diff --git a/api.php b/api.php index 37de01d9..236a5f64 100644 --- a/api.php +++ b/api.php @@ -13,8 +13,8 @@ if(!isset($_GET['api_key']) OR empty($_GET['api_key'])) { } // Validate API key from GET request -$config_api_key = mysqli_real_escape_string($mysqli,$_GET['api_key']); -$sql = mysqli_query($mysqli,"SELECT * FROM settings, companies WHERE settings.company_id = companies.company_id AND settings.config_api_key = '$config_api_key'"); +$api_key = mysqli_real_escape_string($mysqli,$_GET['api_key']); +$sql = mysqli_query($mysqli,"SELECT * FROM api_keys, companies WHERE api_keys.company_id = companies.company_id AND api_keys.api_key_secret = '$api_key'"); if(mysqli_num_rows($sql) != 1){ // Invalid Key header("HTTP/1.1 401 Unauthorized"); diff --git a/api_key_edit_modal.php b/api_key_edit_modal.php index ff1e371f..cdb02194 100644 --- a/api_key_edit_modal.php +++ b/api_key_edit_modal.php @@ -22,19 +22,6 @@ -
- -
-
- -
- -
- -
-
-
-
diff --git a/db.sql b/db.sql index c0b19ebf..025047a5 100644 --- a/db.sql +++ b/db.sql @@ -1040,7 +1040,6 @@ DROP TABLE IF EXISTS `settings`; /*!40101 SET character_set_client = utf8 */; CREATE TABLE `settings` ( `company_id` int(11) NOT NULL, - `config_api_key` varchar(200) DEFAULT NULL, `config_aes_key` varchar(250) DEFAULT NULL, `config_base_url` varchar(200) DEFAULT NULL, `config_smtp_host` varchar(200) DEFAULT NULL, @@ -1368,4 +1367,4 @@ CREATE TABLE `vendors` ( /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2022-02-03 19:11:34 +-- Dump completed on 2022-02-04 15:58:24 diff --git a/get_settings.php b/get_settings.php index aae75a6d..12840648 100644 --- a/get_settings.php +++ b/get_settings.php @@ -5,7 +5,6 @@ $sql_settings = mysqli_query($mysqli,"SELECT * FROM settings WHERE company_id = $row = mysqli_fetch_array($sql_settings); //General -$config_api_key = $row['config_api_key']; $config_aes_key = $row['config_aes_key']; //Legacy $config_base_url = $row['config_base_url']; diff --git a/post.php b/post.php index 34200eb8..c709e7cc 100644 --- a/post.php +++ b/post.php @@ -402,8 +402,9 @@ if(isset($_GET['delete_user'])){ if(isset($_POST['add_api_key'])){ $name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['name']))); - $secret = trim(mysqli_real_escape_string($mysqli,$_POST['secret'])); $expire = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['expire']))); + // Gen a Key + $secret = keygen(); mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_expire = '$expire', api_key_created_at = NOW(), company_id = $session_company_id"); @@ -422,10 +423,9 @@ if(isset($_POST['edit_api_key'])){ $api_key_id = intval($_POST['api_key_id']); $name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['name']))); - $secret = trim(mysqli_real_escape_string($mysqli,$_POST['secret'])); $expire = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['expire']))); - mysqli_query($mysqli,"UPDATE api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_expire = '$expire', api_key_updated_at = NOW() WHERE api_key_id = $api_key_id AND company_id = $session_company_id"); + mysqli_query($mysqli,"UPDATE api_keys SET api_key_name = '$name', api_key_expire = '$expire', api_key_updated_at = NOW() WHERE api_key_id = $api_key_id AND company_id = $session_company_id"); // Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API Key', log_action = 'Modify', log_description = '$session_name modified API Key $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), log_user_id = $session_user_id, company_id = $session_company_id"); @@ -737,25 +737,9 @@ if(isset($_POST['verify'])){ if(isset($_POST['edit_general_settings'])){ - $config_api_key = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_api_key']))); - //$old_aes_key = $config_aes_key; - //$config_aes_key = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_aes_key']))); $config_base_url = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_base_url']))); - mysqli_query($mysqli,"UPDATE settings SET config_api_key = '$config_api_key', config_base_url = '$config_base_url' WHERE company_id = $session_company_id"); - -// //Update AES key on client_logins if changed -// if($old_aes_key != $config_aes_key){ -// $sql = mysqli_query($mysqli,"SELECT login_id, AES_DECRYPT(login_password, '$old_aes_key') AS old_login_password FROM logins -// WHERE company_id = $session_company_id"); -// -// while($row = mysqli_fetch_array($sql)){ -// $login_id = $row['login_id']; -// $old_login_password = $row['old_login_password']; -// -// mysqli_query($mysqli,"UPDATE logins SET login_password = AES_ENCRYPT('$old_login_password','$config_aes_key') WHERE login_id = $login_id"); -// } -// } + mysqli_query($mysqli,"UPDATE settings SET config_base_url = '$config_base_url' WHERE company_id = $session_company_id"); //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified general settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), log_user_id = $session_user_id, company_id = $session_company_id"); diff --git a/settings-general.php b/settings-general.php index 89f1ba8e..a106850a 100644 --- a/settings-general.php +++ b/settings-general.php @@ -9,19 +9,6 @@
-
- -
-
- -
- -
- -
-
-
-
diff --git a/setup.php b/setup.php index c3cbf85d..7616ecfd 100644 --- a/setup.php +++ b/setup.php @@ -485,7 +485,6 @@ if(isset($_POST['add_company_settings'])){ $company_id = mysqli_insert_id($mysqli); $config_base_url = $_SERVER['HTTP_HOST'] . dirname($_SERVER['REQUEST_URI']); - $config_api_key = keygen(); mkdir_missing("uploads/clients/$company_id"); file_put_contents("uploads/clients/$company_id/index.php", ""); @@ -541,7 +540,7 @@ if(isset($_POST['add_company_settings'])){ //Set User Company Permissions mysqli_query($mysqli,"INSERT INTO user_companies SET user_id = $user_id, company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO settings SET company_id = $company_id, config_invoice_prefix = 'INV-', config_invoice_next_number = 1, config_recurring_prefix = 'REC-', config_recurring_next_number = 1, config_invoice_overdue_reminders = '1,3,7', config_quote_prefix = 'QUO-', config_quote_next_number = 1, config_api_key = '$config_api_key', config_recurring_auto_send_invoice = 1, config_default_net_terms = 7, config_send_invoice_reminders = 1, config_enable_cron = 0, config_ticket_next_number = 1, config_base_url = '$config_base_url'"); + mysqli_query($mysqli,"INSERT INTO settings SET company_id = $company_id, config_invoice_prefix = 'INV-', config_invoice_next_number = 1, config_recurring_prefix = 'REC-', config_recurring_next_number = 1, config_invoice_overdue_reminders = '1,3,7', config_quote_prefix = 'QUO-', config_quote_next_number = 1, config_recurring_auto_send_invoice = 1, config_default_net_terms = 7, config_send_invoice_reminders = 1, config_enable_cron = 0, config_ticket_next_number = 1, config_base_url = '$config_base_url'"); //Create Some Data