AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 08:50:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
agent/ajax.php
View File

@@ -47,7 +47,7 @@ if (isset($_POST['client_set_notes'])) {
enforceUserPermission('module_client', 2);
$client_id = intval($_POST['client_id']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
// Update notes
mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id");
@@ -64,14 +64,14 @@ if (isset($_POST['contact_set_notes'])) {
enforceUserPermission('module_client', 2);
$contact_id = intval($_POST['contact_id']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
// Get Contact Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id
FROM contacts WHERE contact_id = $contact_id"
);
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
// Update notes
@@ -89,14 +89,14 @@ if (isset($_POST['asset_set_notes'])) {
enforceUserPermission('module_support', 2);
$asset_id = intval($_POST['asset_id']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
// Get Asset Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id
FROM assets WHERE asset_id = $asset_id"
);
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
// Update notes
@@ -161,10 +161,10 @@ if (isset($_GET['share_generate_link'])) {
$item_encrypted_credential = ''; // Default empty
$client_id = intval($_GET['client_id']);
$item_type = sanitizeInput($_GET['type']);
$item_type = escapeSql($_GET['type']);
$item_id = intval($_GET['id']);
$item_email = sanitizeInput($_GET['contact_email']);
$item_note = sanitizeInput($_GET['note']);
$item_email = escapeSql($_GET['contact_email']);
$item_note = escapeSql($_GET['note']);
$item_view_limit = intval($_GET['views']);
$item_view_limit_wording = "";
if ($item_view_limit == 1) {
@@ -188,19 +188,19 @@ if (isset($_GET['share_generate_link'])) {
if ($item_type == "Document") {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = $item_id AND document_client_id = $client_id LIMIT 1"));
$item_name = sanitizeInput($row['document_name']);
$item_name = escapeSql($row['document_name']);
}
if ($item_type == "File") {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = $item_id AND file_client_id = $client_id LIMIT 1"));
$item_name = sanitizeInput($row['file_name']);
$item_name = escapeSql($row['file_name']);
}
if ($item_type == "Credential") {
$credential = mysqli_query($mysqli, "SELECT credential_name, credential_username, credential_password FROM credentials WHERE credential_id = $item_id AND credential_client_id = $client_id LIMIT 1");
$row = mysqli_fetch_assoc($credential);
$item_name = sanitizeInput($row['credential_name']);
$item_name = escapeSql($row['credential_name']);
// Decrypt & re-encrypt username/password for sharing
$credential_encryption_key = randomString();
@@ -230,14 +230,14 @@ if (isset($_GET['share_generate_link'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
// Send user e-mail, if specified
if(!empty($config_smtp_host) && filter_var($item_email, FILTER_VALIDATE_EMAIL)){
@@ -401,7 +401,7 @@ if (isset($_GET['get_totp_token_via_id'])) {
$credential_id = intval($_GET['credential_id']);
$sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_otp_secret, credential_client_id FROM credentials WHERE credential_id = $credential_id"));
$name = sanitizeInput($sql['credential_name']);
$name = escapeSql($sql['credential_name']);
$totp_secret = $sql['credential_otp_secret'];
$client_id = intval($sql['credential_client_id']);
@@ -501,26 +501,26 @@ if (isset($_POST['update_kanban_ticket'])) {
");
$row = mysqli_fetch_assoc($ticket_sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_subject = escapeSql($row['ticket_subject']);
$client_id = intval($row['ticket_client_id']);
$ticket_assigned_to = intval($row['ticket_assigned_to']);
$ticket_status = sanitizeInput($row['ticket_status_name']);
$url_key = sanitizeInput($row['ticket_url_key']);
$ticket_status = escapeSql($row['ticket_status_name']);
$url_key = escapeSql($row['ticket_url_key']);
// Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
// Get Company Info
$sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// EMAIL
$subject = "Ticket resolved - [$ticket_prefix$ticket_number] - $ticket_subject | (pending closure)";
@@ -548,7 +548,7 @@ if (isset($_POST['update_kanban_ticket'])) {
$sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id");
$body .= "<br><br>----------------------------------------<br>YOU ARE A COLLABORATOR ON THIS TICKET";
while ($row = mysqli_fetch_assoc($sql_watchers)) {
$watcher_email = sanitizeInput($row['watcher_email']);
$watcher_email = escapeSql($row['watcher_email']);
// Queue Mail
$data[] = [
@@ -712,7 +712,7 @@ if (isset($_POST['update_recurring_invoice_items_order'])) {
if (isset($_GET['client_duplicate_check'])) {
enforceUserPermission('module_client', 2);
$name = sanitizeInput($_GET['name']);
$name = escapeSql($_GET['name']);
$response['message'] = ""; // default
@@ -736,8 +736,8 @@ if (isset($_GET['client_duplicate_check'])) {
if (isset($_GET['contact_email_check'])) {
enforceUserPermission('module_client', 2);
$email = sanitizeInput($_GET['email']);
$domain = sanitizeInput(substr($_GET['email'], strpos($_GET['email'], '@') + 1));
$email = escapeSql($_GET['email']);
$domain = escapeSql(substr($_GET['email'], strpos($_GET['email'], '@') + 1));
$response['message'] = ""; // default
@@ -1014,7 +1014,7 @@ if (isset($_GET['ai_ticket_summary'])) {
if (isset($_GET['apex_domain_check'])) {
enforceUserPermission('module_support', 2);
$domain = sanitizeInput($_GET['domain']);
$domain = escapeSql($_GET['domain']);
$response['message'] = ""; // default

4
agent/client_autopay.php
View File

@@ -17,8 +17,8 @@ $config_stripe_secret = escapeHtml($stripe_vars['config_stripe_secret']);
// Get client's StripeID from database
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
if ($stripe_client_details) {
$stripe_id = sanitizeInput($stripe_client_details['stripe_id']);
$stripe_pm = sanitizeInput($stripe_client_details['stripe_pm']);
$stripe_id = escapeSql($stripe_client_details['stripe_id']);
$stripe_pm = escapeSql($stripe_client_details['stripe_pm']);
}
// Stripe not enabled in settings

4
agent/clients.php
View File

@@ -32,7 +32,7 @@ if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) {
// Industry Filter
if (isset($_GET['industry']) & !empty($_GET['industry'])) {
$industry_query = "AND (clients.client_type = '" . sanitizeInput($_GET['industry']) . "')";
$industry_query = "AND (clients.client_type = '" . escapeSql($_GET['industry']) . "')";
$industry_filter = escapeHtml($_GET['industry']);
} else {
// Default - any
@@ -42,7 +42,7 @@ if (isset($_GET['industry']) & !empty($_GET['industry'])) {
// Referral Filter
if (isset($_GET['referral']) & !empty($_GET['referral'])) {
$referral_query = "AND (clients.client_referral = '" . sanitizeInput($_GET['referral']) . "')";
$referral_query = "AND (clients.client_referral = '" . escapeSql($_GET['referral']) . "')";
$referral_filter = escapeHtml($_GET['referral']);
} else {
// Default - any

2
agent/global_search.php
View File

@@ -11,7 +11,7 @@ $purifier = new HTMLPurifier($purifier_config);
if (isset($_GET['query'])) {
$query = sanitizeInput($_GET['query']);
$query = escapeSql($_GET['query']);
$phone_query = preg_replace("/[^0-9]/", '', $query);
if (empty($phone_query)) {

2
agent/modals/product/product_stock_add.php
View File

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
$product_id = intval($_GET['id']);
// Get product name
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
// Generate the HTML form content using output buffering.
ob_start();

2
agent/payments.php
View File

@@ -20,7 +20,7 @@ enforceUserPermission('module_financial');
// Payment Method Filter
if (isset($_GET['method']) & !empty($_GET['method'])) {
$payment_method_query = "AND (payment_method = '" . sanitizeInput($_GET['method']) . "')";
$payment_method_query = "AND (payment_method = '" . escapeSql($_GET['method']) . "')";
$method_filter = escapeHtml($_GET['method']);
} else {
// Default - any

14
agent/post/account.php
View File

@@ -12,10 +12,10 @@ if (isset($_POST['add_account'])) {
enforceUserPermission('module_financial', 2);
$name = sanitizeInput($_POST['name']);
$name = escapeSql($_POST['name']);
$opening_balance = floatval($_POST['opening_balance']);
$currency_code = sanitizeInput($_POST['currency_code']);
$notes = sanitizeInput($_POST['notes']);
$currency_code = escapeSql($_POST['currency_code']);
$notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"INSERT INTO accounts SET account_name = '$name', opening_balance = $opening_balance, account_currency_code = '$currency_code', account_notes = '$notes'");
@@ -34,8 +34,8 @@ if (isset($_POST['edit_account'])) {
enforceUserPermission('module_financial', 2);
$account_id = intval($_POST['account_id']);
$name = sanitizeInput($_POST['name']);
$notes = sanitizeInput($_POST['notes']);
$name = escapeSql($_POST['name']);
$notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"UPDATE accounts SET account_name = '$name', account_notes = '$notes' WHERE account_id = $account_id");
@@ -55,7 +55,7 @@ if (isset($_GET['archive_account'])) {
$account_id = intval($_GET['archive_account']);
$account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name'));
$account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name'));
mysqli_query($mysqli,"UPDATE accounts SET account_archived_at = NOW() WHERE account_id = $account_id");
@@ -76,7 +76,7 @@ if (isset($_GET['delete_account'])) {
$account_id = intval($_GET['delete_account']);
$account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name'));
$account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name'));
mysqli_query($mysqli,"DELETE FROM accounts WHERE account_id = $account_id");

152
agent/post/asset.php
View File

@@ -91,7 +91,7 @@ if (isset($_POST['edit_asset'])) {
// Get Existing Photo and assigned client_id
$sql = mysqli_query($mysqli,"SELECT asset_photo, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['asset_photo']);
$existing_file_name = escapeSql($row['asset_photo']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -158,7 +158,7 @@ if (isset($_GET['archive_asset'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -187,7 +187,7 @@ if (isset($_GET['restore_asset'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -216,7 +216,7 @@ if (isset($_GET['delete_asset'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -246,7 +246,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) {
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -290,7 +290,7 @@ if (isset($_POST['bulk_assign_asset_location'])) {
// Get Location name and client id for logging and alert
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -307,7 +307,7 @@ if (isset($_POST['bulk_assign_asset_location'])) {
// Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -333,7 +333,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) {
enforceUserPermission('module_support', 2);
$physical_location = sanitizeInput($_POST['physical_location']);
$physical_location = escapeSql($_POST['physical_location']);
// Assign Physical Location to Selected Assets
if (isset($_POST['asset_ids'])) {
@@ -347,7 +347,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) {
// Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -392,15 +392,15 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
LEFT JOIN clients ON client_id = asset_client_id
WHERE asset_id = $current_asset_id")
);
$asset_name = sanitizeInput($row['asset_name']);
$asset_notes = sanitizeInput($row['asset_notes']);
$asset_name = escapeSql($row['asset_name']);
$asset_notes = escapeSql($row['asset_notes']);
$current_client_id = intval($row['asset_client_id']);
$current_client_name = sanitizeInput($row['client_name']);
$current_client_name = escapeSql($row['client_name']);
enforceClientAccess($current_client_id);
// Get new client name for logging
$new_client_name = sanitizeInput(getFieldById('clients', $new_client_id, 'client_name'));
$new_client_name = escapeSql(getFieldById('clients', $new_client_id, 'client_name'));
// Create new asset
mysqli_query($mysqli, "
@@ -415,8 +415,8 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
$sql_interfaces = mysqli_query($mysqli, "SELECT * FROM asset_interfaces WHERE interface_asset_id = $current_asset_id");
while ($row = mysqli_fetch_assoc($sql_interfaces)) {
$interface_name = sanitizeInput($row['interface_name']);
$interface_mac = sanitizeInput($row['interface_mac']);
$interface_name = escapeSql($row['interface_name']);
$interface_mac = escapeSql($row['interface_mac']);
$interface_primary = intval($row['interface_primary']);
mysqli_query($mysqli,"INSERT INTO asset_interfaces SET interface_name = '$interface_name', interface_mac = '$interface_mac', interface_primary = $interface_primary, interface_asset_id = $new_asset_id");
@@ -468,7 +468,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) {
// Get Contact name and client id for logging and Notification
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -485,7 +485,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) {
// Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id");
@@ -508,7 +508,7 @@ if (isset($_POST['bulk_edit_asset_status'])) {
enforceUserPermission('module_support', 2);
$status = sanitizeInput($_POST['bulk_status']);
$status = escapeSql($_POST['bulk_status']);
if (isset($_POST['asset_ids'])) {
@@ -520,7 +520,7 @@ if (isset($_POST['bulk_edit_asset_status'])) {
// Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -560,7 +560,7 @@ if (isset($_POST['bulk_favorite_assets'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -598,7 +598,7 @@ if (isset($_POST['bulk_unfavorite_assets'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -636,7 +636,7 @@ if (isset($_POST['bulk_archive_assets'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -677,7 +677,7 @@ if (isset($_POST['bulk_restore_assets'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -719,7 +719,7 @@ if (isset($_POST['bulk_delete_assets'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -752,13 +752,13 @@ if (isset($_POST['link_software_to_asset'])) {
// Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']);
$software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"INSERT INTO software_assets SET asset_id = $asset_id, software_id = $software_id");
@@ -782,13 +782,13 @@ if (isset($_GET['unlink_software_from_asset'])) {
// Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']);
$software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM software_assets WHERE asset_id = $asset_id AND software_id = $software_id");
@@ -813,13 +813,13 @@ if (isset($_POST['link_asset_to_credential'])) {
// Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = $asset_id WHERE credential_id = $credential_id");
@@ -843,13 +843,13 @@ if (isset($_GET['unlink_credential_from_asset'])) {
// Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = 0 WHERE credential_id = $credential_id");
@@ -873,13 +873,13 @@ if (isset($_POST['link_service_to_asset'])) {
// Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']);
$service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"INSERT INTO service_assets SET asset_id = $asset_id, service_id = $service_id");
@@ -903,13 +903,13 @@ if (isset($_GET['unlink_service_from_asset'])) {
// Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']);
$service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM service_assets WHERE asset_id = $asset_id AND service_id = $service_id");
@@ -933,13 +933,13 @@ if (isset($_POST['link_asset_to_file'])) {
// Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
// asset add query
mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id");
@@ -964,13 +964,13 @@ if (isset($_GET['unlink_asset_from_file'])) {
// Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id");
@@ -1045,7 +1045,7 @@ if (isset($_POST["import_assets_csv"])) {
// Name
if (isset($column[0])) {
$name = sanitizeInput($column[0]);
$name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id = $client_id")) > 0) {
$duplicate_detect = 1;
}
@@ -1053,37 +1053,37 @@ if (isset($_POST["import_assets_csv"])) {
// Desc
if (!empty($column[1])) {
$description = sanitizeInput($column[1]);
$description = escapeSql($column[1]);
}
// Type
if (!empty($column[2])) {
$type = sanitizeInput($column[2]);
$type = escapeSql($column[2]);
}
// Make
if (!empty($column[3])) {
$make = sanitizeInput($column[3]);
$make = escapeSql($column[3]);
}
// Model
if (!empty($column[4])) {
$model = sanitizeInput($column[4]);
$model = escapeSql($column[4]);
}
// Serial
if (!empty($column[5])) {
$serial = sanitizeInput($column[5]);
$serial = escapeSql($column[5]);
}
// OS
if (!empty($column[6])) {
$os = sanitizeInput($column[6]);
$os = escapeSql($column[6]);
}
// Purchase date
if (!empty($column[7])) {
$purchase_date = sanitizeInput($column[7]);
$purchase_date = escapeSql($column[7]);
if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $purchase_date) || empty($purchase_date)) {
$purchase_date = "NULL";
@@ -1094,7 +1094,7 @@ if (isset($_POST["import_assets_csv"])) {
// Assigned to (contact)
if (!empty($column[8])) {
$contact = sanitizeInput($column[8]);
$contact = escapeSql($column[8]);
if ($contact) {
$sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_contact);
@@ -1104,7 +1104,7 @@ if (isset($_POST["import_assets_csv"])) {
// Location (lookup)
if (!empty($column[9])) {
$location = sanitizeInput($column[9]);
$location = escapeSql($column[9]);
if ($location) {
$sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_location);
@@ -1114,12 +1114,12 @@ if (isset($_POST["import_assets_csv"])) {
// Physical location (varchar)
if (!empty($column[10])) {
$physical_location = sanitizeInput($column[10]);
$physical_location = escapeSql($column[10]);
}
// Notes (varchar)
if (!empty($column[11])) {
$notes = sanitizeInput($column[11]);
$notes = escapeSql($column[11]);
}
// Check if duplicate was detected
@@ -1271,7 +1271,7 @@ if (isset($_POST['add_asset_interface'])) {
WHERE asset_id = $asset_id
");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1335,14 +1335,14 @@ if (isset($_POST['add_asset_multiple_interfaces'])) {
$asset_id = intval($_POST['asset_id']);
$interface_start = intval($_POST['interface_start']);
$interfaces = intval($_POST['interfaces']);
$type = sanitizeInput($_POST['type']);
$name_prefix = sanitizeInput($_POST['name_prefix']);
$type = escapeSql($_POST['type']);
$name_prefix = escapeSql($_POST['name_prefix']);
$network = intval($_POST['network']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
$sql = mysqli_query($mysqli, "SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1393,7 +1393,7 @@ if (isset($_POST['edit_asset_interface'])) {
");
$row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']);
$asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1471,8 +1471,8 @@ if (isset($_GET['delete_asset_interface'])) {
");
$row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']);
$interface_name = sanitizeInput($row['interface_name']);
$asset_name = sanitizeInput($row['asset_name']);
$interface_name = escapeSql($row['interface_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1505,7 +1505,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) {
enforceUserPermission('module_support', 2);
$type = sanitizeInput($_POST['bulk_type']);
$type = escapeSql($_POST['bulk_type']);
if (isset($_POST['interface_ids'])) {
@@ -1524,7 +1524,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) {
");
$row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']);
$asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1554,7 +1554,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) {
$network_id = intval($_POST['bulk_network']);
// Get Network Name for logging
$network_name = sanitizeInput(getFieldById('networks', $network_id, 'network_name'));
$network_name = escapeSql(getFieldById('networks', $network_id, 'network_name'));
if (isset($_POST['interface_ids'])) {
@@ -1573,7 +1573,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) {
");
$row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']);
$asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1616,7 +1616,7 @@ if (isset($_POST['bulk_edit_asset_interface_ip_dhcp'])) {
");
$row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']);
$asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1660,8 +1660,8 @@ if (isset($_POST['bulk_delete_asset_interfaces'])) {
");
$row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']);
$interface_name = sanitizeInput($row['interface_name']);
$asset_name = sanitizeInput($row['asset_name']);
$interface_name = escapeSql($row['interface_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
@@ -1693,7 +1693,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
$sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql_asset);
$client_id = intval($row['asset_client_id']);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
enforceClientAccess();
@@ -1742,31 +1742,31 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
$duplicate_detect = 0;
if (isset($column[0])) {
$name = sanitizeInput($column[0]);
$name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT interface_name FROM asset_interfaces WHERE interface_asset_id = $asset_id AND interface_name = '$name'")) > 0) {
$duplicate_detect = 1;
}
}
if (!empty($column[1])) {
$description = sanitizeInput($column[1]);
$description = escapeSql($column[1]);
}
if (!empty($column[2])) {
$type = sanitizeInput($column[2]);
$type = escapeSql($column[2]);
}
if (!empty($column[3])) {
$mac = sanitizeInput($column[3]);
$mac = escapeSql($column[3]);
}
if (!empty($column[4])) {
$ip = sanitizeInput($column[4]);
$ip = escapeSql($column[4]);
}
if (!empty($column[5])) {
$nat_ip = sanitizeInput($column[5]);
$nat_ip = escapeSql($column[5]);
}
if (!empty($column[6])) {
$ipv6 = sanitizeInput($column[6]);
$ipv6 = escapeSql($column[6]);
}
if (!empty($column[7])) {
$network = sanitizeInput($column[7]);
$network = escapeSql($column[7]);
if ($network) {
$sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_network);

18
agent/post/asset_interface_model.php
View File

@@ -1,17 +1,17 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$primary_interface = sanitizeInput($_POST['primary_interface']) ?? 0;
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);
$mac = sanitizeInput($_POST['mac']);
$ip = sanitizeInput($_POST['ip']);
$name = escapeSql($_POST['name']);
$primary_interface = escapeSql($_POST['primary_interface']) ?? 0;
$description = escapeSql($_POST['description']);
$type = escapeSql($_POST['type']);
$mac = escapeSql($_POST['mac']);
$ip = escapeSql($_POST['ip']);
if ($_POST['dhcp'] == 1){
$ip = 'DHCP';
}
$nat_ip = sanitizeInput($_POST['nat_ip']);
$ipv6 = sanitizeInput($_POST['ipv6']);
$nat_ip = escapeSql($_POST['nat_ip']);
$ipv6 = escapeSql($_POST['ipv6']);
$network = intval($_POST['network']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
$connected_to = intval($_POST['connected_to']);

42
agent/post/asset_model.php
View File

@@ -1,48 +1,48 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);
$make = sanitizeInput($_POST['make']);
$model = sanitizeInput($_POST['model']);
$serial = sanitizeInput($_POST['serial']);
$os = sanitizeInput($_POST['os']);
$ip = sanitizeInput($_POST['ip']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$type = escapeSql($_POST['type']);
$make = escapeSql($_POST['make']);
$model = escapeSql($_POST['model']);
$serial = escapeSql($_POST['serial']);
$os = escapeSql($_POST['os']);
$ip = escapeSql($_POST['ip']);
$dhcp = intval($_POST['dhcp'] ?? 0);
if ($dhcp == 1) {
$ip = 'DHCP';
}
$ipv6 = sanitizeInput($_POST['ipv6']);
$nat_ip = sanitizeInput($_POST['nat_ip']);
$mac = sanitizeInput($_POST['mac']);
$uri = sanitizeInput($_POST['uri']);
$uri_2 = sanitizeInput($_POST['uri_2']);
$uri_client = sanitizeInput($_POST['uri_client']);
$status = sanitizeInput($_POST['status']);
$ipv6 = escapeSql($_POST['ipv6']);
$nat_ip = escapeSql($_POST['nat_ip']);
$mac = escapeSql($_POST['mac']);
$uri = escapeSql($_POST['uri']);
$uri_2 = escapeSql($_POST['uri_2']);
$uri_client = escapeSql($_POST['uri_client']);
$status = escapeSql($_POST['status']);
$location = intval($_POST['location'] ?? 0);
$physical_location = sanitizeInput($_POST['physical_location']);
$physical_location = escapeSql($_POST['physical_location']);
$vendor = intval($_POST['vendor'] ?? 0);
$contact = intval($_POST['contact'] ?? 0);
$network = intval($_POST['network'] ?? 0);
$purchase_reference = sanitizeInput($_POST['purchase_reference']);
$purchase_date = sanitizeInput($_POST['purchase_date']);
$purchase_reference = escapeSql($_POST['purchase_reference']);
$purchase_date = escapeSql($_POST['purchase_date']);
if (empty($purchase_date)) {
$purchase_date = "NULL";
} else {
$purchase_date = "'" . $purchase_date . "'";
}
$warranty_expire = sanitizeInput($_POST['warranty_expire']);
$warranty_expire = escapeSql($_POST['warranty_expire']);
if (empty($warranty_expire)) {
$warranty_expire = "NULL";
} else {
$warranty_expire = "'" . $warranty_expire . "'";
}
$install_date = sanitizeInput($_POST['install_date']);
$install_date = escapeSql($_POST['install_date']);
if (empty($install_date)) {
$install_date = "NULL";
} else {
$install_date = "'" . $install_date . "'";
}
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
$favorite = intval($_POST['favorite'] ?? 0);

6
agent/post/category_model.php
View File

@@ -1,6 +1,6 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$type = sanitizeInput($_POST['type']);
$color = sanitizeInput($_POST['color']);
$name = escapeSql($_POST['name']);
$type = escapeSql($_POST['type']);
$color = escapeSql($_POST['color']);

18
agent/post/certificate.php
View File

@@ -24,7 +24,7 @@ if (isset($_POST['add_certificate'])) {
$public_key_obj = openssl_x509_parse($_POST['public_key']);
if ($public_key_obj) {
$expire = date('Y-m-d', $public_key_obj['validTo_time_t']);
$issued_by = sanitizeInput($public_key_obj['issuer']['O']);
$issued_by = escapeSql($public_key_obj['issuer']['O']);
}
}
@@ -66,7 +66,7 @@ if (isset($_POST['edit_certificate'])) {
$public_key_obj = openssl_x509_parse($_POST['public_key']);
if ($public_key_obj) {
$expire = date('Y-m-d', $public_key_obj['validTo_time_t']);
$issued_by = sanitizeInput($public_key_obj['issuer']['O']);
$issued_by = escapeSql($public_key_obj['issuer']['O']);
}
}
@@ -104,9 +104,9 @@ if (isset($_POST['edit_certificate'])) {
foreach ($original_certificate_info as $column => $old_value) {
$new_value = $new_certificate_info[$column];
if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
$column = sanitizeInput($column);
$old_value = sanitizeInput($old_value);
$new_value = sanitizeInput($new_value);
$column = escapeSql($column);
$old_value = escapeSql($old_value);
$new_value = escapeSql($new_value);
mysqli_query($mysqli,"INSERT INTO certificate_history SET certificate_history_column = '$column', certificate_history_old_value = '$old_value', certificate_history_new_value = '$new_value', certificate_history_certificate_id = $certificate_id");
}
}
@@ -130,7 +130,7 @@ if (isset($_GET['archive_certificate'])) {
// Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']);
$certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']);
enforceClientAccess();
@@ -156,7 +156,7 @@ if (isset($_GET['restore_certificate'])) {
// Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']);
$certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']);
enforceClientAccess();
@@ -182,7 +182,7 @@ if (isset($_GET['delete_certificate'])) {
// Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']);
$certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']);
enforceClientAccess();
@@ -216,7 +216,7 @@ if (isset($_POST['bulk_delete_certificates'])) {
// Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']);
$certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']);
enforceClientAccess();

14
agent/post/certificate_model.php
View File

@@ -1,11 +1,11 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$domain = sanitizeInput($_POST['domain']);
$issued_by = sanitizeInput($_POST['issued_by']);
$expire = sanitizeInput($_POST['expire']);
$public_key = sanitizeInput($_POST['public_key']);
$notes = sanitizeInput($_POST['notes']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$domain = escapeSql($_POST['domain']);
$issued_by = escapeSql($_POST['issued_by']);
$expire = escapeSql($_POST['expire']);
$public_key = escapeSql($_POST['public_key']);
$notes = escapeSql($_POST['notes']);
$domain_id = intval($_POST['domain_id'] ?? 0);

92
agent/post/client.php
View File

@@ -350,7 +350,7 @@ if (isset($_GET['archive_client'])) {
}
// Get Client Name
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
$client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
logAction("Client", "Archive", "$session_name archived client $client_name", $client_id, $client_id);
@@ -369,7 +369,7 @@ if (isset($_GET['restore_client'])) {
$client_id = intval($_GET['restore_client']);
// Get Client Name
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
$client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
mysqli_query($mysqli, "UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id");
@@ -390,7 +390,7 @@ if (isset($_GET['delete_client'])) {
$client_id = intval($_GET['delete_client']);
// Get Client Name
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
$client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
// Delete Associations
// Delete Client Data
@@ -580,7 +580,7 @@ if (isset($_POST["import_clients_csv"])) {
while(($column = fgetcsv($file, 1000, ",")) !== false) {
$duplicate_detect = 0;
if (isset($column[0])) {
$name = sanitizeInput($column[0]);
$name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM clients WHERE client_name = '$name'")) > 0) {
$duplicate_detect = 1;
}
@@ -588,22 +588,22 @@ if (isset($_POST["import_clients_csv"])) {
$industry = '';
if (isset($column[1])) {
$industry = sanitizeInput($column[1]);
$industry = escapeSql($column[1]);
}
$referral = '';
if (isset($column[2])) {
$referral = sanitizeInput($column[2]);
$referral = escapeSql($column[2]);
}
$website = '';
if (isset($column[3])) {
$website = sanitizeInput(preg_replace("(^https?://)", "", $column[3]));
$website = escapeSql(preg_replace("(^https?://)", "", $column[3]));
}
$location_name = '';
if (isset($column[4])) {
$location_name = sanitizeInput($column[4]);
$location_name = escapeSql($column[4]);
}
$location_phone = '';
@@ -613,37 +613,37 @@ if (isset($_POST["import_clients_csv"])) {
$address = '';
if (isset($column[6])) {
$address = sanitizeInput($column[6]);
$address = escapeSql($column[6]);
}
$city = '';
if (isset($column[7])) {
$city = sanitizeInput($column[7]);
$city = escapeSql($column[7]);
}
$state = '';
if (isset($column[8])) {
$state = sanitizeInput($column[8]);
$state = escapeSql($column[8]);
}
$zip = '';
if (isset($column[9])) {
$zip = sanitizeInput($column[9]);
$zip = escapeSql($column[9]);
}
$country = '';
if (isset($column[10])) {
$country = sanitizeInput($column[10]);
$country = escapeSql($column[10]);
}
$contact_name = '';
if (isset($column[11])) {
$contact_name = sanitizeInput($column[11]);
$contact_name = escapeSql($column[11]);
}
$title = '';
if (isset($column[12])) {
$title = sanitizeInput($column[12]);
$title = escapeSql($column[12]);
}
$contact_phone = '';
@@ -663,7 +663,7 @@ if (isset($_POST["import_clients_csv"])) {
$contact_email = '';
if (isset($column[16])) {
$contact_email = sanitizeInput($column[16]);
$contact_email = escapeSql($column[16]);
}
$hourly_rate = $config_default_hourly_rate;
@@ -671,24 +671,24 @@ if (isset($_POST["import_clients_csv"])) {
$hourly_rate = floatval($column[17]);
}
$currency_code = sanitizeInput($session_company_currency);
$currency_code = escapeSql($session_company_currency);
if (isset($column[18])) {
$currency_code = sanitizeInput($column[18]);
$currency_code = escapeSql($column[18]);
}
$payment_terms = sanitizeInput($config_default_net_terms);
$payment_terms = escapeSql($config_default_net_terms);
if (isset($column[19])) {
$payment_terms = intval($column[19]);
}
$tax_id_number = '';
if (isset($column[20])) {
$tax_id_number = sanitizeInput($column[20]);
$tax_id_number = escapeSql($column[20]);
}
$abbreviation = '';
if (isset($column[21])) {
$abbreviation = sanitizeInput($column[21]);
$abbreviation = escapeSql($column[21]);
}
// Check if duplicate was detected
@@ -783,8 +783,8 @@ if (isset($_POST['bulk_add_client_ticket'])) {
} else {
$ticket_status = 2;
}
$subject = sanitizeInput($_POST['bulk_subject']);
$priority = sanitizeInput($_POST['bulk_priority']);
$subject = escapeSql($_POST['bulk_subject']);
$priority = escapeSql($_POST['bulk_priority']);
$category_id = intval($_POST['bulk_category']);
$details = mysqli_real_escape_string($mysqli, $_POST['bulk_details']);
$project_id = intval($_POST['bulk_project']);
@@ -799,7 +799,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
// Override Template Subject
if(empty($subject)) {
$subject = sanitizeInput($row['ticket_template_subject']);
$subject = escapeSql($row['ticket_template_subject']);
}
$details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
@@ -820,7 +820,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
// Atomically increment and get the new ticket number
mysqli_query($mysqli, "
@@ -834,10 +834,10 @@ if (isset($_POST['bulk_add_client_ticket'])) {
$ticket_number = mysqli_insert_id($mysqli);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
//Generate a unique URL key for clients to access
$url_key = randomString(32);
@@ -849,7 +849,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
// Add Tasks
if (!empty($_POST['tasks'])) {
foreach ($_POST['tasks'] as $task) {
$task_name = sanitizeInput($task);
$task_name = escapeSql($task);
// Check that task_name is not-empty (For some reason the !empty on the array doesnt work here like in watchers)
if (!empty($task_name)) {
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_ticket_id = $ticket_id");
@@ -862,7 +862,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
if (mysqli_num_rows($sql_task_templates) > 0) {
while ($row = mysqli_fetch_assoc($sql_task_templates)) {
$task_order = intval($row['task_template_order']);
$task_name = sanitizeInput($row['task_template_name']);
$task_name = escapeSql($row['task_template_name']);
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_order = $task_order, task_ticket_id = $ticket_id");
}
@@ -889,7 +889,7 @@ if (isset($_POST['bulk_edit_client_industry'])) {
enforceUserPermission('module_client', 2);
$industry = sanitizeInput($_POST['bulk_industry']);
$industry = escapeSql($_POST['bulk_industry']);
if (isset($_POST['client_ids'])) {
@@ -900,7 +900,7 @@ if (isset($_POST['bulk_edit_client_industry'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_type = '$industry' WHERE client_id = $client_id");
@@ -923,7 +923,7 @@ if (isset($_POST['bulk_edit_client_referral'])) {
enforceUserPermission('module_client', 2);
$referral = sanitizeInput($_POST['bulk_referral']);
$referral = escapeSql($_POST['bulk_referral']);
if (isset($_POST['client_ids'])) {
@@ -934,7 +934,7 @@ if (isset($_POST['bulk_edit_client_referral'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_referral = '$referral' WHERE client_id = $client_id");
@@ -968,7 +968,7 @@ if (isset($_POST['bulk_edit_client_hourly_rate'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_rate = '$rate' WHERE client_id = $client_id");
@@ -1002,7 +1002,7 @@ if (isset($_POST['bulk_edit_client_net_terms'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_net_terms = $net_terms WHERE client_id = $client_id");
@@ -1034,7 +1034,7 @@ if (isset($_POST['bulk_assign_client_tags'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
if ($_POST['bulk_remove_tags']) {
mysqli_query($mysqli, "DELETE FROM client_tags WHERE client_id = $client_id");
@@ -1074,11 +1074,11 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
$count = count($client_ids);
// Email metadata
$mail_from = sanitizeInput($_POST['mail_from']);
$mail_from_name = sanitizeInput($_POST['mail_from_name']);
$subject = sanitizeInput($_POST['subject']);
$mail_from = escapeSql($_POST['mail_from']);
$mail_from_name = escapeSql($_POST['mail_from_name']);
$subject = escapeSql($_POST['subject']);
$body = mysqli_real_escape_string($mysqli, $_POST['body']);
$queued_at = sanitizeInput($_POST['queued_at']);
$queued_at = escapeSql($_POST['queued_at']);
// Build contact type filters
$filters = [];
@@ -1115,7 +1115,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
$unique_contacts = [];
while ($row = mysqli_fetch_assoc($result)) {
$contact_email = sanitizeInput($row['contact_email']);
$contact_email = escapeSql($row['contact_email']);
// Skip if email is missing or invalid
if (empty($contact_email) || !filter_var($contact_email, FILTER_VALIDATE_EMAIL)) {
@@ -1128,7 +1128,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
}
$unique_contacts[$contact_email] = true;
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$data[] = [
'from' => $mail_from,
@@ -1169,7 +1169,7 @@ if (isset($_POST['bulk_archive_clients'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NOW() WHERE client_id = $client_id");
@@ -1205,7 +1205,7 @@ if (isset($_POST['bulk_unarchive_clients'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id");

136
agent/post/contact.php
View File

@@ -96,7 +96,7 @@ if (isset($_POST['edit_contact'])) {
// Get Contact Info
$sql = mysqli_query($mysqli,"SELECT contact_photo, contact_user_id, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['contact_photo']);
$existing_file_name = escapeSql($row['contact_photo']);
$contact_user_id = intval($row['contact_user_id']);
$client_id = intval($row['contact_client_id']);
@@ -175,17 +175,17 @@ if (isset($_POST['edit_contact'])) {
if ($send_email && $auth_method && $config_smtp_provider && $contact_user_id) {
// Sanitize Config vars from get_settings.php
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_base_url = escapeSql($config_base_url);
// Get Company Phone Number
$sql = mysqli_query($mysqli,"SELECT company_name, company_phone FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone']));
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
// Authentication info (azure, reset password, or tech-provided temporary password)
@@ -234,13 +234,13 @@ if (isset($_POST['add_contact_note'])) {
enforceUserPermission('module_client', 2);
$contact_id = intval($_POST['contact_id']);
$type = sanitizeInput($_POST['type']);
$note = sanitizeInput($_POST['note']);
$type = escapeSql($_POST['type']);
$note = escapeSql($_POST['note']);
// Get Contact details for logging and alerting
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -269,8 +269,8 @@ if (isset($_GET['archive_contact_note'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id");
$row = mysqli_fetch_assoc($sql);
$contact_note_type = sanitizeInput($row['contact_note_type']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_note_type = escapeSql($row['contact_note_type']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_id = intval($row['contact_id']);
@@ -297,8 +297,8 @@ if (isset($_GET['restore_contact_note'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id");
$row = mysqli_fetch_assoc($sql);
$contact_note_type = sanitizeInput($row['contact_note_type']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_note_type = escapeSql($row['contact_note_type']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_id = intval($row['contact_id']);
@@ -325,8 +325,8 @@ if (isset($_GET['delete_contact_note'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id");
$row = mysqli_fetch_assoc($sql);
$contact_note_type = sanitizeInput($row['contact_note_type']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_note_type = escapeSql($row['contact_note_type']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_id = intval($row['contact_id']);
@@ -353,7 +353,7 @@ if (isset($_POST['bulk_assign_contact_location'])) {
// Get Location name for logging and Notification
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -370,7 +370,7 @@ if (isset($_POST['bulk_assign_contact_location'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
mysqli_query($mysqli,"UPDATE contacts SET contact_location_id = $location_id WHERE contact_id = $contact_id");
@@ -407,7 +407,7 @@ if (isset($_POST['bulk_edit_contact_phone'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -433,7 +433,7 @@ if (isset($_POST['bulk_edit_contact_department'])) {
enforceUserPermission('module_client', 2);
$department = sanitizeInput($_POST['bulk_department']);
$department = escapeSql($_POST['bulk_department']);
// Assign Location to Selected Contacts
if (isset($_POST['contact_ids'])) {
@@ -447,7 +447,7 @@ if (isset($_POST['bulk_edit_contact_department'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -489,7 +489,7 @@ if (isset($_POST['bulk_edit_contact_role'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -529,7 +529,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -574,11 +574,11 @@ if (isset($_POST['send_bulk_mail_now'])) {
$count = count($_POST['contact_ids']);
$mail_from = sanitizeInput($_POST['mail_from']);
$mail_from_name = sanitizeInput($_POST['mail_from_name']);
$subject = sanitizeInput($_POST['subject']);
$mail_from = escapeSql($_POST['mail_from']);
$mail_from_name = escapeSql($_POST['mail_from_name']);
$subject = escapeSql($_POST['subject']);
$body = mysqli_escape_string($mysqli, $_POST['body']);
$queued_at = sanitizeInput($_POST['queued_at']);
$queued_at = escapeSql($_POST['queued_at']);
// Add Emails
foreach($_POST['contact_ids'] as $contact_id) {
@@ -586,8 +586,8 @@ if (isset($_POST['send_bulk_mail_now'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$client_id = intval($row['contact_client_id']);
enforceClientAccess();
@@ -633,7 +633,7 @@ if (isset($_POST['bulk_archive_contacts'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_primary, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_primary = intval($row['contact_primary']);
$client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']);
@@ -685,7 +685,7 @@ if (isset($_POST['bulk_restore_contacts'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']);
@@ -730,7 +730,7 @@ if (isset($_POST['bulk_delete_contacts'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']);
@@ -769,10 +769,10 @@ if (isset($_GET['anonymize_contact'])) {
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_email, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_first_name = explode(" ", $contact_name)[0];
$contact_email = sanitizeInput($row['contact_email']);
$contact_phone = sanitizeInput($row['contact_phone']);
$contact_email = escapeSql($row['contact_email']);
$contact_phone = escapeSql($row['contact_phone']);
$info_to_redact = array($contact_name, $contact_first_name, $contact_email, $contact_phone);
$client_id = intval($row['contact_client_id']);
@@ -813,7 +813,7 @@ if (isset($_GET['anonymize_contact'])) {
$log_id = intval($log['log_id']);
$description = $log['log_description'];
$description = str_ireplace($info_to_redact, "*****", $description);
$description = sanitizeInput($description);
$description = escapeSql($description);
mysqli_query($mysqli,"UPDATE logs SET log_description = '$description' WHERE log_id = $log_id AND log_client_id = $client_id");
}
@@ -828,14 +828,14 @@ if (isset($_GET['anonymize_contact'])) {
// Redact contact name or email in the subject of all tickets they raised
$subject = $ticket['ticket_subject'];
$subject = str_ireplace($info_to_redact, "*****", $subject);
$subject = sanitizeInput($subject);
$subject = escapeSql($subject);
mysqli_query($mysqli,"UPDATE tickets SET ticket_subject = '$subject' WHERE ticket_id = $ticket_id");
// Redact contact name or email in the description of all tickets they raised
$details = $ticket['ticket_details'];
$details = str_ireplace($info_to_redact, "*****", $details);
$details = sanitizeInput($details);
$details = escapeSql($details);
mysqli_query($mysqli,"UPDATE tickets SET ticket_details = '$details' WHERE ticket_id = $ticket_id");
// Redact contact name or email in the replies of all tickets they raised
@@ -845,7 +845,7 @@ if (isset($_GET['anonymize_contact'])) {
$ticket_reply_id = intval($ticket_reply['ticket_reply_id']);
$ticket_reply_details = $ticket_reply['ticket_reply'];
$ticket_reply_details = str_ireplace($info_to_redact, "*****", $ticket_reply_details);
$ticket_reply_details = sanitizeInput($ticket_reply_details);
$ticket_reply_details = escapeSql($ticket_reply_details);
mysqli_query($mysqli,"UPDATE ticket_replies SET ticket_reply = '$ticket_reply_details'
WHERE ticket_reply_id = $ticket_reply_id"
@@ -876,7 +876,7 @@ if (isset($_GET['archive_contact'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']);
@@ -908,7 +908,7 @@ if (isset($_GET['restore_contact'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']);
@@ -940,7 +940,7 @@ if (isset($_GET['delete_contact'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']);
@@ -973,13 +973,13 @@ if (isset($_POST['link_contact_to_asset'])) {
// Get Asset Name and Client ID for logging
$sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql_asset);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id");
@@ -1003,13 +1003,13 @@ if (isset($_GET['unlink_asset_from_contact'])) {
// Get asset Name and Client ID for logging
$sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql_asset);
$asset_name = sanitizeInput($row['asset_name']);
$asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = 0 WHERE asset_id = $asset_id");
@@ -1033,13 +1033,13 @@ if (isset($_POST['link_software_to_contact'])) {
// Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']);
$software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"INSERT INTO software_contacts SET contact_id = $contact_id, software_id = $software_id");
@@ -1063,13 +1063,13 @@ if (isset($_GET['unlink_software_from_contact'])) {
// Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']);
$software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM software_contacts WHERE contact_id = $contact_id AND software_id = $software_id");
@@ -1093,13 +1093,13 @@ if (isset($_POST['link_contact_to_credential'])) {
// Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = $contact_id WHERE credential_id = $credential_id");
@@ -1123,13 +1123,13 @@ if (isset($_GET['unlink_credential_from_contact'])) {
// Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = 0 WHERE credential_id = $credential_id");
@@ -1153,13 +1153,13 @@ if (isset($_POST['link_service_to_contact'])) {
// Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']);
$service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"INSERT INTO service_contacts SET contact_id = $contact_id, service_id = $service_id");
@@ -1183,13 +1183,13 @@ if (isset($_GET['unlink_service_from_contact'])) {
// Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']);
$service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM service_contacts WHERE contact_id = $contact_id AND service_id = $service_id");
@@ -1213,13 +1213,13 @@ if (isset($_POST['link_contact_to_file'])) {
// Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
// Contact add query
mysqli_query($mysqli,"INSERT INTO contact_files SET contact_id = $contact_id, file_id = $file_id");
@@ -1244,13 +1244,13 @@ if (isset($_GET['unlink_contact_from_file'])) {
// Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM contact_files WHERE contact_id = $contact_id AND file_id = $file_id");
@@ -1370,19 +1370,19 @@ if (isset($_POST["import_contacts_csv"])) {
while(($column = fgetcsv($file, 1000, ",")) !== false) {
$duplicate_detect = 0;
if (isset($column[0])) {
$name = sanitizeInput($column[0]);
$name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$name' AND contact_client_id = $client_id")) > 0) {
$duplicate_detect = 1;
}
}
if (isset($column[1])) {
$title = sanitizeInput($column[1]);
$title = escapeSql($column[1]);
}
if (isset($column[2])) {
$department = sanitizeInput($column[2]);
$department = escapeSql($column[2]);
}
if (isset($column[3])) {
$email = sanitizeInput($column[3]);
$email = escapeSql($column[3]);
}
if (isset($column[4])) {
$phone = preg_replace("/[^0-9]/", '',$column[4]);
@@ -1394,7 +1394,7 @@ if (isset($_POST["import_contacts_csv"])) {
$mobile = preg_replace("/[^0-9]/", '',$column[6]);
}
if (isset($column[7])) {
$location = sanitizeInput($column[7]);
$location = escapeSql($column[7]);
$sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_location);
$location_id = intval($row['location_id']);

14
agent/post/contact_model.php
View File

@@ -1,20 +1,20 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$title = sanitizeInput($_POST['title']);
$department = sanitizeInput($_POST['department']);
$name = escapeSql($_POST['name']);
$title = escapeSql($_POST['title']);
$department = escapeSql($_POST['department']);
$phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']);
$phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
$extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
$mobile_country_code = preg_replace("/[^0-9]/", '', $_POST['mobile_country_code']);
$mobile = preg_replace("/[^0-9]/", '', $_POST['mobile']);
$email = sanitizeInput($_POST['email']);
$notes = sanitizeInput($_POST['notes']);
$email = escapeSql($_POST['email']);
$notes = escapeSql($_POST['notes']);
$contact_primary = intval($_POST['contact_primary'] ?? 0);
$contact_important = intval($_POST['contact_important'] ?? 0);
$contact_billing = intval($_POST['contact_billing'] ?? 0);
$contact_technical = intval($_POST['contact_technical'] ?? 0);
$location_id = intval($_POST['location'] ?? 0);
$pin = sanitizeInput($_POST['pin']);
$auth_method = sanitizeInput($_POST['auth_method']);
$pin = escapeSql($_POST['pin']);
$auth_method = escapeSql($_POST['auth_method']);

30
agent/post/credential.php
View File

@@ -94,7 +94,7 @@ if(isset($_GET['archive_credential'])){
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -120,7 +120,7 @@ if(isset($_GET['restore_credential'])){
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -146,7 +146,7 @@ if (isset($_GET['delete_credential'])) {
// Get Credential Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -179,7 +179,7 @@ if (isset($_POST['bulk_assign_credential_tags'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -232,7 +232,7 @@ if (isset($_POST['bulk_favorite_credentials'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -270,7 +270,7 @@ if (isset($_POST['bulk_unfavorite_credentials'])) {
// Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -310,7 +310,7 @@ if (isset($_POST['bulk_archive_credentials'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -349,7 +349,7 @@ if (isset($_POST['bulk_restore_credentials'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -389,7 +389,7 @@ if (isset($_POST['bulk_delete_credentials'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']);
$credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']);
enforceClientAccess();
@@ -521,30 +521,30 @@ if (isset($_POST["import_credentials_csv"])) {
$duplicate_detect = 0;
// Name
if (isset($column[0])) {
$name = sanitizeInput($column[0]);
$name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM credentials WHERE credential_name = '$name' AND credential_client_id = $client_id")) > 0){
$duplicate_detect = 1;
}
}
// Desc
if (isset($column[1])) {
$description = sanitizeInput($column[1]);
$description = escapeSql($column[1]);
}
// User
if (isset($column[2])) {
$username = sanitizeInput(encryptCredentialEntry($column[2]));
$username = escapeSql(encryptCredentialEntry($column[2]));
}
// Pass
if (isset($column[3])) {
$password = sanitizeInput(encryptCredentialEntry($column[3]));
$password = escapeSql(encryptCredentialEntry($column[3]));
}
// OTP
if (isset($column[4])) {
$totp = sanitizeInput($column[4]);
$totp = escapeSql($column[4]);
}
// URL
if (isset($column[4])) {
$uri = sanitizeInput($column[5]);
$uri = escapeSql($column[5]);
}
// Check if duplicate was detected

12
agent/post/credential_model.php
View File

@@ -2,14 +2,14 @@
// Model of reusable variables for client credentials - not to be confused with the ITFLow login process
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$uri = sanitizeInput($_POST['uri']);
$uri_2 = sanitizeInput($_POST['uri_2']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$uri = escapeSql($_POST['uri']);
$uri_2 = escapeSql($_POST['uri_2']);
$username = encryptCredentialEntry(trim($_POST['username']));
$password = encryptCredentialEntry(trim($_POST['password']));
$otp_secret = sanitizeInput($_POST['otp_secret']);
$note = sanitizeInput($_POST['note']);
$otp_secret = escapeSql($_POST['otp_secret']);
$note = escapeSql($_POST['note']);
$favorite = intval($_POST['favorite'] ?? 0);
$contact_id = intval($_POST['contact'] ?? 0);
$asset_id = intval($_POST['asset'] ?? 0);

6
agent/post/credit.php
View File

@@ -14,9 +14,9 @@ if (isset($_POST['add_credit'])) {
$client_id = intval($_POST['client']);
$amount = floatval($_POST['amount']);
$type = sanitizeInput($_POST['type']);
$expire = sanitizeInput($_POST['expire']);
$note = sanitizeInput($_POST['note']);
$type = escapeSql($_POST['type']);
$expire = escapeSql($_POST['expire']);
$note = escapeSql($_POST['note']);
mysqli_query($mysqli,"INSERT INTO credits SET credit_amount = $amount, credit_type = '$type', credit_note = '$note', credit_created_by = $session_user_id, credit_client_id = $client_id");

82
agent/post/document.php
View File

@@ -60,8 +60,8 @@ if (isset($_POST['add_document_from_template'])) {
enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
$document_name = sanitizeInput($_POST['name']);
$document_description = sanitizeInput($_POST['description']);
$document_name = escapeSql($_POST['name']);
$document_description = escapeSql($_POST['description']);
$document_template_id = intval($_POST['document_template_id']);
$folder = intval($_POST['folder']);
@@ -76,7 +76,7 @@ if (isset($_POST['add_document_from_template'])) {
$row = mysqli_fetch_assoc($sql_document);
$document_template_name = sanitizeInput($row['document_template_name']);
$document_template_name = escapeSql($row['document_template_name']);
$template_content_html = $row['document_template_content']; // raw HTML from template
// 1) Create the new document with placeholder content to get an ID
@@ -110,7 +110,7 @@ if (isset($_POST['add_document_from_template'])) {
// 4) Prepare content + content_raw
$content = mysqli_real_escape_string($mysqli, $processed_html);
$content_raw = sanitizeInput(
$content_raw = escapeSql(
$document_name . " " . str_replace("<", " <", $processed_html)
);
$content_raw = mysqli_real_escape_string($mysqli, $content_raw);
@@ -161,13 +161,13 @@ if (isset($_POST['edit_document'])) {
$row = mysqli_fetch_assoc($sql_original_document);
$original_document_name = sanitizeInput($row['document_name']);
$original_document_description = sanitizeInput($row['document_description']);
$original_document_name = escapeSql($row['document_name']);
$original_document_description = escapeSql($row['document_description']);
$original_document_content = mysqli_real_escape_string($mysqli, $row['document_content']);
$original_document_created_by = intval($row['document_created_by']);
$original_document_updated_by = intval($row['document_updated_by']);
$original_document_created_at = sanitizeInput($row['document_created_at']);
$original_document_updated_at = sanitizeInput($row['document_updated_at']);
$original_document_created_at = escapeSql($row['document_created_at']);
$original_document_updated_at = escapeSql($row['document_updated_at']);
if ($original_document_updated_at) {
$document_version_created_at = $original_document_updated_at;
@@ -211,7 +211,7 @@ if (isset($_POST['edit_document'])) {
$content = mysqli_real_escape_string($mysqli, $processed_html);
// Rebuild content_raw for full-text search
$content_raw = sanitizeInput(
$content_raw = escapeSql(
$name . " " . str_replace("<", " <", $processed_html)
);
$content_raw = mysqli_real_escape_string($mysqli, $content_raw);
@@ -254,7 +254,7 @@ if (isset($_POST['move_document'])) {
// Get Document Name Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -262,7 +262,7 @@ if (isset($_POST['move_document'])) {
// Get Folder Name for logging
$sql_folder = mysqli_query($mysqli,"SELECT folder_name FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql_folder);
$folder_name = sanitizeInput($row['folder_name']);
$folder_name = escapeSql($row['folder_name']);
// Document edit query
mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id");
@@ -282,7 +282,7 @@ if (isset($_POST['rename_document'])) {
enforceUserPermission('module_support', 2);
$document_id = intval($_POST['document_id']);
$name = sanitizeInput($_POST['name']);
$name = escapeSql($_POST['name']);
$client_id = intval(getFieldById('documents', $document_id, 'document_client_id'));
@@ -291,7 +291,7 @@ if (isset($_POST['rename_document'])) {
// Get Document Name before renaming for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$old_document_name = sanitizeInput($row['document_name']);
$old_document_name = escapeSql($row['document_name']);
// Document edit query
mysqli_query($mysqli,"UPDATE documents SET document_name = '$name', document_updated_at = document_updated_at WHERE document_id = $document_id");
@@ -316,7 +316,7 @@ if (isset($_POST['bulk_move_document'])) {
// Get folder name for logging and Notification
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql);
$folder_name = sanitizeInput($row['folder_name']);
$folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']);
enforceClientAccess();
@@ -330,7 +330,7 @@ if (isset($_POST['bulk_move_document'])) {
foreach($_POST['document_ids'] as $document_id) {
$document_id = intval($document_id);
// Get document name for logging
$document_name = sanitizeInput(getFieldById('documents', $document_id, 'document_name'));
$document_name = escapeSql(getFieldById('documents', $document_id, 'document_name'));
// Document move query
mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id");
@@ -359,13 +359,13 @@ if (isset($_POST['link_file_to_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get File Name for logging
$file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name'));
$file_name = escapeSql(getFieldById('files', $file_id, 'file_name'));
// Document add query
mysqli_query($mysqli,"INSERT INTO document_files SET file_id = $file_id, document_id = $document_id");
@@ -390,13 +390,13 @@ if (isset($_GET['unlink_file_from_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get File Name for logging
$file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name'));
$file_name = escapeSql(getFieldById('files', $file_id, 'file_name'));
mysqli_query($mysqli,"DELETE FROM document_files WHERE file_id = $file_id AND document_id = $document_id");
@@ -420,13 +420,13 @@ if (isset($_POST['link_vendor_to_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Vendor Name for logging
$vendor_name = sanitizeInput(getFieldById('vendors', $vendor_id, 'vendor_name'));
$vendor_name = escapeSql(getFieldById('vendors', $vendor_id, 'vendor_name'));
// Document add query
mysqli_query($mysqli,"INSERT INTO vendor_documents SET vendor_id = $vendor_id, document_id = $document_id");
@@ -451,13 +451,13 @@ if (isset($_GET['unlink_vendor_from_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Vendor Name for logging
$vendor_name = sanitizeInput(getFieldById('vendors', $vendor_id, 'vendor_name'));
$vendor_name = escapeSql(getFieldById('vendors', $vendor_id, 'vendor_name'));
mysqli_query($mysqli,"DELETE FROM vendor_documents WHERE vendor_id = $vendor_id AND document_id = $document_id");
@@ -482,13 +482,13 @@ if (isset($_POST['link_contact_to_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
// Contact add query
mysqli_query($mysqli,"INSERT INTO contact_documents SET contact_id = $contact_id, document_id = $document_id");
@@ -513,13 +513,13 @@ if (isset($_GET['unlink_contact_from_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name'));
$contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM contact_documents WHERE contact_id = $contact_id AND document_id = $document_id");
@@ -543,13 +543,13 @@ if (isset($_POST['link_asset_to_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"INSERT INTO asset_documents SET asset_id = $asset_id, document_id = $document_id");
@@ -573,13 +573,13 @@ if (isset($_GET['unlink_asset_from_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM asset_documents WHERE asset_id = $asset_id AND document_id = $document_id");
@@ -603,13 +603,13 @@ if (isset($_POST['link_software_to_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Software Name for logging
$software_name = sanitizeInput(getFieldById('software', $software_id, 'software_name'));
$software_name = escapeSql(getFieldById('software', $software_id, 'software_name'));
// Contact add query
mysqli_query($mysqli,"INSERT INTO software_documents SET software_id = $software_id, document_id = $document_id");
@@ -634,13 +634,13 @@ if (isset($_GET['unlink_software_from_document'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
// Get Software Name for logging
$software_name = sanitizeInput(getFieldById('software', $software_id, 'software_name'));
$software_name = escapeSql(getFieldById('software', $software_id, 'software_name'));
mysqli_query($mysqli,"DELETE FROM software_documents WHERE software_id = $software_id AND document_id = $document_id");
@@ -670,7 +670,7 @@ if (isset($_POST['toggle_document_visibility'])) {
// Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -696,7 +696,7 @@ if (isset($_GET['export_document'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT document_name, document_content, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$document_content = $row['document_content'];
$client_id = intval($row['document_client_id']);
@@ -744,7 +744,7 @@ if (isset($_GET['archive_document'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -789,7 +789,7 @@ if (isset($_GET['restore_document'])) {
// Get Document Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -816,7 +816,7 @@ if (isset($_GET['delete_document_version'])) {
$sql = mysqli_query($mysqli,"SELECT document_version_name, document_client_id FROM documents, document_versions WHERE document_version_document_id = document_id AND document_version_id = $document_version_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_version_name = sanitizeInput($row['document_version_name']);
$document_version_name = escapeSql($row['document_version_name']);
enforceClientAccess();
@@ -842,7 +842,7 @@ if (isset($_GET['delete_document'])) {
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
enforceClientAccess();

6
agent/post/document_model.php
View File

@@ -1,9 +1,9 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$name = escapeSql($_POST['name']);
$folder = intval($_POST['folder']);
$description = sanitizeInput($_POST['description']);
$description = escapeSql($_POST['description']);
$content = mysqli_real_escape_string($mysqli,$_POST['content']);
$content_raw = sanitizeInput($_POST['name'] . " " . str_replace("<", " <", $_POST['content']));
$content_raw = escapeSql($_POST['name'] . " " . str_replace("<", " <", $_POST['content']));
// Content Raw is used for FULL INDEX searching. Adding a space before HTML tags to allow spaces between newlines, bulletpoints, etc. for searching.

44
agent/post/domain.php
View File

@@ -33,11 +33,11 @@ if (isset($_POST['add_domain'])) {
// NS, MX, A and WHOIS records/data
$records = getDomainRecords($name);
$a = sanitizeInput($records['a']);
$ns = sanitizeInput($records['ns']);
$mx = sanitizeInput($records['mx']);
$txt = sanitizeInput($records['txt']);
$whois = sanitizeInput($records['whois']);
$a = escapeSql($records['a']);
$ns = escapeSql($records['ns']);
$mx = escapeSql($records['mx']);
$txt = escapeSql($records['txt']);
$whois = escapeSql($records['whois']);
// Add domain record
mysqli_query($mysqli,"INSERT INTO domains SET domain_name = '$name', domain_description = '$description', domain_registrar = $registrar, domain_webhost = $webhost, domain_dnshost = $dnshost, domain_mailhost = $mailhost, domain_expire = $expire, domain_ip = '$a', domain_name_servers = '$ns', domain_mail_servers = '$mx', domain_txt = '$txt', domain_raw_whois = '$whois', domain_notes = '$notes', domain_client_id = $client_id");
@@ -48,9 +48,9 @@ if (isset($_POST['add_domain'])) {
// Get SSL cert for domain (if exists)
$certificate = getSSL($name);
if ($certificate['success'] == "TRUE") {
$expire = sanitizeInput($certificate['expire']);
$issued_by = sanitizeInput($certificate['issued_by']);
$public_key = sanitizeInput($certificate['public_key']);
$expire = escapeSql($certificate['expire']);
$issued_by = escapeSql($certificate['issued_by']);
$public_key = escapeSql($certificate['public_key']);
mysqli_query($mysqli,"INSERT INTO certificates SET certificate_name = '$name', certificate_domain = '$name', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_public_key = '$public_key', certificate_domain_id = $domain_id, certificate_client_id = $client_id");
$extended_log_description = ', with associated SSL cert';
@@ -95,11 +95,11 @@ if (isset($_POST['edit_domain'])) {
// Update NS, MX, A and WHOIS records/data
$records = getDomainRecords($name);
$a = sanitizeInput($records['a']);
$ns = sanitizeInput($records['ns']);
$mx = sanitizeInput($records['mx']);
$txt = sanitizeInput($records['txt']);
$whois = sanitizeInput($records['whois']);
$a = escapeSql($records['a']);
$ns = escapeSql($records['ns']);
$mx = escapeSql($records['mx']);
$txt = escapeSql($records['txt']);
$whois = escapeSql($records['whois']);
// Current domain info
$original_domain_info = mysqli_fetch_assoc(mysqli_query($mysqli,"
@@ -141,9 +141,9 @@ if (isset($_POST['edit_domain'])) {
foreach ($original_domain_info as $column => $old_value) {
$new_value = $new_domain_info[$column];
if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
$column = sanitizeInput($column);
$old_value = sanitizeInput($old_value);
$new_value = sanitizeInput($new_value);
$column = escapeSql($column);
$old_value = escapeSql($old_value);
$new_value = escapeSql($new_value);
mysqli_query($mysqli,"INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id");
}
}
@@ -167,7 +167,7 @@ if (isset($_GET['archive_domain'])) {
//Get domain Name
$sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']);
$domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']);
enforceClientAccess();
@@ -193,7 +193,7 @@ if(isset($_GET['restore_domain'])){
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']);
$domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']);
enforceClientAccess();
@@ -219,7 +219,7 @@ if (isset($_GET['delete_domain'])) {
// Get Domain Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']);
$domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']);
enforceClientAccess();
@@ -253,7 +253,7 @@ if (isset($_POST['bulk_archive_domains'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']);
$domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']);
enforceClientAccess();
@@ -292,7 +292,7 @@ if (isset($_POST['bulk_restore_domains'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']);
$domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']);
enforceClientAccess();
@@ -332,7 +332,7 @@ if (isset($_POST['bulk_delete_domains'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']);
$domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']);
enforceClientAccess();

8
agent/post/domain_model.php
View File

@@ -1,11 +1,11 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = preg_replace("(^https?://)", "", sanitizeInput($_POST['name']));
$description = sanitizeInput($_POST['description']);
$name = preg_replace("(^https?://)", "", escapeSql($_POST['name']));
$description = escapeSql($_POST['description']);
$registrar = intval($_POST['registrar'] ?? 0);
$dnshost = intval($_POST['dnshost'] ?? 0);
$webhost = intval($_POST['webhost'] ?? 0);
$mailhost = intval($_POST['mailhost'] ?? 0);
$expire = sanitizeInput($_POST['expire']);
$notes = sanitizeInput($_POST['notes']);
$expire = escapeSql($_POST['expire']);
$notes = escapeSql($_POST['notes']);

74
agent/post/event.php
View File

@@ -10,8 +10,8 @@ if (isset($_POST['add_calendar'])) {
validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']);
$color = sanitizeInput($_POST['color']);
$name = escapeSql($_POST['name']);
$color = escapeSql($_POST['color']);
mysqli_query($mysqli,"INSERT INTO calendars SET calendar_name = '$name', calendar_color = '$color'");
@@ -30,8 +30,8 @@ if (isset($_POST['edit_calendar'])) {
validateCSRFToken($_POST['csrf_token']);
$calendar_id = intval($_POST['calendar_id']);
$name = sanitizeInput($_POST['name']);
$color = sanitizeInput($_POST['color']);
$name = escapeSql($_POST['name']);
$color = escapeSql($_POST['color']);
mysqli_query($mysqli,"UPDATE calendars SET calendar_name = '$name', calendar_color = '$color' WHERE calendar_id = $calendar_id");
@@ -52,7 +52,7 @@ if (isset($_GET['delete_calendar'])) {
// Get Calendar Name
$sql = mysqli_query($mysqli,"SELECT * FROM calendars WHERE calendar_id = $calendar_id");
$row = mysqli_fetch_assoc($sql);
$calendar_name = sanitizeInput($row['calendar_name']);
$calendar_name = escapeSql($row['calendar_name']);
// Delete Calendar
mysqli_query($mysqli,"DELETE FROM calendars WHERE calendar_id = $calendar_id");
@@ -84,33 +84,33 @@ if (isset($_POST['add_event'])) {
$event_id = mysqli_insert_id($mysqli);
// Get Calendar Name
$calendar_name = sanitizeInput(getFieldById('calendars', $calendar_id, 'calendar_name'));
$calendar_name = escapeSql(getFieldById('calendars', $calendar_id, 'calendar_name'));
//If email is checked
if ($email_event == 1) {
$sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id");
$row = mysqli_fetch_assoc($sql_client);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
$company_logo = escapeSql($row['company_logo']);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
$subject = "New Calendar Event";
$body = "Hello $contact_name,<br><br>A calendar event has been scheduled:<br><br>Event Title: $title<br>Event Date: $start<br><br><br>--<br>$company_name<br>$company_phone";
@@ -165,26 +165,26 @@ if (isset($_POST['edit_event'])) {
$sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id");
$row = mysqli_fetch_assoc($sql_client);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
$company_logo = escapeSql($row['company_logo']);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
$subject = "Calendar Event Rescheduled";
@@ -228,7 +228,7 @@ if (isset($_GET['delete_event'])) {
// Get Event Title
$sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id");
$row = mysqli_fetch_assoc($sql);
$event_title = sanitizeInput($row['event_title']);
$event_title = escapeSql($row['event_title']);
$client_id = intval($row['event_client_id']);
// Don't Enforce Client Access if Calendar event doesn't have a client

12
agent/post/event_model.php
View File

@@ -2,11 +2,11 @@
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$calendar_id = intval($_POST['calendar']);
$title = sanitizeInput($_POST['title']);
$location = sanitizeInput($_POST['location']);
$description = sanitizeInput($_POST['description']);
$start = sanitizeInput($_POST['start']);
$end = sanitizeInput($_POST['end']);
$repeat = sanitizeInput($_POST['repeat'] ?? 0);
$title = escapeSql($_POST['title']);
$location = escapeSql($_POST['location']);
$description = escapeSql($_POST['description']);
$start = escapeSql($_POST['start']);
$end = escapeSql($_POST['end']);
$repeat = escapeSql($_POST['repeat'] ?? 0);
$client_id = intval($_POST['client_id']);
$email_event = intval($_POST['email_event'] ?? 0);

26
agent/post/expense.php
View File

@@ -64,7 +64,7 @@ if (isset($_POST['edit_expense'])) {
$expense_id = intval($_POST['expense_id']);
// Get old receipt
$existing_file_name = sanitizeInput(getFieldById('expenses', $expense_id, 'expense_receipt'));
$existing_file_name = escapeSql(getFieldById('expenses', $expense_id, 'expense_receipt'));
// Check for and process attachment
$extended_alert_description = '';
@@ -106,8 +106,8 @@ if (isset($_GET['delete_expense'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql);
$expense_receipt = sanitizeInput($row['expense_receipt']);
$expense_description = sanitizeInput($row['expense_description']);
$expense_receipt = escapeSql($row['expense_receipt']);
$expense_description = escapeSql($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
@@ -135,7 +135,7 @@ if (isset($_POST['bulk_edit_expense_category'])) {
$category_id = intval($_POST['bulk_category_id']);
// Get Category name for logging and Notification
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name'));
$category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
// Assign category to Selected Expenses
if (isset($_POST['expense_ids'])) {
@@ -149,7 +149,7 @@ if (isset($_POST['bulk_edit_expense_category'])) {
// Get Expense Details for Logging
$sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql);
$expense_description = sanitizeInput($row['expense_description']);
$expense_description = escapeSql($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
@@ -180,7 +180,7 @@ if (isset($_POST['bulk_edit_expense_account'])) {
$account_id = intval($_POST['bulk_account_id']);
// Get Account name for logging and Notification
$account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name'));
$account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name'));
// Assign account to Selected Expenses
if (isset($_POST['expense_ids'])) {
@@ -194,7 +194,7 @@ if (isset($_POST['bulk_edit_expense_account'])) {
// Get Expense Details for Logging
$sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql);
$expense_description = sanitizeInput($row['expense_description']);
$expense_description = escapeSql($row['expense_description']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
@@ -227,7 +227,7 @@ if (isset($_POST['bulk_edit_expense_client'])) {
enforceClientAccess();
// Get Client name for logging and Notification
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name'));
$client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
// Assign Client to Selected Expenses
if (isset($_POST['expense_ids'])) {
@@ -239,7 +239,7 @@ if (isset($_POST['bulk_edit_expense_client'])) {
$expense_id = intval($expense_id);
// Get Expense Details for Logging
$expense_description = sanitizeInput(getFieldById('expenses', $expense_id, 'expense_description'));
$expense_description = escapeSql(getFieldById('expenses', $expense_id, 'expense_description'));
mysqli_query($mysqli,"UPDATE expenses SET expense_client_id = $client_id WHERE expense_id = $expense_id");
@@ -272,8 +272,8 @@ if (isset($_POST['bulk_delete_expenses'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql);
$expense_description = sanitizeInput($row['expense_description']);
$expense_receipt = sanitizeInput($row['expense_receipt']);
$expense_description = escapeSql($row['expense_description']);
$expense_receipt = escapeSql($row['expense_receipt']);
$client_id = intval($row['expense_client_id']);
if ($client_id) {
@@ -304,8 +304,8 @@ if (isset($_POST['export_expenses_csv'])) {
enforceUserPermission('module_financial');
$date_from = sanitizeInput($_POST['date_from']);
$date_to = sanitizeInput($_POST['date_to']);
$date_from = escapeSql($_POST['date_from']);
$date_to = escapeSql($_POST['date_to']);
$account = intval($_POST['account']);
$vendor = intval($_POST['vendor']);
$category = intval($_POST['category']);

6
agent/post/expense_model.php
View File

@@ -1,11 +1,11 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']);
$account = intval($_POST['account']);
$vendor = intval($_POST['vendor']);
$client_id = intval($_POST['client_id']);
$category = intval($_POST['category']);
$description = sanitizeInput($_POST['description']);
$reference = sanitizeInput($_POST['reference']);
$description = escapeSql($_POST['description']);
$reference = escapeSql($_POST['reference']);

52
agent/post/file.php
View File

@@ -15,7 +15,7 @@ if (isset($_POST['upload_files'])) {
// Sanitize and initialize inputs
$client_id = intval($_POST['client_id']);
$folder_id = intval($_POST['folder_id']);
$description = sanitizeInput($_POST['description']);
$description = escapeSql($_POST['description']);
$contact_id = intval($_POST['contact_id'] ?? 0);
$asset_id = intval($_POST['asset_id'] ?? 0);
$client_dir = "../uploads/clients/$client_id";
@@ -52,10 +52,10 @@ if (isset($_POST['upload_files'])) {
if ($file_reference_name = checkFileUpload($single_file, $allowedExtensions)) {
$file_tmp_path = $single_file['tmp_name'];
$file_name = sanitizeInput($originalName);
$file_name = escapeSql($originalName);
$extParts = explode('.', $file_name);
$file_extension = strtolower(end($extParts));
$file_mime_type = sanitizeInput($single_file['type']);
$file_mime_type = escapeSql($single_file['type']);
$file_size = intval($single_file['size']);
// Define destination path and move the uploaded file
@@ -110,13 +110,13 @@ if (isset($_POST['rename_file'])) {
enforceUserPermission('module_support', 2);
$file_id = intval($_POST['file_id']);
$file_name = sanitizeInput($_POST['file_name']);
$file_description = sanitizeInput($_POST['file_description']);
$file_name = escapeSql($_POST['file_name']);
$file_description = escapeSql($_POST['file_description']);
// Get File Details Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql);
$old_file_name = sanitizeInput($row['file_name']);
$old_file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
@@ -144,13 +144,13 @@ if (isset($_POST['move_file'])) {
// Get File Name and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Folder Name for Logging
$folder_name = sanitizeInput(getFieldById('folders', $folder_id, 'folder_name'));
$folder_name = escapeSql(getFieldById('folders', $folder_id, 'folder_name'));
mysqli_query($mysqli,"UPDATE files SET file_folder_id = $folder_id WHERE file_id = $file_id");
@@ -173,7 +173,7 @@ if (isset($_GET['archive_file'])) {
// Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
@@ -199,7 +199,7 @@ if (isset($_GET['restore_file'])) {
// Get Document Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
@@ -225,8 +225,8 @@ if (isset($_POST['delete_file'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']);
$file_reference_name = sanitizeInput($row['file_reference_name']);
$file_name = escapeSql($row['file_name']);
$file_reference_name = escapeSql($row['file_reference_name']);
$file_has_thumbnail = intval($row['file_has_thumbnail']);
$file_has_preview = intval($row['file_has_preview']);
@@ -270,7 +270,7 @@ if (isset($_POST['bulk_archive_files'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
enforceClientAccess();
@@ -293,7 +293,7 @@ if (isset($_POST['bulk_archive_files'])) {
// Get document name for logging
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -333,8 +333,8 @@ if (isset($_POST['bulk_delete_files'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']);
$file_reference_name = sanitizeInput($row['file_reference_name']);
$file_name = escapeSql($row['file_name']);
$file_reference_name = escapeSql($row['file_reference_name']);
$file_has_thumbnail = intval($row['file_has_thumbnail']);
$file_has_preview = intval($row['file_has_preview']);
@@ -369,7 +369,7 @@ if (isset($_POST['bulk_delete_files'])) {
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
enforceClientAccess();
@@ -414,7 +414,7 @@ if (isset($_POST['bulk_restore_files'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
enforceClientAccess();
@@ -437,7 +437,7 @@ if (isset($_POST['bulk_restore_files'])) {
// Get document name for logging
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']);
$document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']);
enforceClientAccess();
@@ -475,7 +475,7 @@ if (isset($_POST['bulk_move_files'])) {
if ($folder_id > 0) {
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
if ($row = mysqli_fetch_assoc($sql)) {
$folder_name = sanitizeInput($row['folder_name']);
$folder_name = escapeSql($row['folder_name']);
$log_client_id = intval($row['folder_client_id']);
}
}
@@ -494,7 +494,7 @@ if (isset($_POST['bulk_move_files'])) {
foreach ($file_ids as $file_id) {
// Get file name for logging
$file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name'));
$file_name = escapeSql(getFieldById('files', $file_id, 'file_name'));
$client_id = intval(getFieldById('files', $file_id, 'file_client_id'));
enforceClientAccess();
@@ -532,7 +532,7 @@ if (isset($_POST['bulk_move_files'])) {
foreach ($document_ids as $document_id) {
// Get document name for logging
$document_name = sanitizeInput(getFieldById('documents', $document_id, 'document_name'));
$document_name = escapeSql(getFieldById('documents', $document_id, 'document_name'));
$client_id = intval(getFieldById('documents', $document_id, 'document_client_id'));
enforceClientAccess();
@@ -588,13 +588,13 @@ if (isset($_POST['link_asset_to_file'])) {
// Get File Name and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Asset Name for Logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
// Contact add query
mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id");
@@ -619,13 +619,13 @@ if (isset($_GET['unlink_asset_from_file'])) {
// Get File Name and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']);
$file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']);
enforceClientAccess();
// Get Asset Name for Logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name'));
$asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id");

8
agent/post/folder.php
View File

@@ -14,7 +14,7 @@ if (isset($_POST['create_folder'])) {
$client_id = intval($_POST['client_id']);
$folder_location = intval($_POST['folder_location']);
$folder_name = sanitizeInput($_POST['folder_name']);
$folder_name = escapeSql($_POST['folder_name']);
$parent_folder = intval($_POST['parent_folder']);
enforceClientAccess();
@@ -38,12 +38,12 @@ if (isset($_POST['rename_folder'])) {
enforceUserPermission('module_support', 2);
$folder_id = intval($_POST['folder_id']);
$folder_name = sanitizeInput($_POST['folder_name']);
$folder_name = escapeSql($_POST['folder_name']);
// Get old Folder Name Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql);
$old_folder_name = sanitizeInput($row['folder_name']);
$old_folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']);
enforceClientAccess();
@@ -70,7 +70,7 @@ if (isset($_GET['delete_folder'])) {
// Get Folder Name Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql);
$folder_name = sanitizeInput($row['folder_name']);
$folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']);
enforceClientAccess();

106
agent/post/invoice.php
View File

@@ -62,12 +62,12 @@ if (isset($_POST['edit_invoice'])) {
require_once 'invoice_model.php';
$invoice_id = intval($_POST['invoice_id']);
$due = sanitizeInput($_POST['due']);
$due = escapeSql($_POST['due']);
// Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -100,20 +100,20 @@ if (isset($_POST['add_invoice_copy'])) {
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
//Get Net Terms
$sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$client_net_terms = intval($row['client_net_terms']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_scope = escapeSql($row['invoice_scope']);
$invoice_discount_amount = floatval($row['invoice_discount_amount']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_note = sanitizeInput($row['invoice_note']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$invoice_note = escapeSql($row['invoice_note']);
$client_id = intval($row['invoice_client_id']);
$category_id = intval($row['invoice_category_id']);
$old_invoice_prefix = sanitizeInput($row['invoice_prefix']);
$old_invoice_prefix = escapeSql($row['invoice_prefix']);
$old_invoice_number = intval($row['invoice_number']);
enforceClientAccess();
@@ -141,8 +141,8 @@ if (isset($_POST['add_invoice_copy'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']);
$item_description = sanitizeInput($row['item_description']);
$item_name = escapeSql($row['item_name']);
$item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -175,7 +175,7 @@ if (isset($_GET['mark_invoice_sent'])) {
// Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -204,7 +204,7 @@ if (isset($_GET['mark_invoice_non-billable'])) {
// Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -233,7 +233,7 @@ if (isset($_GET['cancel_invoice'])) {
// Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -262,7 +262,7 @@ if (isset($_GET['delete_invoice'])) {
// Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -309,8 +309,8 @@ if (isset($_POST['add_invoice_item'])) {
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']);
$price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']);
@@ -326,7 +326,7 @@ if (isset($_POST['add_invoice_item'])) {
// Update Product Inventory
if ($product_id) {
// Only enforce stock for tangible products
$product_type = sanitizeInput(getFieldById('products', $product_id, 'product_type'));
$product_type = escapeSql(getFieldById('products', $product_id, 'product_type'));
if ($product_type === 'product') {
// Current available stock
@@ -367,7 +367,7 @@ if (isset($_POST['add_invoice_item'])) {
// Get Discount and Invoice Details
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_discount = floatval($row['invoice_discount_amount']);
@@ -397,12 +397,12 @@ if (isset($_POST['invoice_note'])) {
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']);
$note = sanitizeInput($_POST['note']);
$note = escapeSql($_POST['note']);
// Get Invoice Details for logging
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -425,8 +425,8 @@ if (isset($_POST['edit_invoice_item'])) {
enforceUserPermission('module_sales', 2);
$item_id = intval($_POST['item_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']);
$price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']);
@@ -453,7 +453,7 @@ if (isset($_POST['edit_invoice_item'])) {
//Get Discount Amount
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
$invoice_discount = floatval($row['invoice_discount_amount']);
@@ -488,7 +488,7 @@ if (isset($_GET['delete_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id");
$row = mysqli_fetch_assoc($sql);
$invoice_id = intval($row['item_invoice_id']);
$item_name = sanitizeInput($row['item_name']);
$item_name = escapeSql($row['item_name']);
$item_quantity = floatval($row['item_quantity']);
$item_product_id = intval($row['item_product_id']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -497,7 +497,7 @@ if (isset($_GET['delete_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
@@ -538,39 +538,39 @@ if (isset($_GET['email_invoice'])) {
$row = mysqli_fetch_assoc($sql);
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_status = sanitizeInput($row['invoice_status']);
$invoice_date = sanitizeInput(validateDate($row['invoice_date']));
$invoice_due = sanitizeInput(validateDate($row['invoice_due']));
$invoice_scope = escapeSql($row['invoice_scope']);
$invoice_status = escapeSql($row['invoice_status']);
$invoice_date = escapeSql(validateDate($row['invoice_date']));
$invoice_due = escapeSql(validateDate($row['invoice_due']));
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
enforceClientAccess();
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
$company_logo = escapeSql($row['company_logo']);
// Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email);
$config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
$sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payment_id DESC");
@@ -628,8 +628,8 @@ if (isset($_GET['email_invoice'])) {
$data = [];
while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) {
$billing_contact_name = sanitizeInput($billing_contact['contact_name']);
$billing_contact_email = sanitizeInput($billing_contact['contact_email']);
$billing_contact_name = escapeSql($billing_contact['contact_name']);
$billing_contact_email = escapeSql($billing_contact['contact_email']);
$data[] = [
'from' => $config_invoice_from_email,
@@ -668,8 +668,8 @@ if (isset($_POST['export_invoices_csv'])) {
$file_name_prepend = "$session_company_name-";
}
$date_from = sanitizeInput($_POST['date_from']);
$date_to = sanitizeInput($_POST['date_to']);
$date_from = escapeSql($_POST['date_from']);
$date_to = escapeSql($_POST['date_to']);
if (!empty($date_from) && !empty($date_to)) {
$date_query = "DATE(invoice_date) BETWEEN '$date_from' AND '$date_to'";
$file_name_date = "$date_from-to-$date_to";
@@ -1145,7 +1145,7 @@ if (isset($_POST['bulk_edit_invoice_category'])) {
$category_id = intval($_POST['bulk_category_id']);
// Get Category name for logging and Notification
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name'));
$category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
// Assign Income category to Selected Invoices
if (isset($_POST['invoice_ids'])) {
@@ -1159,9 +1159,9 @@ if (isset($_POST['bulk_edit_invoice_category'])) {
// Get Invoice Details for Logging
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_scope = escapeSql($row['invoice_scope']);
$client_id = intval($row['invoice_client_id']);
enforceClientAccess();

6
agent/post/invoice_model.php
View File

@@ -1,10 +1,10 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']);
$scope = escapeSql($_POST['scope']);
$invoice_discount = floatval($_POST['invoice_discount']);
$recurring_discount = floatval($_POST['recurring_discount']);
$config_invoice_prefix = sanitizeInput($config_invoice_prefix);
$config_invoice_prefix = escapeSql($config_invoice_prefix);

30
agent/post/location.php
View File

@@ -77,7 +77,7 @@ if(isset($_POST['edit_location'])){
// Get old location photo
$sql = mysqli_query($mysqli,"SELECT location_photo, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['location_photo']);
$existing_file_name = escapeSql($row['location_photo']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -142,7 +142,7 @@ if(isset($_GET['archive_location'])){
// Get Location Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -168,7 +168,7 @@ if(isset($_GET['restore_location'])){
// Get Location Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -194,7 +194,7 @@ if(isset($_GET['delete_location'])){
// Get Location Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -227,7 +227,7 @@ if (isset($_POST['bulk_assign_location_tags'])) {
// Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -281,7 +281,7 @@ if (isset($_POST['bulk_archive_locations'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id, location_primary FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$location_primary = intval($row['location_primary']);
$client_id = intval($row['location_client_id']);
@@ -327,7 +327,7 @@ if (isset($_POST['bulk_restore_locations'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -367,7 +367,7 @@ if (isset($_POST['bulk_delete_locations'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']);
$location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']);
enforceClientAccess();
@@ -496,31 +496,31 @@ if (isset($_POST["import_locations_csv"])) {
while(($column = fgetcsv($file, 1000, ",")) !== false){
$duplicate_detect = 0;
if(isset($column[0])){
$name = sanitizeInput($column[0]);
$name = escapeSql($column[0]);
if(mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$name' AND location_client_id = $client_id")) > 0){
$duplicate_detect = 1;
}
}
if(isset($column[1])){
$description = sanitizeInput($column[1]);
$description = escapeSql($column[1]);
}
if(isset($column[2])){
$address = sanitizeInput($column[2]);
$address = escapeSql($column[2]);
}
if(isset($column[3])){
$city = sanitizeInput($column[3]);
$city = escapeSql($column[3]);
}
if(isset($column[4])){
$state = sanitizeInput($column[4]);
$state = escapeSql($column[4]);
}
if(isset($column[5])){
$zip = sanitizeInput($column[5]);
$zip = escapeSql($column[5]);
}
if(isset($column[6])){
$phone = preg_replace("/[^0-9]/", '',$column[6]);
}
if(isset($column[7])){
$hours = sanitizeInput($column[7]);
$hours = escapeSql($column[7]);
}
// Check if duplicate was detected

18
agent/post/location_model.php
View File

@@ -1,19 +1,19 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$country = sanitizeInput($_POST['country']);
$address = sanitizeInput($_POST['address']);
$city = sanitizeInput($_POST['city']);
$state = sanitizeInput($_POST['state']);
$zip = sanitizeInput($_POST['zip']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$country = escapeSql($_POST['country']);
$address = escapeSql($_POST['address']);
$city = escapeSql($_POST['city']);
$state = escapeSql($_POST['state']);
$zip = escapeSql($_POST['zip']);
$phone = preg_replace("/[^0-9]/", '',$_POST['phone']);
$phone_country_code = preg_replace("/[^0-9]/", '',$_POST['phone_country_code']);
$extension = preg_replace("/[^0-9]/", '',$_POST['extension']);
$fax = preg_replace("/[^0-9]/", '',$_POST['fax']);
$fax_country_code = preg_replace("/[^0-9]/", '',$_POST['fax_country_code']);
$hours = sanitizeInput($_POST['hours']);
$notes = sanitizeInput($_POST['notes']);
$hours = escapeSql($_POST['hours']);
$notes = escapeSql($_POST['notes']);
$contact = intval($_POST['contact'] ?? 0);
$location_primary = intval($_POST['location_primary'] ?? 0);

22
agent/post/network.php
View File

@@ -65,7 +65,7 @@ if (isset($_GET['archive_network'])) {
// Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']);
$network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']);
enforceClientAccess();
@@ -91,7 +91,7 @@ if (isset($_GET['restore_network'])) {
// Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']);
$network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']);
enforceClientAccess();
@@ -117,7 +117,7 @@ if (isset($_GET['delete_network'])) {
// Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']);
$network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']);
enforceClientAccess();
@@ -151,7 +151,7 @@ if (isset($_POST['bulk_delete_networks'])) {
// Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']);
$network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']);
enforceClientAccess();
@@ -324,14 +324,14 @@ if (isset($_POST['import_networks_csv'])) {
$duplicate_detect = 0;
$name = isset($column[0]) ? sanitizeInput($column[0]) : '';
$description = isset($column[1]) ? sanitizeInput($column[1]) : '';
$name = isset($column[0]) ? escapeSql($column[0]) : '';
$description = isset($column[1]) ? escapeSql($column[1]) : '';
$vlan = isset($column[2]) ? intval($column[2]) : 0;
$network = isset($column[3]) ? sanitizeInput($column[3]) : '';
$gateway = isset($column[4]) ? sanitizeInput($column[4]) : '';
$dhcp_range = isset($column[5]) ? sanitizeInput($column[5]) : '';
$primary_dns = isset($column[6]) ? sanitizeInput($column[6]) : '';
$secondary_dns = isset($column[7]) ? sanitizeInput($column[7]) : '';
$network = isset($column[3]) ? escapeSql($column[3]) : '';
$gateway = isset($column[4]) ? escapeSql($column[4]) : '';
$dhcp_range = isset($column[5]) ? escapeSql($column[5]) : '';
$primary_dns = isset($column[6]) ? escapeSql($column[6]) : '';
$secondary_dns = isset($column[7]) ? escapeSql($column[7]) : '';
// Skip rows with no name
if ($name === '') {

16
agent/post/network_model.php
View File

@@ -1,13 +1,13 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$vlan = intval($_POST['vlan']);
$network = sanitizeInput($_POST['network']);
$gateway = sanitizeInput($_POST['gateway']);
$primary_dns = sanitizeInput($_POST['primary_dns']);
$secondary_dns = sanitizeInput($_POST['secondary_dns']);
$dhcp_range = sanitizeInput($_POST['dhcp_range']);
$notes = sanitizeInput($_POST['notes']);
$network = escapeSql($_POST['network']);
$gateway = escapeSql($_POST['gateway']);
$primary_dns = escapeSql($_POST['primary_dns']);
$secondary_dns = escapeSql($_POST['secondary_dns']);
$dhcp_range = escapeSql($_POST['dhcp_range']);
$notes = escapeSql($_POST['notes']);
$location_id = intval($_POST['location'] ?? 0);

188
agent/post/payment.php
View File

@@ -15,12 +15,12 @@ if (isset($_POST['add_payment'])) {
$invoice_id = intval($_POST['invoice_id']);
$balance = floatval($_POST['balance']);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']);
$account = intval($_POST['account']);
$currency_code = sanitizeInput($_POST['currency_code']);
$payment_method = sanitizeInput($_POST['payment_method']);
$reference = sanitizeInput($_POST['reference']);
$currency_code = escapeSql($_POST['currency_code']);
$payment_method = escapeSql($_POST['payment_method']);
$reference = escapeSql($_POST['reference']);
$email_receipt = intval($_POST['email_receipt']);
$client_id = intval(getFieldById('invoices', $invoice_id, 'invoice_client_id'));
@@ -51,34 +51,34 @@ if (isset($_POST['add_payment'])) {
$row = mysqli_fetch_assoc($sql);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
$company_logo = escapeSql($row['company_logo']);
// Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email);
$config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
//Calculate the Invoice balance
$invoice_balance = $invoice_amount - $total_payments_amount;
@@ -184,11 +184,11 @@ if (isset($_POST['edit_payment'])) {
enforceUserPermission('module_financial', 3);
$payment_id = intval($_POST['payment_id']);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']);
$account = intval($_POST['account']);
$payment_method = sanitizeInput($_POST['payment_method']);
$reference = sanitizeInput($_POST['reference']);
$payment_method = escapeSql($_POST['payment_method']);
$reference = escapeSql($_POST['reference']);
$client_id = intval(getFieldById('payments', $payment_id, 'payment_client_id'));
@@ -220,9 +220,9 @@ if (isset($_POST['apply_credit'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']);
$invoice_status = escapeSql($row['invoice_status']);
$invoice_credit_amount = floatval($row['invoice_credit_amount']);
$invoice_amount = floatval('invoice_amount');
$client_id = intval($row['invoice_client_id']);
@@ -335,53 +335,53 @@ if (isset($_POST['add_payment_stripe'])) {
);
$row = mysqli_fetch_assoc($sql);
$invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']);
$invoice_status = escapeSql($row['invoice_status']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
enforceClientAccess();
// Get ITFlow company details
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
// Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email);
$config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
// Get Client Payment Details
$sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$public_key = sanitizeInput($row['payment_provider_public_key']);
$private_key = sanitizeInput($row['payment_provider_private_key']);
$public_key = escapeSql($row['payment_provider_public_key']);
$private_key = escapeSql($row['payment_provider_private_key']);
$account_id = intval($row['payment_provider_account']);
$expense_category_id = intval($row['payment_provider_expense_category']);
$expense_vendor_id = intval($row['payment_provider_expense_vendor']);
$expense_percentage_fee = floatval($row['payment_provider_expense_percentage_fee']);
$expense_flat_fee = floatval($row['payment_provider_expense_flat_fee']);
$payment_provider_client = sanitizeInput($row['payment_provider_client']);
$saved_payment_method = sanitizeInput($row['saved_payment_provider_method']);
$saved_payment_description = sanitizeInput($row['saved_payment_description']);
$payment_provider_client = escapeSql($row['payment_provider_client']);
$saved_payment_method = escapeSql($row['saved_payment_provider_method']);
$saved_payment_description = escapeSql($row['saved_payment_description']);
// Sanity checks
if (!$payment_provider_client || !$saved_payment_method) {
@@ -421,10 +421,10 @@ if (isset($_POST['add_payment_stripe'])) {
]);
// Get details from PI
$pi_id = sanitizeInput($payment_intent->id);
$pi_id = escapeSql($payment_intent->id);
$pi_date = date('Y-m-d', $payment_intent->created);
$pi_amount_paid = floatval(($payment_intent->amount_received / 100));
$pi_currency = strtoupper(sanitizeInput($payment_intent->currency));
$pi_currency = strtoupper(escapeSql($payment_intent->currency));
$pi_livemode = $payment_intent->livemode;
} catch (Exception $e) {
@@ -532,41 +532,41 @@ if (isset($_GET['add_payment_stripe'])) {
);
$row = mysqli_fetch_assoc($sql);
$invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']);
$invoice_status = escapeSql($row['invoice_status']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
// Get ITFlow company details
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
// Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email);
$config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
// Get Client Stripe details
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
$stripe_id = sanitizeInput($stripe_client_details['stripe_id']);
$stripe_pm = sanitizeInput($stripe_client_details['stripe_pm']);
$stripe_id = escapeSql($stripe_client_details['stripe_id']);
$stripe_pm = escapeSql($stripe_client_details['stripe_pm']);
// Sanity checks
if (!$config_stripe_enable || !$stripe_id || !$stripe_pm) {
@@ -606,10 +606,10 @@ if (isset($_GET['add_payment_stripe'])) {
]);
// Get details from PI
$pi_id = sanitizeInput($payment_intent->id);
$pi_id = escapeSql($payment_intent->id);
$pi_date = date('Y-m-d', $payment_intent->created);
$pi_amount_paid = floatval(($payment_intent->amount_received / 100));
$pi_currency = strtoupper(sanitizeInput($payment_intent->currency));
$pi_currency = strtoupper(escapeSql($payment_intent->currency));
$pi_livemode = $payment_intent->livemode;
} catch (Exception $e) {
@@ -708,14 +708,14 @@ if (isset($_POST['add_bulk_payment'])) {
enforceUserPermission('module_financial', 2);
$client_id = intval($_POST['client_id']);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$bulk_payment_amount = floatval($_POST['amount']);
$bulk_payment_amount_static = floatval($_POST['amount']);
$total_account_balance = floatval($_POST['balance']);
$account = intval($_POST['account']);
$currency_code = sanitizeInput($_POST['currency_code']);
$payment_method = sanitizeInput($_POST['payment_method']);
$reference = sanitizeInput($_POST['reference']);
$currency_code = escapeSql($_POST['currency_code']);
$payment_method = escapeSql($_POST['payment_method']);
$reference = escapeSql($_POST['reference']);
$email_receipt = intval($_POST['email_receipt']);
enforceClientAccess();
@@ -738,10 +738,10 @@ if (isset($_POST['add_bulk_payment'])) {
// Loop Through Each Invoice
while ($row = mysqli_fetch_assoc($result_invoices)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_balance_query = "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id";
$result_amount_paid = mysqli_query($mysqli, $invoice_balance_query);
$row_amount_paid = mysqli_fetch_assoc($result_amount_paid);
@@ -798,19 +798,19 @@ if (isset($_POST['add_bulk_payment'])) {
);
$row = mysqli_fetch_assoc($sql_client);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email);
$config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
$subject = "Payment Received - Multiple Invoices";
$body = "Hello $contact_name,<br><br>Thank you for your payment of " . numfmt_format_currency($currency_format, $bulk_payment_amount_static, $currency_code) . " We\'ve applied your payment to the following invoices, updating their balances accordingly:<br><br>$email_body_invoices<br><br><br>We appreciate your continued business!<br><br>Sincerely,<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone";
@@ -861,7 +861,7 @@ if (isset($_GET['delete_payment'])) {
// Get the invoice total and details
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']);

22
agent/post/product.php
View File

@@ -13,7 +13,7 @@ if (isset($_POST['add_product'])) {
enforceUserPermission('module_sales', 2);
require_once 'product_model.php';
$type = sanitizeInput($_POST['type']);
$type = escapeSql($_POST['type']);
mysqli_query($mysqli,"INSERT INTO products SET product_name = '$name', product_type = '$type', product_description = '$description', product_code = '$code', product_location = '$location', product_price = '$price', product_currency_code = '$session_company_currency', product_tax_id = $tax, product_category_id = $category");
@@ -55,7 +55,7 @@ if (isset($_GET['archive_product'])) {
$product_id = intval($_GET['archive_product']);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id");
@@ -75,7 +75,7 @@ if (isset($_GET['restore_product'])) {
$product_id = intval($_GET['restore_product']);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id");
@@ -96,7 +96,7 @@ if (isset($_GET['delete_product'])) {
$product_id = intval($_GET['delete_product']);
//Get Product Name
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"DELETE FROM products WHERE product_id = $product_id");
@@ -117,7 +117,7 @@ if (isset($_POST['bulk_edit_product_category'])) {
$category_id = intval($_POST['bulk_category_id']);
// Get Category name for logging and Notification
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name'));
$category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
// Assign category to Selected Products
if (isset($_POST['product_ids'])) {
@@ -129,7 +129,7 @@ if (isset($_POST['bulk_edit_product_category'])) {
$product_id = intval($product_id);
// Get Product Details for Logging
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_category_id = $category_id WHERE product_id = $product_id");
@@ -161,7 +161,7 @@ if (isset($_POST['bulk_archive_products'])) {
$product_id = intval($product_id);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id");
@@ -193,7 +193,7 @@ if (isset($_POST['bulk_restore_products'])) {
$product_id = intval($product_id);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id");
@@ -226,7 +226,7 @@ if (isset($_POST['bulk_delete_products'])) {
foreach ($_POST['product_ids'] as $product_id) {
$product_id = intval($product_id);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli, "DELETE FROM products WHERE product_id = $product_id");
@@ -298,10 +298,10 @@ if (isset($_POST['add_product_stock'])) {
$product_id = intval($_POST['product_id']);
$qty = intval($_POST['qty']);
$expense = intval($_POST['expense']);
$note = sanitizeInput($_POST['note']);
$note = escapeSql($_POST['note']);
// Get product name
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name'));
$product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"INSERT INTO product_stock SET stock_qty = $qty, stock_expense_id = $expense, stock_note = '$note', stock_product_id = $product_id");

8
agent/post/product_model.php
View File

@@ -1,10 +1,10 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$code = sanitizeInput($_POST['code']);
$location = sanitizeInput($_POST['location']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$code = escapeSql($_POST['code']);
$location = escapeSql($_POST['location']);
$price = floatval($_POST['price']);
$category = intval($_POST['category']);
$tax = intval($_POST['tax']);

42
agent/post/project.php
View File

@@ -12,9 +12,9 @@ if (isset($_POST['add_project'])) {
enforceUserPermission('module_support', 2);
$project_name = sanitizeInput($_POST['name']);
$project_description = sanitizeInput($_POST['description']);
$due_date = sanitizeInput($_POST['due_date']);
$project_name = escapeSql($_POST['name']);
$project_description = escapeSql($_POST['description']);
$due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']);
$project_template_id = intval($_POST['project_template_id']);
@@ -25,7 +25,7 @@ if (isset($_POST['add_project'])) {
}
// Sanitize Project Prefix
$config_project_prefix = sanitizeInput($config_project_prefix);
$config_project_prefix = escapeSql($config_project_prefix);
// Atomically increment and get the new project number
mysqli_query($mysqli, "
@@ -53,7 +53,7 @@ if (isset($_POST['add_project'])) {
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
$ticket_template_id = intval($row['ticket_template_id']);
$ticket_template_order = intval($row['ticket_template_order']);
$ticket_template_subject = sanitizeInput($row['ticket_template_subject']);
$ticket_template_subject = escapeSql($row['ticket_template_subject']);
$ticket_template_details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
// Atomically increment and get the new ticket number
@@ -79,7 +79,7 @@ if (isset($_POST['add_project'])) {
while ($row = mysqli_fetch_assoc($sql_task_templates)) {
$task_template_id = intval($row['task_template_id']);
$task_template_order = intval($row['task_template_order']);
$task_template_name = sanitizeInput($row['task_template_name']);
$task_template_name = escapeSql($row['task_template_name']);
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_template_name', task_order = $task_template_order, task_ticket_id = $ticket_id");
} // End task Loop
@@ -101,9 +101,9 @@ if (isset($_POST['edit_project'])) {
enforceUserPermission('module_support', 2);
$project_id = intval($_POST['project_id']);
$project_name = sanitizeInput($_POST['name']);
$project_description = sanitizeInput($_POST['description']);
$due_date = sanitizeInput($_POST['due_date']);
$project_name = escapeSql($_POST['name']);
$project_description = escapeSql($_POST['description']);
$due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']);
@@ -133,7 +133,7 @@ if (isset($_GET['close_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
@@ -162,7 +162,7 @@ if (isset($_GET['archive_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
@@ -191,8 +191,8 @@ if (isset($_GET['restore_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$client_id = sanitizeInput($row['project_client_id']);
$project_name = escapeSql($row['project_name']);
$client_id = escapeSql($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
@@ -220,7 +220,7 @@ if (isset($_GET['delete_project'])) {
// Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client
@@ -250,7 +250,7 @@ if (isset($_POST['link_ticket_to_project'])) {
$sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['project_client_id']);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
@@ -269,9 +269,9 @@ if (isset($_POST['link_ticket_to_project'])) {
// Get Ticket Info
$sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
$row = mysqli_fetch_assoc($sql);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_subject = escapeSql($row['ticket_subject']);
mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id WHERE ticket_id = $ticket_id");
@@ -301,7 +301,7 @@ if (isset($_POST['link_closed_ticket_to_project'])) {
$sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['project_client_id']);
$project_name = sanitizeInput($row['project_name']);
$project_name = escapeSql($row['project_name']);
// Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) {
@@ -316,10 +316,10 @@ if (isset($_POST['link_closed_ticket_to_project'])) {
}
$row = mysqli_fetch_assoc($sql);
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_updated = sanitizeInput($row['ticket_updated_at']); // So we don't mess with the last response
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_updated = escapeSql($row['ticket_updated_at']); // So we don't mess with the last response
mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id, ticket_updated_at = '$ticket_updated' WHERE ticket_id = $ticket_id");

136
agent/post/quote.php
View File

@@ -56,12 +56,12 @@ if (isset($_POST['add_quote_copy'])) {
$quote_id = intval($_POST['quote_id']);
$client_id = intval($_POST['client_id']);
$date = sanitizeInput($_POST['date']);
$expire = sanitizeInput($_POST['expire']);
$date = escapeSql($_POST['date']);
$expire = escapeSql($_POST['expire']);
enforceClientAccess();
$config_quote_prefix = sanitizeInput($config_quote_prefix);
$config_quote_prefix = escapeSql($config_quote_prefix);
// Atomically increment and get the new quote number
mysqli_query($mysqli, "
@@ -76,13 +76,13 @@ if (isset($_POST['add_quote_copy'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$original_quote_prefix = sanitizeInput($row['quote_prefix']);
$original_quote_number = sanitizeInput($row['quote_number']);
$original_quote_prefix = escapeSql($row['quote_prefix']);
$original_quote_number = escapeSql($row['quote_number']);
$quote_discount_amount = floatval($row['quote_discount_amount']);
$quote_amount = floatval($row['quote_amount']);
$quote_currency_code = sanitizeInput($row['quote_currency_code']);
$quote_scope = sanitizeInput($row['quote_scope']);
$quote_note = sanitizeInput($row['quote_note']);
$quote_currency_code = escapeSql($row['quote_currency_code']);
$quote_scope = escapeSql($row['quote_scope']);
$quote_note = escapeSql($row['quote_note']);
$category_id = intval($row['quote_category_id']);
//Generate a unique URL key for clients to access
@@ -97,8 +97,8 @@ if (isset($_POST['add_quote_copy'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']);
$item_description = sanitizeInput($row['item_description']);
$item_name = escapeSql($row['item_name']);
$item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -127,25 +127,25 @@ if (isset($_POST['add_quote_to_invoice'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$sql = mysqli_query($mysqli,"SELECT * FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$client_net_terms = intval($row['client_net_terms']);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$quote_discount_amount = floatval($row['quote_discount_amount']);
$quote_amount = floatval($row['quote_amount']);
$quote_currency_code = sanitizeInput($row['quote_currency_code']);
$quote_scope = sanitizeInput($row['quote_scope']);
$quote_note = sanitizeInput($row['quote_note']);
$quote_currency_code = escapeSql($row['quote_currency_code']);
$quote_scope = escapeSql($row['quote_scope']);
$quote_note = escapeSql($row['quote_note']);
$client_id = intval($row['quote_client_id']);
$category_id = intval($row['quote_category_id']);
enforceClientAccess();
$config_invoice_prefix = sanitizeInput($config_invoice_prefix);
$config_invoice_prefix = escapeSql($config_invoice_prefix);
// Atomically increment and get the new invoice number
mysqli_query($mysqli, "
@@ -170,8 +170,8 @@ if (isset($_POST['add_quote_to_invoice'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']);
$item_description = sanitizeInput($row['item_description']);
$item_name = escapeSql($row['item_name']);
$item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -199,7 +199,7 @@ if (isset($_POST['add_quote_to_invoice'])) {
if ($result_ticket && $row = mysqli_fetch_assoc($result_ticket)) {
$ticket_id = intval($row['ticket_id']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
mysqli_query($mysqli, "UPDATE tickets SET ticket_invoice_id = $new_invoice_id WHERE ticket_id = $ticket_id AND ticket_invoice_id = '0'"); // Only if ticket doesn't already have an invoice
@@ -220,8 +220,8 @@ if (isset($_POST['add_quote_item'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']);
$price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']);
@@ -249,8 +249,8 @@ if (isset($_POST['add_quote_item'])) {
// Get Quote Details
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$quote_discount_amount = floatval($row['quote_discount_amount']);
$client_id = intval($row['quote_client_id']);
@@ -280,8 +280,8 @@ if (isset($_POST['edit_quote_item'])) {
enforceUserPermission('module_sales', 2);
$item_id = intval($_POST['item_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']);
$price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']);
@@ -308,7 +308,7 @@ if (isset($_POST['edit_quote_item'])) {
//Get Discount Amount
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$client_id = intval($row['quote_client_id']);
$quote_discount = floatval($row['quote_discount_amount']);
@@ -339,13 +339,13 @@ if (isset($_POST['quote_note'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$note = sanitizeInput($_POST['note']);
$note = escapeSql($_POST['note']);
// Get Quote Details
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -373,8 +373,8 @@ if (isset($_POST['edit_quote'])) {
// Get Quote Details for logging
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -409,8 +409,8 @@ if (isset($_GET['delete_quote'])) {
// Get Quote Details for logging
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -454,7 +454,7 @@ if (isset($_GET['delete_quote_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_id = $item_id");
$row = mysqli_fetch_assoc($sql);
$item_name = sanitizeInput($row['item_name']);
$item_name = escapeSql($row['item_name']);
$quote_id = intval($row['item_quote_id']);
$item_subtotal = floatval($row['item_subtotal']);
$item_tax = floatval($row['item_tax']);
@@ -462,8 +462,8 @@ if (isset($_GET['delete_quote_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -492,8 +492,8 @@ if (isset($_GET['mark_quote_sent'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -520,8 +520,8 @@ if (isset($_GET['accept_quote'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -550,8 +550,8 @@ if (isset($_GET['decline_quote'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
@@ -585,40 +585,40 @@ if (isset($_GET['email_quote'])) {
);
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$quote_scope = sanitizeInput($row['quote_scope']);
$quote_status = sanitizeInput($row['quote_status']);
$quote_date = sanitizeInput($row['quote_date']);
$quote_expire = sanitizeInput($row['quote_expire']);
$quote_scope = escapeSql($row['quote_scope']);
$quote_status = escapeSql($row['quote_status']);
$quote_date = escapeSql($row['quote_date']);
$quote_expire = escapeSql($row['quote_expire']);
$quote_amount = floatval($row['quote_amount']);
$quote_url_key = sanitizeInput($row['quote_url_key']);
$quote_currency_code = sanitizeInput($row['quote_currency_code']);
$quote_url_key = escapeSql($row['quote_url_key']);
$quote_currency_code = escapeSql($row['quote_currency_code']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
enforceClientAccess();
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_country = sanitizeInput($row['company_country']);
$company_address = sanitizeInput($row['company_address']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']);
$company_name = escapeSql($row['company_name']);
$company_country = escapeSql($row['company_country']);
$company_address = escapeSql($row['company_address']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_zip = escapeSql($row['company_zip']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
$company_logo = escapeSql($row['company_logo']);
// Sanitize Config vars from get_settings.php
$config_quote_from_name = sanitizeInput($config_quote_from_name);
$config_quote_from_email = sanitizeInput($config_quote_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_quote_from_name = escapeSql($config_quote_from_name);
$config_quote_from_email = escapeSql($config_quote_from_email);
$config_base_url = escapeSql($config_base_url);
$subject = "Quote [$quote_scope]";
$body = "Hello $contact_name,<br><br>Thank you for your inquiry, we are pleased to provide you with the following estimate.<br><br><br>$quote_scope<br>Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "<br><br><br>View and accept your estimate online <a href=\'https://$config_base_url/guest/guest_view_quote.php?quote_id=$quote_id&url_key=$quote_url_key\'>here</a><br><br><br>--<br>$company_name - Sales<br>$config_quote_from_email<br>$company_phone";
@@ -662,8 +662,8 @@ if (isset($_GET['mark_quote_invoiced'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();

8
agent/post/quote_model.php
View File

@@ -1,10 +1,10 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$expire = sanitizeInput($_POST['expire']);
$date = escapeSql($_POST['date']);
$expire = escapeSql($_POST['expire']);
$category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']);
$scope = escapeSql($_POST['scope']);
$quote_discount = floatval($_POST['quote_discount']);
$config_quote_prefix = sanitizeInput($config_quote_prefix);
$config_quote_prefix = escapeSql($config_quote_prefix);

48
agent/post/rack.php
View File

@@ -13,15 +13,15 @@ if (isset($_POST['add_rack'])) {
enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);
$model = sanitizeInput($_POST['model']);
$depth = sanitizeInput($_POST['depth']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$type = escapeSql($_POST['type']);
$model = escapeSql($_POST['model']);
$depth = escapeSql($_POST['depth']);
$units = intval($_POST['units']);
$physical_location = sanitizeInput($_POST['physical_location']);
$physical_location = escapeSql($_POST['physical_location']);
$location = intval($_POST['location']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
enforceClientAccess();
@@ -60,15 +60,15 @@ if (isset($_POST['edit_rack'])) {
enforceUserPermission('module_support', 2);
$rack_id = intval($_POST['rack_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);
$model = sanitizeInput($_POST['model']);
$depth = sanitizeInput($_POST['depth']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$type = escapeSql($_POST['type']);
$model = escapeSql($_POST['model']);
$depth = escapeSql($_POST['depth']);
$units = intval($_POST['units']);
$physical_location = sanitizeInput($_POST['physical_location']);
$physical_location = escapeSql($_POST['physical_location']);
$location = intval($_POST['location']);
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
$client_id = intval(getFieldById('racks', $rack_id, 'rack_client_id'));
@@ -113,7 +113,7 @@ if (isset($_GET['archive_rack'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']);
$rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']);
mysqli_query($mysqli,"UPDATE racks SET rack_archived_at = NOW() WHERE rack_id = $rack_id");
@@ -137,7 +137,7 @@ if (isset($_GET['restore_rack'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']);
$rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']);
enforceClientAccess();
@@ -163,8 +163,8 @@ if (isset($_GET['delete_rack'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id, rack_photo FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']);
$rack_photo = sanitizeInput($row['rack_photo']);
$rack_name = escapeSql($row['rack_name']);
$rack_photo = escapeSql($row['rack_photo']);
$client_id = intval($row['rack_client_id']);
enforceClientAccess();
@@ -191,7 +191,7 @@ if (isset($_POST['add_rack_unit'])) {
enforceUserPermission('module_support', 2);
$rack_id = intval($_POST['rack_id']);
$name = sanitizeInput($_POST['name']);
$name = escapeSql($_POST['name']);
$unit_start = intval($_POST['unit_start']);
$unit_end = intval($_POST['unit_end']);
$asset = intval($_POST['asset']);
@@ -199,7 +199,7 @@ if (isset($_POST['add_rack_unit'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']);
$rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']);
enforceClientAccess();
@@ -240,7 +240,7 @@ if (isset($_POST['edit_rack_unit'])) {
$unit_id = intval($_POST['unit_id']);
$rack_id = intval($_POST['rack_id']);
$name = sanitizeInput($_POST['name']);
$name = escapeSql($_POST['name']);
$unit_start = intval($_POST['unit_start']);
$unit_end = intval($_POST['unit_end']);
$asset = intval($_POST['asset']);
@@ -248,7 +248,7 @@ if (isset($_POST['edit_rack_unit'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']);
$rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']);
enforceClientAccess();
@@ -274,8 +274,8 @@ if (isset($_GET['remove_rack_unit'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_id, rack_client_id FROM racks LEFT JOIN rack_units ON unit_rack_id = rack_id WHERE unit_id = $unit_id");
$row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']);
$unit_device = sanitizeInput($row['unit_device']);
$rack_name = escapeSql($row['rack_name']);
$unit_device = escapeSql($row['unit_device']);
$client_id = intval($row['rack_client_id']);
$rack_id = intval($row['rack_id']);

10
agent/post/recurring_expense.php
View File

@@ -20,8 +20,8 @@ if (isset($_POST['create_recurring_expense'])) {
$vendor = intval($_POST['vendor']);
$client_id = intval($_POST['client_id']);
$category = intval($_POST['category']);
$description = sanitizeInput($_POST['description']);
$reference = sanitizeInput($_POST['reference']);
$description = escapeSql($_POST['description']);
$reference = escapeSql($_POST['reference']);
$year = date('Y');
if (strtotime("$year-$month-$day") < time()) {
@@ -56,8 +56,8 @@ if (isset($_POST['edit_recurring_expense'])) {
$vendor = intval($_POST['vendor']);
$client_id = intval($_POST['client_id']);
$category = intval($_POST['category']);
$description = sanitizeInput($_POST['description']);
$reference = sanitizeInput($_POST['reference']);
$description = escapeSql($_POST['description']);
$reference = escapeSql($_POST['reference']);
$year = date('Y');
if (strtotime("$year-$month-$day") < time()) {
@@ -86,7 +86,7 @@ if (isset($_GET['delete_recurring_expense'])) {
// Get Recurring Expense Details for Logging
$sql = mysqli_query($mysqli,"SELECT recurring_expense_description, recurring_expense_client_id FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id");
$row = mysqli_fetch_assoc($sql);
$recurring_expense_description = sanitizeInput($row['recurring_expense_description']);
$recurring_expense_description = escapeSql($row['recurring_expense_description']);
$client_id = intval($row['recurring_expense_client_id']);
mysqli_query($mysqli,"DELETE FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id");

110
agent/post/recurring_invoice.php
View File

@@ -17,13 +17,13 @@ if (isset($_POST['add_invoice_recurring'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_date = sanitizeInput(validateDate($row['invoice_date']));
$invoice_date = escapeSql(validateDate($row['invoice_date']));
$invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_note = sanitizeInput($row['invoice_note']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$invoice_scope = escapeSql($row['invoice_scope']);
$invoice_note = escapeSql($row['invoice_note']);
$client_id = intval($row['invoice_client_id']);
$category_id = intval($row['invoice_category_id']);
@@ -49,8 +49,8 @@ if (isset($_POST['add_invoice_recurring'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']);
$item_description = sanitizeInput($row['item_description']);
$item_name = escapeSql($row['item_name']);
$item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -77,10 +77,10 @@ if (isset($_POST['add_recurring_invoice'])) {
enforceUserPermission('module_sales', 2);
$client_id = intval($_POST['client_id']);
$frequency = sanitizeInput($_POST['frequency']);
$start_date = sanitizeInput($_POST['start_date']);
$frequency = escapeSql($_POST['frequency']);
$start_date = escapeSql($_POST['start_date']);
$category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']);
$scope = escapeSql($_POST['scope']);
enforceClientAccess();
@@ -116,17 +116,17 @@ if (isset($_POST['edit_recurring_invoice'])) {
enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$frequency = sanitizeInput($_POST['frequency']);
$next_date = sanitizeInput($_POST['next_date']);
$frequency = escapeSql($_POST['frequency']);
$next_date = escapeSql($_POST['next_date']);
$category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']);
$scope = escapeSql($_POST['scope']);
$status = intval($_POST['status']);
$recurring_invoice_discount = floatval($_POST['recurring_invoice_discount']);
// Get Recurring Invoice Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);
@@ -164,9 +164,9 @@ if (isset($_GET['delete_recurring_invoice'])) {
// Get Recurring Invoice Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_scope, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$recurring_invoice_scope = sanitizeInput($row['recurring_invoice_scope']);
$recurring_invoice_scope = escapeSql($row['recurring_invoice_scope']);
$client_id = intval($row['recurring_invoice_client_id']);
enforceClientAccess();
@@ -202,8 +202,8 @@ if (isset($_POST['add_recurring_invoice_item'])) {
enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']);
$price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']);
@@ -232,7 +232,7 @@ if (isset($_POST['add_recurring_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);
@@ -262,8 +262,8 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
enforceUserPermission('module_sales', 2);
$item_id = intval($_POST['item_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']);
$price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']);
@@ -290,7 +290,7 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
//Get Discount Amount
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);
$recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
@@ -322,12 +322,12 @@ if (isset($_POST['recurring_invoice_note'])) {
enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$note = sanitizeInput($_POST['note']);
$note = escapeSql($_POST['note']);
// Get Recurring details for logging
$sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);
@@ -354,14 +354,14 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_id = $item_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_id = intval($row['item_recurring_invoice_id']);
$item_name = sanitizeInput($row['item_name']);
$item_name = escapeSql($row['item_name']);
$item_subtotal = floatval($row['item_subtotal']);
$item_tax = floatval($row['item_tax']);
$item_total = floatval($row['item_total']);
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);
@@ -393,15 +393,15 @@ if (isset($_GET['force_recurring'])) {
$row = mysqli_fetch_assoc($sql_recurring_invoices);
$recurring_invoice_id = intval($row['recurring_invoice_id']);
$recurring_invoice_scope = sanitizeInput($row['recurring_invoice_scope']);
$recurring_invoice_scope = escapeSql($row['recurring_invoice_scope']);
$recurring_invoice_frequency = ($_POST['frequency'] === 'year') ? 'year' : 'month';
$recurring_invoice_status = sanitizeInput($row['recurring_invoice_status']);
$recurring_invoice_last_sent = sanitizeInput($row['recurring_invoice_last_sent']);
$recurring_invoice_next_date = sanitizeInput($row['recurring_invoice_next_date']);
$recurring_invoice_status = escapeSql($row['recurring_invoice_status']);
$recurring_invoice_last_sent = escapeSql($row['recurring_invoice_last_sent']);
$recurring_invoice_next_date = escapeSql($row['recurring_invoice_next_date']);
$recurring_invoice_discount_amount = floatval($row['recurring_invoice_discount_amount']);
$recurring_invoice_amount = floatval($row['recurring_invoice_amount']);
$recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']);
$recurring_invoice_note = sanitizeInput($row['recurring_invoice_note']);
$recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
$recurring_invoice_note = escapeSql($row['recurring_invoice_note']);
$category_id = intval($row['recurring_invoice_category_id']);
$client_id = intval($row['recurring_invoice_client_id']);
$client_net_terms = intval($row['client_net_terms']);
@@ -431,8 +431,8 @@ if (isset($_GET['force_recurring'])) {
while($row = mysqli_fetch_assoc($sql_invoice_items)) {
$item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']);
$item_description = sanitizeInput($row['item_description']);
$item_name = escapeSql($row['item_name']);
$item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -477,31 +477,31 @@ if (isset($_GET['force_recurring'])) {
);
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_date = sanitizeInput(validateDate($row['invoice_date']));
$invoice_due = sanitizeInput($row['invoice_due']);
$invoice_scope = escapeSql($row['invoice_scope']);
$invoice_date = escapeSql(validateDate($row['invoice_date']));
$invoice_due = escapeSql($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = intval($row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
// Sanitize Config Vars
$config_invoice_from_email = sanitizeInput($config_invoice_from_email);
$config_invoice_from_name = sanitizeInput($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
$config_invoice_from_name = escapeSql($config_invoice_from_name);
// Email to client
@@ -561,9 +561,9 @@ if (isset($_POST['set_recurring_payment'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['recurring_invoice_client_id']);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']);
$recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
$recurring_invoice_amount = floatval($row['recurring_invoice_amount']);
enforceClientAccess();
@@ -580,9 +580,9 @@ if (isset($_POST['set_recurring_payment'])) {
$row = mysqli_fetch_assoc($sql);
$provider_id = intval($row['payment_provider_id']);
$provider_name = sanitizeInput($row['payment_provider_name']);
$provider_name = escapeSql($row['payment_provider_name']);
$account_id = intval($row['payment_provider_account']);
$saved_payment_description = sanitizeInput($row['saved_payment_description']);
$saved_payment_description = escapeSql($row['saved_payment_description']);
mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id");
mysqli_query($mysqli,"INSERT INTO recurring_payments SET recurring_payment_currency_code = '$recurring_invoice_currency_code', recurring_payment_account_id = $account_id, recurring_payment_method = 'Credit Card', recurring_payment_recurring_invoice_id = $recurring_invoice_id, recurring_payment_saved_payment_id = $saved_payment_id");
@@ -670,7 +670,7 @@ if (isset($_GET['recurring_invoice_email_notify'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']);

110
agent/post/recurring_ticket.php
View File

@@ -18,7 +18,7 @@ if (isset($_POST['add_recurring_ticket'])) {
enforceClientAccess();
$start_date = sanitizeInput($_POST['start_date']);
$start_date = escapeSql($_POST['start_date']);
mysqli_query($mysqli, "INSERT INTO recurring_tickets SET recurring_ticket_subject = '$subject', recurring_ticket_details = '$details', recurring_ticket_priority = '$priority', recurring_ticket_frequency = '$frequency', recurring_ticket_billable = $billable, recurring_ticket_start_date = '$start_date', recurring_ticket_next_run = '$start_date', recurring_ticket_assigned_to = $assigned_to, recurring_ticket_created_by = $session_user_id, recurring_ticket_client_id = $client_id, recurring_ticket_contact_id = $contact_id, recurring_ticket_asset_id = $asset_id, recurring_ticket_category = $category_id");
@@ -49,7 +49,7 @@ if (isset($_POST['edit_recurring_ticket'])) {
require_once 'recurring_ticket_model.php';
$recurring_ticket_id = intval($_POST['recurring_ticket_id']);
$next_run_date = sanitizeInput($_POST['next_date']);
$next_run_date = escapeSql($_POST['next_date']);
$client_id = intval(getFieldById('recurring_tickets', $recurring_ticket_id, 'recurring_ticket_client_id'));
@@ -90,12 +90,12 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
if (mysqli_num_rows($sql) > 0) {
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency']));
$priority = escapeSql($row['recurring_ticket_priority']);
$frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']);
$old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']);
$old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']);
$created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']);
$contact_id = intval($row['recurring_ticket_contact_id']);
@@ -112,10 +112,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
}
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
// Atomically increment and get the new ticket number
mysqli_query($mysqli, "
@@ -152,15 +152,15 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
);
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = [];
@@ -230,12 +230,12 @@ if (isset($_GET['force_recurring_ticket'])) {
if (mysqli_num_rows($sql) > 0) {
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency']));
$priority = escapeSql($row['recurring_ticket_priority']);
$frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']);
$old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']);
$old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']);
$created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']);
$contact_id = intval($row['recurring_ticket_contact_id']);
@@ -252,10 +252,10 @@ if (isset($_GET['force_recurring_ticket'])) {
}
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
// Atomically increment and get the new ticket number
mysqli_query($mysqli, "
@@ -292,15 +292,15 @@ if (isset($_GET['force_recurring_ticket'])) {
);
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = [];
@@ -369,8 +369,8 @@ if (isset($_GET['delete_recurring_ticket'])) {
// Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$frequency = sanitizeInput($row['recurring_ticket_frequency']);
$subject = escapeSql($row['recurring_ticket_subject']);
$frequency = escapeSql($row['recurring_ticket_frequency']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
@@ -404,8 +404,8 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) {
// Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$frequency = sanitizeInput($row['recurring_ticket_frequency']);
$subject = escapeSql($row['recurring_ticket_subject']);
$frequency = escapeSql($row['recurring_ticket_frequency']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
@@ -445,8 +445,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_name = sanitizeInput($row['recurring_ticket_name']);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$recurring_ticket_name = escapeSql($row['recurring_ticket_name']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
@@ -460,8 +460,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
$agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users LEFT JOIN user_settings ON users.user_id = user_settings.user_id WHERE users.user_id = $assign_to");
$agent_details = mysqli_fetch_assoc($agent_details_sql);
$agent_name = sanitizeInput($agent_details['user_name']);
$agent_email = sanitizeInput($agent_details['user_email']);
$agent_name = escapeSql($agent_details['user_name']);
$agent_email = escapeSql($agent_details['user_email']);
if (!$agent_name) {
flash_alert("Invalid agent!", 'error');
@@ -487,9 +487,9 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
if (!empty($config_smtp_provider)) {
// Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$company_name = sanitizeInput($session_company_name);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$company_name = escapeSql($session_company_name);
$subject = "$config_app_name - $recurring_ticket_count recurring tickets have been assigned to you";
$body = "Hi $agent_name, <br><br>$session_name assigned $recurring_ticket_count recurring tickets to you!<br><br>$tickets_assigned_body<br>Thanks, <br>$session_name<br>$company_name";
@@ -523,7 +523,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
enforceUserPermission('module_support', 2);
$priority = sanitizeInput($_POST['bulk_priority']);
$priority = escapeSql($_POST['bulk_priority']);
// Assign Tech to Selected Recurring Tickets
if (isset($_POST['recurring_ticket_ids'])) {
@@ -537,8 +537,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$original_recurring_ticket_priority = sanitizeInput($row['recurring_ticket_priority']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$original_recurring_ticket_priority = escapeSql($row['recurring_ticket_priority']);
$client_id = intval($row['ticket_client_id']);
enforceClientAccess();
@@ -578,13 +578,13 @@ if (isset($_POST['bulk_edit_recurring_ticket_category'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, category_name, recurring_ticket_client_id FROM recurring_tickets LEFT JOIN categories ON recurring_ticket_category = category_id WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$previous_recurring_ticket_category_name = sanitizeInput($row['category_name']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_category_name = escapeSql($row['category_name']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name'));
$category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_category = '$category_id' WHERE recurring_ticket_id = $recurring_ticket_id");
@@ -626,7 +626,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_billable'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_billable = intval($row['recurring_ticket_billable']);
if ($previous_recurring_ticket_billable) {
$previous_billable_status = "Billable";
@@ -659,7 +659,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
enforceUserPermission('module_support', 2);
$next_run_date = sanitizeInput($_POST['next_run_date']);
$next_run_date = escapeSql($_POST['next_run_date']);
if (isset($_POST['recurring_ticket_ids'])) {
@@ -671,8 +671,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$previous_recurring_ticket_next_run_date = sanitizeInput($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_next_run_date = escapeSql($row['recurring_ticket_next_run']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();

6
agent/post/recurring_ticket_model.php
View File

@@ -1,10 +1,10 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$subject = sanitizeInput($_POST['subject']);
$priority = sanitizeInput($_POST['priority']);
$subject = escapeSql($_POST['subject']);
$priority = escapeSql($_POST['priority']);
$details = mysqli_real_escape_string($mysqli, $_POST['details']);
$frequency = sanitizeInput($_POST['frequency']);
$frequency = escapeSql($_POST['frequency']);
$billable = intval($_POST['billable'] ?? 0);
$asset_id = intval($_POST['asset_id'] ?? 0);
$contact_id = intval($_POST['contact_id'] ?? 0);

18
agent/post/revenue.php
View File

@@ -12,13 +12,13 @@ if (isset($_POST['add_revenue'])) {
enforceUserPermission('module_sales', 2);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']);
$account = intval($_POST['account']);
$category = intval($_POST['category']);
$payment_method = sanitizeInput($_POST['payment_method']);
$description = sanitizeInput($_POST['description']);
$reference = sanitizeInput($_POST['reference']);
$payment_method = escapeSql($_POST['payment_method']);
$description = escapeSql($_POST['description']);
$reference = escapeSql($_POST['reference']);
mysqli_query($mysqli,"INSERT INTO revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_currency_code = '$session_company_currency', revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account");
@@ -39,13 +39,13 @@ if (isset($_POST['edit_revenue'])) {
enforceUserPermission('module_sales', 2);
$revenue_id = intval($_POST['revenue_id']);
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']);
$account = intval($_POST['account']);
$category = intval($_POST['category']);
$payment_method = sanitizeInput($_POST['payment_method']);
$description = sanitizeInput($_POST['description']);
$reference = sanitizeInput($_POST['reference']);
$payment_method = escapeSql($_POST['payment_method']);
$description = escapeSql($_POST['description']);
$reference = escapeSql($_POST['reference']);
mysqli_query($mysqli,"UPDATE revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account WHERE revenue_id = $revenue_id");
@@ -66,7 +66,7 @@ if (isset($_GET['delete_revenue'])) {
$revenue_id = intval($_GET['delete_revenue']);
// Get Revenue Details
$revenue_description = sanitizeInput(getFieldById('revenues', $revenue_id, 'revenue_description'));
$revenue_description = escapeSql(getFieldById('revenues', $revenue_id, 'revenue_description'));
mysqli_query($mysqli,"DELETE FROM revenues WHERE revenue_id = $revenue_id");

26
agent/post/service.php
View File

@@ -13,12 +13,12 @@ if (isset($_POST['add_service'])) {
enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
$service_name = sanitizeInput($_POST['name']);
$service_description = sanitizeInput($_POST['description']);
$service_category = sanitizeInput($_POST['category']); //TODO: Needs integration with company categories
$service_importance = sanitizeInput($_POST['importance']);
$service_backup = sanitizeInput($_POST['backup']);
$service_notes = sanitizeInput($_POST['note']);
$service_name = escapeSql($_POST['name']);
$service_description = escapeSql($_POST['description']);
$service_category = escapeSql($_POST['category']); //TODO: Needs integration with company categories
$service_importance = escapeSql($_POST['importance']);
$service_backup = escapeSql($_POST['backup']);
$service_notes = escapeSql($_POST['note']);
enforceClientAccess();
@@ -93,12 +93,12 @@ if (isset($_POST['edit_service'])) {
enforceUserPermission('module_support', 2);
$service_id = intval($_POST['service_id']);
$service_name = sanitizeInput($_POST['name']);
$service_description = sanitizeInput($_POST['description']);
$service_category = sanitizeInput($_POST['category']); //TODO: Needs integration with company categories
$service_importance = sanitizeInput($_POST['importance']);
$service_backup = sanitizeInput($_POST['backup']);
$service_notes = sanitizeInput($_POST['note']);
$service_name = escapeSql($_POST['name']);
$service_description = escapeSql($_POST['description']);
$service_category = escapeSql($_POST['category']); //TODO: Needs integration with company categories
$service_importance = escapeSql($_POST['importance']);
$service_backup = escapeSql($_POST['backup']);
$service_notes = escapeSql($_POST['note']);
$client_id = intval(getFieldById('services', $service_id, 'service_client_id'));
@@ -185,7 +185,7 @@ if (isset($_GET['delete_service'])) {
// Get Service Details
$sql = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql);
$service_name = sanitizeInput($row['service_name']);
$service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']);
enforceClientAccess();

60
agent/post/software.php
View File

@@ -21,12 +21,12 @@ if (isset($_POST['add_software_from_template'])) {
// GET Software Template Info
$sql_software_templates = mysqli_query($mysqli,"SELECT * FROM software_templates WHERE software_template_id = $software_template_id");
$row = mysqli_fetch_assoc($sql_software_templates);
$name = sanitizeInput($row['software_template_name']);
$version = sanitizeInput($row['software_template_version']);
$description = sanitizeInput($row['software_template_description']);
$type = sanitizeInput($row['software_template_type']);
$license_type = sanitizeInput($row['software_template_license_type']);
$notes = sanitizeInput($row['software_template_notes']);
$name = escapeSql($row['software_template_name']);
$version = escapeSql($row['software_template_version']);
$description = escapeSql($row['software_template_description']);
$type = escapeSql($row['software_template_type']);
$license_type = escapeSql($row['software_template_license_type']);
$notes = escapeSql($row['software_template_notes']);
$vendor = intval($_POST['vendor'] ?? 0);
// Software add query
@@ -49,28 +49,28 @@ if (isset($_POST['add_software'])) {
enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$version = sanitizeInput($_POST['version']);
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);
$license_type = sanitizeInput($_POST['license_type']);
$notes = sanitizeInput($_POST['notes']);
$key = sanitizeInput($_POST['key']);
$name = escapeSql($_POST['name']);
$version = escapeSql($_POST['version']);
$description = escapeSql($_POST['description']);
$type = escapeSql($_POST['type']);
$license_type = escapeSql($_POST['license_type']);
$notes = escapeSql($_POST['notes']);
$key = escapeSql($_POST['key']);
$seats = intval($_POST['seats']);
$purchase_reference = sanitizeInput($_POST['purchase_reference']);
$purchase = sanitizeInput($_POST['purchase']);
$purchase_reference = escapeSql($_POST['purchase_reference']);
$purchase = escapeSql($_POST['purchase']);
if (empty($purchase)) {
$purchase = "NULL";
} else {
$purchase = "'" . $purchase . "'";
}
$expire = sanitizeInput($_POST['expire']);
$expire = escapeSql($_POST['expire']);
if (empty($expire)) {
$expire = "NULL";
} else {
$expire = "'" . $expire . "'";
}
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
$vendor = intval($_POST['vendor'] ?? 0);
enforceClientAccess();
@@ -112,28 +112,28 @@ if (isset($_POST['edit_software'])) {
enforceUserPermission('module_support', 2);
$software_id = intval($_POST['software_id']);
$name = sanitizeInput($_POST['name']);
$version = sanitizeInput($_POST['version']);
$description = sanitizeInput($_POST['description']);
$type = sanitizeInput($_POST['type']);
$license_type = sanitizeInput($_POST['license_type']);
$notes = sanitizeInput($_POST['notes']);
$key = sanitizeInput($_POST['key']);
$name = escapeSql($_POST['name']);
$version = escapeSql($_POST['version']);
$description = escapeSql($_POST['description']);
$type = escapeSql($_POST['type']);
$license_type = escapeSql($_POST['license_type']);
$notes = escapeSql($_POST['notes']);
$key = escapeSql($_POST['key']);
$seats = intval($_POST['seats']);
$purchase_reference = sanitizeInput($_POST['purchase_reference']);
$purchase = sanitizeInput($_POST['purchase']);
$purchase_reference = escapeSql($_POST['purchase_reference']);
$purchase = escapeSql($_POST['purchase']);
if (empty($purchase)) {
$purchase = "NULL";
} else {
$purchase = "'" . $purchase . "'";
}
$expire = sanitizeInput($_POST['expire']);
$expire = escapeSql($_POST['expire']);
if (empty($expire)) {
$expire = "NULL";
} else {
$expire = "'" . $expire . "'";
}
$notes = sanitizeInput($_POST['notes']);
$notes = escapeSql($_POST['notes']);
$vendor = intval($_POST['vendor'] ?? 0);
$client_id = intval(getFieldById('software', $software_id, 'software_client_id'));
@@ -180,7 +180,7 @@ if (isset($_GET['archive_software'])) {
// Get Software Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql);
$software_name = sanitizeInput($row['software_name']);
$software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']);
enforceClientAccess();
@@ -210,7 +210,7 @@ if (isset($_GET['delete_software'])) {
// Get Software Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql);
$software_name = sanitizeInput($row['software_name']);
$software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']);
enforceClientAccess();

6
agent/post/tag_model.php
View File

@@ -1,7 +1,7 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$name = escapeSql($_POST['name']);
$type = intval($_POST['type']);
$color = sanitizeInput($_POST['color']);
$icon = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['icon']));
$color = escapeSql($_POST['color']);
$icon = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['icon']));

52
agent/post/task.php
View File

@@ -13,7 +13,7 @@ if (isset($_POST['add_task'])) {
enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']);
$task_name = sanitizeInput($_POST['name']);
$task_name = escapeSql($_POST['name']);
// Get Client ID from tickets using the ticket_id
$client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));
@@ -37,7 +37,7 @@ if (isset($_POST['edit_ticket_task'])) {
enforceUserPermission('module_support', 2);
$task_id = intval($_POST['task_id']);
$task_name = sanitizeInput($_POST['name']);
$task_name = escapeSql($_POST['name']);
$task_order = intval($_POST['order']);
$task_completion_estimate = intval($_POST['completion_estimate']);
@@ -63,7 +63,7 @@ if (isset($_POST['edit_ticket_template_task'])) {
enforceUserPermission('module_support', 2);
$task_template_id = intval($_POST['task_template_id']);
$task_name = sanitizeInput($_POST['name']);
$task_name = escapeSql($_POST['name']);
$task_order = intval($_POST['order']);
$task_completion_estimate = intval($_POST['completion_estimate']);
@@ -89,7 +89,7 @@ if (isset($_GET['delete_task'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']);
$task_name = sanitizeInput($row['task_name']);
$task_name = escapeSql($row['task_name']);
mysqli_query($mysqli, "DELETE FROM tasks WHERE task_id = $task_id");
@@ -113,7 +113,7 @@ if (isset($_GET['complete_task'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']);
$task_name = sanitizeInput($row['task_name']);
$task_name = escapeSql($row['task_name']);
$task_completion_estimate = intval($row['task_completion_estimate']);
$ticket_id = intval($row['ticket_id']);
@@ -147,7 +147,7 @@ if (isset($_GET['undo_complete_task'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
$row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']);
$task_name = sanitizeInput($row['task_name']);
$task_name = escapeSql($row['task_name']);
$ticket_id = intval($row['ticket_id']);
mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NULL, task_completed_by = NULL WHERE task_id = $task_id");
@@ -172,8 +172,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
enforceUserPermission('module_support', 2);
$task_id = intval($_POST['task_id']);
$scope = sanitizeInput($_POST['approval_scope']);
$type = sanitizeInput($_POST['approval_type']);
$scope = escapeSql($_POST['approval_scope']);
$type = escapeSql($_POST['approval_type']);
$approval_url_key = randomString(32);
$required_user_id = "NULL";
@@ -193,27 +193,27 @@ if (isset($_POST['add_ticket_task_approver'])) {
WHERE task_id = $task_id LIMIT 1
")
);
$task_name = sanitizeInput($tt_row['task_name']);
$task_name = escapeSql($tt_row['task_name']);
$ticket_id = intval($tt_row['task_ticket_id']);
$ticket_prefix = sanitizeInput($tt_row['ticket_prefix']);
$ticket_prefix = escapeSql($tt_row['ticket_prefix']);
$ticket_number = intval($tt_row['ticket_number']);
$ticket_subject = sanitizeInput($tt_row['ticket_subject']);
$ticket_status = sanitizeInput($tt_row['ticket_status_name']);
$ticket_url_key = sanitizeInput($tt_row['ticket_url_key']);
$ticket_subject = escapeSql($tt_row['ticket_subject']);
$ticket_status = escapeSql($tt_row['ticket_status_name']);
$ticket_url_key = escapeSql($tt_row['ticket_url_key']);
$ticket_contact_id = intval($tt_row['ticket_contact_id']);
$client_id = intval($tt_row['ticket_client_id']);
// --Notifications--
// Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
// Get Company Info
$crow = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"));
$company_name = sanitizeInput($crow['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($crow['company_phone'], $crow['company_phone_country_code']));
$company_name = escapeSql($crow['company_name']);
$company_phone = escapeSql(formatPhoneNumber($crow['company_phone'], $crow['company_phone_country_code']));
// Email contents
$subject = "Ticket task approval required - [$ticket_prefix$ticket_number] - $ticket_subject";
@@ -224,8 +224,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
if (!empty($config_smtp_host)) {
$agent_contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $required_user_id AND user_archived_at IS NULL"));
$name = sanitizeInput($agent_contact['user_name']);
$email = sanitizeInput($agent_contact['user_email']);
$name = escapeSql($agent_contact['user_name']);
$email = escapeSql($agent_contact['user_email']);
// Only add contact to email queue if email is valid
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
@@ -247,8 +247,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
if (!empty($config_smtp_host) && $scope == 'client' && $type == 'any') {
$contact_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_email FROM contacts WHERE contact_id = $ticket_contact_id LIMIT 1"));
$contact_name = sanitizeInput($contact_row['contact_name']);
$contact_email = sanitizeInput($contact_row['contact_email']);
$contact_name = escapeSql($contact_row['contact_name']);
$contact_email = escapeSql($contact_row['contact_email']);
$data = [];
@@ -279,8 +279,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
$data = [];
while ($technical_contact = mysqli_fetch_assoc($sql_technical_contacts)) {
$technical_contact_name = sanitizeInput($technical_contact['contact_name']);
$technical_contact_email = sanitizeInput($technical_contact['contact_email']);
$technical_contact_name = escapeSql($technical_contact['contact_name']);
$technical_contact_email = escapeSql($technical_contact['contact_email']);
if (filter_var($technical_contact_email, FILTER_VALIDATE_EMAIL)) {
$data[] = [
@@ -312,8 +312,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
$data = [];
while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) {
$billing_contact_name = sanitizeInput($billing_contact['contact_name']);
$billing_contact_email = sanitizeInput($billing_contact['contact_email']);
$billing_contact_name = escapeSql($billing_contact['contact_name']);
$billing_contact_email = escapeSql($billing_contact['contact_email']);
if (filter_var($billing_contact_email, FILTER_VALIDATE_EMAIL)) {
$data[] = [

480
agent/post/ticket.php
View File

File diff suppressed because it is too large Load Diff

6
agent/post/transfer.php
View File

@@ -17,13 +17,13 @@ if (isset($_POST['add_transfer'])) {
// Get Source Account Name for logging
$sql = mysqli_query($mysqli,"SELECT account_name, account_currency_code FROM accounts WHERE account_id = $account_from");
$row = mysqli_fetch_assoc($sql);
$source_account_name = sanitizeInput($row['account_name']);
$account_currency_code = sanitizeInput($row['account_currency_code']);
$source_account_name = escapeSql($row['account_name']);
$account_currency_code = escapeSql($row['account_currency_code']);
// Get Destination Account Name for logging
$sql = mysqli_query($mysqli,"SELECT account_name FROM accounts WHERE account_id = $account_to");
$row = mysqli_fetch_assoc($sql);
$destination_account_name = sanitizeInput($row['account_name']);
$destination_account_name = escapeSql($row['account_name']);
mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = $amount, expense_currency_code = '$session_company_currency', expense_vendor_id = 0, expense_category_id = 0, expense_account_id = $account_from");
$expense_id = mysqli_insert_id($mysqli);

6
agent/post/transfer_model.php
View File

@@ -1,9 +1,9 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']);
$account_from = intval($_POST['account_from']);
$account_to = intval($_POST['account_to']);
$transfer_method = sanitizeInput($_POST['transfer_method']);
$notes = sanitizeInput($_POST['notes']);
$transfer_method = escapeSql($_POST['transfer_method']);
$notes = escapeSql($_POST['notes']);

8
agent/post/trip.php
View File

@@ -67,8 +67,8 @@ if (isset($_GET['delete_trip'])) {
// Get Trip Info and Client ID for logging
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id"));
$client_id = intval($row['trip_client_id']);
$trip_source = sanitizeInput($row['trip_source']);
$trip_destination = sanitizeInput($row['trip_destination']);
$trip_source = escapeSql($row['trip_source']);
$trip_destination = escapeSql($row['trip_destination']);
if ($client_id) {
enforceClientAccess();
@@ -102,8 +102,8 @@ if (isset($_POST['export_trips_csv'])) {
$file_name_prepend = "$session_company_name-";
}
$date_from = sanitizeInput($_POST['date_from']);
$date_to = sanitizeInput($_POST['date_to']);
$date_from = escapeSql($_POST['date_from']);
$date_to = escapeSql($_POST['date_to']);
if (!empty($date_from) && !empty($date_to)){
$date_query = "DATE(trip_date) BETWEEN '$date_from' AND '$date_to'";
$file_name_date = "$date_from-to-$date_to";

8
agent/post/trip_model.php
View File

@@ -1,10 +1,10 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']);
$source = sanitizeInput($_POST['source']);
$destination = sanitizeInput($_POST['destination']);
$date = escapeSql($_POST['date']);
$source = escapeSql($_POST['source']);
$destination = escapeSql($_POST['destination']);
$miles = floatval($_POST['miles']);
$roundtrip = intval($_POST['roundtrip'] ?? 0);
$purpose = sanitizeInput($_POST['purpose']);
$purpose = escapeSql($_POST['purpose']);
$user_id = intval($_POST['user']);

2
agent/reports/tax_summary.php
View File

@@ -79,7 +79,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT `tax_name` FROM `taxes`");
while ($row = mysqli_fetch_assoc($sql_tax)) {
$tax_name_raw = $row['tax_name'];
$tax_name = sanitizeInput($tax_name_raw);
$tax_name = escapeSql($tax_name_raw);
echo "<tr>";
echo "<td>" . escapeHtml($tax_name_raw) . "</td>";

32
agent/user/post/profile.php
View File

@@ -10,23 +10,23 @@ if (isset($_POST['edit_your_user_details'])) {
validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']);
$email = sanitizeInput($_POST['email']);
$name = escapeSql($_POST['name']);
$email = escapeSql($_POST['email']);
$signature = mysqli_escape_string($mysqli,$_POST['signature']);
$existing_file_name = sanitizeInput(getFieldById('users', $session_user_id, 'user_avatar'));
$existing_file_name = escapeSql(getFieldById('users', $session_user_id, 'user_avatar'));
$logout = false;
$extended_log_description = '';
// Email notification when password or email is changed
$user_old_email_sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_email FROM users WHERE user_id = $session_user_id"));
$user_old_email = sanitizeInput($user_old_email_sql['user_email']);
$user_old_email = escapeSql($user_old_email_sql['user_email']);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_app_name = sanitizeInput($config_app_name);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
$config_app_name = escapeSql($config_app_name);
if (!empty($config_smtp_host) && ($user_old_email !== $email)) {
@@ -96,7 +96,7 @@ if (isset($_GET['clear_your_user_avatar'])) {
validateCSRFToken($_GET['csrf_token']);
$user_avatar = sanitizeInput(getFieldById('users', $session_user_id, 'user_avatar'));
$user_avatar = escapeSql(getFieldById('users', $session_user_id, 'user_avatar'));
unlink("../../uploads/users/$session_user_id/$user_avatar");
@@ -122,13 +122,13 @@ if (isset($_POST['edit_your_user_password'])) {
// Email notification when password or email is changed
$user_sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $session_user_id"));
$name = sanitizeInput($user_sql['user_name']);
$user_email = sanitizeInput($user_sql['user_email']);
$name = escapeSql($user_sql['user_name']);
$user_email = escapeSql($user_sql['user_email']);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_app_name = sanitizeInput($config_app_name);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
$config_app_name = escapeSql($config_app_name);
if (!empty($config_smtp_host)){
@@ -276,9 +276,9 @@ if (isset($_GET['disable_mfa'])){
mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id");
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email);
$config_app_name = sanitizeInput($config_app_name);
$config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = escapeSql($config_mail_from_email);
$config_app_name = escapeSql($config_app_name);
// Email notification
if (!empty($config_smtp_host)) {