AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 12:35:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Feature: Add new js function to retrieve and Audit log Password reveals, still need to get the edit modals

Browse Source
This commit is contained in:
johnnyq
2026-07-15 20:32:50 -04:00
parent 89cb9074ab
commit b1c57fc5c7
8 changed files with 88 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
agent/ajax.php
View File

@@ -1050,3 +1050,28 @@ if (isset($_GET['get_internal_users'])) {
echo json_encode($response); echo json_encode($response);
exit; exit;
} }
if (isset($_GET['get_credential_via_id'])) {
enforceUserPermission('module_credential');
$credential_id = intval($_GET['credential_id']);
$sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_username, credential_password, credential_client_id FROM credentials WHERE credential_id = $credential_id"));
$name = escapeSql($sql['credential_name']);
$client_id = intval($sql['credential_client_id']);
enforceClientAccess($client_id);
$response = array(
'username' => decryptCredentialEntry($sql['credential_username']),
'password' => decryptCredentialEntry($sql['credential_password'])
);
echo json_encode($response);
// Only log if this user hasn't viewed this credential recently (mirrors TOTP dedup)
$check_recent_view = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS recent_view FROM logs WHERE log_type = 'Credential' AND log_action = 'View' AND log_user_id = $session_user_id AND log_entity_id = $credential_id AND log_client_id = $client_id AND log_created_at > (NOW() - INTERVAL 5 MINUTE)"));
if (intval($check_recent_view['recent_view']) == 0) {
logAudit("Credential", "View", "$session_name viewed credential $name", $client_id, $credential_id);
}
}

6
agent/asset.php
View File

@@ -654,7 +654,6 @@ if (isset($_GET['asset_id'])) {
} else { } else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>"; $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
} }
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']); $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"'; $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) { if (empty($credential_otp_secret)) {
@@ -701,7 +700,7 @@ if (isset($_GET['asset_id'])) {
<td><?= $credential_description; ?></td> <td><?= $credential_description; ?></td>
<td><?= $credential_username_display; ?></td> <td><?= $credential_username_display; ?></td>
<td> <td>
<button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?= $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" data-clipboard-text="<?= $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button> <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
</td> </td>
<td><?= $otp_display; ?></td> <td><?= $otp_display; ?></td>
<td><?= $credential_uri_display; ?></td> <td><?= $credential_uri_display; ?></td>
@@ -1257,8 +1256,9 @@ if (isset($_GET['asset_id'])) {
}); });
</script> </script>
<!-- Include script to get TOTP code via the credential ID --> <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
<script src="js/credential_show_otp_via_id.js"></script> <script src="js/credential_show_otp_via_id.js"></script>
<script src="js/credential_show_password_via_id.js"></script>
<script src="../js/bulk_actions.js"></script> <script src="../js/bulk_actions.js"></script>

8
agent/client_overview.php
View File

@@ -256,7 +256,7 @@ $sql_asset_retired = mysqli_query(
<tr> <tr>
<td> <td>
<a href="#" class="ajax-modal" <a href="#" class="ajax-modal"
data-modal-size="lg" data-modal-size="xl"
data-modal-url="modals/contact/contact.php?id=<?= $contact_id ?>"> data-modal-url="modals/contact/contact.php?id=<?= $contact_id ?>">
<div class="media"> <div class="media">
<?php if ($contact_photo) { ?> <?php if ($contact_photo) { ?>
@@ -378,7 +378,6 @@ $sql_asset_retired = mysqli_query(
} else { } else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>"; $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
} }
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']); $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"'; $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) { if (empty($credential_otp_secret)) {
@@ -397,7 +396,7 @@ $sql_asset_retired = mysqli_query(
</td> </td>
<td><?= $credential_username_display ?></td> <td><?= $credential_username_display ?></td>
<td class="text-nowrap"> <td class="text-nowrap">
<button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" type="button" data-clipboard-text="<?php echo $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button> <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
<div><?= $otp_display ?></div> <div><?= $otp_display ?></div>
</td> </td>
@@ -800,8 +799,9 @@ $sql_asset_retired = mysqli_query(
</div> </div>
<!-- Include script to get TOTP code via the login ID --> <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
<script src="js/credential_show_otp_via_id.js"></script> <script src="js/credential_show_otp_via_id.js"></script>
<script src="js/credential_show_password_via_id.js"></script>
<script> <script>
function updateClientNotes(client_id) { function updateClientNotes(client_id) {

6
agent/contact.php
View File

@@ -552,7 +552,6 @@ if (isset($_GET['contact_id'])) {
} else { } else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>"; $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
} }
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']); $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"'; $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) { if (empty($credential_otp_secret)) {
@@ -599,7 +598,7 @@ if (isset($_GET['contact_id'])) {
<td><?php echo $credential_description; ?></td> <td><?php echo $credential_description; ?></td>
<td><?php echo $credential_username_display; ?></td> <td><?php echo $credential_username_display; ?></td>
<td> <td>
<button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" data-clipboard-text="<?php echo $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button> <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
</td> </td>
<td><?php echo $otp_display; ?></td> <td><?php echo $otp_display; ?></td>
<td><?php echo $credential_uri_display; ?></td> <td><?php echo $credential_uri_display; ?></td>
@@ -1226,8 +1225,9 @@ if (isset($_GET['contact_id'])) {
}); });
</script> </script>
<!-- Include script to get TOTP code via the Credential ID --> <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
<script src="js/credential_show_otp_via_id.js"></script> <script src="js/credential_show_otp_via_id.js"></script>
<script src="js/credential_show_password_via_id.js"></script>
<?php <?php
require_once "../includes/footer.php"; require_once "../includes/footer.php";

5
agent/credentials.php
View File

@@ -331,9 +331,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
} else { } else {
$credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>"; $credential_username_display = "$credential_username<button class='btn btn-sm clipboardjs' type='button' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
} }
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']); $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) { if (empty($credential_otp_secret)) {
$otp_display = "-"; $otp_display = "-";
} else { } else {
@@ -444,7 +442,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
</td> </td>
<td class="text-nowrap"><?php echo $credential_username_display; ?></td> <td class="text-nowrap"><?php echo $credential_username_display; ?></td>
<td class="text-nowrap"> <td class="text-nowrap">
<button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm clipboardjs" type="button" data-clipboard-text="<?php echo $credential_password; ?>"><i class="far fa-copy text-secondary"></i></button> <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
</td> </td>
<td class="text-nowrap"><?php echo $otp_display; ?></td> <td class="text-nowrap"><?php echo $otp_display; ?></td>
<td><?php echo $credential_uri_display; ?></td> <td><?php echo $credential_uri_display; ?></td>
@@ -541,6 +539,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<!-- Include script to get TOTP code via the login ID --> <!-- Include script to get TOTP code via the login ID -->
<script src="js/credential_show_otp_via_id.js"></script> <script src="js/credential_show_otp_via_id.js"></script>
<script src="js/credential_show_password_via_id.js"></script>
<script src="../js/bulk_actions.js"></script> <script src="../js/bulk_actions.js"></script>
<?php <?php

43
agent/js/credential_show_password_via_id.js Normal file
View File

@@ -0,0 +1,43 @@
function showPasswordViaCredentialID(button, credential_id) {
// Send a GET request to ajax.php as ajax.php?get_credential_via_id=true&credential_id=ID
jQuery.get(
"ajax.php", {
get_credential_via_id: 'true',
credential_id: credential_id
},
function(data) {
const credential = JSON.parse(data);
// (Re)create the popover with the fetched password and show it
// trigger: focus dismisses it when the user clicks away
jQuery(button).popover('dispose').popover({
content: credential.password,
placement: 'top',
trigger: 'focus'
}).popover('show');
}
);
}
function copyPasswordViaCredentialID(button, credential_id) {
jQuery.get(
"ajax.php", {
get_credential_via_id: 'true',
credential_id: credential_id
},
function(data) {
const credential = JSON.parse(data);
navigator.clipboard.writeText(credential.password).then(function() {
// Flash "Copied!" tooltip, matching the ClipboardJS success handler in app.js
jQuery(button).tooltip('hide')
.attr('data-original-title', 'Copied!')
.tooltip('show');
setTimeout(function() {
jQuery(button).tooltip('hide');
}, 1000);
});
}
);
}

7
agent/modals/asset/asset.php
View File

@@ -530,7 +530,6 @@ ob_start();
} else { } else {
$credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>"; $credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
} }
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']); $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
$credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"'; $credential_id_with_secret = '"' . $row['credential_id'] . '","' . $row['credential_otp_secret'] . '"';
if (empty($credential_otp_secret)) { if (empty($credential_otp_secret)) {
@@ -573,8 +572,7 @@ ob_start();
</td> </td>
<td><?php echo $credential_username_display; ?></td> <td><?php echo $credential_username_display; ?></td>
<td> <td>
<button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?php echo $credential_password; ?>"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button> <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i></button><button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)"><i class="far fa-copy text-secondary"></i></button>
<button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='<?php echo $credential_password; ?>'><i class='far fa-copy text-secondary'></i></button>
</td> </td>
<td><?php echo $otp_display; ?></td> <td><?php echo $otp_display; ?></td>
<td><?php echo $credential_uri_display; ?></td> <td><?php echo $credential_uri_display; ?></td>
@@ -590,8 +588,9 @@ ob_start();
</table> </table>
</div> </div>
</div> </div>
<!-- Include script to get TOTP code via the credentials ID --> <!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
<script src="../js/credential_show_otp_via_id.js"></script> <script src="../js/credential_show_otp_via_id.js"></script>
<script src="../js/credential_show_password_via_id.js"></script>
<?php } ?> <?php } ?>
<?php if ($ticket_count) { ?> <?php if ($ticket_count) { ?>

10
agent/modals/contact/contact.php
View File

@@ -556,8 +556,6 @@ ob_start();
$credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>"; $credential_username_display = "$credential_username <button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$credential_username'><i class='far fa-copy text-secondary'></i></button>";
} }
$credential_password = escapeHtml(decryptCredentialEntry($row['credential_password']));
$credential_otp_secret = escapeHtml($row['credential_otp_secret']); $credential_otp_secret = escapeHtml($row['credential_otp_secret']);
if (empty($credential_otp_secret)) { if (empty($credential_otp_secret)) {
$otp_display = "-"; $otp_display = "-";
@@ -570,10 +568,10 @@ ob_start();
<td><?= $credential_description ?></td> <td><?= $credential_description ?></td>
<td><?= $credential_username_display ?></td> <td><?= $credential_username_display ?></td>
<td> <td>
<button class="btn p-0" type="button" data-toggle="popover" data-trigger="focus" data-placement="top" data-content="<?= $credential_password ?>"> <button class="btn p-0" type="button" onclick="showPasswordViaCredentialID(this, <?php echo $credential_id; ?>)">
<i class="fas fa-ellipsis-h text-secondary"></i><i class="fas fa-ellipsis-h text-secondary"></i> <i class="fas fa-2x fa-ellipsis-h text-secondary"></i><i class="fas fa-2x fa-ellipsis-h text-secondary"></i>
</button> </button>
<button type="button" class="btn btn-sm clipboardjs" data-clipboard-text="<?= $credential_password ?>"> <button class="btn btn-sm" type="button" onclick="copyPasswordViaCredentialID(this, <?php echo $credential_id; ?>)">
<i class="far fa-copy text-secondary"></i> <i class="far fa-copy text-secondary"></i>
</button> </button>
</td> </td>
@@ -586,7 +584,9 @@ ob_start();
</tbody> </tbody>
</table> </table>
</div> </div>
<!-- Include scripts to fetch TOTP codes and passwords via the credential ID -->
<script src="js/credential_show_otp_via_id.js"></script> <script src="js/credential_show_otp_via_id.js"></script>
<script src="js/credential_show_password_via_id.js"></script>
</div> </div>
<?php } ?> <?php } ?>