
LEFT JOIN contacts ON ticket_contact_id = contact_id

12
agent/document.php
View File

@@ -17,7 +17,9 @@ if (isset($_GET['document_id'])) {
$folder_location = 0;
$sql_document = mysqli_query($mysqli, "SELECT * FROM documents
$sql_document = mysqli_query($mysqli, "SELECT document_archived_at, document_client_visible, document_content, document_created_at,
document_created_by, document_description, document_folder_id, document_name,
document_updated_at, folder_name, user_name FROM documents
LEFT JOIN folders ON document_folder_id = folder_id
LEFT JOIN users ON document_created_by = user_id
WHERE document_client_id = $client_id AND document_id = $document_id
@@ -142,7 +144,8 @@ $page_title = $row['document_name'];
</thead>
<tbody>
<?php
$sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
$sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
document_version_name, user_name FROM document_versions
LEFT JOIN users ON document_version_created_by = user_id
WHERE document_version_document_id = $document_id
ORDER BY document_version_created_at ASC"
@@ -208,7 +211,7 @@ $page_title = $row['document_name'];
</button>
</h6>
<?php
$sql_files = mysqli_query($mysqli, "SELECT * FROM files, document_files
$sql_files = mysqli_query($mysqli, "SELECT file_folder_id, files.file_id, file_name FROM files, document_files
WHERE document_files.file_id = files.file_id
AND document_files.document_id = $document_id
ORDER BY file_name ASC"
@@ -394,7 +397,8 @@ $page_title = $row['document_name'];
<h6><i class="fas fa-history mr-2"></i>Revisions</h6>
<?php
$sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
$sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
document_version_name, user_name FROM document_versions
LEFT JOIN users ON document_version_created_by = user_id
WHERE document_version_document_id = $document_id
ORDER BY document_version_created_at DESC"

4
agent/domains.php
View File

@@ -78,7 +78,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS domains.*, clients.*,
LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
WHERE (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR dnshost.vendor_name LIKE '%$q%' OR mailhost.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
AND $archive_query
$access_permission_query
" . clientScopeSql('domain_client_id') . "
$client_query
$expire_query
ORDER BY $sort $order LIMIT $record_from, $record_to");
@@ -134,7 +134,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
FROM clients
JOIN domains ON domain_client_id = client_id
WHERE $archive_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_name ASC
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {

7
agent/expenses.php
View File

@@ -41,7 +41,10 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM expenses
"SELECT SQL_CALC_FOUND_ROWS account_name, category_name, client_name, expense_account_id, expense_amount,
expense_category_id, expense_client_id, expense_created_at, expense_currency_code,
expense_date, expense_description, expense_id, expense_receipt, expense_reference,
expense_vendor_id, vendor_name FROM expenses
LEFT JOIN categories ON expense_category_id = category_id
LEFT JOIN vendors ON expense_vendor_id = vendor_id
LEFT JOIN accounts ON expense_account_id = account_id
@@ -52,7 +55,7 @@ $sql = mysqli_query(
$category_query
AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
$account_query
$access_permission_query
" . clientScopeSql('expense_client_id') . "
ORDER BY $sort $order LIMIT $record_from, $record_to"
);

6
agent/files.php
View File

@@ -99,7 +99,7 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root
$sql_folders = mysqli_query(
$mysqli,
"SELECT * FROM folders
"SELECT folder_id, folder_name FROM folders
WHERE parent_folder = $parent_folder_id
AND folder_client_id = $client_id
ORDER BY folder_name ASC"
@@ -731,7 +731,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
// Shared?
$sql_shared = mysqli_query(
$mysqli,
"SELECT * FROM shared_items
"SELECT item_expire_at, item_recipient FROM shared_items
WHERE item_client_id = $client_id
AND item_active = 1
AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)
@@ -843,7 +843,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
$sql_shared = mysqli_query(
$mysqli,
"SELECT * FROM shared_items
"SELECT item_expire_at, item_recipient FROM shared_items
WHERE item_client_id = $client_id
AND item_active = 1
AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)

79
agent/global_search.php
View File

@@ -28,15 +28,19 @@ if (isset($_GET['query'])) {
$can_sales = lookupUserPermission('module_sales') >= 1;
$can_credential = lookupUserPermission('module_credential') >= 1;
$sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM clients
$sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, client_website, location_phone, location_phone_country_code
FROM clients
LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
WHERE client_archived_at IS NULL
AND (client_name LIKE '%$query%' OR client_abbreviation LIKE '%$query%')
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_id DESC LIMIT 5"
);
$sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM contacts
$sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, contact_department, contact_email, contact_extension, contact_id,
contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
contact_phone_country_code, contact_title
FROM contacts
LEFT JOIN clients ON client_id = contact_client_id
WHERE contact_archived_at IS NULL
AND (contact_name LIKE '%$query%'
@@ -44,51 +48,59 @@ if (isset($_GET['query'])) {
OR contact_email LIKE '%$query%'
OR contact_phone LIKE '%$phone_query%'
OR contact_mobile LIKE '%$phone_query%')
$access_permission_query
" . clientScopeSql('contact_client_id') . "
ORDER BY contact_id DESC LIMIT 5"
);
$sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM vendors
$sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, vendor_description, vendor_name, vendor_phone,
vendor_phone_country_code
FROM vendors
LEFT JOIN clients ON vendor_client_id = client_id
WHERE vendor_archived_at IS NULL
AND (vendor_name LIKE '%$query%' OR vendor_phone LIKE '%$phone_query%')
$access_permission_query
" . clientScopeSql('vendor_client_id') . "
ORDER BY vendor_id DESC LIMIT 5"
);
$sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM domains
$sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, domain_expire, domain_id, domain_name
FROM domains
LEFT JOIN clients ON domain_client_id = client_id
WHERE domain_archived_at IS NULL
AND domain_name LIKE '%$query%'
$access_permission_query
" . clientScopeSql('domain_client_id') . "
ORDER BY domain_id DESC LIMIT 5"
);
$sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM products
$sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT product_description, product_name
FROM products
WHERE product_archived_at IS NULL
AND product_name LIKE '%$query%'
ORDER BY product_id DESC LIMIT 5"
);
$sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM documents
$sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, document_client_id, document_id, document_name
FROM documents
LEFT JOIN clients on document_client_id = clients.client_id
WHERE document_archived_at IS NULL
AND MATCH(document_content_raw) AGAINST ('$query')
$access_permission_query
" . clientScopeSql('document_client_id') . "
ORDER BY document_id DESC LIMIT 5"
);
$sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM files
$sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, file_client_id, file_description, file_id, file_name, folder_id, folder_name
FROM files
LEFT JOIN clients ON file_client_id = client_id
LEFT JOIN folders ON folder_id = file_folder_id
WHERE file_archived_at IS NULL
AND (file_name LIKE '%$query%'
OR file_description LIKE '%$query%')
$access_permission_query
" . clientScopeSql('file_client_id') . "
ORDER BY file_id DESC LIMIT 5"
);
$sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM tickets
$sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_status_name,
ticket_subject
FROM tickets
LEFT JOIN clients on tickets.ticket_client_id = clients.client_id
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
WHERE ticket_archived_at IS NULL
@@ -96,62 +108,75 @@ if (isset($_GET['query'])) {
OR ticket_details LIKE '%$query%'
OR CONCAT(ticket_prefix,ticket_number) LIKE '%$query%'
OR ticket_number = '$ticket_num_query')
$access_permission_query
" . clientScopeSql('tickets.ticket_client_id') . "
ORDER BY ticket_id DESC LIMIT 5"
);
$sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM recurring_tickets
$sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, recurring_ticket_frequency, recurring_ticket_id,
recurring_ticket_next_run, recurring_ticket_subject
FROM recurring_tickets
LEFT JOIN clients ON recurring_ticket_client_id = client_id
WHERE (recurring_ticket_subject LIKE '%$query%'
OR recurring_ticket_details LIKE '%$query%')
$access_permission_query
" . clientScopeSql('recurring_ticket_client_id') . "
ORDER BY recurring_ticket_id DESC LIMIT 5"
);
$sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT * FROM credentials
$sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT client_id, client_name, credential_client_id, credential_description, credential_name,
credential_password, credential_username
FROM credentials
LEFT JOIN contacts ON credential_contact_id = contact_id
LEFT JOIN clients ON credential_client_id = client_id
WHERE credential_archived_at IS NULL
AND (credential_name LIKE '%$query%' OR credential_description LIKE '%$query%')
$access_permission_query
" . clientScopeSql('credential_client_id') . "
ORDER BY credential_id DESC LIMIT 5"
);
$sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM quotes
$sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, quote_amount, quote_currency_code, quote_id, quote_number,
quote_prefix, quote_status
FROM quotes
LEFT JOIN clients ON quote_client_id = client_id
LEFT JOIN categories ON quote_category_id = category_id
WHERE quote_archived_at IS NULL
AND (CONCAT(quote_prefix,quote_number) LIKE '%$query%' OR quote_number LIKE '%$query%' OR quote_scope LIKE '%$query%')
$access_permission_query
" . clientScopeSql('quote_client_id') . "
ORDER BY quote_number DESC LIMIT 5"
);
$sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM invoices
$sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_id, invoice_number,
invoice_prefix, invoice_status
FROM invoices
LEFT JOIN clients ON invoice_client_id = client_id
LEFT JOIN categories ON invoice_category_id = category_id
WHERE invoice_archived_at IS NULL
AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$query%' OR invoice_number LIKE '%$query%' OR invoice_scope LIKE '%$query%')
$access_permission_query
" . clientScopeSql('invoice_client_id') . "
ORDER BY invoice_number DESC LIMIT 5"
);
$sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM assets
$sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT asset_client_id, asset_contact_id, asset_created_at, asset_description, asset_id,
asset_location_id, asset_make, asset_model, asset_name, asset_serial, asset_status, asset_type,
asset_uri, client_name, contact_archived_at, contact_id, contact_name
FROM assets
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
LEFT JOIN clients ON asset_client_id = client_id
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_archived_at IS NULL
AND (asset_name LIKE '%$query%' OR asset_description LIKE '%$query%' OR asset_type LIKE '%$query%' OR asset_make LIKE '%$query%' OR asset_model LIKE '%$query%' OR asset_serial LIKE '%$query%' OR asset_os LIKE '%$query%' OR interface_ip LIKE '%$query%' OR interface_nat_ip LIKE '%$query%' OR interface_mac LIKE '%$query%' OR asset_status LIKE '%$query%')
$access_permission_query
" . clientScopeSql('asset_client_id') . "
ORDER BY asset_name DESC LIMIT 5"
);
$sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM ticket_replies
$sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_reply,
ticket_subject
FROM ticket_replies
LEFT JOIN tickets ON ticket_reply_ticket_id = ticket_id
LEFT JOIN clients ON ticket_client_id = client_id
WHERE ticket_reply_archived_at IS NULL
AND (ticket_reply LIKE '%$query%')
$access_permission_query
" . clientScopeSql('ticket_client_id') . "
ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
);

18
agent/includes/client_overview_side_nav.php
View File

@@ -1,31 +1,31 @@
<?php
// Badge Counts
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('contact_client_id') . ""));
$num_contacts = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('location_client_id') . ""));
$num_locations = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('asset_client_id') . ""));
$num_assets = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL " . clientScopeSql('service_client_id') . ""));
$num_services = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('credential_client_id') . ""));
$num_credentials = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('network_client_id') . ""));
$num_networks = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('domain_client_id') . ""));
$num_domains = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('certificate_client_id') . ""));
$num_certificates = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('software_client_id') . ""));
$num_software = $row['num'];
?>

14
agent/includes/get_side_nav_counts.php
View File

@@ -2,31 +2,31 @@
// Get Main Side Bar Badge Counts
// Active Clients Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . ""));
$num_active_clients = $row['num'];
// Active Ticket Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 " . clientScopeSql('ticket_client_id') . ""));
$num_active_tickets = $row['num'];
// Recurring Ticket Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets LEFT JOIN clients ON client_id = recurring_ticket_client_id WHERE 1 = 1 $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets WHERE 1 = 1 " . clientScopeSql('recurring_ticket_client_id') . ""));
$num_recurring_tickets = $row['num'];
// Active Project Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects LEFT JOIN clients ON project_client_id = client_id WHERE project_archived_at IS NULL AND project_completed_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects WHERE project_archived_at IS NULL AND project_completed_at IS NULL " . clientScopeSql('project_client_id') . ""));
$num_active_projects = $row['num'];
// Open Invoices Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL " . clientScopeSql('invoice_client_id') . ""));
$num_open_invoices = $row['num'];
// Recurring Invoice Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices LEFT JOIN clients ON recurring_invoice_client_id = client_id WHERE recurring_invoice_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices WHERE recurring_invoice_archived_at IS NULL " . clientScopeSql('recurring_invoice_client_id') . ""));
$num_recurring_invoices = $row['num'];
// Open Quotes Count
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL $access_permission_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL " . clientScopeSql('quote_client_id') . ""));
$num_open_quotes = $row['num'];
// Recurring Expenses Count

10
agent/includes/inc_all_client.php
View File

@@ -18,7 +18,13 @@ if (isset($_GET['client_id'])) {
$sql = mysqli_query(
$mysqli,
"SELECT * FROM clients
"SELECT client_abbreviation, client_archived_at, client_created_at, client_currency_code,
client_lead, client_name, client_net_terms, client_notes, client_rate, client_referral,
client_tax_id_number, client_type, client_website, contact_email, contact_extension,
contact_id, contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
contact_phone_country_code, contact_primary, contact_title, location_address,
location_city, location_country, location_id, location_name, location_phone,
location_phone_country_code, location_primary, location_state, location_zip FROM clients
LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
WHERE client_id = $client_id"
@@ -75,7 +81,7 @@ if (isset($_GET['client_id'])) {
$client_tag_name_display_array = array();
$client_tag_id_array = array();
$sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
$sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_client_tags)) {
$client_tag_id = intval($row['tag_id']);

2
agent/includes/inc_client_top_head.php
View File

@@ -31,7 +31,7 @@
</a>
<?php } ?>
<?php } ?>
<?php if (lookupUserPermission("module_client") >= 3) { ?>
<?php if (lookupUserPermission("module_client") >= 1) { ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item" href="#" data-toggle="modal" data-target="#exportClientPDFModal">
<i class="fas fa-fw fa-file-pdf mr-2"></i>Export Data

2
agent/includes/side_nav.php
View File

@@ -200,7 +200,7 @@
<?php } ?>
<?php
$sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
$sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
ORDER BY custom_link_order ASC, custom_link_name ASC"
);

5
agent/income.php
View File

@@ -91,7 +91,7 @@ $income_query =
LEFT JOIN categories ON invoice_category_id = category_id
WHERE payment_archived_at IS NULL
$payment_client_query
$access_permission_query
" . clientScopeSql('invoice_client_id') . "
UNION ALL
@@ -120,7 +120,8 @@ $income_query =
LEFT JOIN transfers ON transfer_revenue_id = revenue_id
WHERE revenue_archived_at IS NULL
AND transfer_id IS NULL
$revenue_client_query";
$revenue_client_query
" . clientScopeSql('revenue_client_id') . "";
$income_filter_query =
"WHERE DATE(income_date) BETWEEN '$dtf' AND '$dtt'

29
agent/invoice.php
View File

@@ -16,12 +16,18 @@ if (isset($_GET['invoice_id'])) {
$sql = mysqli_query(
$mysqli,
"SELECT * FROM invoices
"SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
invoice_created_at, invoice_credit_amount, invoice_currency_code, invoice_date,
invoice_discount_amount, invoice_due, invoice_id, invoice_note, invoice_number,
invoice_prefix, invoice_scope, invoice_status, invoice_url_key, location_address,
location_city, location_country, location_state, location_zip FROM invoices
LEFT JOIN clients ON invoice_client_id = client_id
LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
WHERE invoice_id = $invoice_id
$access_permission_query
" . clientScopeSql('invoice_client_id') . "
LIMIT 1"
);
@@ -77,7 +83,9 @@ if (isset($_GET['invoice_id'])) {
$tab_title = $row['client_name'];
$page_title = "{$row['invoice_prefix']}{$row['invoice_number']}";
$sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
company_name, company_phone, company_phone_country_code, company_state, company_tax_id,
company_website, company_zip FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_id = intval($row['company_id']);
$company_name = escapeHtml($row['company_name']);
@@ -98,9 +106,10 @@ if (isset($_GET['invoice_id'])) {
}
$company_logo = escapeHtml($row['company_logo']);
$sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
$sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
$sql_payments = mysqli_query($mysqli, "SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
$sql_payments = mysqli_query($mysqli, "SELECT account_name, payment_amount, payment_currency_code, payment_date, payment_id,
payment_reference FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
$sql_tickets = mysqli_query($mysqli, "
SELECT
@@ -121,8 +130,7 @@ if (isset($_GET['invoice_id'])) {
//Get billable, and unbilled tickets to add to invoice
$sql_tickets_billable = mysqli_query(
$mysqli, "
SELECT
*
SELECT 1
FROM
tickets
WHERE
@@ -190,7 +198,7 @@ if (isset($_GET['invoice_id'])) {
// Saved Payment Methods
$sql_saved_payment_methods = mysqli_query($mysqli, "
SELECT * FROM client_saved_payment_methods
SELECT 1 FROM client_saved_payment_methods
LEFT JOIN payment_providers
ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
WHERE saved_payment_client_id = $client_id
@@ -372,7 +380,8 @@ if (isset($_GET['invoice_id'])) {
</div>
</div>
<?php $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
<?php $sql_invoice_items = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_id, item_name, item_price, item_product_id,
item_quantity, item_tax, item_tax_id, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
<div class="row mb-3">
<div class="col-md-12">
@@ -469,7 +478,7 @@ if (isset($_GET['invoice_id'])) {
<select class="form-control select2" name="tax_id" id="tax" required>
<option value="0">No Tax</option>
<?php
$taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
$taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
while ($row = mysqli_fetch_assoc($taxes_sql)) {
$tax_id = intval($row['tax_id']);
$tax_name = escapeHtml($row['tax_name']);

38
agent/invoices.php
View File

@@ -11,57 +11,57 @@ if (isset($_GET['client_id'])) {
$client_url = "client_id=$client_id&";
} else {
require_once "includes/inc_all.php";
$client_query = "$access_permission_query";
$client_query = clientScopeSql('invoice_client_id');
$client_url = '';
}
// Perms
enforceUserPermission('module_sales');
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Sent' $client_query"));
$sent_count = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Viewed' $client_query"));
$viewed_count = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Partial' $client_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Partial' $client_query"));
$partial_count = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Draft' $client_query"));
$draft_count = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Cancelled' $client_query"));
$cancelled_count = $row['num'];
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
$overdue_count = $row['num'];
$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query");
$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices WHERE invoice_status = 'Draft' $client_query");
$row = mysqli_fetch_assoc($sql_total_draft_amount);
$total_draft_amount = floatval($row['total_draft_amount']);
$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query");
$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices WHERE invoice_status = 'Sent' $client_query");
$row = mysqli_fetch_assoc($sql_total_sent_amount);
$total_sent_amount = floatval($row['total_sent_amount']);
$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query");
$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices WHERE invoice_status = 'Viewed' $client_query");
$row = mysqli_fetch_assoc($sql_total_viewed_amount);
$total_viewed_amount = floatval($row['total_viewed_amount']);
$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query");
$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices WHERE invoice_status = 'Cancelled' $client_query");
$row = mysqli_fetch_assoc($sql_total_cancelled_amount);
$total_cancelled_amount = floatval($row['total_cancelled_amount']);
$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
$row = mysqli_fetch_assoc($sql_total_partial_amount);
$total_partial_amount = floatval($row['total_partial_amount']);
$total_partial_count = mysqli_num_rows($sql_total_partial_amount);
$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
$row = mysqli_fetch_assoc($sql_total_overdue_partial_amount);
$total_overdue_partial_amount = floatval($row['total_overdue_partial_amount']);
$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
$row = mysqli_fetch_assoc($sql_total_overdue_amount);
$total_overdue_amount = floatval($row['total_overdue_amount']);
@@ -94,7 +94,11 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
$sql = mysqli_query(
$mysqli,
"SELECT SQL_CALC_FOUND_ROWS * FROM invoices
"SELECT SQL_CALC_FOUND_ROWS category_id, category_name, client_currency_code, client_id, client_name, client_net_terms,
invoice_amount, invoice_created_at, invoice_currency_code, invoice_date,
invoice_discount_amount, invoice_due, invoice_id, invoice_number, invoice_prefix,
invoice_scope, invoice_status, recurring_invoice_id, recurring_invoice_number,
recurring_invoice_prefix FROM invoices
LEFT JOIN clients ON invoice_client_id = client_id
LEFT JOIN categories ON invoice_category_id = category_id
LEFT JOIN recurring_invoices ON invoice_recurring_invoice_id = recurring_invoice_id
@@ -103,7 +107,7 @@ $sql = mysqli_query(
$category_query
AND DATE(invoice_date) BETWEEN '$dtf' AND '$dtt'
AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$q%' OR invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR invoice_status LIKE '%$q%' OR invoice_amount LIKE '%$q%' OR category_name LIKE '%$q%')
$access_permission_query
" . clientScopeSql('invoice_client_id') . "
$client_query
ORDER BY $sort $order LIMIT $record_from, $record_to"
);
@@ -362,7 +366,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
// Saved Payment Methods
$sql_saved_payment_methods = mysqli_query($mysqli, "
SELECT * FROM client_saved_payment_methods
SELECT 1 FROM client_saved_payment_methods
LEFT JOIN payment_providers
ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
WHERE saved_payment_client_id = $client_id

6
agent/locations.php
View File

@@ -64,7 +64,7 @@ $sql = mysqli_query(
WHERE $archive_query
$tag_query
AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_city LIKE '%$q%' OR location_state LIKE '%$q%' OR location_zip LIKE '%$q%' OR location_country LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
$access_permission_query
" . clientScopeSql('location_client_id') . "
$client_query
GROUP BY location_id
ORDER BY location_primary DESC, $sort $order LIMIT $record_from, $record_to"
@@ -154,7 +154,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
FROM clients
JOIN locations ON location_client_id = client_id
WHERE $archive_query
$access_permission_query
" . clientScopeSql('clients.client_id') . "
ORDER BY client_name ASC
");
while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -306,7 +306,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$location_tag_name_display_array = array();
$location_tag_id_array = array();
$sql_location_tags = mysqli_query($mysqli, "SELECT * FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
$sql_location_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, location_tags.tag_id, tag_name FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_location_tags)) {
$location_tag_id = intval($row['tag_id']);

2
agent/modals/account/account_edit.php
View File

@@ -6,7 +6,7 @@ enforceUserPermission('module_financial', 2);
$account_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT account_name, account_notes FROM accounts WHERE account_id = $account_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$account_name = escapeHtml($row['account_name']);

28
agent/modals/asset/asset.php
View File

@@ -6,7 +6,15 @@ enforceUserPermission('module_support');
$asset_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets
$sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
asset_os, asset_photo, asset_physical_location, asset_purchase_date,
asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
contact_archived_at, contact_email, contact_extension, contact_mobile,
contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
location_archived_at, location_name FROM assets
LEFT JOIN clients ON client_id = asset_client_id
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
@@ -82,7 +90,7 @@ if ($location_archived_at) {
// Tags - many to many relationship
$asset_tag_name_display_array = array();
$asset_tag_id_array = array();
$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
$asset_tag_id = intval($row['tag_id']);
@@ -179,7 +187,8 @@ $sql_related_tickets = mysqli_query($mysqli, "
$ticket_count = mysqli_num_rows($sql_related_tickets);
// Related Recurring Tickets Query
$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_assets.recurring_ticket_id,
recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
LEFT JOIN recurring_ticket_assets ON recurring_tickets.recurring_ticket_id = recurring_ticket_assets.recurring_ticket_id
WHERE recurring_ticket_asset_id = $asset_id OR recurring_ticket_assets.asset_id = $asset_id
GROUP BY recurring_tickets.recurring_ticket_id
@@ -188,7 +197,8 @@ $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_
$recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
// Related Documents
$sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
$sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
document_updated_at, user_name FROM asset_documents
LEFT JOIN documents ON asset_documents.document_id = documents.document_id
LEFT JOIN users ON user_id = document_created_by
WHERE asset_documents.asset_id = $asset_id
@@ -198,7 +208,7 @@ $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
$document_count = mysqli_num_rows($sql_related_documents);
// Related Files
$sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
$sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_mime_type, file_name FROM asset_files
LEFT JOIN files ON asset_files.file_id = files.file_id
WHERE asset_files.asset_id = $asset_id
AND file_archived_at IS NULL
@@ -209,7 +219,9 @@ $file_count = mysqli_num_rows($sql_related_files);
// Related Software Query
$sql_related_software = mysqli_query(
$mysqli,
"SELECT * FROM software_assets
"SELECT software_expire, software_assets.software_id, software_key, software_license_type,
software_name, software_notes, software_purchase, software_seats, software_type,
software_version FROM software_assets
LEFT JOIN software ON software_assets.software_id = software.software_id
WHERE software_assets.asset_id = $asset_id
AND software_archived_at IS NULL
@@ -219,7 +231,7 @@ $sql_related_software = mysqli_query(
$software_count = mysqli_num_rows($sql_related_software);
// Related Notes
$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
$sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_type, user_name FROM asset_notes
LEFT JOIN users ON asset_note_created_by = user_id
WHERE asset_note_asset_id = $asset_id
AND asset_note_archived_at IS NULL
@@ -571,7 +583,7 @@ ob_start();
// Tags
$credential_tag_name_display_array = array();
$credential_tag_id_array = array();
$sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
$sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
$credential_tag_id = intval($row['tag_id']);

8
agent/modals/asset/asset_add.php
View File

@@ -7,12 +7,12 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
$type = escapeHtml(ucwords($_GET['type']) ?? '');
if ($client_id) {
$sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
$sql_vendor_select = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
$sql_network_select = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
$sql_vendor_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
$sql_location_select = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
$sql_contact_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
$sql_contact_select = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
} else {
$sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
$sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
}
// OS typeahead suggestions

2
agent/modals/asset/asset_bulk_add_ticket.php
View File

@@ -116,7 +116,7 @@ ob_start();
<option value="0">- None -</option>
<?php
$sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
$sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
while ($row = mysqli_fetch_assoc($sql_projects)) {
$project_id_select = intval($row['project_id']);
$project_name_select = escapeHtml($row['project_name']); ?>

2
agent/modals/asset/asset_bulk_assign_contact.php
View File

@@ -37,7 +37,7 @@ ob_start();
<option value="">- Contact -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
$sql = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$contact_id = intval($row['contact_id']);
$contact_name = escapeHtml($row['contact_name']);

2
agent/modals/asset/asset_bulk_assign_tags.php
View File

@@ -37,7 +37,7 @@ ob_start();
<select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
<?php
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
$sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = escapeHtml($row['tag_name']);

15
agent/modals/asset/asset_copy.php
View File

@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
$asset_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets
$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
asset_vendor_id, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
interface_nat_ip, interface_network_id FROM assets
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_id = $asset_id LIMIT 1"
);
@@ -181,7 +186,7 @@ ob_start();
<option value="">- Select Location -</option>
<?php
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
$sql_locations = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = escapeHtml($row['location_name']);
@@ -213,7 +218,7 @@ ob_start();
<option value="">- Select Contact -</option>
<?php
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
$sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = escapeHtml($row['contact_name']);
@@ -265,7 +270,7 @@ ob_start();
<option value="">- Select Network -</option>
<?php
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
$sql_networks = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_networks)) {
$network_id_select = intval($row['network_id']);
$network_name_select = escapeHtml($row['network_name']);
@@ -358,7 +363,7 @@ ob_start();
<option value="">- Select Vendor -</option>
<?php
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
$sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = escapeHtml($row['vendor_name']);

19
agent/modals/asset/asset_edit.php
View File

@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
$asset_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets
$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
asset_favorite, asset_id, asset_install_date, asset_location_id, asset_make, asset_model,
asset_name, asset_notes, asset_os, asset_photo, asset_physical_location,
asset_purchase_date, asset_purchase_reference, asset_serial, asset_status, asset_type,
asset_uri, asset_uri_2, asset_uri_client, asset_vendor_id, asset_warranty_expire,
interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id FROM assets
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_id = $asset_id LIMIT 1"
);
@@ -47,7 +52,7 @@ $asset_network_id = intval($row['interface_network_id']);
$device_icon = getAssetIcon($asset_type);
// Asset History Query
$sql_asset_history = mysqli_query($mysqli, "SELECT * FROM asset_history
$sql_asset_history = mysqli_query($mysqli, "SELECT asset_history_created_at, asset_history_description, asset_history_status FROM asset_history
WHERE asset_history_asset_id = $asset_id
ORDER BY asset_history_id
DESC LIMIT 10"
@@ -210,7 +215,7 @@ ob_start();
<option value="">- Select Location -</option>
<?php
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
$sql_locations = mysqli_query($mysqli, "SELECT location_archived_at, location_id, location_name FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
while ($row = mysqli_fetch_assoc($sql_locations)) {
$location_id_select = intval($row['location_id']);
$location_name_select = escapeHtml($row['location_name']);
@@ -248,7 +253,7 @@ ob_start();
<option value="">- Select Contact -</option>
<?php
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
$sql_contacts = mysqli_query($mysqli, "SELECT contact_archived_at, contact_id, contact_name FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id_select = intval($row['contact_id']);
$contact_name_select = escapeHtml($row['contact_name']);
@@ -308,7 +313,7 @@ ob_start();
<option value="">- Select Network -</option>
<?php
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
$sql_networks = mysqli_query($mysqli, "SELECT network, network_archived_at, network_id, network_name FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
while ($row = mysqli_fetch_assoc($sql_networks)) {
$network_id_select = intval($row['network_id']);
$network_name_select = escapeHtml($row['network_name']);
@@ -416,7 +421,7 @@ ob_start();
<option value="">- Select Vendor -</option>
<?php
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
$sql_vendors = mysqli_query($mysqli, "SELECT vendor_archived_at, vendor_id, vendor_name FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendors)) {
$vendor_id_select = intval($row['vendor_id']);
$vendor_name_select = escapeHtml($row['vendor_name']);
@@ -506,7 +511,7 @@ ob_start();
<select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
<?php
$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
$sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
while ($row = mysqli_fetch_assoc($sql_tags_select)) {
$tag_id_select = intval($row['tag_id']);
$tag_name_select = escapeHtml($row['tag_name']);

Some files were not shown because too many files have changed in this diff Show More