AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 17:47:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Apply further gating to client pdf export

Browse Source
This commit is contained in:
johnnyq
2026-08-06 19:03:47 -04:00
parent 64423cbefa
commit 942fe41b18
4 changed files with 155 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
agent/post/client.php
View File

@@ -1175,11 +1175,15 @@ if (isset($_POST["export_client_pdf"])) {
validateCSRFToken();
// Enforce permissions
enforceUserPermission("module_client", 3);
enforceUserPermission("module_support", 1);
enforceUserPermission("module_sales", 1);
enforceUserPermission("module_financial", 1);
// The pack always carries the client's own record, so client read is the floor.
// Everything past that is gated per section in resolveClientPackSections() - a
// role missing one module loses that section, not the whole export.
enforceUserPermission('module_client');
$client_id = intval($_POST["client_id"]);
enforceClientAccess();
$pack = resolveClientPackSections();
$sql = mysqli_query($mysqli, "SELECT company_email, company_logo, company_name, company_phone, company_phone_country_code,
company_website FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
@@ -1191,30 +1195,6 @@ if (isset($_POST["export_client_pdf"])) {
$company_website = escapeHtml($row['company_website']);
$company_logo = escapeHtml($row['company_logo']);
$client_id = intval($_POST["client_id"]);
$export_contacts = intval($_POST["include_contacts"] ?? 0);
$export_locations = intval($_POST["include_locations"] ?? 0);
$export_assets = intval($_POST["include_assets"] ?? 0);
$export_software = intval($_POST["include_software"] ?? 0);
$export_credentials = 0;
if (lookupUserPermission("module_credential") >= 1) {
$export_credentials = intval($_POST["include_credentials"] ?? 0);
}
$export_networks = intval($_POST["include_networks"] ?? 0);
$export_certificates = intval($_POST["include_certificates"] ?? 0);
$export_domains = intval($_POST["include_domains"] ?? 0);
$export_tickets = intval($_POST["include_tickets"] ?? 0);
$export_recurring_tickets = intval($_POST["include_recurring_tickets"] ?? 0);
$export_vendors = intval($_POST["include_vendors"] ?? 0);
$export_invoices = intval($_POST["include_invoices"] ?? 0);
$export_recurring_invoices = intval($_POST["include_recurring_invoices"] ?? 0);
$export_quotes = intval($_POST["include_quotes"] ?? 0);
$export_payments = intval($_POST["include_payments"] ?? 0);
$export_trips = intval($_POST["include_trips"] ?? 0);
$export_logs = intval($_POST["include_logs"] ?? 0);
enforceClientAccess();
logAudit("Client", "Export", "$session_name exported client data to a PDF file", $client_id, $client_id);
// Get client record (joining primary contact and primary location)
@@ -1241,19 +1221,19 @@ if (isset($_POST["export_client_pdf"])) {
$client_website = escapeHtml($row["client_website"]);
// Other queries remain unchanged
$sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_name ASC");
$sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
$sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = $client_id AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
$sql_credentials = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id = $client_id ORDER BY credential_name ASC");
$sql_assets = mysqli_query($mysqli, "SELECT 1 FROM assets
$sql_contacts = $pack['contacts'] ? mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_name ASC") : false;
$sql_locations = $pack['locations'] ? mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC") : false;
$sql_vendors = $pack['vendors'] ? mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = $client_id AND vendor_archived_at IS NULL ORDER BY vendor_name ASC") : false;
$sql_credentials = $pack['credentials'] ? mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id = $client_id ORDER BY credential_name ASC") : false;
$sql_assets = $pack['assets'] ? mysqli_query($mysqli, "SELECT 1 FROM assets
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_client_id = $client_id
AND asset_archived_at IS NULL
ORDER BY asset_type ASC"
);
$sql_asset_workstations = mysqli_query($mysqli, "SELECT * FROM assets
) : false;
$sql_asset_workstations = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
@@ -1261,31 +1241,31 @@ if (isset($_POST["export_client_pdf"])) {
AND (asset_type = 'desktop' OR asset_type = 'laptop')
AND asset_archived_at IS NULL
ORDER BY asset_name ASC"
);
$sql_asset_servers = mysqli_query($mysqli, "SELECT * FROM assets
) : false;
$sql_asset_servers = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
LEFT JOIN locations ON asset_location_id = location_id
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_client_id = $client_id
AND asset_type = 'server'
AND asset_archived_at IS NULL
ORDER BY asset_name ASC"
);
$sql_asset_vms = mysqli_query($mysqli, "SELECT * FROM assets
) : false;
$sql_asset_vms = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_client_id = $client_id
AND asset_type = 'virtual machine'
AND asset_archived_at IS NULL
ORDER BY asset_name ASC"
);
$sql_asset_network = mysqli_query($mysqli, "SELECT * FROM assets
) : false;
$sql_asset_network = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
LEFT JOIN locations ON asset_location_id = location_id
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
WHERE asset_client_id = $client_id
AND (asset_type = 'Firewall/Router' OR asset_type = 'Switch' OR asset_type = 'Access Point')
AND asset_archived_at IS NULL
ORDER BY asset_type ASC"
);
$sql_asset_other = mysqli_query($mysqli, "SELECT * FROM assets
) : false;
$sql_asset_other = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
LEFT JOIN contacts ON asset_contact_id = contact_id
LEFT JOIN locations ON asset_location_id = location_id
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
@@ -1293,13 +1273,13 @@ if (isset($_POST["export_client_pdf"])) {
AND (asset_type NOT LIKE 'laptop' AND asset_type NOT LIKE 'desktop' AND asset_type NOT LIKE 'server' AND asset_type NOT LIKE 'virtual machine' AND asset_type NOT LIKE 'firewall/router' AND asset_type NOT LIKE 'switch' AND asset_type NOT LIKE 'access point')
AND asset_archived_at IS NULL
ORDER BY asset_type ASC"
);
$sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id = $client_id AND network_archived_at IS NULL ORDER BY network_name ASC");
$sql_domains = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id = $client_id AND domain_archived_at IS NULL ORDER BY domain_name ASC");
$sql_certficates = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = $client_id AND certificate_archived_at IS NULL ORDER BY certificate_name ASC");
$sql_software = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = $client_id AND software_archived_at IS NULL ORDER BY software_name ASC");
) : false;
$sql_networks = $pack['networks'] ? mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id = $client_id AND network_archived_at IS NULL ORDER BY network_name ASC") : false;
$sql_domains = $pack['domains'] ? mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id = $client_id AND domain_archived_at IS NULL ORDER BY domain_name ASC") : false;
$sql_certficates = $pack['certificates'] ? mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = $client_id AND certificate_archived_at IS NULL ORDER BY certificate_name ASC") : false;
$sql_software = $pack['software'] ? mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = $client_id AND software_archived_at IS NULL ORDER BY software_name ASC") : false;
$sql_user_licenses = mysqli_query($mysqli, "
$sql_user_licenses = $pack['software'] ? mysqli_query($mysqli, "
SELECT
contact_name,
software_name
@@ -1315,9 +1295,9 @@ if (isset($_POST["export_client_pdf"])) {
AND contact_client_id = $client_id
ORDER BY
contact_name, software_name;"
);
) : false;
$sql_asset_licenses = mysqli_query($mysqli, "
$sql_asset_licenses = $pack['software'] ? mysqli_query($mysqli, "
SELECT
asset_name,
software_name
@@ -1333,7 +1313,7 @@ if (isset($_POST["export_client_pdf"])) {
AND asset_client_id = $client_id
ORDER BY
asset_name, software_name;"
);
) : false;
require_once("../libs/TCPDF/tcpdf.php");
@@ -1426,7 +1406,7 @@ if (isset($_POST["export_client_pdf"])) {
// Add bookmarks and TOC entries for each major section:
// Contacts Section
if (mysqli_num_rows($sql_contacts) > 0 && $export_contacts == 1) {
if ($pack['contacts'] == 1 && mysqli_num_rows($sql_contacts) > 0) {
$pdf->Bookmark("Contacts", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Contacts</h2>
@@ -1471,7 +1451,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Locations Section
if (mysqli_num_rows($sql_locations) > 0 && $export_locations == 1) {
if ($pack['locations'] == 1 && mysqli_num_rows($sql_locations) > 0) {
$pdf->Bookmark("Locations", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Locations</h2>
@@ -1506,7 +1486,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Vendors Section
if (mysqli_num_rows($sql_vendors) > 0 && $export_vendors == 1) {
if ($pack['vendors'] == 1 && mysqli_num_rows($sql_vendors) > 0) {
$pdf->Bookmark("Vendors", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Vendors</h2>
@@ -1543,7 +1523,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Credentials Section
if (mysqli_num_rows($sql_credentials) > 0 && $export_credentials == 1) {
if ($pack['credentials'] == 1 && mysqli_num_rows($sql_credentials) > 0) {
$pdf->Bookmark("Credentials", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Credentials</h2>
@@ -1582,14 +1562,14 @@ if (isset($_POST["export_client_pdf"])) {
}
// Assets Section Header
if (mysqli_num_rows($sql_assets) > 0 && $export_assets == 1) {
if ($pack['assets'] == 1 && mysqli_num_rows($sql_assets) > 0) {
$pdf->Bookmark("Assets", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Assets</h2>";
}
// Workstations
if (mysqli_num_rows($sql_asset_workstations) > 0 && $export_assets == 1) {
if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_workstations) > 0) {
$pdf->Bookmark("Workstations", 1, 0, "", "", array(0,0,0));
$html .= "
<h3 class='subsection-title'>Workstations</h3>
@@ -1641,7 +1621,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Servers
if (mysqli_num_rows($sql_asset_servers) > 0 && $export_assets == 1) {
if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_servers) > 0) {
$pdf->Bookmark("Servers", 1, 0, "", "", array(0,0,0));
$html .= "
<h3 class='subsection-title'>Servers</h3>
@@ -1690,7 +1670,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Virtual Machines
if (mysqli_num_rows($sql_asset_vms) > 0 && $export_assets == 1) {
if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_vms) > 0) {
$pdf->Bookmark("Virtual Machines", 1, 0, "", "", array(0,0,0));
$html .= "
<h3 class='subsection-title'>Virtual Machines</h3>
@@ -1723,7 +1703,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Network Devices
if (mysqli_num_rows($sql_asset_network) > 0 && $export_assets == 1) {
if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_network) > 0) {
$pdf->Bookmark("Network Devices", 1, 0, "", "", array(0,0,0));
$html .= "
<h3 class='subsection-title'>Network Devices</h3>
@@ -1772,7 +1752,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Other Devices
if (mysqli_num_rows($sql_asset_other) > 0 && $export_assets == 1) {
if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_other) > 0) {
$pdf->Bookmark("Other Devices", 1, 0, "", "", array(0,0,0));
$html .= "
<h3 class='subsection-title'>Other Devices</h3>
@@ -1821,7 +1801,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Software Section
if (mysqli_num_rows($sql_software) > 0 && $export_software == 1) {
if ($pack['software'] == 1 && mysqli_num_rows($sql_software) > 0) {
$pdf->Bookmark("Software", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Software</h2>
@@ -1863,7 +1843,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// User Assigned Software Licenses
if (mysqli_num_rows($sql_user_licenses) > 0 && $export_software == 1) {
if ($pack['software'] == 1 && mysqli_num_rows($sql_user_licenses) > 0) {
$pdf->Bookmark("User Assigned Licenses", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>User Assigned Licenses</h2>
@@ -1890,7 +1870,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Asset Assigned Software Licenses
if (mysqli_num_rows($sql_asset_licenses) > 0 && $export_software == 1) {
if ($pack['software'] == 1 && mysqli_num_rows($sql_asset_licenses) > 0) {
$pdf->Bookmark("Asset Assigned Licenses", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Asset Assigned Licenses</h2>
@@ -1917,7 +1897,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Networks Section
if (mysqli_num_rows($sql_networks) > 0 && $export_networks == 1) {
if ($pack['networks'] == 1 && mysqli_num_rows($sql_networks) > 0) {
$pdf->Bookmark("Networks", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Networks</h2>
@@ -1953,7 +1933,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Domains Section
if (mysqli_num_rows($sql_domains) > 0 && $export_domains == 1) {
if ($pack['domains'] == 1 && mysqli_num_rows($sql_domains) > 0) {
$pdf->Bookmark("Domains", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Domains</h2>
@@ -1980,7 +1960,7 @@ if (isset($_POST["export_client_pdf"])) {
}
// Certificates Section
if (mysqli_num_rows($sql_certficates) > 0 && $export_certificates == 1) {
if ($pack['certificates'] == 1 && mysqli_num_rows($sql_certficates) > 0) {
$pdf->Bookmark("Certificates", 0, 0, "", "B", array(0,0,0));
$html .= "
<h2 class='section-title'>Certificates</h2>