AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-25 01:40:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
cron/certificate_refresher.php
View File

@@ -44,13 +44,13 @@ $sql_certificates = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_certificates)) {
$certificate_id = intval($row['certificate_id']);
$domain = sanitizeInput($row['certificate_domain']);
$domain = escapeSql($row['certificate_domain']);
$certificate = getSSL($domain);
$expire = sanitizeInput($certificate['expire']);
$issued_by = sanitizeInput($certificate['issued_by']);
$public_key = sanitizeInput($certificate['public_key']);
$expire = escapeSql($certificate['expire']);
$issued_by = escapeSql($certificate['issued_by']);
$public_key = escapeSql($certificate['public_key']);
if (!empty($expire)) {
@@ -89,9 +89,9 @@ while ($row = mysqli_fetch_assoc($sql_certificates)) {
foreach ($original_certificate_info as $column => $old_value) {
$new_value = $new_certificate_info[$column];
if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
$column = sanitizeInput($column);
$old_value = sanitizeInput($old_value);
$new_value = sanitizeInput($new_value);
$column = escapeSql($column);
$old_value = escapeSql($old_value);
$new_value = escapeSql($new_value);
mysqli_query($mysqli,"INSERT INTO certificate_history SET certificate_history_column = '$column', certificate_history_old_value = '$old_value', certificate_history_new_value = '$new_value', certificate_history_certificate_id = $certificate_id");
}
}

196
cron/cron.php
View File

@@ -19,43 +19,43 @@ $sql_companies = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE
$row = mysqli_fetch_assoc($sql_companies);
// Company Details
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']);
$company_website = sanitizeInput($row['company_website']);
$company_city = sanitizeInput($row['company_city']);
$company_state = sanitizeInput($row['company_state']);
$company_country = sanitizeInput($row['company_country']);
$company_locale = sanitizeInput($row['company_locale']);
$company_currency = sanitizeInput($row['company_currency']);
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = escapeSql($row['company_email']);
$company_website = escapeSql($row['company_website']);
$company_city = escapeSql($row['company_city']);
$company_state = escapeSql($row['company_state']);
$company_country = escapeSql($row['company_country']);
$company_locale = escapeSql($row['company_locale']);
$company_currency = escapeSql($row['company_currency']);
// Company Settings
$config_enable_cron = intval($row['config_enable_cron']);
$config_invoice_overdue_reminders = $row['config_invoice_overdue_reminders'];
$config_invoice_prefix = sanitizeInput($row['config_invoice_prefix']);
$config_invoice_from_email = sanitizeInput($row['config_invoice_from_email']);
$config_invoice_from_name = sanitizeInput($row['config_invoice_from_name']);
$config_invoice_prefix = escapeSql($row['config_invoice_prefix']);
$config_invoice_from_email = escapeSql($row['config_invoice_from_email']);
$config_invoice_from_name = escapeSql($row['config_invoice_from_name']);
$config_invoice_late_fee_enable = intval($row['config_invoice_late_fee_enable']);
$config_invoice_late_fee_percent = floatval($row['config_invoice_late_fee_percent']);
// Mail Settings
$config_smtp_provider = sanitizeInput($row['config_smtp_provider']);
$config_smtp_provider = escapeSql($row['config_smtp_provider']);
$config_smtp_host = $row['config_smtp_host'];
$config_smtp_username = $row['config_smtp_username'];
$config_smtp_password = $row['config_smtp_password'];
$config_smtp_port = intval($row['config_smtp_port']);
$config_smtp_encryption = $row['config_smtp_encryption'];
$config_mail_from_email = sanitizeInput($row['config_mail_from_email']);
$config_mail_from_name = sanitizeInput($row['config_mail_from_name']);
$config_mail_from_email = escapeSql($row['config_mail_from_email']);
$config_mail_from_name = escapeSql($row['config_mail_from_name']);
$config_recurring_auto_send_invoice = intval($row['config_recurring_auto_send_invoice']);
// Tickets
$config_ticket_prefix = sanitizeInput($row['config_ticket_prefix']);
$config_ticket_from_name = sanitizeInput($row['config_ticket_from_name']);
$config_ticket_from_email = sanitizeInput($row['config_ticket_from_email']);
$config_ticket_prefix = escapeSql($row['config_ticket_prefix']);
$config_ticket_from_name = escapeSql($row['config_ticket_from_name']);
$config_ticket_from_email = escapeSql($row['config_ticket_from_email']);
$config_ticket_client_general_notifications = intval($row['config_ticket_client_general_notifications']);
$config_ticket_autoclose_hours = intval($row['config_ticket_autoclose_hours']);
$config_ticket_new_ticket_notification_email = sanitizeInput($row['config_ticket_new_ticket_notification_email']);
$config_ticket_new_ticket_notification_email = escapeSql($row['config_ticket_new_ticket_notification_email']);
// Get Config for Telemetry
$config_theme = $row['config_theme'];
@@ -186,10 +186,10 @@ if ($config_enable_alert_domain_expire == 1) {
while ($row = mysqli_fetch_assoc($sql)) {
$domain_id = intval($row['domain_id']);
$domain_name = sanitizeInput($row['domain_name']);
$domain_expire = sanitizeInput($row['domain_expire']);
$domain_name = escapeSql($row['domain_name']);
$domain_expire = escapeSql($row['domain_expire']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
appNotify("Domain Expiring", "Domain $domain_name for $client_name will expire in $day Days on $domain_expire", "/agent/domains.php?client_id=$client_id", $client_id);
@@ -216,12 +216,12 @@ foreach ($certificateAlertArray as $day) {
while ($row = mysqli_fetch_assoc($sql)) {
$certificate_id = intval($row['certificate_id']);
$certificate_name = sanitizeInput($row['certificate_name']);
$certificate_domain = sanitizeInput($row['certificate_domain']);
$certificate_expire = sanitizeInput($row['certificate_expire']);
$certificate_name = escapeSql($row['certificate_name']);
$certificate_domain = escapeSql($row['certificate_domain']);
$certificate_expire = escapeSql($row['certificate_expire']);
$certificate_public_key = $row['certificate_public_key']; // Sanitize input breaks parsing
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
// Calculate the validity period
if (!empty($certificate_public_key)) {
@@ -266,10 +266,10 @@ foreach ($warranty_alert_array as $day) {
while ($row = mysqli_fetch_assoc($sql)) {
$asset_id = intval($row['asset_id']);
$asset_name = sanitizeInput($row['asset_name']);
$asset_warranty_expire = sanitizeInput($row['asset_warranty_expire']);
$asset_name = escapeSql($row['asset_name']);
$asset_warranty_expire = escapeSql($row['asset_warranty_expire']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
appNotify("Asset Warranty Expiring", "Asset $asset_name warranty for $client_name will expire in $day Days on $asset_warranty_expire", "/agent/assets.php?client_id=$client_id", $client_id);
@@ -302,10 +302,10 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) {
while ($row = mysqli_fetch_assoc($sql_recurring_tickets)) {
$recurring_ticket_id = intval($row['recurring_ticket_id']);
$subject = sanitizeInput($row['recurring_ticket_subject']);
$subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency']));
$priority = escapeSql($row['recurring_ticket_priority']);
$frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']);
$created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']);
@@ -363,15 +363,15 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) {
);
$row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = [];
@@ -450,7 +450,7 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) {
// Flag any active recurring "next run" dates that are in the past
$sql_invalid_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_next_run < CURDATE()");
while ($row = mysqli_fetch_assoc($sql_invalid_recurring_tickets)) {
$subject = sanitizeInput($row['recurring_ticket_subject']);
$subject = escapeSql($row['recurring_ticket_subject']);
appNotify("Ticket", "Recurring ticket $subject next run date is in the past!", "/agent/recurring_tickets.php");
}
@@ -471,11 +471,11 @@ $sql_resolved_tickets_to_close = mysqli_query(
while ($row = mysqli_fetch_assoc($sql_resolved_tickets_to_close)) {
$ticket_id = $row['ticket_id'];
$ticket_prefix = sanitizeInput($row['ticket_prefix']);
$ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_status = sanitizeInput($row['ticket_status']);
$ticket_assigned_to = sanitizeInput($row['ticket_assigned_to']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_status = escapeSql($row['ticket_status']);
$ticket_assigned_to = escapeSql($row['ticket_assigned_to']);
$client_id = intval($row['ticket_client_id']);
mysqli_query($mysqli,"UPDATE tickets SET ticket_status = 5, ticket_closed_at = NOW(), ticket_closed_by = $ticket_assigned_to WHERE ticket_id = $ticket_id");
@@ -511,18 +511,18 @@ if ($config_send_invoice_reminders == 1) {
while ($row = mysqli_fetch_assoc($sql)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']);
$invoice_date = sanitizeInput($row['invoice_date']);
$invoice_due = sanitizeInput($row['invoice_due']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_status = escapeSql($row['invoice_status']);
$invoice_date = escapeSql($row['invoice_date']);
$invoice_due = escapeSql($row['invoice_due']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
// Sum payments already applied, derive the real balance owed
$sql_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id");
@@ -610,24 +610,24 @@ $sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoice
while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
$recurring_invoice_id = intval($row['recurring_invoice_id']);
$recurring_invoice_scope = sanitizeInput($row['recurring_invoice_scope']);
$recurring_invoice_frequency = sanitizeInput($row['recurring_invoice_frequency']);
$recurring_invoice_status = sanitizeInput($row['recurring_invoice_status']);
$recurring_invoice_last_sent = sanitizeInput($row['recurring_invoice_last_sent']);
$recurring_invoice_next_date = sanitizeInput($row['recurring_invoice_next_date']);
$recurring_invoice_scope = escapeSql($row['recurring_invoice_scope']);
$recurring_invoice_frequency = escapeSql($row['recurring_invoice_frequency']);
$recurring_invoice_status = escapeSql($row['recurring_invoice_status']);
$recurring_invoice_last_sent = escapeSql($row['recurring_invoice_last_sent']);
$recurring_invoice_next_date = escapeSql($row['recurring_invoice_next_date']);
$recurring_invoice_discount_amount = floatval($row['recurring_invoice_discount_amount']);
$recurring_invoice_amount = floatval($row['recurring_invoice_amount']);
$recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']);
$recurring_invoice_note = sanitizeInput($row['recurring_invoice_note']);
$recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
$recurring_invoice_note = escapeSql($row['recurring_invoice_note']);
$recurring_invoice_email_notify = intval($row['recurring_invoice_email_notify']);
$category_id = intval($row['recurring_invoice_category_id']);
$client_id = intval($row['recurring_invoice_client_id']);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
$client_net_terms = intval($row['client_net_terms']);
$recurring_payment_recurring_invoice_id = intval($row['recurring_payment_recurring_invoice_id']);
$recurring_payment_currency_code = sanitizeInput($row['recurring_payment_currency_code']);
$recurring_payment_method = sanitizeInput($row['recurring_payment_method']);
$recurring_payment_currency_code = escapeSql($row['recurring_payment_currency_code']);
$recurring_payment_method = escapeSql($row['recurring_payment_method']);
$recurring_payment_account_id = intval($row['recurring_payment_account_id']);
// Atomically increment and get the new invoice number
@@ -653,8 +653,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
while ($row = mysqli_fetch_assoc($sql_invoice_items)) {
$item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']); //SQL Escape incase of ,
$item_description = sanitizeInput($row['item_description']); //SQL Escape incase of ,
$item_name = escapeSql($row['item_name']); //SQL Escape incase of ,
$item_description = escapeSql($row['item_description']); //SQL Escape incase of ,
$item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']);
@@ -687,17 +687,17 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
WHERE invoice_id = $new_invoice_id"
);
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_date = sanitizeInput($row['invoice_date']);
$invoice_due = sanitizeInput($row['invoice_due']);
$invoice_scope = escapeSql($row['invoice_scope']);
$invoice_date = escapeSql($row['invoice_date']);
$invoice_due = escapeSql($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
if ($config_recurring_auto_send_invoice == 1 && $recurring_invoice_email_notify == 1) {
@@ -737,8 +737,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
);
while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) {
$billing_contact_name = sanitizeInput($billing_contact['contact_name']);
$billing_contact_email = sanitizeInput($billing_contact['contact_email']);
$billing_contact_name = escapeSql($billing_contact['contact_name']);
$billing_contact_email = escapeSql($billing_contact['contact_email']);
$data = [
[
@@ -761,7 +761,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
// Start Flag any active recurring "next run" dates that are in the past
$sql_invalid_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_next_date < CURDATE() AND recurring_invoice_status = 1");
while ($row = mysqli_fetch_assoc($sql_invalid_recurring_invoices)) {
$invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']);
$invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$invoice_number = intval($row['recurring_invoice_number']);
appNotify("Invoice", "Recurring invoice $invoice_prefix$invoice_number next run date is in the past!", "/agent/recurring_invoices.php");
}
@@ -780,22 +780,22 @@ $sql_recurring_payments = mysqli_query($mysqli, "
while ($row = mysqli_fetch_assoc($sql_recurring_payments)) {
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']);
$invoice_date = sanitizeInput($row['invoice_date']);
$invoice_due = sanitizeInput($row['invoice_due']);
$invoice_scope = escapeSql($row['invoice_scope']);
$invoice_date = escapeSql($row['invoice_date']);
$invoice_due = escapeSql($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$recurring_payment_account_id = intval($row['recurring_payment_account_id']);
$recurring_payment_method = sanitizeInput($row['recurring_payment_method']);
$recurring_payment_currency_code = sanitizeInput($row['recurring_payment_currency_code']);
$recurring_payment_method = escapeSql($row['recurring_payment_method']);
$recurring_payment_currency_code = escapeSql($row['recurring_payment_currency_code']);
$recurring_payment_saved_payment_id = intval($row['recurring_payment_saved_payment_id']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
// Only attempt autopay if a saved payment method is set
if ($recurring_payment_saved_payment_id) {
@@ -815,14 +815,14 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) {
}
$provider_id = intval($saved_payment['payment_provider_id']);
$provider_name = sanitizeInput($saved_payment['payment_provider_name']);
$provider_name = escapeSql($saved_payment['payment_provider_name']);
$provider_private_key = $saved_payment['payment_provider_private_key'];
$account_id = intval($saved_payment['payment_provider_account']);
$expense_category_id = intval($saved_payment['payment_provider_expense_category']);
$expense_vendor_id = intval($saved_payment['payment_provider_expense_vendor']);
$expense_percentage_fee = floatval($saved_payment['payment_provider_expense_percentage_fee']);
$expense_flat_fee = floatval($saved_payment['payment_provider_expense_flat_fee']);
$saved_payment_description = sanitizeInput($saved_payment['saved_payment_description']);
$saved_payment_description = escapeSql($saved_payment['saved_payment_description']);
$stripe_payment_method_id = $saved_payment['saved_payment_provider_method'];
// NEW: Get the payment_provider_client (Stripe Customer ID) from client_payment_provider
@@ -833,7 +833,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) {
LIMIT 1
");
$cpp_row = mysqli_fetch_assoc($cpp_query);
$stripe_customer_id = $cpp_row ? sanitizeInput($cpp_row['payment_provider_client']) : '';
$stripe_customer_id = $cpp_row ? escapeSql($cpp_row['payment_provider_client']) : '';
// Stripe
if ($provider_name === "Stripe") {
@@ -861,10 +861,10 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) {
]
]);
$pi_id = sanitizeInput($payment_intent->id);
$pi_id = escapeSql($payment_intent->id);
$pi_date = date('Y-m-d', $payment_intent->created);
$pi_amount_paid = floatval($payment_intent->amount_received / 100);
$pi_currency = strtoupper(sanitizeInput($payment_intent->currency));
$pi_currency = strtoupper(escapeSql($payment_intent->currency));
$pi_livemode = $payment_intent->livemode;
} catch (Exception $e) {
@@ -957,11 +957,11 @@ while ($row = mysqli_fetch_assoc($sql_recurring_expenses)) {
$recurring_expense_frequency = intval($row['recurring_expense_frequency']);
$recurring_expense_month = intval($row['recurring_expense_month']);
$recurring_expense_day = intval($row['recurring_expense_day']);
$recurring_expense_description = sanitizeInput($row['recurring_expense_description']);
$recurring_expense_description = escapeSql($row['recurring_expense_description']);
$recurring_expense_amount = floatval($row['recurring_expense_amount']);
$recurring_expense_payment_method = sanitizeInput($row['recurring_expense_payment_method']);
$recurring_expense_reference = sanitizeInput($row['recurring_expense_reference']);
$recurring_expense_currency_code = sanitizeInput($row['recurring_expense_currency_code']);
$recurring_expense_payment_method = escapeSql($row['recurring_expense_payment_method']);
$recurring_expense_reference = escapeSql($row['recurring_expense_reference']);
$recurring_expense_currency_code = escapeSql($row['recurring_expense_currency_code']);
$recurring_expense_vendor_id = intval($row['recurring_expense_vendor_id']);
$recurring_expense_category_id = intval($row['recurring_expense_category_id']);
$recurring_expense_account_id = intval($row['recurring_expense_account_id']);
@@ -993,7 +993,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_expenses)) {
// Flag any active recurring "next run" dates that are in the past
$sql_invalid_recurring_expenses = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_next_date < CURDATE() AND recurring_expense_status = 1");
while ($row = mysqli_fetch_assoc($sql_invalid_recurring_expenses)) {
$recurring_expense_description = sanitizeInput($row['recurring_expense_description']);
$recurring_expense_description = escapeSql($row['recurring_expense_description']);
appNotify("Expense", "Recurring expense $recurring_expense_description next run date is in the past!", "/agent/recurring_expenses.php");
}

20
cron/domain_refresher.php
View File

@@ -41,8 +41,8 @@ if ($row) {
// Get current data in database
$domain_id = intval($row['domain_id']);
$domain_name = sanitizeInput($row['domain_name']);
$current_expire = sanitizeInput($row['domain_expire']);
$domain_name = escapeSql($row['domain_name']);
$current_expire = escapeSql($row['domain_expire']);
// Touch the record we're refreshing to ensure we don't loop
mysqli_query($mysqli, "UPDATE domains SET domain_updated_at = NOW() WHERE domain_id = $domain_id");
@@ -50,11 +50,11 @@ if ($row) {
// Lookup fresh info
$expire = getDomainExpirationDate($domain_name);
$records = getDomainRecords($domain_name);
$a = sanitizeInput($records['a']);
$ns = sanitizeInput($records['ns']);
$mx = sanitizeInput($records['mx']);
$txt = sanitizeInput($records['txt']);
$whois = sanitizeInput($records['whois']);
$a = escapeSql($records['a']);
$ns = escapeSql($records['ns']);
$mx = escapeSql($records['mx']);
$txt = escapeSql($records['txt']);
$whois = escapeSql($records['whois']);
// Handle expiry date
if (strtotime($expire)) {
@@ -108,9 +108,9 @@ if ($row) {
foreach ($original_domain_info as $column => $old_value) {
$new_value = $new_domain_info[$column];
if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
$column = sanitizeInput($column);
$old_value = sanitizeInput($old_value);
$new_value = sanitizeInput($new_value);
$column = escapeSql($column);
$old_value = escapeSql($old_value);
$new_value = escapeSql($new_value);
mysqli_query($mysqli,"INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id");
}
}

20
cron/mail_queue.php
View File

@@ -319,7 +319,7 @@ if (mysqli_num_rows($sql_queue) > 0) {
// Check sender
if (!filter_var($email_from, FILTER_VALIDATE_EMAIL)) {
$email_from_logging = sanitizeInput($rowq['email_from']);
$email_from_logging = escapeSql($rowq['email_from']);
mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_attempts = 99 WHERE email_id = $email_id");
logApp("Cron-Mail-Queue", "Error", "Failed to send email #$email_id due to invalid sender address: $email_from_logging - check configuration in settings.");
appNotify("Mail", "Failed to send email #$email_id due to invalid sender address");
@@ -331,19 +331,19 @@ if (mysqli_num_rows($sql_queue) > 0) {
// Basic recipient syntax check
if (!filter_var($email_recipient, FILTER_VALIDATE_EMAIL)) {
mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_attempts = 99 WHERE email_id = $email_id");
$email_to_logging = sanitizeInput($email_recipient);
$email_subject_logging = sanitizeInput($rowq['email_subject']);
$email_to_logging = escapeSql($email_recipient);
$email_subject_logging = escapeSql($rowq['email_subject']);
logApp("Cron-Mail-Queue", "Error", "Failed to send email: $email_id to $email_to_logging due to invalid recipient address. Email subject was: $email_subject_logging");
appNotify("Mail", "Failed to send email #$email_id to $email_to_logging due to invalid recipient address: Email subject was: $email_subject_logging");
continue;
}
// More intelligent recipient MX check (if not disabled with --no-mx-validation)
$domain = sanitizeInput(substr($email_recipient, strpos($email_recipient, '@') + 1));
$domain = escapeSql(substr($email_recipient, strpos($email_recipient, '@') + 1));
if (!in_array('--no-mx-validation', $argv) && !checkdnsrr($domain, 'MX')) {
mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_attempts = 99 WHERE email_id = $email_id");
$email_to_logging = sanitizeInput($email_recipient);
$email_subject_logging = sanitizeInput($rowq['email_subject']);
$email_to_logging = escapeSql($email_recipient);
$email_subject_logging = escapeSql($rowq['email_subject']);
logApp("Cron-Mail-Queue", "Error", "Failed to send email: $email_id to $email_to_logging due to invalid recipient domain (no MX). Email subject was: $email_subject_logging");
appNotify("Mail", "Failed to send email #$email_id to $email_to_logging due to invalid recipient domain (no MX): Email subject was: $email_subject_logging");
continue;
@@ -377,8 +377,8 @@ if (mysqli_num_rows($sql_queue) > 0) {
} catch (Exception $e) {
mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_failed_at = NOW(), email_attempts = 1 WHERE email_id = $email_id");
$email_recipient_logging = sanitizeInput($rowq['email_recipient']);
$email_subject_logging = sanitizeInput($rowq['email_subject']);
$email_recipient_logging = escapeSql($rowq['email_recipient']);
$email_subject_logging = escapeSql($rowq['email_subject']);
$err = substr("Mailer Error: " . $e->getMessage(), 0, 100) . "...";
appNotify("Cron-Mail-Queue", "Failed to send email #$email_id to $email_recipient_logging");
@@ -447,8 +447,8 @@ if (mysqli_num_rows($sql_failed_queue) > 0) {
} catch (Exception $e) {
mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_failed_at = NOW(), email_attempts = $email_attempts WHERE email_id = $email_id");
$email_recipient_logging = sanitizeInput($rowf['email_recipient']);
$email_subject_logging = sanitizeInput($rowf['email_subject']);
$email_recipient_logging = escapeSql($rowf['email_recipient']);
$email_subject_logging = escapeSql($rowf['email_subject']);
$err = substr("Mailer Error: " . $e->getMessage(), 0, 100) . "...";
logApp("Cron-Mail-Queue", "Error", "Failed to re-send email #$email_id to $email_recipient_logging regarding $email_subject_logging. $err");

58
cron/ticket_email_parser.php
View File

@@ -28,15 +28,15 @@ require_once "../functions.php";
// Get settings for the "default" company
require_once "../includes/load_global_settings.php";
$config_ticket_prefix = sanitizeInput($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name);
$config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_email_parse_unknown_senders = intval($row['config_ticket_email_parse_unknown_senders']);
// Get company name & phone & timezone
$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
$row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// Check setting enabled
if ($config_ticket_email_parse == 0) {
@@ -143,8 +143,8 @@ function addTicket($contact_id, $contact_name, $contact_email, $client_id, $date
$att_saved_path = $att_dir . $att_saved_filename;
file_put_contents($att_saved_path, $attachment['content']);
$ticket_attachment_name = sanitizeInput($att_name);
$ticket_attachment_reference_name = sanitizeInput($att_saved_filename);
$ticket_attachment_name = escapeSql($att_name);
$ticket_attachment_reference_name = escapeSql($att_saved_filename);
$ticket_attachment_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_name);
$ticket_attachment_reference_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_reference_name);
@@ -191,7 +191,7 @@ function addTicket($contact_id, $contact_name, $contact_email, $client_id, $date
} else {
$client_sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $client_id");
$client_row = mysqli_fetch_assoc($client_sql);
$client_name = sanitizeInput($client_row['client_name']);
$client_name = escapeSql($client_row['client_name']);
$client_uri = "&client_id=$client_id";
}
$email_subject = "$config_app_name - New Ticket - $client_name: $subject";
@@ -260,17 +260,17 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac
if ($row) {
$ticket_id = intval($row['ticket_id']);
$ticket_subject = sanitizeInput($row['ticket_subject']);
$ticket_status = sanitizeInput($row['ticket_status']);
$ticket_subject = escapeSql($row['ticket_subject']);
$ticket_status = escapeSql($row['ticket_status']);
$ticket_reply_contact = intval($row['ticket_contact_id']);
$ticket_contact_email = sanitizeInput($row['contact_email']);
$ticket_contact_email = escapeSql($row['contact_email']);
$client_id = intval($row['ticket_client_id']);
if ($client_id) {
$client_uri = "&client_id=$client_id";
} else {
$client_uri = '';
}
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
if ($ticket_status == 5) {
$config_ticket_prefix_esc = mysqli_real_escape_string($mysqli, $config_ticket_prefix);
@@ -324,8 +324,8 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac
$att_saved_path = $ticket_dir . $att_saved_filename;
file_put_contents($att_saved_path, $attachment['content']);
$ticket_attachment_name = sanitizeInput($att_name);
$ticket_attachment_reference_name = sanitizeInput($att_saved_filename);
$ticket_attachment_name = escapeSql($att_name);
$ticket_attachment_reference_name = escapeSql($att_saved_filename);
$ticket_attachment_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_name);
$ticket_attachment_reference_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_reference_name);
@@ -344,8 +344,8 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac
if ($ticket_assigned_to) {
$tech_sql = mysqli_query($mysqli, "SELECT user_email, user_name FROM users WHERE user_id = $ticket_assigned_to LIMIT 1");
$tech_row = mysqli_fetch_assoc($tech_sql);
$tech_email = sanitizeInput($tech_row['user_email']);
$tech_name = sanitizeInput($tech_row['user_name']);
$tech_email = escapeSql($tech_row['user_email']);
$tech_name = escapeSql($tech_row['user_name']);
$email_subject = "$config_app_name - Ticket updated - [$config_ticket_prefix$ticket_number] $ticket_subject";
$email_body = "Hello $tech_name,<br><br>A new reply has been added to the below ticket.<br><br>Client: $client_name<br>Ticket: $config_ticket_prefix$ticket_number<br>Subject: $ticket_subject<br>Link: https://$config_base_url/agent/ticket.php?ticket_id=$ticket_id$client_uri<br><br>--------------------------------<br>$message_esc";
@@ -686,14 +686,14 @@ foreach ($messages as $message) {
// From
$from_addr = $message->from(); // ?Address
$from_email = sanitizeInput($from_addr?->email() ?: 'itflow-guest@example.com');
$from_name = sanitizeInput($from_addr?->name() ?: 'Unknown');
$from_email = escapeSql($from_addr?->email() ?: 'itflow-guest@example.com');
$from_name = escapeSql($from_addr?->name() ?: 'Unknown');
$from_domain = explode("@", $from_email);
$from_domain = sanitizeInput(end($from_domain));
$from_domain = escapeSql(end($from_domain));
// Subject
$subject = sanitizeInput((string)$message->subject() ?: 'No Subject');
$subject = escapeSql((string)$message->subject() ?: 'No Subject');
// Skip vacation/out-of-office auto-responders to prevent mail loops (RFC 3834)
// NDRs use "auto-generated" and are still handled by the NDR logic below
@@ -724,7 +724,7 @@ foreach ($messages as $message) {
// Date (string)
$dateObj = $message->date(); // ?CarbonInterface
$date = sanitizeInput($dateObj ? $dateObj->setTimezone(date_default_timezone_get())->format('Y-m-d H:i:s') : date('Y-m-d H:i:s'));
$date = escapeSql($dateObj ? $dateObj->setTimezone(date_default_timezone_get())->format('Y-m-d H:i:s') : date('Y-m-d H:i:s'));
// Body (prefer HTML)
$message_body_html = $message->html();
@@ -751,7 +751,7 @@ foreach ($messages as $message) {
// Skip oversized attachments entirely
if ($size > $max_attachment_bytes) {
logApp("Cron-Email-Parser", "warning", "Email parser skipped oversized attachment " . sanitizeInput($name) . " (" . round($size / 1048576, 1) . " MB) from $from_email ($subject)");
logApp("Cron-Email-Parser", "warning", "Email parser skipped oversized attachment " . escapeSql($name) . " (" . round($size / 1048576, 1) . " MB) from $from_email ($subject)");
continue;
}
@@ -831,9 +831,9 @@ foreach ($messages as $message) {
$rowc = mysqli_fetch_assoc($any_contact_sql);
if ($rowc) {
$contact_name = sanitizeInput($rowc['contact_name']);
$contact_name = escapeSql($rowc['contact_name']);
$contact_id = intval($rowc['contact_id']);
$contact_email = sanitizeInput($rowc['contact_email']);
$contact_email = escapeSql($rowc['contact_email']);
$client_id = intval($rowc['contact_client_id']);
$email_processed = addTicket($contact_id, $contact_name, $contact_email, $client_id, $date, $subject, $message_body, $attachments, $original_message_file, $ccs);
@@ -889,15 +889,15 @@ foreach ($messages as $message) {
if (strpos($ctype, 'delivery-status') !== false) {
if (preg_match('/Final-Recipient:\s*rfc822;\s*(.+)/i', $body, $m)) {
$failed_recipient = sanitizeInput(trim($m[1]));
$failed_recipient = escapeSql(trim($m[1]));
}
if (preg_match('/Diagnostic-Code:\s*(.+)/i', $body, $m)) {
$diagnostic_code = sanitizeInput(trim($m[1]));
$diagnostic_code = escapeSql(trim($m[1]));
}
if (preg_match('/Status:\s*([0-9\.]+)/i', $body, $m)) {
$status_code = sanitizeInput(trim($m[1]));
$status_code = escapeSql(trim($m[1]));
}
}
@@ -905,11 +905,11 @@ foreach ($messages as $message) {
if (strpos($ctype, 'message/rfc822') !== false) {
if (preg_match('/^To:\s*(.+)$/mi', $body, $m)) {
$original_to = sanitizeInput(trim($m[1]));
$original_to = escapeSql(trim($m[1]));
}
if (preg_match('/^Subject:\s*(.+)$/mi', $body, $m)) {
$original_subject = sanitizeInput(trim($m[1]));
$original_subject = escapeSql(trim($m[1]));
}
}
}
@@ -920,7 +920,7 @@ foreach ($messages as $message) {
// Exim puts diagnostics on an indented line
if (preg_match('/\n\s{2,}(.+)/', $text, $m)) {
$diagnostic_code = sanitizeInput(trim($m[1]));
$diagnostic_code = escapeSql(trim($m[1]));
}
}