diff --git a/post/user/quote.php b/post/user/quote.php
index 1cc92d1e..a925660b 100644
--- a/post/user/quote.php
+++ b/post/user/quote.php
@@ -568,10 +568,10 @@ if(isset($_POST['export_client_quotes_csv'])){
$_SESSION['alert_message'] = "Exported $num_rows quote(s)";
- exit;
-
header("Location: " . $_SERVER["HTTP_REFERER"]);
+ exit;
+
}
if (isset($_POST['update_quote_item_order'])) {
diff --git a/post/user/rack.php b/post/user/rack.php
index 2e0220df..e7bc7e66 100644
--- a/post/user/rack.php
+++ b/post/user/rack.php
@@ -6,7 +6,7 @@
if (isset($_POST['add_rack'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
@@ -41,8 +41,8 @@ if (isset($_POST['add_rack'])) {
}
}
- //Logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Rack', log_action = 'Create', log_description = '$session_name created rack $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ // Logging
+ logAction("Rack", "Create", "$session_name created rack $name", $client_id, $rack_id);
$_SESSION['alert_message'] = "Rack $name created";
@@ -52,7 +52,7 @@ if (isset($_POST['add_rack'])) {
if (isset($_POST['edit_rack'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$rack_id = intval($_POST['rack_id']);
$client_id = intval($_POST['client_id']);
@@ -86,8 +86,8 @@ if (isset($_POST['edit_rack'])) {
}
}
- //Logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Rack', log_action = 'Edit', log_description = '$session_name edited rack $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ // Logging
+ logAction("Rack", "Edit", "$session_name edited rack $name", $client_id, $rack_id);
$_SESSION['alert_message'] = "Rack $name edited";
@@ -97,7 +97,7 @@ if (isset($_POST['edit_rack'])) {
if (isset($_GET['archive_rack'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$rack_id = intval($_GET['archive_rack']);
@@ -105,15 +105,15 @@ if (isset($_GET['archive_rack'])) {
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_array($sql);
$rack_name = sanitizeInput($row['rack_name']);
- $client_id = intval($row['asset_client_id']);
+ $client_id = intval($row['rack_client_id']);
mysqli_query($mysqli,"UPDATE racks SET rack_archived_at = NOW() WHERE rack_id = $rack_id");
- //logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Rack', log_action = 'Archive', log_description = '$session_name archived rack $rack_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ // Logging
+ logAction("Rack", "Archive", "$session_name archived rack $rack_name", $client_id, $rack_id);
$_SESSION['alert_type'] = "error";
- $_SESSION['alert_message'] = "Asset $rack_name archived";
+ $_SESSION['alert_message'] = "Rack $rack_name archived";
header("Location: " . $_SERVER["HTTP_REFERER"]);
@@ -121,7 +121,7 @@ if (isset($_GET['archive_rack'])) {
if (isset($_GET['unarchive_rack'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$rack_id = intval($_GET['unarchive_rack']);
@@ -133,8 +133,8 @@ if (isset($_GET['unarchive_rack'])) {
mysqli_query($mysqli,"UPDATE racks SET rack_archived_at = NULL WHERE rack_id = $rack_id");
- //logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Asset', log_action = 'Unarchive', log_description = '$session_name restored rack $rack_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $asset_id");
+ // Logging
+ logAction("Rack", "Unarchive", "$session_name unarchived rack $rack_name", $client_id, $rack_id);
$_SESSION['alert_message'] = "Rack $rack_name Unarchived";
@@ -144,7 +144,7 @@ if (isset($_GET['unarchive_rack'])) {
if (isset($_GET['delete_rack'])) {
- validateAdminRole();
+ enforceUserPermission('module_support', 3);
$rack_id = intval($_GET['delete_rack']);
@@ -162,8 +162,8 @@ if (isset($_GET['delete_rack'])) {
unlink("uploads/clients/$client_id/$rack_photo");
}
- //Logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Rack', log_action = 'Delete', log_description = '$session_name deleted rack $rack_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ // Logging
+ logAction("Rack", "Delete", "$session_name deleted rack $rack_name", $client_id);
$_SESSION['alert_type'] = "error";
$_SESSION['alert_message'] = "Rack $rack_name deleted";
@@ -174,7 +174,7 @@ if (isset($_GET['delete_rack'])) {
if (isset($_POST['add_rack_unit'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
$rack_id = intval($_POST['rack_id']);
@@ -183,6 +183,12 @@ if (isset($_POST['add_rack_unit'])) {
$unit_end = intval($_POST['unit_end']);
$asset = intval($_POST['asset']);
+ // Get Name and Client ID for logging and alert message
+ $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
+ $row = mysqli_fetch_array($sql);
+ $rack_name = sanitizeInput($row['rack_name']);
+ $client_id = intval($row['rack_client_id']);
+
// **New Validation Check**
if ($unit_start > $unit_end) {
$_SESSION['alert_type'] = "error";
@@ -208,16 +214,16 @@ if (isset($_POST['add_rack_unit'])) {
$unit_id = mysqli_insert_id($mysqli);
// Logging
- mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Rack Unit', log_action = 'Create', log_description = '$session_name added units $unit_start to $unit_end to the rack', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ logAction("Rack", "Edit", "$session_name added device $name to units $unit_start - $unit_end in rack $rack_name", $client_id, $rack_id);
- $_SESSION['alert_message'] = "Device added to units $unit_start - $unit_end in rack.";
+ $_SESSION['alert_message'] = "Device $name added to units $unit_start - $unit_end in rack.";
header("Location: " . $_SERVER["HTTP_REFERER"]);
}
if (isset($_POST['edit_rack_unit'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$unit_id = intval($_POST['unit_id']);
$client_id = intval($_POST['client_id']);
@@ -227,12 +233,18 @@ if (isset($_POST['edit_rack_unit'])) {
$unit_end = intval($_POST['unit_end']);
$asset = intval($_POST['asset']);
+ // Get Name and Client ID for logging and alert message
+ $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
+ $row = mysqli_fetch_array($sql);
+ $rack_name = sanitizeInput($row['rack_name']);
+ $client_id = intval($row['rack_client_id']);
+
mysqli_query($mysqli,"UPDATE rack_units SET unit_device = '$name', unit_asset_id = $asset, unit_start_number = $unit_start, unit_end_number = $unit_end WHERE unit_id = $unit_id");
- //Logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Rack Unit', log_action = 'Edit', log_description = '$session_name edited a unit on the rack', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ // Logging
+ logAction("Rack", "Edit", "$session_name edited device $name in rack $rack_name", $client_id, $rack_id);
- $_SESSION['alert_message'] = "Device edited on the rack";
+ $_SESSION['alert_message'] = "Device $name edited on the rack";
header("Location: " . $_SERVER["HTTP_REFERER"]);
@@ -240,7 +252,7 @@ if (isset($_POST['edit_rack_unit'])) {
if (isset($_GET['remove_rack_unit'])) {
- validateTechRole();
+ enforceUserPermission('module_support', 2);
$unit_id = intval($_GET['remove_rack_unit']);
@@ -248,16 +260,17 @@ if (isset($_GET['remove_rack_unit'])) {
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_id, rack_client_id FROM racks LEFT JOIN rack_units ON unit_rack_id = rack_id WHERE unit_id = $unit_id");
$row = mysqli_fetch_array($sql);
$rack_name = sanitizeInput($row['rack_name']);
+ $unit_device = sanitizeInput($row['unit_device']);
$client_id = intval($row['rack_client_id']);
$rack_id = intval($row['rack_id']);
mysqli_query($mysqli,"DELETE FROM rack_units WHERE unit_id = $unit_id");
- //Logging
- mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Rack Unit', log_action = 'Delete', log_description = '$session_name removed device from rack', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $rack_id");
+ // Logging
+ logAction("Rack", "Edit", "$session_name removed device $device_name from rack $rack_name", $client_id, $rack_id);
$_SESSION['alert_type'] = "error";
- $_SESSION['alert_message'] = "You removed device from the rack";
+ $_SESSION['alert_message'] = "Device $device_name removed from rack";
header("Location: " . $_SERVER["HTTP_REFERER"]);