Assets: remove client_id from edit asset modal as it should get the client_id in post, enforceClientAccess

agent/modals/asset/asset_edit.php

@@ -71,7 +71,6 @@ ob_start();
 <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="asset_id" value="<?= $asset_id ?>">
-    <input type="hidden" name="client_id" value="<?= $client_id ?>">
 
     <div class="modal-body">
 

agent/post/asset.php

@@ -14,6 +14,8 @@ if (isset($_POST['add_asset'])) {
 
     require_once 'asset_model.php';
 
+    enforceClientAccess();
+
     $alert_extended = "";
 
     mysqli_query($mysqli,"INSERT INTO assets SET asset_name = '$name', asset_description = '$description', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_uri = '$uri', asset_uri_2 = '$uri_2', asset_uri_client = '$uri_client', asset_location_id = $location, asset_vendor_id = $vendor, asset_contact_id = $contact, asset_status = '$status', asset_purchase_reference = '$purchase_reference', asset_purchase_date = $purchase_date, asset_warranty_expire = $warranty_expire, asset_install_date = $install_date, asset_physical_location = '$physical_location', asset_notes = '$notes', asset_favorite = $favorite, asset_client_id = $client_id");
@@ -81,12 +83,16 @@ if (isset($_POST['edit_asset'])) {
     enforceUserPermission('module_support', 2);
 
     require_once 'asset_model.php';
+
     $asset_id = intval($_POST['asset_id']);
 
-    // Get Existing Photo
+    // Get Existing Photo and assigned client_id
-    $sql = mysqli_query($mysqli,"SELECT asset_photo FROM assets WHERE asset_id = $asset_id");
+    $sql = mysqli_query($mysqli,"SELECT asset_photo, asset_client_id FROM assets WHERE asset_id = $asset_id");
     $row = mysqli_fetch_assoc($sql);
     $existing_file_name = sanitizeInput($row['asset_photo']);
+    $client_id = intval($row['asset_client_id']);
+
+    enforceClientAccess();
 
     mysqli_query($mysqli,"UPDATE assets SET asset_name = '$name', asset_description = '$description', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_uri = '$uri', asset_uri_2 = '$uri_2', asset_uri_client = '$uri_client', asset_location_id = $location, asset_vendor_id = $vendor, asset_contact_id = $contact, asset_status = '$status', asset_purchase_reference = '$purchase_reference', asset_purchase_date = $purchase_date, asset_warranty_expire = $warranty_expire, asset_install_date = $install_date, asset_physical_location = '$physical_location', asset_notes = '$notes', asset_favorite = $favorite WHERE asset_id = $asset_id");
 
@@ -153,6 +159,8 @@ if (isset($_GET['archive_asset'])) {
     $asset_name = sanitizeInput($row['asset_name']);
     $client_id = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     mysqli_query($mysqli,"UPDATE assets SET asset_archived_at = NOW() WHERE asset_id = $asset_id");
 
     // Add to History
@@ -180,6 +188,8 @@ if (isset($_GET['restore_asset'])) {
     $asset_name = sanitizeInput($row['asset_name']);
     $client_id = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     mysqli_query($mysqli,"UPDATE assets SET asset_archived_at = NULL WHERE asset_id = $asset_id");
 
     // Add to History
@@ -207,6 +217,8 @@ if (isset($_GET['delete_asset'])) {
     $asset_name = sanitizeInput($row['asset_name']);
     $client_id = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     mysqli_query($mysqli,"DELETE FROM assets WHERE asset_id = $asset_id");
 
     logAction("Asset", "Delete", "$session_name deleted asset $asset_name", $client_id);
@@ -235,6 +247,8 @@ if (isset($_POST['bulk_assign_asset_tags'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             if($_POST['remove_tags']) {
                 mysqli_query($mysqli, "DELETE FROM asset_tags WHERE asset_tag_asset_id = $asset_id");
             }
@@ -277,6 +291,8 @@ if (isset($_POST['bulk_assign_asset_location'])) {
     $location_name = sanitizeInput($row['location_name']);
     $client_id = intval($row['location_client_id']);
 
+    enforceClientAccess();
+
     // Assign Location to Selected Assets
     if (isset($_POST['asset_ids'])) {
 
@@ -292,6 +308,8 @@ if (isset($_POST['bulk_assign_asset_location'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_location_id = $location_id WHERE asset_id = $asset_id");
 
             logAction("Asset", "Edit", "$session_name assigned asset $asset_name to location $location_name", $client_id, $asset_id);
@@ -330,6 +348,8 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_physical_location = '$physical_location' WHERE asset_id = $asset_id");
 
             logAction("Asset", "Edit", "$session_name set asset $asset_name to physical location $physical_location", $client_id, $asset_id);
@@ -353,6 +373,8 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
 
     $new_client_id = intval($_POST['bulk_client_id']);
 
+    enforceClientAccess($new_client_id);
+
     // Transfer selected asset to new client
     if (isset($_POST['asset_ids'])) {
 
@@ -373,6 +395,8 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
             $current_client_id = intval($row['asset_client_id']);
             $current_client_name = sanitizeInput($row['client_name']);
 
+            enforceClientAccess($current_client_id);
+
             // Get new client name for logging
             $new_client_name = sanitizeInput(getFieldById('clients', $new_client_id, 'client_name'));
 
@@ -445,6 +469,8 @@ if (isset($_POST['bulk_assign_asset_contact'])) {
     $contact_name = sanitizeInput($row['contact_name']);
     $client_id = intval($row['contact_client_id']);
 
+    enforceClientAccess();
+
     // Assign Contact to Selected Assets
     if (isset($_POST['asset_ids'])) {
 
@@ -495,6 +521,8 @@ if (isset($_POST['bulk_edit_asset_status'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_status = '$status' WHERE asset_id = $asset_id");
 
             logAction("Asset", "Edit", "$session_name set status to $status on $asset_name", $client_id, $asset_id);
@@ -533,6 +561,8 @@ if (isset($_POST['bulk_favorite_assets'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_favorite = 1 WHERE asset_id = $asset_id");
 
             logAction("Asset", "Edit", "$session_name marked asset $asset_name a favorite", $client_id, $asset_id);
@@ -569,6 +599,8 @@ if (isset($_POST['bulk_unfavorite_assets'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_favorite = 0 WHERE asset_id = $asset_id");
 
             logAction("Asset", "Edit", "$session_name unfavorited asset $asset_name", $client_id, $asset_id);
@@ -605,6 +637,8 @@ if (isset($_POST['bulk_archive_assets'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_archived_at = NOW() WHERE asset_id = $asset_id");
 
             logAction("Asset", "Archive", "$session_name archived asset $asset_name", $client_id, $asset_id);
@@ -644,6 +678,8 @@ if (isset($_POST['bulk_restore_assets'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE assets SET asset_archived_at = NULL WHERE asset_id = $asset_id");
 
             // Individual Asset logging
@@ -684,6 +720,8 @@ if (isset($_POST['bulk_delete_assets'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"DELETE FROM assets WHERE asset_id = $asset_id");
 
             logAction("Asset", "Delete", "$session_name deleted asset $asset_name", $client_id, $asset_id);
@@ -715,6 +753,8 @@ if (isset($_POST['link_software_to_asset'])) {
     $software_name = sanitizeInput($row['software_name']);
     $client_id = intval($row['software_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -743,6 +783,8 @@ if (isset($_GET['unlink_software_from_asset'])) {
     $software_name = sanitizeInput($row['software_name']);
     $client_id = intval($row['software_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -772,6 +814,8 @@ if (isset($_POST['link_asset_to_credential'])) {
     $credential_name = sanitizeInput($row['credential_name']);
     $client_id = intval($row['credential_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -800,6 +844,8 @@ if (isset($_GET['unlink_credential_from_asset'])) {
     $credential_name = sanitizeInput($row['credential_name']);
     $client_id = intval($row['credential_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -828,6 +874,8 @@ if (isset($_POST['link_service_to_asset'])) {
     $service_name = sanitizeInput($row['service_name']);
     $client_id = intval($row['service_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -856,6 +904,8 @@ if (isset($_GET['unlink_service_from_asset'])) {
     $service_name = sanitizeInput($row['service_name']);
     $client_id = intval($row['service_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -884,6 +934,8 @@ if (isset($_POST['link_asset_to_file'])) {
     $file_name = sanitizeInput($row['file_name']);
     $client_id = intval($row['file_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -913,6 +965,8 @@ if (isset($_GET['unlink_asset_from_file'])) {
     $file_name = sanitizeInput($row['file_name']);
     $client_id = intval($row['file_client_id']);
 
+    enforceClientAccess();
+
     // Get Asset Name for logging
     $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
 
@@ -936,6 +990,9 @@ if (isset($_POST["import_assets_csv"])) {
     enforceUserPermission('module_support', 2);
 
     $client_id = intval($_POST['client_id']);
+
+    enforceClientAccess();
+
     $file_name = $_FILES["file"]["tmp_name"];
 
     $error = false;
@@ -1149,7 +1206,7 @@ if (isset($_POST['export_assets_csv'])) {
     }
 
     // Get records from database
-    $sql = mysqli_query($mysqli,"SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id LEFT JOIN locations ON asset_location_id = location_id LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL $client_query ORDER BY asset_name ASC");
+    $sql = mysqli_query($mysqli,"SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id LEFT JOIN locations ON asset_location_id = location_id LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL $client_query $access_permission_query ORDER BY asset_name ASC");
     $num_rows = mysqli_num_rows($sql);
 
     if ($num_rows > 0) {
@@ -1213,6 +1270,8 @@ if (isset($_POST['add_asset_interface'])) {
     $asset_name = sanitizeInput($row['asset_name']);
     $client_id  = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     // 4) Insert new interface into asset_interfaces (using SET syntax)
     $sql_insert = "
         INSERT INTO asset_interfaces SET
@@ -1282,6 +1341,8 @@ if (isset($_POST['add_asset_multiple_interfaces'])) {
     $asset_name = sanitizeInput($row['asset_name']);
     $client_id  = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     for ($interface_number = $interface_start; $interface_number < $interface_start + $interfaces; $interface_number++) {
 
         // Format $interface_number as a 2-digit number
@@ -1331,6 +1392,8 @@ if (isset($_POST['edit_asset_interface'])) {
     $asset_name= sanitizeInput($row['asset_name']);
     $client_id = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     // 2) Update the interface details in asset_interfaces
     $sql_update = "
         UPDATE asset_interfaces SET
@@ -1408,6 +1471,8 @@ if (isset($_GET['delete_asset_interface'])) {
     $asset_name     = sanitizeInput($row['asset_name']);
     $client_id      = intval($row['asset_client_id']);
 
+    enforceClientAccess();
+
     // 2) Delete the interface this cascadingly delete asset_interface_links
     mysqli_query($mysqli, "
         DELETE FROM asset_interfaces
@@ -1458,6 +1523,8 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) {
             $asset_name= sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             // Update inteface type
             mysqli_query($mysqli,"UPDATE asset_interfaces SET interface_type = '$type' WHERE interface_id = $interface_id");
 
@@ -1505,6 +1572,8 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) {
             $asset_name= sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             // Update inteface type
             mysqli_query($mysqli,"UPDATE asset_interfaces SET interface_network_id = $network_id WHERE interface_id = $interface_id");
 
@@ -1546,6 +1615,8 @@ if (isset($_POST['bulk_edit_asset_interface_ip_dhcp'])) {
             $asset_name= sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             // Update inteface type
             mysqli_query($mysqli,"UPDATE asset_interfaces SET interface_ip = 'DHCP' WHERE interface_id = $interface_id");
 
@@ -1589,6 +1660,8 @@ if (isset($_POST['bulk_delete_asset_interfaces'])) {
             $asset_name = sanitizeInput($row['asset_name']);
             $client_id = intval($row['asset_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli, "DELETE FROM asset_interfaces WHERE interface_id = $interface_id");
 
             logAction("Asset Interface", "Delete", "$session_name deleted interface $interface_name from asset $asset_name", $client_id, $asset_id);
@@ -1618,6 +1691,8 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
     $client_id = intval($row['asset_client_id']);
     $asset_name = sanitizeInput($row['asset_name']);
 
+    enforceClientAccess();
+
     $error = false;
 
     if (!empty($_FILES["file"]["tmp_name"])) {
@@ -1764,6 +1839,10 @@ if (isset($_POST['export_client_asset_interfaces_csv'])) {
 
     $asset_id = intval($_POST['asset_id']);
 
+    $client_id = intval(getFieldById('assets', $asset_id, 'asset_client_id'));
+
+    enforceClientAccess();
+
     //get records from database
     $sql = mysqli_query($mysqli,"SELECT * FROM asset_interfaces LEFT JOIN assets ON asset_id = interface_asset_id LEFT JOIN networks ON interface_network_id = network_id LEFT JOIN clients ON asset_client_id = client_id WHERE asset_id = $asset_id AND interface_archived_at IS NULL ORDER BY interface_name ASC");
     $row = mysqli_fetch_assoc($sql);