From a252ff717e48c58ecba8a98e1768021c7be2125d Mon Sep 17 00:00:00 2001 From: johnnyq Date: Fri, 6 Mar 2026 16:43:56 -0500 Subject: [PATCH] Racks: remove client_id post from edit rack and add rack device modal as it should get the client_id in post, enforceClientAccess --- agent/modals/rack/rack_device_add.php | 1 - agent/modals/rack/rack_edit.php | 1 - agent/post/network.php | 22 ++++++++++++++++++++-- agent/post/network_model.php | 1 - agent/post/rack.php | 21 ++++++++++++++++++--- 5 files changed, 38 insertions(+), 8 deletions(-) diff --git a/agent/modals/rack/rack_device_add.php b/agent/modals/rack/rack_device_add.php index ab09cc9e..9d372ea6 100644 --- a/agent/modals/rack/rack_device_add.php +++ b/agent/modals/rack/rack_device_add.php @@ -22,7 +22,6 @@ ob_start();
-
diff --git a/agent/modals/rack/rack_edit.php b/agent/modals/rack/rack_edit.php index 0f1960bc..e80301bd 100644 --- a/agent/modals/rack/rack_edit.php +++ b/agent/modals/rack/rack_edit.php @@ -33,7 +33,6 @@ ob_start(); -
diff --git a/agent/post/network.php b/agent/post/network.php index af96479e..e69b9b6d 100644 --- a/agent/post/network.php +++ b/agent/post/network.php @@ -14,6 +14,10 @@ if (isset($_POST['add_network'])) { require_once 'network_model.php'; + $client_id = intval($_POST['client_id']); + + enforceClientAccess(); + mysqli_query($mysqli,"INSERT INTO networks SET network_name = '$name', network_description = '$description', network_vlan = $vlan, network = '$network', network_subnet = '$subnet', network_gateway = '$gateway', network_primary_dns = '$primary_dns', network_secondary_dns = '$secondary_dns', network_notes = '$notes', network_location_id = $location_id, network_client_id = $client_id"); $network_id = mysqli_insert_id($mysqli); @@ -32,9 +36,14 @@ if (isset($_POST['edit_network'])) { enforceUserPermission('module_support', 2); - $network_id = intval($_POST['network_id']); require_once 'network_model.php'; + $network_id = intval($_POST['network_id']); + + $client_id = intval(getFieldById('networks', $network_id, 'network_client_id')); + + enforceClientAccess(); + mysqli_query($mysqli,"UPDATE networks SET network_name = '$name', network_description = '$description', network_vlan = $vlan, network = '$network', network_gateway = '$gateway', network_primary_dns = '$primary_dns', network_secondary_dns = '$secondary_dns', network_dhcp_range = '$dhcp_range', network_notes = '$notes', network_location_id = $location_id WHERE network_id = $network_id"); logAction("Network", "Edit", "$session_name edited network $name", $client_id, $network_id); @@ -59,6 +68,8 @@ if (isset($_GET['archive_network'])) { $network_name = sanitizeInput($row['network_name']); $client_id = intval($row['network_client_id']); + enforceClientAccess(); + mysqli_query($mysqli,"UPDATE networks SET network_archived_at = NOW() WHERE network_id = $network_id"); logAction("Network", "Archive", "$session_name archived network $network_name", $client_id, $network_id); @@ -83,6 +94,8 @@ if (isset($_GET['restore_network'])) { $network_name = sanitizeInput($row['network_name']); $client_id = intval($row['network_client_id']); + enforceClientAccess(); + mysqli_query($mysqli,"UPDATE networks SET network_archived_at = NULL WHERE network_id = $network_id"); logAction("Network", "Restore", "$session_name restored contact $contact_name", $client_id, $network_id); @@ -107,6 +120,8 @@ if (isset($_GET['delete_network'])) { $network_name = sanitizeInput($row['network_name']); $client_id = intval($row['network_client_id']); + enforceClientAccess(); + mysqli_query($mysqli,"DELETE FROM networks WHERE network_id = $network_id"); logAction("Network", "Delete", "$session_name deleted network $network_name", $client_id); @@ -139,6 +154,8 @@ if (isset($_POST['bulk_delete_networks'])) { $network_name = sanitizeInput($row['network_name']); $client_id = intval($row['network_client_id']); + enforceClientAccess(); + mysqli_query($mysqli, "DELETE FROM networks WHERE network_id = $network_id AND network_client_id = $client_id"); logAction("Network", "Delete", "$session_name deleted network $network_name", $client_id); @@ -164,13 +181,14 @@ if (isset($_POST['export_networks_csv'])) { $client_query = "AND network_client_id = $client_id"; $client_name = getFieldById('clients', $client_id, 'client_name'); $file_name_prepend = "$client_name-"; + enforceClientAccess(); } else { $client_query = ''; $client_id = 0; $file_name_prepend = "$session_company_name-"; } - $sql = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_archived_at IS NULL $client_query ORDER BY network_name ASC"); + $sql = mysqli_query($mysqli,"SELECT * FROM networks LEFT JOIN client ON client_id = network_client_id WHERE network_archived_at IS NULL $client_query $access_permission_query ORDER BY network_name ASC"); $num_rows = mysqli_num_rows($sql); diff --git a/agent/post/network_model.php b/agent/post/network_model.php index d8706e4d..3c609e50 100644 --- a/agent/post/network_model.php +++ b/agent/post/network_model.php @@ -11,4 +11,3 @@ $secondary_dns = sanitizeInput($_POST['secondary_dns']); $dhcp_range = sanitizeInput($_POST['dhcp_range']); $notes = sanitizeInput($_POST['notes']); $location_id = intval($_POST['location'] ?? 0); -$client_id = intval($_POST['client_id']); diff --git a/agent/post/rack.php b/agent/post/rack.php index 7beb28ae..7b953f63 100644 --- a/agent/post/rack.php +++ b/agent/post/rack.php @@ -23,6 +23,8 @@ if (isset($_POST['add_rack'])) { $location = intval($_POST['location']); $notes = sanitizeInput($_POST['notes']); + enforceClientAccess(); + mysqli_query($mysqli,"INSERT INTO racks SET rack_name = '$name', rack_description = '$description', rack_type = '$type', rack_model = '$model', rack_depth = '$depth', rack_units = $units, rack_location_id = $location, rack_physical_location = '$physical_location', rack_notes = '$notes', rack_client_id = $client_id"); $rack_id = mysqli_insert_id($mysqli); @@ -58,7 +60,6 @@ if (isset($_POST['edit_rack'])) { enforceUserPermission('module_support', 2); $rack_id = intval($_POST['rack_id']); - $client_id = intval($_POST['client_id']); $name = sanitizeInput($_POST['name']); $description = sanitizeInput($_POST['description']); $type = sanitizeInput($_POST['type']); @@ -69,6 +70,10 @@ if (isset($_POST['edit_rack'])) { $location = intval($_POST['location']); $notes = sanitizeInput($_POST['notes']); + $client_id = intval(getFieldById('racks', $rack_id, 'rack_client_id')); + + enforceClientAccess(); + mysqli_query($mysqli,"UPDATE racks SET rack_name = '$name', rack_description = '$description', rack_type = '$type', rack_model = '$model', rack_depth = '$depth', rack_units = $units, rack_location_id = $location, rack_physical_location = '$physical_location', rack_notes = '$notes' WHERE rack_id = $rack_id"); // Add Photo @@ -103,6 +108,8 @@ if (isset($_GET['archive_rack'])) { $rack_id = intval($_GET['archive_rack']); + enforceClientAccess(); + // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id"); $row = mysqli_fetch_assoc($sql); @@ -133,6 +140,8 @@ if (isset($_GET['restore_rack'])) { $rack_name = sanitizeInput($row['rack_name']); $client_id = intval($row['rack_client_id']); + enforceClientAccess(); + mysqli_query($mysqli,"UPDATE racks SET rack_archived_at = NULL WHERE rack_id = $rack_id"); logAction("Rack", "Restore", "$session_name restored rack $rack_name", $client_id, $rack_id); @@ -158,6 +167,8 @@ if (isset($_GET['delete_rack'])) { $rack_photo = sanitizeInput($row['rack_photo']); $client_id = intval($row['rack_client_id']); + enforceClientAccess(); + mysqli_query($mysqli,"DELETE FROM racks WHERE rack_id = $rack_id"); // Delete Photo if exists @@ -179,7 +190,6 @@ if (isset($_POST['add_rack_unit'])) { enforceUserPermission('module_support', 2); - $client_id = intval($_POST['client_id']); $rack_id = intval($_POST['rack_id']); $name = sanitizeInput($_POST['name']); $unit_start = intval($_POST['unit_start']); @@ -192,6 +202,8 @@ if (isset($_POST['add_rack_unit'])) { $rack_name = sanitizeInput($row['rack_name']); $client_id = intval($row['rack_client_id']); + enforceClientAccess(); + // **New Validation Check** if ($unit_start > $unit_end) { flash_alert("Unit Start number cannot be higher than Unit End number.", 'error'); @@ -227,7 +239,6 @@ if (isset($_POST['edit_rack_unit'])) { enforceUserPermission('module_support', 2); $unit_id = intval($_POST['unit_id']); - $client_id = intval($_POST['client_id']); $rack_id = intval($_POST['rack_id']); $name = sanitizeInput($_POST['name']); $unit_start = intval($_POST['unit_start']); @@ -240,6 +251,8 @@ if (isset($_POST['edit_rack_unit'])) { $rack_name = sanitizeInput($row['rack_name']); $client_id = intval($row['rack_client_id']); + enforceClientAccess(); + mysqli_query($mysqli,"UPDATE rack_units SET unit_device = '$name', unit_asset_id = $asset, unit_start_number = $unit_start, unit_end_number = $unit_end WHERE unit_id = $unit_id"); logAction("Rack", "Edit", "$session_name edited device $name in rack $rack_name", $client_id, $rack_id); @@ -266,6 +279,8 @@ if (isset($_GET['remove_rack_unit'])) { $client_id = intval($row['rack_client_id']); $rack_id = intval($row['rack_id']); + enforceClientAccess(); + mysqli_query($mysqli,"DELETE FROM rack_units WHERE unit_id = $unit_id"); logAction("Rack", "Edit", "$session_name removed device $device_name from rack $rack_name", $client_id, $rack_id);