AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 02:07:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

Browse Source
This commit is contained in:
johnnyq
2026-07-24 13:40:37 -04:00
parent dd358da65d
commit af51c4316f
80 changed files with 519 additions and 517 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
admin/post/ai_model.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_ai_model'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider_id = intval($_POST['provider']);
$model = escapeSql($_POST['model']);
@@ -29,7 +29,7 @@ if (isset($_POST['add_ai_model'])) {
if (isset($_POST['edit_ai_model'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$model_id = intval($_POST['model_id']);
$model = escapeSql($_POST['model']);
@@ -48,7 +48,7 @@ if (isset($_POST['edit_ai_model'])) {
if (isset($_GET['delete_ai_model'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$model_id = intval($_GET['delete_ai_model']);

6
admin/post/ai_provider.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_ai_provider'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider = escapeSql($_POST['provider']);
$url = escapeSql($_POST['url']);
@@ -29,7 +29,7 @@ if (isset($_POST['add_ai_provider'])) {
if (isset($_POST['edit_ai_provider'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider_id = intval($_POST['provider_id']);
$provider = escapeSql($_POST['provider']);
@@ -48,7 +48,7 @@ if (isset($_POST['edit_ai_provider'])) {
if (isset($_GET['delete_ai_provider'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$provider_id = intval($_GET['delete_ai_provider']);

8
admin/post/api_keys.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_api_key'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$expire = escapeSql($_POST['expire']);
@@ -33,7 +33,7 @@ if (isset($_POST['add_api_key'])) {
if (isset($_GET['revoke_api_key'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$api_key_id = intval($_GET['revoke_api_key']);
@@ -54,7 +54,7 @@ if (isset($_GET['revoke_api_key'])) {
if (isset($_GET['delete_api_key'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$api_key_id = intval($_GET['delete_api_key']);
@@ -75,7 +75,7 @@ if (isset($_GET['delete_api_key'])) {
if (isset($_POST['bulk_delete_api_keys'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if (isset($_POST['api_key_ids'])) {

4
admin/post/backup.php
View File

@@ -206,7 +206,7 @@ function zipFolderStrict(string $folderPath, string $zipFilePath): void {
if (isset($_GET['download_backup'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$timestamp = date('YmdHis');
$baseName = "itflow_{$timestamp}";
@@ -302,7 +302,7 @@ if (isset($_GET['download_backup'])) {
if (isset($_POST['backup_master_key'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$password = $_POST['password'];

10
admin/post/category.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'category_model.php';
@@ -26,7 +26,7 @@ if (isset($_POST['add_category'])) {
if (isset($_POST['edit_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'category_model.php';
@@ -44,7 +44,7 @@ if (isset($_POST['edit_category'])) {
if (isset($_GET['archive_category'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$category_id = intval($_GET['archive_category']);
@@ -66,7 +66,7 @@ if (isset($_GET['archive_category'])) {
if (isset($_GET['restore_category'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$category_id = intval($_GET['restore_category']);
@@ -88,7 +88,7 @@ if (isset($_GET['restore_category'])) {
if (isset($_GET['delete_category'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$category_id = intval($_GET['delete_category']);

10
admin/post/contract_template.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_contract_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Sanitize text inputs
$name = escapeSql($_POST['name']);
@@ -63,7 +63,7 @@ if (isset($_POST['add_contract_template'])) {
if (isset($_POST['edit_contract_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$contract_template_id = intval($_POST['contract_template_id']);
$name = escapeSql($_POST['name']);
@@ -112,7 +112,7 @@ if (isset($_POST['edit_contract_template'])) {
if (isset($_GET['archive_contract_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$contract_template_id = intval($_GET['archive_contract_template']);
@@ -131,7 +131,7 @@ if (isset($_GET['archive_contract_template'])) {
if (isset($_GET['restore_contract_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$contract_template_id = intval($_GET['restore_contract_template']);
@@ -150,7 +150,7 @@ if (isset($_GET['restore_contract_template'])) {
if (isset($_GET['delete_contract_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$contract_template_id = intval($_GET['delete_contract_template']);

6
admin/post/custom_field.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if(isset($_POST['create_custom_field'])){
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'custom_field_model.php';
@@ -28,7 +28,7 @@ if(isset($_POST['create_custom_field'])){
if(isset($_POST['edit_custom_field'])){
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'custom_field_model.php';
@@ -46,7 +46,7 @@ if(isset($_POST['edit_custom_field'])){
if(isset($_GET['delete_custom_field'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$custom_field_id = intval($_GET['delete_custom_field']);

6
admin/post/custom_link.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_custom_link'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$uri = escapeSql($_POST['uri']);
@@ -31,7 +31,7 @@ if (isset($_POST['add_custom_link'])) {
if (isset($_POST['edit_custom_link'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$custom_link_id = intval($_POST['custom_link_id']);
$name = escapeSql($_POST['name']);
@@ -53,7 +53,7 @@ if (isset($_POST['edit_custom_link'])) {
if (isset($_GET['delete_custom_link'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$custom_link_id = intval($_GET['delete_custom_link']);

6
admin/post/document_template.php
View File

@@ -6,7 +6,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_document_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
@@ -38,7 +38,7 @@ if (isset($_POST['add_document_template'])) {
if (isset($_POST['edit_document_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$document_template_id = intval($_POST['document_template_id']);
$name = escapeSql($_POST['name']);
@@ -73,7 +73,7 @@ if (isset($_POST['edit_document_template'])) {
if (isset($_GET['delete_document_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$document_template_id = intval($_GET['delete_document_template']);

2
admin/post/identity_provider.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_identity_provider'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$azure_client_id = escapeSql($_POST['azure_client_id']);
$azure_client_secret = escapeSql($_POST['azure_client_secret']);

8
admin/post/mail_queue.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_GET['send_failed_mail'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$email_id = intval($_GET['send_failed_mail']);
@@ -20,7 +20,7 @@ if (isset($_GET['send_failed_mail'])) {
if (isset($_GET['cancel_mail'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$email_id = intval($_GET['cancel_mail']);
@@ -36,7 +36,7 @@ if (isset($_GET['cancel_mail'])) {
if (isset($_POST['bulk_cancel_emails'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if (isset($_POST['email_ids'])) {
@@ -64,7 +64,7 @@ if (isset($_POST['bulk_cancel_emails'])) {
if (isset($_POST['bulk_delete_emails'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if (isset($_POST['email_ids'])) {

6
admin/post/payment_method.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_payment_method'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = cleanInput($_POST['name']);
$description = cleanInput($_POST['description']);
@@ -32,7 +32,7 @@ if (isset($_POST['add_payment_method'])) {
if (isset($_POST['edit_payment_method'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$payment_method_id = intval($_POST['payment_method_id']);
$name = cleanInput($_POST['name']);
@@ -59,7 +59,7 @@ if (isset($_POST['edit_payment_method'])) {
if (isset($_GET['delete_payment_method'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$payment_method_id = intval($_GET['delete_payment_method']);

6
admin/post/payment_provider.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_payment_provider'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider = escapeSql($_POST['provider']);
$public_key = escapeSql($_POST['public_key']);
@@ -39,7 +39,7 @@ if (isset($_POST['add_payment_provider'])) {
if (isset($_POST['edit_payment_provider'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider_id = intval($_POST['provider_id']);
$description = escapeSql($_POST['description']);
@@ -62,7 +62,7 @@ if (isset($_POST['edit_payment_provider'])) {
if (isset($_GET['delete_payment_provider'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$provider_id = intval($_GET['delete_payment_provider']);

12
admin/post/project_template.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_project_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
@@ -23,7 +23,7 @@ if (isset($_POST['add_project_template'])) {
if (isset($_POST['edit_project_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$project_template_id = intval($_POST['project_template_id']);
$name = escapeSql($_POST['name']);
@@ -41,7 +41,7 @@ if (isset($_POST['edit_project_template'])) {
if (isset($_POST['edit_ticket_template_order'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_template_id = intval($_POST['ticket_template_id']);
$project_template_id = intval($_POST['project_template_id']);
@@ -55,7 +55,7 @@ if (isset($_POST['edit_ticket_template_order'])) {
if (isset($_POST['add_ticket_template_to_project_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$project_template_id = intval($_POST['project_template_id']);
$ticket_template_id = intval($_POST['ticket_template_id']);
@@ -73,7 +73,7 @@ if (isset($_POST['add_ticket_template_to_project_template'])) {
if (isset($_POST['remove_ticket_template_from_project_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_template_id = intval($_POST['ticket_template_id']);
$project_template_id = intval($_POST['project_template_id']);
@@ -90,7 +90,7 @@ if (isset($_POST['remove_ticket_template_from_project_template'])) {
if (isset($_GET['delete_project_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$project_template_id = intval($_GET['delete_project_template']);

6
admin/post/roles.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_role'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['role_name']);
$description = escapeSql($_POST['role_description']);
@@ -42,7 +42,7 @@ if (isset($_POST['add_role'])) {
if (isset($_POST['edit_role'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$role_id = intval($_POST['role_id']);
$name = escapeSql($_POST['role_name']);
@@ -75,7 +75,7 @@ if (isset($_POST['edit_role'])) {
if (isset($_GET['archive_role'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$role_id = intval($_GET['archive_role']);

2
admin/post/saved_payment_method.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_GET['delete_saved_payment'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$saved_payment_id = intval($_GET['delete_saved_payment']);

2
admin/post/settings_ai.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_ai_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider = escapeSql($_POST['provider']);
if($provider){

4
admin/post/settings_company.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_company'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$address = escapeSql($_POST['address']);
@@ -54,7 +54,7 @@ if (isset($_POST['edit_company'])) {
if (isset($_GET['remove_company_logo'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$sql = mysqli_query($mysqli,"SELECT company_logo FROM companies");
$row = mysqli_fetch_assoc($sql);

2
admin/post/settings_default.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_default_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$start_page = escapeSql($_POST['start_page']);
$expense_account = intval($_POST['expense_account']);

2
admin/post/settings_invoice.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_invoice_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_invoice_prefix = escapeSql($_POST['config_invoice_prefix']);
$config_invoice_next_number = intval($_POST['config_invoice_next_number']);

2
admin/post/settings_localization.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_localization'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$locale = escapeSql($_POST['locale']);
$currency_code = escapeSql($_POST['currency_code']);

16
admin/post/settings_mail.php
View File

@@ -8,7 +8,7 @@ if (!defined('MICROSOFT_OAUTH_BASE_URL')) {
if (isset($_POST['oauth_connect_microsoft_mail'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Save the OAuth credential fields from this form so the auth flow uses the latest inputs
$config_mail_oauth_client_id = escapeSql($_POST['config_mail_oauth_client_id'] ?? '');
@@ -75,7 +75,7 @@ if (isset($_POST['oauth_connect_microsoft_mail'])) {
if (isset($_POST['edit_mail_smtp_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_smtp_provider = escapeSql($_POST['config_smtp_provider']);
$config_smtp_host = escapeSql($_POST['config_smtp_host'] ?? $config_smtp_host);
@@ -105,7 +105,7 @@ if (isset($_POST['edit_mail_smtp_settings'])) {
if (isset($_POST['edit_mail_imap_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_imap_provider = escapeSql($_POST['config_imap_provider']);
$config_imap_host = escapeSql($_POST['config_imap_host'] ?? $config_imap_host);
@@ -135,7 +135,7 @@ if (isset($_POST['edit_mail_imap_settings'])) {
if (isset($_POST['edit_mail_oauth_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_mail_oauth_client_id = escapeSql($_POST['config_mail_oauth_client_id'] ?? '');
$config_mail_oauth_client_secret = escapeSql($_POST['config_mail_oauth_client_secret'] ?? '');
@@ -159,7 +159,7 @@ if (isset($_POST['edit_mail_oauth_settings'])) {
if (isset($_POST['edit_mail_from_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_mail_from_email = escapeSql(filter_var($_POST['config_mail_from_email'], FILTER_VALIDATE_EMAIL));
$config_mail_from_name = escapeSql(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_mail_from_name']));
@@ -185,7 +185,7 @@ if (isset($_POST['edit_mail_from_settings'])) {
if (isset($_POST['test_email_smtp'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$test_email = intval($_POST['test_email']);
@@ -232,7 +232,7 @@ if (isset($_POST['test_email_smtp'])) {
if (isset($_POST['test_email_imap'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider = escapeSql($config_imap_provider ?? '');
@@ -497,7 +497,7 @@ if (isset($_POST['test_email_imap'])) {
if (isset($_POST['test_oauth_token_refresh'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$provider = escapeSql($_POST['oauth_provider'] ?? '');

2
admin/post/settings_module.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_module_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_module_enable_itdoc = intval($_POST['config_module_enable_itdoc'] ?? 0);
$config_module_enable_ticketing = intval($_POST['config_module_enable_ticketing'] ?? 0);

2
admin/post/settings_notification.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_notification_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_enable_cron = intval($_POST['config_enable_cron'] ?? 0);
$config_enable_alert_domain_expire = intval($_POST['config_enable_alert_domain_expire'] ?? 0);

2
admin/post/settings_online_payment.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_online_payment_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_stripe_enable = intval($_POST['config_stripe_enable'] ?? 0);
$config_stripe_publishable = escapeSql($_POST['config_stripe_publishable']);

4
admin/post/settings_online_payment_clients.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_GET['stripe_remove_pm'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
if (!$config_stripe_enable) {
flashAlert("Stripe not enabled", 'error');
@@ -49,7 +49,7 @@ if (isset($_GET['stripe_remove_pm'])) {
if (isset($_GET['stripe_reset_customer'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$client_id = intval($_GET['client_id']);

2
admin/post/settings_project.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_project_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_project_prefix = escapeSql($_POST['config_project_prefix']);
$config_project_next_number = intval($_POST['config_project_next_number']);

2
admin/post/settings_quote.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_quote_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_quote_prefix = escapeSql($_POST['config_quote_prefix']);
$config_quote_next_number = intval($_POST['config_quote_next_number']);

2
admin/post/settings_security.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_security_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_login_message = escapeSql($_POST['config_login_message']);
$config_login_key_required = intval($_POST['config_login_key_required'] ?? 0);

2
admin/post/settings_telemetry.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_telemetry_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_telemetry = intval($_POST['config_telemetry']);

6
admin/post/settings_theme.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_theme_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$theme = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['edit_theme_settings']));
@@ -20,7 +20,7 @@ if (isset($_POST['edit_theme_settings'])) {
if (isset($_POST['edit_favicon_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Check to see if a file is attached
if (isset($_FILES['file']['tmp_name'])) {
@@ -52,7 +52,7 @@ if (isset($_POST['edit_favicon_settings'])) {
if (isset($_GET['reset_favicon'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
if (file_exists("../uploads/favicon.ico")) {
unlink("../uploads/favicon.ico");

2
admin/post/settings_ticket.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_ticket_settings'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$config_ticket_prefix = escapeSql($_POST['config_ticket_prefix']);
$config_ticket_next_number = intval($_POST['config_ticket_next_number']);

6
admin/post/software_template.php
View File

@@ -6,7 +6,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_software_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$version = escapeSql($_POST['version']);
@@ -29,7 +29,7 @@ if (isset($_POST['add_software_template'])) {
if (isset($_POST['edit_software_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$software_template_id = intval($_POST['software_template_id']);
$name = escapeSql($_POST['name']);
@@ -51,7 +51,7 @@ if (isset($_POST['edit_software_template'])) {
if (isset($_GET['delete_software_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$software_template_id = intval($_GET['delete_software_template']);

6
admin/post/tag.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_tag'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'tag_model.php';
@@ -26,7 +26,7 @@ if (isset($_POST['add_tag'])) {
if (isset($_POST['edit_tag'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'post/tag_model.php';
@@ -44,7 +44,7 @@ if (isset($_POST['edit_tag'])) {
if (isset($_GET['delete_tag'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$tag_id = intval($_GET['delete_tag']);

8
admin/post/tax.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_tax'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$percent = floatval($_POST['percent']);
@@ -27,7 +27,7 @@ if (isset($_POST['add_tax'])) {
if (isset($_POST['edit_tax'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$tax_id = intval($_POST['tax_id']);
$name = escapeSql($_POST['name']);
@@ -45,7 +45,7 @@ if (isset($_POST['edit_tax'])) {
if (isset($_GET['archive_tax'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$tax_id = intval($_GET['archive_tax']);
@@ -63,7 +63,7 @@ if (isset($_GET['archive_tax'])) {
if (isset($_GET['delete_tax'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$tax_id = intval($_GET['delete_tax']);

6
admin/post/ticket_status.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_ticket_status'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$color = escapeSql($_POST['color']);
@@ -23,7 +23,7 @@ if (isset($_POST['add_ticket_status'])) {
if (isset($_POST['edit_ticket_status'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_status_id = intval($_POST['ticket_status_id']);
$name = escapeSql($_POST['name']);
@@ -43,7 +43,7 @@ if (isset($_POST['edit_ticket_status'])) {
if (isset($_GET['delete_ticket_status'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_status_id = intval($_GET['delete_ticket_status']);

10
admin/post/ticket_template.php
View File

@@ -10,7 +10,7 @@ require_once '../agent/post/task.php';
if (isset($_POST['add_ticket_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
@@ -36,7 +36,7 @@ if (isset($_POST['add_ticket_template'])) {
if (isset($_POST['edit_ticket_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_template_id = intval($_POST['ticket_template_id']);
$name = escapeSql($_POST['name']);
@@ -56,7 +56,7 @@ if (isset($_POST['edit_ticket_template'])) {
if (isset($_GET['delete_ticket_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_template_id = intval($_GET['delete_ticket_template']);
@@ -78,7 +78,7 @@ if (isset($_GET['delete_ticket_template'])) {
if (isset($_POST['add_ticket_template_task'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_template_id = intval($_POST['ticket_template_id']);
$task_name = escapeSql($_POST['task_name']);
@@ -97,7 +97,7 @@ if (isset($_POST['add_ticket_template_task'])) {
if (isset($_GET['delete_task_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$task_template_id = intval($_GET['delete_task_template']);

4
admin/post/update.php
View File

@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_GET['update'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceAdminPermission();
@@ -286,7 +286,7 @@ if (isset($_GET['update'])) {
if (isset($_GET['update_db'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
// Get the current version
require_once ('../includes/database_version.php');

18
admin/post/users.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_user'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'user_model.php';
@@ -100,7 +100,7 @@ if (isset($_POST['add_user'])) {
if (isset($_POST['edit_user'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'user_model.php';
@@ -180,7 +180,7 @@ if (isset($_POST['edit_user'])) {
if (isset($_GET['activate_user'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$user_id = intval($_GET['activate_user']);
@@ -198,7 +198,7 @@ if (isset($_GET['activate_user'])) {
if (isset($_GET['disable_user'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$user_id = intval($_GET['disable_user']);
@@ -220,7 +220,7 @@ if (isset($_GET['disable_user'])) {
if (isset($_GET['revoke_remember_me'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$user_id = intval($_GET['revoke_remember_me']);
@@ -238,7 +238,7 @@ if (isset($_GET['revoke_remember_me'])) {
if (isset($_POST['archive_user'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$user_id = intval($_POST['user_id']);
$ticket_assign = intval($_POST['ticket_assign']);
@@ -263,7 +263,7 @@ if (isset($_POST['archive_user'])) {
if (isset($_POST['restore_user'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$user_id = intval($_POST['user_id']);
$new_password = trim($_POST['new_password']);
@@ -293,7 +293,7 @@ if (isset($_POST['restore_user'])) {
if (isset($_POST['export_users_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
//get records from database
$sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN user_roles ON user_role_id = role_id ORDER BY user_name ASC");
@@ -350,7 +350,7 @@ if (isset($_POST['ir_reset_user_password'])) {
// Incident response: allow mass reset of agent passwords
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Confirm logged-in user password, for security
$admin_password = $_POST['admin_password'];

6
admin/post/vendor_template.php
View File

@@ -9,7 +9,7 @@ require_once '../agent/post/vendor.php';
if (isset($_POST['add_vendor_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
@@ -39,7 +39,7 @@ if (isset($_POST['add_vendor_template'])) {
if (isset($_POST['edit_vendor_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$vendor_template_id = intval($_POST['vendor_template_id']);
$name = escapeSql($_POST['name']);
@@ -145,7 +145,7 @@ if (isset($_POST['edit_vendor_template'])) {
if (isset($_GET['delete_vendor_template'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$vendor_template_id = intval($_GET['delete_vendor_template']);

20
agent/ajax.php
View File

@@ -42,7 +42,7 @@ if (isset($_GET['certificate_fetch_parse_json_details'])) {
if (isset($_POST['client_set_notes'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -61,7 +61,7 @@ if (isset($_POST['client_set_notes'])) {
if (isset($_POST['contact_set_notes'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -88,7 +88,7 @@ if (isset($_POST['contact_set_notes'])) {
if (isset($_POST['asset_set_notes'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -159,7 +159,7 @@ if (isset($_GET['ticket_query_views'])) {
*/
if (isset($_GET['share_generate_link'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -587,7 +587,7 @@ if (isset($_POST['update_kanban_ticket'])) {
if (isset($_POST['update_ticket_tasks_order'])) {
// Update multiple ticket tasks order
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -609,7 +609,7 @@ if (isset($_POST['update_ticket_tasks_order'])) {
if (isset($_POST['update_task_templates_order'])) {
// Update multiple task templates order
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -630,7 +630,7 @@ if (isset($_POST['update_task_templates_order'])) {
if (isset($_POST['update_project_template_ticket_order'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -652,7 +652,7 @@ if (isset($_POST['update_project_template_ticket_order'])) {
if (isset($_POST['update_quote_items_order'])) {
// Update multiple quote items order
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -674,7 +674,7 @@ if (isset($_POST['update_quote_items_order'])) {
if (isset($_POST['update_invoice_items_order'])) {
// Update multiple invoice items order
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -696,7 +696,7 @@ if (isset($_POST['update_invoice_items_order'])) {
if (isset($_POST['update_recurring_invoice_items_order'])) {
// Update multiple recurring invoice items order
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);

8
agent/post/account.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_account'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -29,7 +29,7 @@ if (isset($_POST['add_account'])) {
if (isset($_POST['edit_account'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -49,7 +49,7 @@ if (isset($_POST['edit_account'])) {
if (isset($_GET['archive_account'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -70,7 +70,7 @@ if (isset($_GET['archive_account'])) {
// Not used anywhere?
if (isset($_GET['delete_account'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 3);

72
agent/post/asset.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -80,7 +80,7 @@ if (isset($_POST['add_asset'])) {
if (isset($_POST['edit_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -149,7 +149,7 @@ if (isset($_POST['edit_asset'])) {
if (isset($_GET['archive_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -178,7 +178,7 @@ if (isset($_GET['archive_asset'])) {
if (isset($_GET['restore_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -207,7 +207,7 @@ if (isset($_GET['restore_asset'])) {
if (isset($_GET['delete_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -233,7 +233,7 @@ if (isset($_GET['delete_asset'])) {
if (isset($_POST['bulk_assign_asset_tags'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -281,7 +281,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) {
if (isset($_POST['bulk_assign_asset_location'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -329,7 +329,7 @@ if (isset($_POST['bulk_assign_asset_location'])) {
if (isset($_POST['bulk_assign_asset_physical_location'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -369,7 +369,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) {
if (isset($_POST['bulk_transfer_client_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -459,7 +459,7 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
if (isset($_POST['bulk_assign_asset_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -504,7 +504,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) {
if (isset($_POST['bulk_edit_asset_status'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -545,7 +545,7 @@ if (isset($_POST['bulk_edit_asset_status'])) {
if (isset($_POST['bulk_favorite_assets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -583,7 +583,7 @@ if (isset($_POST['bulk_favorite_assets'])) {
if (isset($_POST['bulk_unfavorite_assets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -621,7 +621,7 @@ if (isset($_POST['bulk_unfavorite_assets'])) {
if (isset($_POST['bulk_archive_assets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -662,7 +662,7 @@ if (isset($_POST['bulk_archive_assets'])) {
if (isset($_POST['bulk_restore_assets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -704,7 +704,7 @@ if (isset($_POST['bulk_restore_assets'])) {
if (isset($_POST['bulk_delete_assets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -742,7 +742,7 @@ if (isset($_POST['bulk_delete_assets'])) {
if (isset($_POST['link_software_to_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -772,7 +772,7 @@ if (isset($_POST['link_software_to_asset'])) {
if (isset($_GET['unlink_software_from_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -803,7 +803,7 @@ if (isset($_GET['unlink_software_from_asset'])) {
// Right now 1 login and have many assets but not many to many
if (isset($_POST['link_asset_to_credential'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -833,7 +833,7 @@ if (isset($_POST['link_asset_to_credential'])) {
if (isset($_GET['unlink_credential_from_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -863,7 +863,7 @@ if (isset($_GET['unlink_credential_from_asset'])) {
if (isset($_POST['link_service_to_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -893,7 +893,7 @@ if (isset($_POST['link_service_to_asset'])) {
if (isset($_GET['unlink_service_from_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -923,7 +923,7 @@ if (isset($_GET['unlink_service_from_asset'])) {
if (isset($_POST['link_asset_to_file'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -954,7 +954,7 @@ if (isset($_POST['link_asset_to_file'])) {
if (isset($_GET['unlink_asset_from_file'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -987,7 +987,7 @@ if (isset($_GET['unlink_asset_from_file'])) {
if (isset($_POST["import_assets_csv"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1190,7 +1190,7 @@ if (isset($_GET['download_assets_csv_template'])) {
if (isset($_POST['export_assets_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support');
@@ -1253,7 +1253,7 @@ if (isset($_POST['add_asset_interface'])) {
// 1) Permissions & CSRF
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1328,7 +1328,7 @@ if (isset($_POST['add_asset_interface'])) {
if (isset($_POST['add_asset_multiple_interfaces'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1375,7 +1375,7 @@ if (isset($_POST['add_asset_multiple_interfaces'])) {
if (isset($_POST['edit_asset_interface'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1456,7 +1456,7 @@ if (isset($_POST['edit_asset_interface'])) {
if (isset($_GET['delete_asset_interface'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1501,7 +1501,7 @@ if (isset($_GET['delete_asset_interface'])) {
if (isset($_POST['bulk_edit_asset_interface_type'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1547,7 +1547,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) {
if (isset($_POST['bulk_edit_asset_interface_network'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1595,7 +1595,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) {
if (isset($_POST['bulk_edit_asset_interface_ip_dhcp'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1639,7 +1639,7 @@ if (isset($_POST['bulk_edit_asset_interface_ip_dhcp'])) {
if (isset($_POST['bulk_delete_asset_interfaces'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1682,7 +1682,7 @@ if (isset($_POST['bulk_delete_asset_interfaces'])) {
if (isset($_POST["import_client_asset_interfaces_csv"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1837,7 +1837,7 @@ if (isset($_GET['download_client_asset_interfaces_csv_template'])) {
if (isset($_POST['export_client_asset_interfaces_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support');

2
agent/post/category.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'category_model.php';

18
agent/post/certificate.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_certificate'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -48,7 +48,7 @@ if (isset($_POST['add_certificate'])) {
if (isset($_POST['edit_certificate'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -121,7 +121,7 @@ if (isset($_POST['edit_certificate'])) {
if (isset($_GET['refresh_certificate'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -161,7 +161,7 @@ if (isset($_GET['refresh_certificate'])) {
if (isset($_GET['archive_certificate'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -187,7 +187,7 @@ if (isset($_GET['archive_certificate'])) {
if (isset($_GET['restore_certificate'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -213,7 +213,7 @@ if (isset($_GET['restore_certificate'])) {
if (isset($_GET['delete_certificate'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -239,7 +239,7 @@ if (isset($_GET['delete_certificate'])) {
if (isset($_POST['bulk_refresh_certificates'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -300,7 +300,7 @@ if (isset($_POST['bulk_refresh_certificates'])) {
if (isset($_POST['bulk_delete_certificates'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -340,7 +340,7 @@ if (isset($_POST['bulk_delete_certificates'])) {
if (isset($_POST['export_certificates_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support');

34
agent/post/client.php
View File

@@ -10,7 +10,7 @@ if (isset($_POST['add_client'])) {
// JQ - Using Prepared MySQLi Statements here for show this is not our standard and is only used in the client add/edit POST.
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -254,7 +254,7 @@ if (isset($_POST['add_client'])) {
if (isset($_POST['edit_client'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -332,7 +332,7 @@ if (isset($_POST['edit_client'])) {
if (isset($_GET['archive_client'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -362,7 +362,7 @@ if (isset($_GET['archive_client'])) {
if (isset($_GET['restore_client'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -383,7 +383,7 @@ if (isset($_GET['restore_client'])) {
if (isset($_GET['delete_client'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -485,7 +485,7 @@ if (isset($_GET['delete_client'])) {
if (isset($_POST['export_clients_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 1);
@@ -537,7 +537,7 @@ if (isset($_POST['export_clients_csv'])) {
if (isset($_POST["import_clients_csv"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
$error = false;
@@ -773,7 +773,7 @@ if (isset($_GET['download_clients_csv_template'])) {
if (isset($_POST['bulk_add_client_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -885,7 +885,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
if (isset($_POST['bulk_edit_client_industry'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -919,7 +919,7 @@ if (isset($_POST['bulk_edit_client_industry'])) {
if (isset($_POST['bulk_edit_client_referral'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -953,7 +953,7 @@ if (isset($_POST['bulk_edit_client_referral'])) {
if (isset($_POST['bulk_edit_client_hourly_rate'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -987,7 +987,7 @@ if (isset($_POST['bulk_edit_client_hourly_rate'])) {
if (isset($_POST['bulk_edit_client_net_terms'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1021,7 +1021,7 @@ if (isset($_POST['bulk_edit_client_net_terms'])) {
if (isset($_POST['bulk_assign_client_tags'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1066,7 +1066,7 @@ if (isset($_POST['bulk_assign_client_tags'])) {
if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 1);
@@ -1155,7 +1155,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
if (isset($_POST['bulk_archive_clients'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1191,7 +1191,7 @@ if (isset($_POST['bulk_archive_clients'])) {
if (isset($_POST['bulk_unarchive_clients'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1225,7 +1225,7 @@ if (isset($_POST['bulk_unarchive_clients'])) {
if (isset($_POST["export_client_pdf"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Enforce permissions
enforceUserPermission("module_client", 3);

62
agent/post/contact.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -84,7 +84,7 @@ if (isset($_POST['add_contact'])) {
if (isset($_POST['edit_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -229,7 +229,7 @@ if (isset($_POST['edit_contact'])) {
if (isset($_POST['add_contact_note'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -260,7 +260,7 @@ if (isset($_POST['add_contact_note'])) {
if (isset($_GET['archive_contact_note'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -288,7 +288,7 @@ if (isset($_GET['archive_contact_note'])) {
if (isset($_GET['restore_contact_note'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -316,7 +316,7 @@ if (isset($_GET['restore_contact_note'])) {
if (isset($_GET['delete_contact_note'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -344,7 +344,7 @@ if (isset($_GET['delete_contact_note'])) {
if (isset($_POST['bulk_assign_contact_location'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -389,7 +389,7 @@ if (isset($_POST['bulk_assign_contact_location'])) {
if (isset($_POST['bulk_edit_contact_phone'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -429,7 +429,7 @@ if (isset($_POST['bulk_edit_contact_phone'])) {
if (isset($_POST['bulk_edit_contact_department'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -469,7 +469,7 @@ if (isset($_POST['bulk_edit_contact_department'])) {
if (isset($_POST['bulk_edit_contact_role'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -513,7 +513,7 @@ if (isset($_POST['bulk_edit_contact_role'])) {
if (isset($_POST['bulk_assign_contact_tags'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -566,7 +566,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) {
if (isset($_POST['send_bulk_mail_now'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client');
@@ -617,7 +617,7 @@ if (isset($_POST['send_bulk_mail_now'])) {
if (isset($_POST['bulk_archive_contacts'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -668,7 +668,7 @@ if (isset($_POST['bulk_archive_contacts'])) {
if (isset($_POST['bulk_restore_contacts'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -713,7 +713,7 @@ if (isset($_POST['bulk_restore_contacts'])) {
if (isset($_POST['bulk_delete_contacts'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -759,7 +759,7 @@ if (isset($_POST['bulk_delete_contacts'])) {
if (isset($_GET['anonymize_contact'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -867,7 +867,7 @@ if (isset($_GET['anonymize_contact'])) {
if (isset($_GET['archive_contact'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -899,7 +899,7 @@ if (isset($_GET['archive_contact'])) {
if (isset($_GET['restore_contact'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -931,7 +931,7 @@ if (isset($_GET['restore_contact'])) {
if (isset($_GET['delete_contact'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -963,7 +963,7 @@ if (isset($_GET['delete_contact'])) {
if (isset($_POST['link_contact_to_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -993,7 +993,7 @@ if (isset($_POST['link_contact_to_asset'])) {
if (isset($_GET['unlink_asset_from_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1023,7 +1023,7 @@ if (isset($_GET['unlink_asset_from_contact'])) {
if (isset($_POST['link_software_to_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1053,7 +1053,7 @@ if (isset($_POST['link_software_to_contact'])) {
if (isset($_GET['unlink_software_from_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1083,7 +1083,7 @@ if (isset($_GET['unlink_software_from_contact'])) {
if (isset($_POST['link_contact_to_credential'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1113,7 +1113,7 @@ if (isset($_POST['link_contact_to_credential'])) {
if (isset($_GET['unlink_credential_from_contact'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1143,7 +1143,7 @@ if (isset($_GET['unlink_credential_from_contact'])) {
if (isset($_POST['link_service_to_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1173,7 +1173,7 @@ if (isset($_POST['link_service_to_contact'])) {
if (isset($_GET['unlink_service_from_contact'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1203,7 +1203,7 @@ if (isset($_GET['unlink_service_from_contact'])) {
if (isset($_POST['link_contact_to_file'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1234,7 +1234,7 @@ if (isset($_POST['link_contact_to_file'])) {
if (isset($_GET['unlink_contact_from_file'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -1264,7 +1264,7 @@ if (isset($_GET['unlink_contact_from_file'])) {
if (isset($_POST['export_contacts_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client');
@@ -1322,7 +1322,7 @@ if (isset($_POST['export_contacts_csv'])) {
if (isset($_POST["import_contacts_csv"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);

26
agent/post/credential.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_credential'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -40,7 +40,7 @@ if (isset($_POST['add_credential'])) {
if (isset($_POST['edit_credential'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -85,7 +85,7 @@ if (isset($_POST['edit_credential'])) {
if(isset($_GET['archive_credential'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -111,7 +111,7 @@ if(isset($_GET['archive_credential'])){
if(isset($_GET['restore_credential'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -137,7 +137,7 @@ if(isset($_GET['restore_credential'])){
if (isset($_GET['delete_credential'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 3);
@@ -163,7 +163,7 @@ if (isset($_GET['delete_credential'])) {
if (isset($_POST['bulk_assign_credential_tags'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -217,7 +217,7 @@ if (isset($_POST['bulk_assign_credential_tags'])) {
if (isset($_POST['bulk_favorite_credentials'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -255,7 +255,7 @@ if (isset($_POST['bulk_favorite_credentials'])) {
if (isset($_POST['bulk_unfavorite_credentials'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -293,7 +293,7 @@ if (isset($_POST['bulk_unfavorite_credentials'])) {
if (isset($_POST['bulk_archive_credentials'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -332,7 +332,7 @@ if (isset($_POST['bulk_archive_credentials'])) {
if (isset($_POST['bulk_restore_credentials'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);
@@ -372,7 +372,7 @@ if (isset($_POST['bulk_restore_credentials'])) {
if (isset($_POST['bulk_delete_credentials'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 3);
@@ -412,7 +412,7 @@ if (isset($_POST['bulk_delete_credentials'])) {
if (isset($_POST['export_credentials_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential');
@@ -472,7 +472,7 @@ if (isset($_POST['export_credentials_csv'])) {
if (isset($_POST["import_credentials_csv"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_credential', 2);

2
agent/post/credit.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_credit'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);

44
agent/post/document.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -55,7 +55,7 @@ if (isset($_POST['add_document'])) {
if (isset($_POST['add_document_from_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -139,7 +139,7 @@ if (isset($_POST['add_document_from_template'])) {
if (isset($_POST['edit_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -244,7 +244,7 @@ if (isset($_POST['edit_document'])) {
if (isset($_POST['move_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -277,7 +277,7 @@ if (isset($_POST['move_document'])) {
if (isset($_POST['rename_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -307,7 +307,7 @@ if (isset($_POST['rename_document'])) {
if (isset($_POST['bulk_move_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -349,7 +349,7 @@ if (isset($_POST['bulk_move_document'])) {
if (isset($_POST['link_file_to_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -380,7 +380,7 @@ if (isset($_POST['link_file_to_document'])) {
if (isset($_GET['unlink_file_from_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -410,7 +410,7 @@ if (isset($_GET['unlink_file_from_document'])) {
if (isset($_POST['link_vendor_to_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -441,7 +441,7 @@ if (isset($_POST['link_vendor_to_document'])) {
if (isset($_GET['unlink_vendor_from_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -471,7 +471,7 @@ if (isset($_GET['unlink_vendor_from_document'])) {
if (isset($_POST['link_contact_to_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -503,7 +503,7 @@ if (isset($_POST['link_contact_to_document'])) {
if (isset($_GET['unlink_contact_from_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -533,7 +533,7 @@ if (isset($_GET['unlink_contact_from_document'])) {
if (isset($_POST['link_asset_to_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -563,7 +563,7 @@ if (isset($_POST['link_asset_to_document'])) {
if (isset($_GET['unlink_asset_from_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -593,7 +593,7 @@ if (isset($_GET['unlink_asset_from_document'])) {
if (isset($_POST['link_software_to_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -624,7 +624,7 @@ if (isset($_POST['link_software_to_document'])) {
if (isset($_GET['unlink_software_from_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -654,7 +654,7 @@ if (isset($_GET['unlink_software_from_document'])) {
if (isset($_POST['toggle_document_visibility'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -687,7 +687,7 @@ if (isset($_POST['toggle_document_visibility'])) {
if (isset($_GET['export_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -735,7 +735,7 @@ if (isset($_GET['export_document'])) {
if (isset($_GET['archive_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -780,7 +780,7 @@ if (isset($_GET['archive_document'])) {
if (isset($_GET['restore_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -806,7 +806,7 @@ if (isset($_GET['restore_document'])) {
if (isset($_GET['delete_document_version'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -832,7 +832,7 @@ if (isset($_GET['delete_document_version'])) {
if (isset($_GET['delete_document'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);

22
agent/post/domain.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_domain'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -66,7 +66,7 @@ if (isset($_POST['add_domain'])) {
if (isset($_POST['edit_domain'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -158,7 +158,7 @@ if (isset($_POST['edit_domain'])) {
if (isset($_GET['refresh_domain'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -200,7 +200,7 @@ if (isset($_GET['refresh_domain'])) {
if (isset($_GET['archive_domain'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -226,7 +226,7 @@ if (isset($_GET['archive_domain'])) {
if(isset($_GET['restore_domain'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -252,7 +252,7 @@ if(isset($_GET['restore_domain'])){
if (isset($_GET['delete_domain'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -278,7 +278,7 @@ if (isset($_GET['delete_domain'])) {
if (isset($_POST['bulk_archive_domains'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -317,7 +317,7 @@ if (isset($_POST['bulk_archive_domains'])) {
if (isset($_POST['bulk_restore_domains'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -357,7 +357,7 @@ if (isset($_POST['bulk_restore_domains'])) {
if (isset($_POST['bulk_delete_domains'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -396,7 +396,7 @@ if (isset($_POST['bulk_delete_domains'])) {
if (isset($_POST['bulk_refresh_domains'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -457,7 +457,7 @@ if (isset($_POST['bulk_refresh_domains'])) {
if (isset($_POST['export_domains_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support');

12
agent/post/event.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_calendar'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$color = escapeSql($_POST['color']);
@@ -27,7 +27,7 @@ if (isset($_POST['add_calendar'])) {
if (isset($_POST['edit_calendar'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$calendar_id = intval($_POST['calendar_id']);
$name = escapeSql($_POST['name']);
@@ -45,7 +45,7 @@ if (isset($_POST['edit_calendar'])) {
if (isset($_GET['delete_calendar'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$calendar_id = intval($_GET['delete_calendar']);
@@ -70,7 +70,7 @@ if (isset($_GET['delete_calendar'])) {
if (isset($_POST['add_event'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'event_model.php';
@@ -147,7 +147,7 @@ if (isset($_POST['add_event'])) {
if (isset($_POST['edit_event'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'event_model.php';
@@ -221,7 +221,7 @@ if (isset($_POST['edit_event'])) {
if (isset($_GET['delete_event'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$event_id = intval($_GET['delete_event']);

16
agent/post/expense.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_expense'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -51,7 +51,7 @@ if (isset($_POST['add_expense'])) {
if (isset($_POST['edit_expense'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -98,7 +98,7 @@ if (isset($_POST['edit_expense'])) {
if (isset($_GET['delete_expense'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 3);
@@ -128,7 +128,7 @@ if (isset($_GET['delete_expense'])) {
if (isset($_POST['bulk_edit_expense_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -173,7 +173,7 @@ if (isset($_POST['bulk_edit_expense_category'])) {
if (isset($_POST['bulk_edit_expense_account'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -218,7 +218,7 @@ if (isset($_POST['bulk_edit_expense_account'])) {
if (isset($_POST['bulk_edit_expense_client'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -256,7 +256,7 @@ if (isset($_POST['bulk_edit_expense_client'])) {
if (isset($_POST['bulk_delete_expenses'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 3);
@@ -300,7 +300,7 @@ if (isset($_POST['bulk_delete_expenses'])) {
if (isset($_POST['export_expenses_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial');

24
agent/post/file.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['upload_files'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -105,7 +105,7 @@ if (isset($_POST['upload_files'])) {
if (isset($_POST['rename_file'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -134,7 +134,7 @@ if (isset($_POST['rename_file'])) {
if (isset($_POST['move_file'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -164,7 +164,7 @@ if (isset($_POST['move_file'])) {
if (isset($_GET['archive_file'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -190,7 +190,7 @@ if (isset($_GET['archive_file'])) {
if (isset($_GET['restore_file'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -216,7 +216,7 @@ if (isset($_GET['restore_file'])) {
if (isset($_POST['delete_file'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -253,7 +253,7 @@ if (isset($_POST['delete_file'])) {
if (isset($_POST['bulk_archive_files'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -316,7 +316,7 @@ if (isset($_POST['bulk_archive_files'])) {
if (isset($_POST['bulk_delete_files'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -397,7 +397,7 @@ if (isset($_POST['bulk_delete_files'])) {
if (isset($_POST['bulk_restore_files'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -461,7 +461,7 @@ if (isset($_POST['bulk_restore_files'])) {
// Unified bulk move for Files + Documents
if (isset($_POST['bulk_move_files'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -578,7 +578,7 @@ if (isset($_POST['bulk_move_files'])) {
if (isset($_POST['link_asset_to_file'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -609,7 +609,7 @@ if (isset($_POST['link_asset_to_file'])) {
if (isset($_GET['unlink_asset_from_file'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

6
agent/post/folder.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['create_folder'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -33,7 +33,7 @@ if (isset($_POST['create_folder'])) {
if (isset($_POST['rename_folder'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -61,7 +61,7 @@ if (isset($_POST['rename_folder'])) {
if (isset($_GET['delete_folder'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);

36
agent/post/invoice.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_invoice'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -55,7 +55,7 @@ if (isset($_POST['add_invoice'])) {
if (isset($_POST['edit_invoice'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -95,7 +95,7 @@ if (isset($_POST['edit_invoice'])) {
if (isset($_POST['add_invoice_copy'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -166,7 +166,7 @@ if (isset($_POST['add_invoice_copy'])) {
if (isset($_GET['mark_invoice_sent'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -195,7 +195,7 @@ if (isset($_GET['mark_invoice_sent'])) {
if (isset($_GET['mark_invoice_non-billable'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -224,7 +224,7 @@ if (isset($_GET['mark_invoice_non-billable'])) {
if (isset($_GET['cancel_invoice'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -253,7 +253,7 @@ if (isset($_GET['cancel_invoice'])) {
if (isset($_GET['delete_invoice'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);
@@ -304,7 +304,7 @@ if (isset($_GET['delete_invoice'])) {
if (isset($_POST['add_invoice_item'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -392,7 +392,7 @@ if (isset($_POST['add_invoice_item'])) {
if (isset($_POST['invoice_note'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -420,7 +420,7 @@ if (isset($_POST['invoice_note'])) {
if (isset($_POST['edit_invoice_item'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -479,7 +479,7 @@ if (isset($_POST['edit_invoice_item'])) {
if (isset($_GET['delete_invoice_item'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -524,7 +524,7 @@ if (isset($_GET['delete_invoice_item'])) {
if (isset($_GET['email_invoice'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -652,7 +652,7 @@ if (isset($_GET['email_invoice'])) {
if (isset($_POST['export_invoices_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales');
@@ -720,7 +720,7 @@ if (isset($_POST['export_invoices_csv'])) {
if (isset($_POST['link_invoice_to_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -741,7 +741,7 @@ if (isset($_POST['link_invoice_to_ticket'])) {
if (isset($_POST['add_ticket_to_invoice'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -762,7 +762,7 @@ if (isset($_POST['add_ticket_to_invoice'])) {
if (isset($_GET['export_invoice_pdf'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales');
@@ -991,7 +991,7 @@ if (isset($_GET['export_invoice_pdf'])) {
if (isset($_GET['export_invoice_packing_slip'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales');
@@ -1138,7 +1138,7 @@ if (isset($_GET['export_invoice_packing_slip'])) {
if (isset($_POST['bulk_edit_invoice_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);

22
agent/post/location.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if(isset($_POST['add_location'])){
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -66,7 +66,7 @@ if(isset($_POST['add_location'])){
if(isset($_POST['edit_location'])){
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -133,7 +133,7 @@ if(isset($_POST['edit_location'])){
if(isset($_GET['archive_location'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -159,7 +159,7 @@ if(isset($_GET['archive_location'])){
if(isset($_GET['restore_location'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -185,7 +185,7 @@ if(isset($_GET['restore_location'])){
if(isset($_GET['delete_location'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -211,7 +211,7 @@ if(isset($_GET['delete_location'])){
if (isset($_POST['bulk_assign_location_tags'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -265,7 +265,7 @@ if (isset($_POST['bulk_assign_location_tags'])) {
if (isset($_POST['bulk_archive_locations'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -310,7 +310,7 @@ if (isset($_POST['bulk_archive_locations'])) {
if (isset($_POST['bulk_restore_locations'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);
@@ -350,7 +350,7 @@ if (isset($_POST['bulk_restore_locations'])) {
if (isset($_POST['bulk_delete_locations'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 3);
@@ -390,7 +390,7 @@ if (isset($_POST['bulk_delete_locations'])) {
if(isset($_POST['export_locations_csv'])){
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client');
@@ -448,7 +448,7 @@ if(isset($_POST['export_locations_csv'])){
if (isset($_POST["import_locations_csv"])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_client', 2);

16
agent/post/network.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_network'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -32,7 +32,7 @@ if (isset($_POST['add_network'])) {
if (isset($_POST['edit_network'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -56,7 +56,7 @@ if (isset($_POST['edit_network'])) {
if (isset($_GET['archive_network'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -82,7 +82,7 @@ if (isset($_GET['archive_network'])) {
if (isset($_GET['restore_network'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -108,7 +108,7 @@ if (isset($_GET['restore_network'])) {
if (isset($_GET['delete_network'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -134,7 +134,7 @@ if (isset($_GET['delete_network'])) {
if (isset($_POST['bulk_delete_networks'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -174,7 +174,7 @@ if (isset($_POST['bulk_delete_networks'])) {
if (isset($_POST['export_networks_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support');
@@ -271,7 +271,7 @@ if (isset($_GET['download_networks_csv_template'])) {
// ----------------------------------------------------------
if (isset($_POST['import_networks_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

14
agent/post/payment.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_payment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
enforceUserPermission('module_financial', 2);
@@ -178,7 +178,7 @@ if (isset($_POST['add_payment'])) {
if (isset($_POST['edit_payment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);
enforceUserPermission('module_financial', 3);
@@ -209,7 +209,7 @@ Apply Credit Not ready for use 2025-08-27 - JQ
if (isset($_POST['apply_credit'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
enforceUserPermission('module_financial', 2);
@@ -319,7 +319,7 @@ if (isset($_POST['apply_credit'])) {
if (isset($_POST['add_payment_stripe'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
enforceUserPermission('module_financial', 2);
@@ -506,7 +506,7 @@ if (isset($_POST['add_payment_stripe'])) {
if (isset($_POST['add_bulk_payment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
enforceUserPermission('module_financial', 2);
@@ -642,7 +642,7 @@ if (isset($_POST['add_bulk_payment'])) {
if (isset($_GET['delete_payment'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
enforceUserPermission('module_financial', 2);
@@ -700,7 +700,7 @@ if (isset($_GET['delete_payment'])) {
if (isset($_POST['export_payments_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial');

22
agent/post/product.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_product'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -29,7 +29,7 @@ if (isset($_POST['add_product'])) {
if (isset($_POST['edit_product'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -49,7 +49,7 @@ if (isset($_POST['edit_product'])) {
if (isset($_GET['archive_product'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -69,7 +69,7 @@ if (isset($_GET['archive_product'])) {
if (isset($_GET['restore_product'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -89,7 +89,7 @@ if (isset($_GET['restore_product'])) {
if (isset($_GET['delete_product'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);
@@ -110,7 +110,7 @@ if (isset($_GET['delete_product'])) {
if (isset($_POST['bulk_edit_product_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -148,7 +148,7 @@ if (isset($_POST['bulk_edit_product_category'])) {
if (isset($_POST['bulk_archive_products'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -180,7 +180,7 @@ if (isset($_POST['bulk_archive_products'])) {
if (isset($_POST['bulk_restore_products'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -213,7 +213,7 @@ if (isset($_POST['bulk_restore_products'])) {
if (isset($_POST['bulk_delete_products'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);
@@ -246,7 +246,7 @@ if (isset($_POST['bulk_delete_products'])) {
if (isset($_POST['export_products_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
//get records from database
$sql = mysqli_query($mysqli,"SELECT * FROM products
@@ -295,7 +295,7 @@ if (isset($_POST['export_products_csv'])) {
if (isset($_POST['add_product_stock'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);

16
agent/post/project.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_project'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -96,7 +96,7 @@ if (isset($_POST['add_project'])) {
if (isset($_POST['edit_project'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -125,7 +125,7 @@ if (isset($_POST['edit_project'])) {
if (isset($_GET['close_project'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -154,7 +154,7 @@ if (isset($_GET['close_project'])) {
if (isset($_GET['archive_project'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -183,7 +183,7 @@ if (isset($_GET['archive_project'])) {
if (isset($_GET['restore_project'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -212,7 +212,7 @@ if (isset($_GET['restore_project'])) {
if (isset($_GET['delete_project'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -241,7 +241,7 @@ if (isset($_GET['delete_project'])) {
if (isset($_POST['link_ticket_to_project'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -291,7 +291,7 @@ if (isset($_POST['link_ticket_to_project'])) {
if (isset($_POST['link_closed_ticket_to_project'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

32
agent/post/quote.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_quote'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -50,7 +50,7 @@ if (isset($_POST['add_quote'])) {
if (isset($_POST['add_quote_copy'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -127,7 +127,7 @@ if (isset($_POST['add_quote_copy'])) {
if (isset($_POST['add_quote_to_invoice'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -220,7 +220,7 @@ if (isset($_POST['add_quote_to_invoice'])) {
if (isset($_POST['add_quote_item'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -280,7 +280,7 @@ if (isset($_POST['add_quote_item'])) {
if (isset($_POST['edit_quote_item'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -339,7 +339,7 @@ if (isset($_POST['edit_quote_item'])) {
if (isset($_POST['quote_note'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -367,7 +367,7 @@ if (isset($_POST['quote_note'])) {
if (isset($_POST['edit_quote'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -405,7 +405,7 @@ if (isset($_POST['edit_quote'])) {
if (isset($_GET['delete_quote'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);
@@ -451,7 +451,7 @@ if (isset($_GET['delete_quote'])) {
if (isset($_GET['delete_quote_item'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -489,7 +489,7 @@ if (isset($_GET['delete_quote_item'])) {
if (isset($_GET['mark_quote_sent'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -517,7 +517,7 @@ if (isset($_GET['mark_quote_sent'])) {
if (isset($_GET['accept_quote'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -547,7 +547,7 @@ if (isset($_GET['accept_quote'])) {
if (isset($_GET['decline_quote'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -577,7 +577,7 @@ if (isset($_GET['decline_quote'])) {
if (isset($_GET['email_quote'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -659,7 +659,7 @@ if (isset($_GET['email_quote'])) {
if (isset($_GET['mark_quote_invoiced'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -687,7 +687,7 @@ if (isset($_GET['mark_quote_invoiced'])) {
if(isset($_POST['export_quotes_csv'])){
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales');
@@ -748,7 +748,7 @@ if(isset($_POST['export_quotes_csv'])){
if (isset($_GET['export_quote_pdf'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales');

16
agent/post/rack.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_rack'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -55,7 +55,7 @@ if (isset($_POST['add_rack'])) {
if (isset($_POST['edit_rack'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -102,7 +102,7 @@ if (isset($_POST['edit_rack'])) {
if (isset($_GET['archive_rack'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -128,7 +128,7 @@ if (isset($_GET['archive_rack'])) {
if (isset($_GET['restore_rack'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -154,7 +154,7 @@ if (isset($_GET['restore_rack'])) {
if (isset($_GET['delete_rack'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -186,7 +186,7 @@ if (isset($_GET['delete_rack'])) {
if (isset($_POST['add_rack_unit'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -234,7 +234,7 @@ if (isset($_POST['add_rack_unit'])) {
if (isset($_POST['edit_rack_unit'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -265,7 +265,7 @@ if (isset($_POST['edit_rack_unit'])) {
if (isset($_GET['remove_rack_unit'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

6
agent/post/recurring_expense.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['create_recurring_expense'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -43,7 +43,7 @@ if (isset($_POST['create_recurring_expense'])) {
if (isset($_POST['edit_recurring_expense'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -77,7 +77,7 @@ if (isset($_POST['edit_recurring_expense'])) {
if (isset($_GET['delete_recurring_expense'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);

24
agent/post/recurring_invoice.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_invoice_recurring'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -72,7 +72,7 @@ if (isset($_POST['add_invoice_recurring'])) {
if (isset($_POST['add_recurring_invoice'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -111,7 +111,7 @@ if (isset($_POST['add_recurring_invoice'])) {
if (isset($_POST['edit_recurring_invoice'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -155,7 +155,7 @@ if (isset($_POST['edit_recurring_invoice'])) {
if (isset($_GET['delete_recurring_invoice'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);
@@ -197,7 +197,7 @@ if (isset($_GET['delete_recurring_invoice'])) {
if (isset($_POST['add_recurring_invoice_item'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -257,7 +257,7 @@ if (isset($_POST['add_recurring_invoice_item'])) {
if (isset($_POST['edit_recurring_invoice_item'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -317,7 +317,7 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
if (isset($_POST['recurring_invoice_note'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -345,7 +345,7 @@ if (isset($_POST['recurring_invoice_note'])) {
if (isset($_GET['delete_recurring_invoice_item'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -383,7 +383,7 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
if (isset($_GET['force_recurring'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -550,7 +550,7 @@ if (isset($_GET['force_recurring'])) {
if (isset($_POST['set_recurring_payment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -607,7 +607,7 @@ if (isset($_POST['set_recurring_payment'])) {
if (isset($_POST['export_client_recurring_invoice_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales');
@@ -661,7 +661,7 @@ if (isset($_POST['export_client_recurring_invoice_csv'])) {
if (isset($_GET['recurring_invoice_email_notify'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);

22
agent/post/recurring_ticket.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_recurring_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -42,7 +42,7 @@ if (isset($_POST['add_recurring_ticket'])) {
if (isset($_POST['edit_recurring_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -76,7 +76,7 @@ if (isset($_POST['edit_recurring_ticket'])) {
if (isset($_POST['bulk_force_recurring_tickets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -220,7 +220,7 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
if (isset($_GET['force_recurring_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -360,7 +360,7 @@ if (isset($_GET['force_recurring_ticket'])) {
if (isset($_GET['delete_recurring_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -388,7 +388,7 @@ if (isset($_GET['delete_recurring_ticket'])) {
if (isset($_POST['bulk_delete_recurring_tickets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -427,7 +427,7 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) {
if (isset($_POST['bulk_assign_recurring_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -519,7 +519,7 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -562,7 +562,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
if (isset($_POST['bulk_edit_recurring_ticket_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -604,7 +604,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_category'])) {
if (isset($_POST['bulk_edit_recurring_ticket_billable'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
enforceUserPermission('module_sales', 2);
@@ -655,7 +655,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_billable'])) {
if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

6
agent/post/revenue.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_revenue'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -34,7 +34,7 @@ if (isset($_POST['add_revenue'])) {
if (isset($_POST['edit_revenue'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 2);
@@ -59,7 +59,7 @@ if (isset($_POST['edit_revenue'])) {
if (isset($_GET['delete_revenue'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_sales', 3);

6
agent/post/service.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_service'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -88,7 +88,7 @@ if (isset($_POST['add_service'])) {
if (isset($_POST['edit_service'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -176,7 +176,7 @@ if (isset($_POST['edit_service'])) {
if (isset($_GET['delete_service'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);

12
agent/post/software.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_software_from_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -44,7 +44,7 @@ if (isset($_POST['add_software_from_template'])) {
if (isset($_POST['add_software'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -107,7 +107,7 @@ if (isset($_POST['add_software'])) {
if (isset($_POST['edit_software'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -171,7 +171,7 @@ if (isset($_POST['edit_software'])) {
if (isset($_GET['archive_software'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -201,7 +201,7 @@ if (isset($_GET['archive_software'])) {
if (isset($_GET['delete_software'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -227,7 +227,7 @@ if (isset($_GET['delete_software'])) {
if (isset($_POST['export_software_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support');

2
agent/post/tag.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_tag'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'tag_model.php';

22
agent/post/task.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_task'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -32,7 +32,7 @@ if (isset($_POST['add_task'])) {
if (isset($_POST['edit_ticket_task'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -58,7 +58,7 @@ if (isset($_POST['edit_ticket_task'])) {
if (isset($_POST['edit_ticket_template_task'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -79,7 +79,7 @@ if (isset($_POST['edit_ticket_template_task'])) {
if (isset($_GET['delete_task'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -103,7 +103,7 @@ if (isset($_GET['delete_task'])) {
if (isset($_GET['complete_task'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -137,7 +137,7 @@ if (isset($_GET['complete_task'])) {
if (isset($_GET['undo_complete_task'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -167,7 +167,7 @@ if (isset($_GET['undo_complete_task'])) {
if (isset($_POST['add_ticket_task_approver'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -341,7 +341,7 @@ if (isset($_POST['add_ticket_task_approver'])) {
if (isset($_GET['approve_ticket_task'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -392,7 +392,7 @@ if (isset($_GET['approve_ticket_task'])) {
if (isset($_GET['delete_ticket_task_approver'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -410,7 +410,7 @@ if (isset($_GET['delete_ticket_task_approver'])) {
if (isset($_GET['complete_all_tasks'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -436,7 +436,7 @@ if (isset($_GET['complete_all_tasks'])) {
if (isset($_GET['undo_complete_all_tasks'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

72
agent/post/ticket.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -198,7 +198,7 @@ if (isset($_POST['add_ticket'])) {
if (isset($_POST['edit_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -316,7 +316,7 @@ if (isset($_POST['edit_ticket'])) {
if (isset($_POST['edit_ticket_priority'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -359,7 +359,7 @@ if (isset($_POST['edit_ticket_priority'])) {
if (isset($_POST['edit_ticket_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -450,7 +450,7 @@ if (isset($_POST['edit_ticket_contact'])) {
if (isset($_POST['edit_ticket_project'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -479,7 +479,7 @@ if (isset($_POST['edit_ticket_project'])) {
if (isset($_POST['add_ticket_watcher'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -564,7 +564,7 @@ if (isset($_POST['add_ticket_watcher'])) {
if (isset($_GET['delete_ticket_watcher'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -605,7 +605,7 @@ if (isset($_GET['delete_ticket_watcher'])) {
if (isset($_GET['delete_ticket_additional_asset'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -646,7 +646,7 @@ if (isset($_GET['delete_ticket_additional_asset'])) {
if (isset($_POST['edit_ticket_asset'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -699,7 +699,7 @@ if (isset($_POST['edit_ticket_asset'])) {
if (isset($_POST['edit_ticket_vendor'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -739,7 +739,7 @@ if (isset($_POST['edit_ticket_vendor'])) {
if (isset($_POST['assign_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -848,7 +848,7 @@ if (isset($_POST['assign_ticket'])) {
if (isset($_GET['delete_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -900,7 +900,7 @@ if (isset($_GET['delete_ticket'])) {
if (isset($_POST['bulk_delete_tickets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 3);
@@ -952,7 +952,7 @@ if (isset($_POST['bulk_delete_tickets'])) {
if (isset($_POST['bulk_assign_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1059,7 +1059,7 @@ if (isset($_POST['bulk_assign_ticket'])) {
if (isset($_POST['bulk_edit_ticket_priority'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1110,7 +1110,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) {
if (isset($_POST['bulk_edit_ticket_category'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1162,7 +1162,7 @@ if (isset($_POST['bulk_edit_ticket_category'])) {
if (isset($_POST['bulk_merge_tickets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1236,7 +1236,7 @@ if (isset($_POST['bulk_merge_tickets'])) {
if (isset($_POST['bulk_resolve_tickets'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1380,7 +1380,7 @@ if (isset($_POST['bulk_resolve_tickets'])) {
if (isset($_POST['bulk_ticket_reply'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1551,7 +1551,7 @@ if (isset($_POST['bulk_ticket_reply'])) {
// Currently not UI Frontend for this
if (isset($_POST['bulk_add_ticket_project'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1604,7 +1604,7 @@ if (isset($_POST['bulk_add_ticket_project'])) {
if (isset($_POST['bulk_add_asset_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1724,7 +1724,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) {
if (isset($_POST['add_ticket_reply'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1909,7 +1909,7 @@ if (isset($_POST['add_ticket_reply'])) {
if (isset($_POST['edit_ticket_reply'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1944,7 +1944,7 @@ if (isset($_POST['edit_ticket_reply'])) {
if (isset($_POST['redact_ticket_reply'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -1977,7 +1977,7 @@ if (isset($_POST['redact_ticket_reply'])) {
if (isset($_GET['archive_ticket_reply'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2003,7 +2003,7 @@ if (isset($_GET['archive_ticket_reply'])) {
if (isset($_POST['merge_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2083,7 +2083,7 @@ if (isset($_POST['merge_ticket'])) {
if (isset($_POST['change_client_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2114,7 +2114,7 @@ if (isset($_POST['change_client_ticket'])) {
if (isset($_GET['resolve_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2226,7 +2226,7 @@ if (isset($_GET['resolve_ticket'])) {
if (isset($_GET['close_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2325,7 +2325,7 @@ if (isset($_GET['close_ticket'])) {
if (isset($_GET['reopen_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2352,7 +2352,7 @@ if (isset($_GET['reopen_ticket'])) {
if (isset($_POST['add_invoice_from_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
enforceUserPermission('module_sales', 2);
@@ -2473,7 +2473,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
if (isset($_POST['add_quote_from_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
enforceUserPermission('module_sales', 2);
@@ -2548,7 +2548,7 @@ if (isset($_POST['add_quote_from_ticket'])) {
if (isset($_POST['export_tickets_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2605,7 +2605,7 @@ if (isset($_POST['export_tickets_csv'])) {
if (isset($_POST['edit_ticket_billable_status'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
enforceUserPermission('module_sales', 2);
@@ -2640,7 +2640,7 @@ if (isset($_POST['edit_ticket_billable_status'])) {
if (isset($_POST['edit_ticket_schedule'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);
@@ -2818,7 +2818,7 @@ if (isset($_POST['edit_ticket_schedule'])) {
if (isset($_GET['cancel_ticket_schedule'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_support', 2);

2
agent/post/transaction.php
View File

@@ -11,7 +11,7 @@ if (!defined('FROM_POST_HANDLER')) {
if (isset($_POST['export_transactions_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial');

6
agent/post/transfer.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_transfer'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -45,7 +45,7 @@ if (isset($_POST['add_transfer'])) {
if (isset($_POST['edit_transfer'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 2);
@@ -71,7 +71,7 @@ if (isset($_POST['edit_transfer'])) {
if (isset($_GET['delete_transfer'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 3);

8
agent/post/trip.php
View File

@@ -10,7 +10,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_trip'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'trip_model.php';
@@ -34,7 +34,7 @@ if (isset($_POST['add_trip'])) {
if (isset($_POST['edit_trip'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'trip_model.php';
@@ -58,7 +58,7 @@ if (isset($_POST['edit_trip'])) {
if (isset($_GET['delete_trip'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial', 3);
@@ -86,7 +86,7 @@ if (isset($_GET['delete_trip'])) {
if (isset($_POST['export_trips_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
enforceUserPermission('module_financial');

20
agent/post/vendor.php
View File

@@ -10,7 +10,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_vendor_from_template'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// GET POST Data
$client_id = intval($_POST['client_id']); //Used if this vendor is under a contact otherwise its 0 for under company and or template
@@ -61,7 +61,7 @@ if (isset($_POST['add_vendor_from_template'])) {
if (isset($_POST['add_vendor'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'vendor_model.php';
@@ -89,7 +89,7 @@ if (isset($_POST['add_vendor'])) {
if (isset($_POST['edit_vendor'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once 'vendor_model.php';
@@ -119,7 +119,7 @@ if (isset($_POST['edit_vendor'])) {
if (isset($_GET['archive_vendor'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$vendor_id = intval($_GET['archive_vendor']);
@@ -149,7 +149,7 @@ if (isset($_GET['archive_vendor'])) {
if(isset($_GET['restore_vendor'])){
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$vendor_id = intval($_GET['restore_vendor']);
@@ -179,7 +179,7 @@ if(isset($_GET['restore_vendor'])){
if (isset($_GET['delete_vendor'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$vendor_id = intval($_GET['delete_vendor']);
@@ -215,7 +215,7 @@ if (isset($_GET['delete_vendor'])) {
if (isset($_POST['bulk_archive_vendors'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if (isset($_POST['vendor_ids'])) {
@@ -258,7 +258,7 @@ if (isset($_POST['bulk_archive_vendors'])) {
if (isset($_POST['bulk_restore_vendors'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if (isset($_POST['vendor_ids'])) {
@@ -302,7 +302,7 @@ if (isset($_POST['bulk_restore_vendors'])) {
if (isset($_POST['bulk_delete_vendors'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if (isset($_POST['vendor_ids'])) {
@@ -352,7 +352,7 @@ if (isset($_POST['bulk_delete_vendors'])) {
if (isset($_POST['export_vendors_csv'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($_POST['client_id']) {
$client_id = intval($_POST['client_id']);

14
agent/user/post/profile.php
View File

@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['edit_your_user_details'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$name = escapeSql($_POST['name']);
$email = escapeSql($_POST['email']);
@@ -94,7 +94,7 @@ if (isset($_POST['edit_your_user_details'])) {
if (isset($_GET['clear_your_user_avatar'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$user_avatar = escapeSql(getFieldById('users', $session_user_id, 'user_avatar'));
@@ -112,7 +112,7 @@ if (isset($_GET['clear_your_user_avatar'])) {
if (isset($_POST['edit_your_user_password'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$new_password = trim($_POST['new_password']);
@@ -163,7 +163,7 @@ if (isset($_POST['edit_your_user_password'])) {
if (isset($_POST['edit_your_user_preferences'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$calendar_first_day = intval($_POST['calendar_first_day']);
$dark_mode = intval($_POST['dark_mode'] ?? 0);
@@ -200,7 +200,7 @@ if (isset($_POST['edit_your_user_preferences'])) {
if (isset($_POST['enable_mfa'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
require_once "../../libs/totp/totp.php";
@@ -268,7 +268,7 @@ if (isset($_GET['disable_mfa'])){
redirect();
}
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
mysqli_query($mysqli,"UPDATE users SET user_token = '' WHERE user_id = $session_user_id");
@@ -308,7 +308,7 @@ if (isset($_GET['disable_mfa'])){
if (isset($_POST['revoke_your_2fa_remember_tokens'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Delete tokens
mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id");

36
client/post.php
View File

@@ -12,7 +12,7 @@ require_once 'functions.php';
if (isset($_POST['add_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$subject = escapeSql($_POST['subject']);
$details = mysqli_real_escape_string($mysqli, ($_POST['details']));
@@ -84,7 +84,7 @@ if (isset($_POST['add_ticket'])) {
if (isset($_POST['add_ticket_comment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_POST['ticket_id']);
$comment = mysqli_real_escape_string($mysqli, $_POST['comment']);
@@ -191,7 +191,7 @@ if (isset($_POST['add_ticket_comment'])) {
if (isset($_GET['approve_ticket_task'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$task_id = intval($_GET['approve_ticket_task']);
$approval_id = intval($_GET['approval_id']);
@@ -230,7 +230,7 @@ if (isset($_GET['approve_ticket_task'])) {
if (isset($_POST['add_ticket_feedback'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_POST['ticket_id']);
$feedback = escapeSql($_POST['add_ticket_feedback']);
@@ -262,7 +262,7 @@ if (isset($_POST['add_ticket_feedback'])) {
if (isset($_GET['resolve_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_GET['resolve_ticket']);
@@ -297,7 +297,7 @@ if (isset($_GET['resolve_ticket'])) {
if (isset($_GET['reopen_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_GET['reopen_ticket']);
@@ -332,7 +332,7 @@ if (isset($_GET['reopen_ticket'])) {
if (isset($_GET['close_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_GET['close_ticket']);
@@ -378,7 +378,7 @@ if (isset($_GET['logout'])) {
if (isset($_POST['edit_profile'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$new_password = $_POST['new_password'];
@@ -396,7 +396,7 @@ if (isset($_POST['edit_profile'])) {
if (isset($_POST['add_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
redirect("post.php?logout");
@@ -445,7 +445,7 @@ if (isset($_POST['add_contact'])) {
if (isset($_POST['edit_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
redirect("post.php?logout");
@@ -497,7 +497,7 @@ if (isset($_POST['edit_contact'])) {
if (isset($_GET['add_payment_by_provider'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$invoice_id = intval($_GET['invoice_id']);
$saved_payment_id = intval($_GET['add_payment_by_provider']);
@@ -687,7 +687,7 @@ if (isset($_GET['add_payment_by_provider'])) {
if (isset($_POST['create_stripe_customer'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_billing_contact) {
redirect("post.php?logout");
@@ -775,7 +775,7 @@ if (isset($_POST['create_stripe_customer'])) {
if (isset($_GET['create_stripe_checkout'])) {
//validateCSRFToken($_GET['csrf_token']);
//validateCSRFToken();
// This page is called by autopay_setup_stripe.js, returns a Checkout Session client_secret
@@ -847,7 +847,7 @@ if (isset($_GET['create_stripe_checkout'])) {
if (isset($_GET['stripe_save_card'])) {
// validateCSRFToken($_GET['csrf_token']); Broken with Stripe Save Card JQ 2026-5-4
// validateCSRFToken(); Broken with Stripe Save Card JQ 2026-5-4
if ($session_contact_primary == 0 && !$session_contact_is_billing_contact) {
redirect("post.php?logout");
@@ -978,7 +978,7 @@ if (isset($_GET['stripe_save_card'])) {
if (isset($_GET['delete_saved_payment'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_billing_contact) {
redirect("post.php?logout");
@@ -1082,7 +1082,7 @@ if (isset($_GET['delete_saved_payment'])) {
if (isset($_POST['set_recurring_payment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$saved_payment_id = intval($_POST['saved_payment_id']);
@@ -1136,7 +1136,7 @@ if (isset($_POST['set_recurring_payment'])) {
if (isset($_POST['client_add_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Permission check - only primary or technical contacts can create documents
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
@@ -1182,7 +1182,7 @@ if (isset($_POST['client_add_document'])) {
if (isset($_POST['client_upload_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Permission check - only primary or technical contacts can upload documents
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {

8
functions/security.php
View File

@@ -177,9 +177,11 @@ function apiEncryptCredentialEntry(#[\SensitiveParameter]$credential_cleartext,
// Cross-Site Request Forgery check for sensitive functions
// Validates the CSRF token provided matches the one in the users session
function validateCSRFToken($token)
{
if (hash_equals($token, $_SESSION['csrf_token'])) {
function validateCSRFToken(?string $token = null) {
// Read the token straight from the request when the caller doesn't pass one
$token ??= $_POST['csrf_token'] ?? $_GET['csrf_token'] ?? '';
if ($token !== '' && hash_equals($_SESSION['csrf_token'] ?? '', $token)) {
return true;
} else {
$_SESSION['alert_type'] = "warning";

6
post/misc.php
View File

@@ -20,7 +20,7 @@ if(isset($_POST['change_records_per_page'])){
if (isset($_GET['dismiss_notification'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$notification_id = intval($_GET['dismiss_notification']);
@@ -37,7 +37,7 @@ if (isset($_GET['dismiss_notification'])) {
if (isset($_GET['dismiss_all_notifications'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$sql = mysqli_query($mysqli,"SELECT * FROM notifications WHERE notification_user_id = $session_user_id AND notification_dismissed_at IS NULL");
@@ -63,7 +63,7 @@ if (isset($_GET['dismiss_all_notifications'])) {
// Revoke sharing (sharing itself is done via ajax.php)
if (isset($_GET['deactivate_shared_item'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$item_id = intval($_GET['deactivate_shared_item']);