From a1931f59f8180df6e3ea51e692b06568e698960b Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Fri, 6 Mar 2026 17:01:34 -0500
Subject: [PATCH] services: remove client_id post from edit service modal as it
 should get the client_id in post, enforceClientAccess

---
 agent/modals/service/service_edit.php | 1 -
 agent/post/service.php                | 9 ++++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/agent/modals/service/service_edit.php b/agent/modals/service/service_edit.php
index 597198a6..357d3491 100644
--- a/agent/modals/service/service_edit.php
+++ b/agent/modals/service/service_edit.php
@@ -93,7 +93,6 @@ ob_start();
 
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id ?>">
     <input type="hidden" name="service_id" value="<?php echo $service_id ?>">
 
     <div class="modal-body">
diff --git a/agent/post/service.php b/agent/post/service.php
index b27ceb39..ef0e2352 100644
--- a/agent/post/service.php
+++ b/agent/post/service.php
@@ -20,6 +20,8 @@ if (isset($_POST['add_service'])) {
     $service_backup = sanitizeInput($_POST['backup']);
     $service_notes = sanitizeInput($_POST['note']);
 
+    enforceClientAccess();
+
     // Create Service
     mysqli_query($mysqli, "INSERT INTO services SET service_name = '$service_name', service_description = '$service_description', service_category = '$service_category', service_importance = '$service_importance', service_backup = '$service_backup', service_notes = '$service_notes', service_client_id = $client_id");
 
@@ -90,7 +92,6 @@ if (isset($_POST['edit_service'])) {
 
     enforceUserPermission('module_support', 2);
 
-    $client_id = intval($_POST['client_id']);
     $service_id = intval($_POST['service_id']);
     $service_name = sanitizeInput($_POST['name']);
     $service_description = sanitizeInput($_POST['description']);
@@ -99,6 +100,10 @@ if (isset($_POST['edit_service'])) {
     $service_backup = sanitizeInput($_POST['backup']);
     $service_notes = sanitizeInput($_POST['note']);
 
+    $client_id = intval(getFieldById('services', $service_id, 'service_client_id'));
+
+    enforceClientAccess();
+
     // Update main service details
     mysqli_query($mysqli, "UPDATE services SET service_name = '$service_name', service_description = '$service_description', service_category = '$service_category', service_importance = '$service_importance', service_backup = '$service_backup', service_notes = '$service_notes' WHERE service_id = $service_id");
 
@@ -183,6 +188,8 @@ if (isset($_GET['delete_service'])) {
     $service_name = sanitizeInput($row['service_name']);
     $client_id = intval($row['service_client_id']);
 
+    enforceClientAccess();
+
     // Delete service
     mysqli_query($mysqli, "DELETE FROM services WHERE service_id = $service_id");