AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-25 01:40:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
agent/post/recurring_ticket.php
View File

@@ -18,7 +18,7 @@ if (isset($_POST['add_recurring_ticket'])) {
enforceClientAccess();
$start_date = sanitizeInput($_POST['start_date']);
$start_date = escapeSql($_POST['start_date']);
mysqli_query($mysqli, "INSERT INTO recurring_tickets SET recurring_ticket_subject = '$subject', recurring_ticket_details = '$details', recurring_ticket_priority = '$priority', recurring_ticket_frequency = '$frequency', recurring_ticket_billable = $billable, recurring_ticket_start_date = '$start_date', recurring_ticket_next_run = '$start_date', recurring_ticket_assigned_to = $assigned_to, recurring_ticket_created_by = $session_user_id, recurring_ticket_client_id = $client_id, recurring_ticket_contact_id = $contact_id, recurring_ticket_asset_id = $asset_id, recurring_ticket_category = $category_id");
@@ -49,7 +49,7 @@ if (isset($_POST['edit_recurring_ticket'])) {
require_once 'recurring_ticket_model.php';
$recurring_ticket_id = intval($_POST['recurring_ticket_id']);
$next_run_date = sanitizeInput($_POST['next_date']);
$next_run_date = escapeSql($_POST['next_date']);
$client_id = intval(getFieldById('recurring_tickets', $recurring_ticket_id, 'recurring_ticket_client_id'));
@@ -90,12 +90,12 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
if (mysqli_num_rows($sql) > 0) {
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency']));
$priority = escapeSql($row['recurring_ticket_priority']);
$frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']);
$old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']);
$old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']);
$created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']);
$contact_id = intval($row['recurring_ticket_contact_id']);
@@ -112,10 +112,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
}
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
// Atomically increment and get the new ticket number
mysqli_query($mysqli, "
@@ -152,15 +152,15 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
);
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = [];
@@ -230,12 +230,12 @@ if (isset($_GET['force_recurring_ticket'])) {
if (mysqli_num_rows($sql) > 0) {
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency']));
$priority = escapeSql($row['recurring_ticket_priority']);
$frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']);
$old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']);
$old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']);
$created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']);
$contact_id = intval($row['recurring_ticket_contact_id']);
@@ -252,10 +252,10 @@ if (isset($_GET['force_recurring_ticket'])) {
}
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url);
$config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = escapeSql($config_base_url);
// Atomically increment and get the new ticket number
mysqli_query($mysqli, "
@@ -292,15 +292,15 @@ if (isset($_GET['force_recurring_ticket'])) {
);
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = [];
@@ -369,8 +369,8 @@ if (isset($_GET['delete_recurring_ticket'])) {
// Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$frequency = sanitizeInput($row['recurring_ticket_frequency']);
$subject = escapeSql($row['recurring_ticket_subject']);
$frequency = escapeSql($row['recurring_ticket_frequency']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
@@ -404,8 +404,8 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) {
// Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$frequency = sanitizeInput($row['recurring_ticket_frequency']);
$subject = escapeSql($row['recurring_ticket_subject']);
$frequency = escapeSql($row['recurring_ticket_frequency']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
@@ -445,8 +445,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_name = sanitizeInput($row['recurring_ticket_name']);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$recurring_ticket_name = escapeSql($row['recurring_ticket_name']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
@@ -460,8 +460,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
$agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users LEFT JOIN user_settings ON users.user_id = user_settings.user_id WHERE users.user_id = $assign_to");
$agent_details = mysqli_fetch_assoc($agent_details_sql);
$agent_name = sanitizeInput($agent_details['user_name']);
$agent_email = sanitizeInput($agent_details['user_email']);
$agent_name = escapeSql($agent_details['user_name']);
$agent_email = escapeSql($agent_details['user_email']);
if (!$agent_name) {
flash_alert("Invalid agent!", 'error');
@@ -487,9 +487,9 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
if (!empty($config_smtp_provider)) {
// Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email);
$company_name = sanitizeInput($session_company_name);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = escapeSql($config_ticket_from_email);
$company_name = escapeSql($session_company_name);
$subject = "$config_app_name - $recurring_ticket_count recurring tickets have been assigned to you";
$body = "Hi $agent_name, <br><br>$session_name assigned $recurring_ticket_count recurring tickets to you!<br><br>$tickets_assigned_body<br>Thanks, <br>$session_name<br>$company_name";
@@ -523,7 +523,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
enforceUserPermission('module_support', 2);
$priority = sanitizeInput($_POST['bulk_priority']);
$priority = escapeSql($_POST['bulk_priority']);
// Assign Tech to Selected Recurring Tickets
if (isset($_POST['recurring_ticket_ids'])) {
@@ -537,8 +537,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$original_recurring_ticket_priority = sanitizeInput($row['recurring_ticket_priority']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$original_recurring_ticket_priority = escapeSql($row['recurring_ticket_priority']);
$client_id = intval($row['ticket_client_id']);
enforceClientAccess();
@@ -578,13 +578,13 @@ if (isset($_POST['bulk_edit_recurring_ticket_category'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, category_name, recurring_ticket_client_id FROM recurring_tickets LEFT JOIN categories ON recurring_ticket_category = category_id WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$previous_recurring_ticket_category_name = sanitizeInput($row['category_name']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_category_name = escapeSql($row['category_name']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name'));
$category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_category = '$category_id' WHERE recurring_ticket_id = $recurring_ticket_id");
@@ -626,7 +626,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_billable'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_billable = intval($row['recurring_ticket_billable']);
if ($previous_recurring_ticket_billable) {
$previous_billable_status = "Billable";
@@ -659,7 +659,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
enforceUserPermission('module_support', 2);
$next_run_date = sanitizeInput($_POST['next_run_date']);
$next_run_date = escapeSql($_POST['next_run_date']);
if (isset($_POST['recurring_ticket_ids'])) {
@@ -671,8 +671,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']);
$previous_recurring_ticket_next_run_date = sanitizeInput($row['recurring_ticket_next_run']);
$recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_next_run_date = escapeSql($row['recurring_ticket_next_run']);
$client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess();