From b1c57fc5c72ecebf961a2bb5bf817c3ff2c10903 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Wed, 15 Jul 2026 20:32:50 -0400
Subject: [PATCH] Feature: Add new js function to retrieve and Audit log
 Password reveals, still need to get the edit modals

---
 agent/ajax.php                              | 25 ++++++++++++
 agent/asset.php                             |  6 +--
 agent/client_overview.php                   |  8 ++--
 agent/contact.php                           |  6 +--
 agent/credentials.php                       |  5 +--
 agent/js/credential_show_password_via_id.js | 43 +++++++++++++++++++++
 agent/modals/asset/asset.php                |  7 ++--
 agent/modals/contact/contact.php            | 10 ++---
 8 files changed, 88 insertions(+), 22 deletions(-)
 create mode 100644 agent/js/credential_show_password_via_id.js

diff --git a/agent/ajax.php b/agent/ajax.php
index f63380c5..4bf9cfdf 100644
--- a/agent/ajax.php
+++ b/agent/ajax.php
@@ -1050,3 +1050,28 @@ if (isset($_GET['get_internal_users'])) {
     echo json_encode($response);
     exit;
 }
+
+if (isset($_GET['get_credential_via_id'])) {
+    enforceUserPermission('module_credential');
+
+    $credential_id = intval($_GET['credential_id']);
+
+    $sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_username, credential_password, credential_client_id FROM credentials WHERE credential_id = $credential_id"));
+    $name = escapeSql($sql['credential_name']);
+    $client_id = intval($sql['credential_client_id']);
+
+    enforceClientAccess($client_id);
+
+    $response = array(
+        'username' => decryptCredentialEntry($sql['credential_username']),
+        'password' => decryptCredentialEntry($sql['credential_password'])
+    );
+    echo json_encode($response);
+
+    // Only log if this user hasn't viewed this credential recently (mirrors TOTP dedup)
+    $check_recent_view = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS recent_view FROM logs WHERE log_type = 'Credential' AND log_action = 'View' AND log_user_id = $session_user_id AND log_entity_id = $credential_id AND log_client_id = $client_id AND log_created_at > (NOW() - INTERVAL 5 MINUTE)"));
+
+    if (intval($check_recent_view['recent_view']) == 0) {
+        logAudit("Credential", "View", "$session_name viewed credential $name", $client_id, $credential_id);
+    }
+}
diff --git a/agent/asset.php b/agent/asset.php
index bd1c487c..380a93c6 100644
--- a/agent/asset.php
+++ b/agent/asset.php
@@ -654,7 +654,6 @@ if (isset($_GET['asset_id'])) {
                                     } else {
                                         $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
                                     }
-                                    $credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
                                     $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
                                     $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
                                     if (empty($credential_otp_secret)) {
@@ -701,7 +700,7 @@ if (isset($_GET['asset_id'])) {
                                         <td><?= $credential_description; ?></td>
                                         <td><?= $credential_username_display; ?></td>
                                         <td>
-                                            <button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?= $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" data-clipboard-text="<?= $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button>
+                                            <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
                                         </td>
                                         <td><?= $otp_display; ?></td>
                                         <td><?= $credential_uri_display; ?></td>
@@ -1257,8 +1256,9 @@ if (isset($_GET['asset_id'])) {
         });
     </script>
 
-    <!-- Include script to get TOTP code via the credential ID -->
+    <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
     <script src="js/credential_show_otp_via_id.js"></script>
+    <script src="js/credential_show_password_via_id.js"></script>
 
     <script src="../js/bulk_actions.js"></script>
 
diff --git a/agent/client_overview.php b/agent/client_overview.php
index b54aec39..e8012d87 100644
--- a/agent/client_overview.php
+++ b/agent/client_overview.php
@@ -256,7 +256,7 @@ $sql_asset_retired = mysqli_query(
                         <tr>
                             <td>
                                 <a href="#" class="ajax-modal"
-                                    data-modal-size="lg"
+                                    data-modal-size="xl"
                                     data-modal-url="modals/contact/contact.php?id=<?= $contact_id ?>">
                                     <div class="media">
                                         <?php if ($contact_photo) { ?>
@@ -378,7 +378,6 @@ $sql_asset_retired = mysqli_query(
                     } else {
                         $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
                     }
-                    $credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
                     $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
                     $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
                     if (empty($credential_otp_secret)) {
@@ -397,7 +396,7 @@ $sql_asset_retired = mysqli_query(
                         </td>
                         <td><?= $credential_username_display ?></td>
                         <td class="text-nowrap">
-                            <button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" type="button" data-clipboard-text="<?php echo $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button>
+                            <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
                             <div><?= $otp_display ?></div>
                         </td>
 
@@ -800,8 +799,9 @@ $sql_asset_retired = mysqli_query(
 
 </div>
 
-<!-- Include script to get TOTP code via the login ID -->
+<!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
 <script src="js/credential_show_otp_via_id.js"></script>
+<script src="js/credential_show_password_via_id.js"></script>
 
 <script>
     function updateClientNotes(client_id) {
diff --git a/agent/contact.php b/agent/contact.php
index 5031c1ae..1996b246 100644
--- a/agent/contact.php
+++ b/agent/contact.php
@@ -552,7 +552,6 @@ if (isset($_GET['contact_id'])) {
                                 } else {
                                     $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
                                 }
-                                $credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
                                 $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
                                 $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
                                 if (empty($credential_otp_secret)) {
@@ -599,7 +598,7 @@ if (isset($_GET['contact_id'])) {
                                     <td><?php echo $credential_description; ?></td>
                                     <td><?php echo $credential_username_display; ?></td>
                                     <td>
-                                        <button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" data-clipboard-text="<?php echo $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button>
+                                        <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
                                     </td>
                                     <td><?php echo $otp_display; ?></td>
                                     <td><?php echo $credential_uri_display; ?></td>
@@ -1226,8 +1225,9 @@ if (isset($_GET['contact_id'])) {
         });
     </script>
 
-    <!-- Include script to get TOTP code via the Credential ID -->
+    <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
     <script src="js/credential_show_otp_via_id.js"></script>
+    <script src="js/credential_show_password_via_id.js"></script>
 
 <?php
 require_once "../includes/footer.php";
diff --git a/agent/credentials.php b/agent/credentials.php
index 7ce3d52c..1c83d07d 100644
--- a/agent/credentials.php
+++ b/agent/credentials.php
@@ -331,9 +331,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             } else {
                                 $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
                             }
-                            $credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
                             $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
-                            $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
                             if (empty($credential_otp_secret)) {
                                 $otp_display = "-";
                             } else {
@@ -444,7 +442,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 </td>
                                 <td class="text-nowrap"><?php echo $credential_username_display; ?></td>
                                 <td class="text-nowrap">
-                                    <button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" type="button" data-clipboard-text="<?php echo $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button>
+                                    <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
                                 </td>
                                 <td class="text-nowrap"><?php echo $otp_display; ?></td>
                                 <td><?php echo $credential_uri_display; ?></td>
@@ -541,6 +539,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
 <!-- Include script to get TOTP code via the login ID -->
 <script src="js/credential_show_otp_via_id.js"></script>
+<script src="js/credential_show_password_via_id.js"></script>
 <script src="../js/bulk_actions.js"></script>
 
 <?php
diff --git a/agent/js/credential_show_password_via_id.js b/agent/js/credential_show_password_via_id.js
new file mode 100644
index 00000000..5d74f407
--- /dev/null
+++ b/agent/js/credential_show_password_via_id.js
@@ -0,0 +1,43 @@
+function showPasswordViaCredentialID(button, credential_id) {
+    // Send a GET request to ajax.php as ajax.php?get_credential_via_id=true&credential_id=ID
+    jQuery.get(
+        "ajax.php", {
+            get_credential_via_id: 'true',
+            credential_id: credential_id
+        },
+        function(data) {
+            const credential = JSON.parse(data);
+
+            // (Re)create the popover with the fetched password and show it
+            //  trigger: focus dismisses it when the user clicks away
+            jQuery(button).popover('dispose').popover({
+                content: credential.password,
+                placement: 'top',
+                trigger: 'focus'
+            }).popover('show');
+        }
+    );
+}
+
+function copyPasswordViaCredentialID(button, credential_id) {
+    jQuery.get(
+        "ajax.php", {
+            get_credential_via_id: 'true',
+            credential_id: credential_id
+        },
+        function(data) {
+            const credential = JSON.parse(data);
+
+            navigator.clipboard.writeText(credential.password).then(function() {
+                // Flash "Copied!" tooltip, matching the ClipboardJS success handler in app.js
+                jQuery(button).tooltip('hide')
+                    .attr('data-original-title', 'Copied!')
+                    .tooltip('show');
+
+                setTimeout(function() {
+                    jQuery(button).tooltip('hide');
+                }, 1000);
+            });
+        }
+    );
+}
\ No newline at end of file
diff --git a/agent/modals/asset/asset.php b/agent/modals/asset/asset.php
index 25fa7f3d..cabd06b5 100644
--- a/agent/modals/asset/asset.php
+++ b/agent/modals/asset/asset.php
@@ -530,7 +530,6 @@ ob_start();
                         } else {
                             $credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
                         }
-                        $credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
                         $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
                         $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
                         if (empty($credential_otp_secret)) {
@@ -573,8 +572,7 @@ ob_start();
                             </td>
                             <td><?php echo $credential_username_display; ?></td>
                             <td>
-                                <button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button>
-                                <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='<?php echo $credential_password; ?>'><i class='far fa-copy text-secondary'></i></button>
+                                <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
                             </td>
                             <td><?php echo $otp_display; ?></td>
                             <td><?php echo $credential_uri_display; ?></td>
@@ -590,8 +588,9 @@ ob_start();
                 </table>
             </div>
         </div>
-        <!-- Include script to get TOTP code via the credentials ID -->
+        <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
         <script src="../js/credential_show_otp_via_id.js"></script>
+        <script src="../js/credential_show_password_via_id.js"></script>
         <?php } ?>
 
         <?php if ($ticket_count) { ?>
diff --git a/agent/modals/contact/contact.php b/agent/modals/contact/contact.php
index f4695ea3..9807c735 100644
--- a/agent/modals/contact/contact.php
+++ b/agent/modals/contact/contact.php
@@ -556,8 +556,6 @@ ob_start();
                                     $credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
                                 }
 
-                                $credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
-
                                 $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
                                 if (empty($credential_otp_secret)) {
                                     $otp_display = "-";
@@ -570,10 +568,10 @@ ob_start();
                                     <td><?= $credential_description ?></td>
                                     <td><?= $credential_username_display ?></td>
                                     <td>
-                                        <button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?= $credential_password ?>">
-                                            <i class="fas fa-ellipsis-h text-secondary"></i><i class="fas fa-ellipsis-h text-secondary"></i>
+                                        <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)">
+                                            <i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i>
                                         </button>
-                                        <button type="button" class="btn btn-sm clipboardjs" data-clipboard-text="<?= $credential_password ?>">
+                                        <button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)">
                                             <i class="far fa-copy text-secondary"></i>
                                         </button>
                                     </td>
@@ -586,7 +584,9 @@ ob_start();
                             </tbody>
                         </table>
                     </div>
+                    <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
                     <script src="js/credential_show_otp_via_id.js"></script>
+                    <script src="js/credential_show_password_via_id.js"></script>
                 </div>
                 <?php } ?>