AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-02-28 02:44:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent post pages being accessed directly

Browse Source
This commit is contained in:
wrongecho
2025-01-09 16:09:39 +00:00
parent ec54b28b02
commit a67de7a8f1
91 changed files with 190 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
post/user/account.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for account(s) (accounting related)
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_account'])) {
enforceUserPermission('module_financial', 2);
validateCSRFToken($_POST['csrf_token']);

2
post/user/asset.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client assets
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_asset'])) {
enforceUserPermission('module_support', 2);

2
post/user/asset_interface_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$mac = sanitizeInput($_POST['mac']);
$ip = sanitizeInput($_POST['ip']);

2
post/user/asset_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);

3
post/user/budget.php
View File

@@ -4,6 +4,9 @@
* ITFlow - GET/POST request handler for budget
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['save_budget'])) {
enforceUserPermission('module_financial', 2);

2
post/user/certificate.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client SSL certificates
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_certificate'])) {
enforceUserPermission('module_support', 2);

2
post/user/certificate_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$domain = sanitizeInput($_POST['domain']);

2
post/user/client.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for clients/customers (overview)
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_client'])) {
validateCSRFToken($_POST['csrf_token']);

2
post/user/client_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$type = sanitizeInput($_POST['type']);
$website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website']));

2
post/user/contact.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client contacts
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_contact'])) {
enforceUserPermission('module_client', 2);

1
post/user/contact_model.php
View File

@@ -1,4 +1,5 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);

2
post/user/credential.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client credentials (formerly logins)
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_login'])) {
enforceUserPermission('module_credential', 2);

2
post/user/credential_model.php
View File

@@ -1,5 +1,7 @@
<?php
// Model of reusable variables for client credentials/logins - not to be confused with the ITFLow login process
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);

2
post/user/document.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client documents
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_document'])) {
enforceUserPermission('module_support', 2);

2
post/user/document_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$folder = intval($_POST['folder']);

2
post/user/domain.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client domains
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_domain'])) {
enforceUserPermission('module_support', 2);

2
post/user/domain_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = preg_replace("(^https?://)", "", sanitizeInput($_POST['name']));
$description = sanitizeInput($_POST['description']);
$registrar = intval($_POST['registrar']);

2
post/user/event.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for calendar & events
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_calendar'])) {
$name = sanitizeInput($_POST['name']);

2
post/user/event_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$calendar_id = intval($_POST['calendar']);
$title = sanitizeInput($_POST['title']);
$location = sanitizeInput($_POST['location']);

2
post/user/expense.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for expenses
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_expense'])) {
require_once 'post/user/expense_model.php';

2
post/user/expense_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$amount = floatval($_POST['amount']);
$account = intval($_POST['account']);

2
post/user/file.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client files/uploads
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['upload_files'])) {
enforceUserPermission('module_support', 2);

2
post/user/folder.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for folders
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['create_folder'])) {
enforceUserPermission('module_support', 2);

2
post/user/invoice.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for invoices & payments
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_invoice'])) {
require_once 'post/user/invoice_model.php';

1
post/user/invoice_model.php
View File

@@ -1,4 +1,5 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$category = intval($_POST['category']);

2
post/user/location.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client physical locations/sites
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if(isset($_POST['add_location'])){
enforceUserPermission('module_client', 2);

2
post/user/location_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);

2
post/user/network.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client networks
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_network'])) {
enforceUserPermission('module_support', 2);

2
post/user/network_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$vlan = intval($_POST['vlan']);

2
post/user/product.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for products
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
// Products
if (isset($_POST['add_product'])) {

2
post/user/product_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$price = floatval($_POST['price']);

2
post/user/profile.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for user profiles (tech/agent)
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_your_user_details'])) {
// CSRF Check

2
post/user/project.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for tasks
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_project'])) {
enforceUserPermission('module_support', 2);

2
post/user/quote.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for quotes
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_quote'])) {
enforceUserPermission('module_sales', 2);

2
post/user/quote_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$expire = sanitizeInput($_POST['expire']);
$category = intval($_POST['category']);

2
post/user/rack.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client racks
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_rack'])) {
enforceUserPermission('module_support', 2);

2
post/user/revenue.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for revenue
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_revenue'])) {
enforceUserPermission('module_sales', 2);

2
post/user/service.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client service info
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_service'])) {
enforceUserPermission('module_support', 2);

1
post/user/software.php
View File

@@ -4,6 +4,7 @@
* ITFlow - GET/POST request handler for client software & licenses
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_software_from_template'])) {

2
post/user/task.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for tasks
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_task'])) {
enforceUserPermission('module_support', 2);

2
post/user/ticket.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for client tickets
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_ticket'])) {
enforceUserPermission('module_support', 2);

1
post/user/ticket_recurring_model.php
View File

@@ -1,4 +1,5 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client']);
$subject = sanitizeInput($_POST['subject']);

2
post/user/transfer.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for transfers (accounting)
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_transfer'])) {
enforceUserPermission('module_financial', 2);

2
post/user/transfer_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$amount = floatval($_POST['amount']);
$account_from = intval($_POST['account_from']);

2
post/user/trip.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for trips (accounting related)
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_trip'])) {
require_once 'post/user/trip_model.php';

2
post/user/trip_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$source = sanitizeInput($_POST['source']);
$destination = sanitizeInput($_POST['destination']);

2
post/user/vendor.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for vendors
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_vendor_from_template'])) {
// GET POST Data

2
post/user/vendor_contact.php
View File

@@ -4,6 +4,8 @@
* ITFlow - GET/POST request handler for vendor contacts
*/
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_vendor_contact'])) {
enforceUserPermission('module_client', 2);

1
post/user/vendor_contact_model.php
View File

@@ -1,4 +1,5 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client_id']);
$vendor_id = intval($_POST['vendor_id']);

2
post/user/vendor_model.php
View File

@@ -1,4 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$account_number = sanitizeInput($_POST['account_number']);