AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-08 00:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
guest/guest_ajax.php
View File

@@ -26,7 +26,7 @@ if (isset($_GET['stripe_create_pi'])) {
$jsonStr = file_get_contents('php://input');
$jsonObj = json_decode($jsonStr, true);
$invoice_id = intval($jsonObj['invoice_id']);
$url_key = sanitizeInput($jsonObj['url_key']);
$url_key = escapeSql($jsonObj['url_key']);
// Query invoice details
$invoice_sql = mysqli_query(

2
guest/guest_approve_ticket_task.php
View File

@@ -35,7 +35,7 @@ $company_phone = escapeHtml(formatPhoneNumber($company_sql_row['company_phone'],
$company_website = escapeHtml($company_sql_row['company_website']);
$approval_id = intval($_GET['task_approval_id']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
$task_row = mysqli_fetch_assoc(mysqli_query($mysqli,
"SELECT * FROM task_approvals

12
guest/guest_download_file.php
View File

@@ -8,18 +8,18 @@ require_once "../includes/inc_set_timezone.php";
require_once "../functions.php";
$session_ip = sanitizeInput(getIP());
$session_user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']);
$session_ip = escapeSql(getIP());
$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']);
if (isset($_GET['id']) && isset($_GET['key'])) {
$item_id = intval($_GET['id']);
$item_key = sanitizeInput($_GET['key']);
$item_key = escapeSql($_GET['key']);
$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$item_active = intval($row['item_active']);
$item_type = sanitizeInput($row['item_type']);
$item_type = escapeSql($row['item_type']);
$item_views = intval($row['item_views']);
$item_view_limit = intval($row['item_view_limit']);
$item_related_id = intval($row['item_related_id']);
@@ -56,8 +56,8 @@ if (isset($_GET['id']) && isset($_GET['key'])) {
exit("Item cannot be viewed at this time (No file, may have been deleted).");
}
$file_name = sanitizeInput($file_row['file_name']);
$file_reference_name = sanitizeInput($file_row['file_reference_name']);
$file_name = escapeSql($file_row['file_name']);
$file_reference_name = escapeSql($file_row['file_reference_name']);
$client_id = intval($file_row['file_client_id']);
$file_path = "../uploads/clients/$client_id/$file_reference_name";

30
guest/guest_pay_invoice_stripe.php
View File

@@ -20,7 +20,7 @@ $stripe_flat_fee = floatval($stripe_provider['payment_provider_expense_f
// Show payment form
if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent'])) {
$invoice_url_key = sanitizeInput($_GET['url_key']);
$invoice_url_key = escapeSql($_GET['url_key']);
$invoice_id = intval($_GET['invoice_id']);
// Query invoice details
@@ -158,7 +158,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
// Payment result processing
} elseif (isset($_GET['payment_intent'], $_GET['payment_intent_client_secret'])) {
$pi_id = sanitizeInput($_GET['payment_intent']);
$pi_id = escapeSql($_GET['payment_intent']);
$pi_cs = $_GET['payment_intent_client_secret'];
require_once '../libs/stripe-php/init.php';
@@ -181,7 +181,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
$pi_invoice_id = intval($pi_obj->metadata->itflow_invoice_id);
$pi_client_id = intval($pi_obj->metadata->itflow_client_id);
$pi_amount_paid = floatval(($pi_obj->amount_received / 100));
$pi_currency = strtoupper(sanitizeInput($pi_obj->currency));
$pi_currency = strtoupper(escapeSql($pi_obj->currency));
$pi_livemode = $pi_obj->livemode;
// Get/Check invoice (& client/primary contact)
@@ -201,21 +201,21 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
$row = mysqli_fetch_assoc($invoice_sql);
$invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']);
$invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']);
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$invoice_url_key = escapeSql($row['invoice_url_key']);
$client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone']));
$company_locale = sanitizeInput($row['company_locale']);
$company_name = escapeSql($row['company_name']);
$company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
$company_locale = escapeSql($row['company_locale']);
$currency_format = numfmt_create($company_locale, NumberFormatter::CURRENCY);
@@ -257,9 +257,9 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
$settings = mysqli_fetch_assoc($sql_settings);
$config_smtp_host = $settings['config_smtp_host'];
$config_invoice_from_name = sanitizeInput($settings['config_invoice_from_name']);
$config_invoice_from_email = sanitizeInput($settings['config_invoice_from_email']);
$config_invoice_paid_notification_email = sanitizeInput($settings['config_invoice_paid_notification_email']);
$config_invoice_from_name = escapeSql($settings['config_invoice_from_name']);
$config_invoice_from_email = escapeSql($settings['config_invoice_from_email']);
$config_invoice_paid_notification_email = escapeSql($settings['config_invoice_paid_notification_email']);
if (!empty($config_smtp_host)) {
$subject = "Payment Received - Invoice $invoice_prefix$invoice_number";

58
guest/guest_post.php
View File

@@ -11,16 +11,16 @@ require_once "../includes/inc_set_timezone.php"; // Must be included after sessi
if (isset($_GET['accept_quote'], $_GET['url_key'])) {
$quote_id = intval($_GET['accept_quote']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
// Select only the necessary fields
$sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_name, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
if (mysqli_num_rows($sql) == 1) {
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
$client_id = intval($row['client_id']);
mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Accepted' WHERE quote_id = $quote_id");
@@ -34,7 +34,7 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) {
$sql_company = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']);
$company_name = escapeSql($row['company_name']);
$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_settings);
@@ -43,10 +43,10 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) {
$config_smtp_encryption = $row['config_smtp_encryption'];
$config_smtp_username = $row['config_smtp_username'];
$config_smtp_password = $row['config_smtp_password'];
$config_quote_from_name = sanitizeInput($row['config_quote_from_name']);
$config_quote_from_email = sanitizeInput($row['config_quote_from_email']);
$config_quote_notification_email = sanitizeInput($row['config_quote_notification_email']);
$config_base_url = sanitizeInput($config_base_url);
$config_quote_from_name = escapeSql($row['config_quote_from_name']);
$config_quote_from_email = escapeSql($row['config_quote_from_email']);
$config_quote_notification_email = escapeSql($row['config_quote_notification_email']);
$config_base_url = escapeSql($config_base_url);
if (!empty($config_smtp_host) && !empty($config_quote_notification_email)) {
$subject = "Quote Accepted - $client_name - Quote $quote_prefix$quote_number";
@@ -76,16 +76,16 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) {
if (isset($_GET['decline_quote'], $_GET['url_key'])) {
$quote_id = intval($_GET['decline_quote']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
// Select only the necessary fields
$sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_name, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
if (mysqli_num_rows($sql) == 1) {
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$client_name = sanitizeInput($row['client_name']);
$client_name = escapeSql($row['client_name']);
$client_id = intval($row['client_id']);
mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Declined' WHERE quote_id = $quote_id");
@@ -99,7 +99,7 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) {
$sql_company = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']);
$company_name = escapeSql($row['company_name']);
$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_settings);
@@ -108,10 +108,10 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) {
$config_smtp_encryption = $row['config_smtp_encryption'];
$config_smtp_username = $row['config_smtp_username'];
$config_smtp_password = $row['config_smtp_password'];
$config_quote_from_name = sanitizeInput($row['config_quote_from_name']);
$config_quote_from_email = sanitizeInput($row['config_quote_from_email']);
$config_quote_notification_email = sanitizeInput($row['config_quote_notification_email']);
$config_base_url = sanitizeInput($config_base_url);
$config_quote_from_name = escapeSql($row['config_quote_from_name']);
$config_quote_from_email = escapeSql($row['config_quote_from_email']);
$config_quote_notification_email = escapeSql($row['config_quote_notification_email']);
$config_base_url = escapeSql($config_base_url);
if (!empty($config_smtp_host) && !empty($config_quote_notification_email)) {
$subject = "Quote Declined - $client_name - Quote $quote_prefix$quote_number";
@@ -140,7 +140,7 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) {
if (isset($_GET['reopen_ticket'], $_GET['url_key'])) {
$ticket_id = intval($_GET['ticket_id']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
// Select only the necessary fields
$sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL AND ticket_closed_at IS NULL");
@@ -167,7 +167,7 @@ if (isset($_GET['reopen_ticket'], $_GET['url_key'])) {
if (isset($_GET['close_ticket'], $_GET['url_key'])) {
$ticket_id = intval($_GET['ticket_id']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
// Select only the necessary fields
$sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL AND ticket_closed_at IS NULL");
@@ -194,8 +194,8 @@ if (isset($_GET['close_ticket'], $_GET['url_key'])) {
if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) {
$ticket_id = intval($_GET['ticket_id']);
$url_key = sanitizeInput($_GET['url_key']);
$feedback = sanitizeInput($_GET['feedback']);
$url_key = escapeSql($_GET['url_key']);
$feedback = escapeSql($_GET['feedback']);
// Select only the necessary fields
$sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_closed_at IS NOT NULL");
@@ -207,7 +207,7 @@ if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) {
// Notify on bad feedback
if ($feedback == "Bad") {
$ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
$ticket_prefix = sanitizeInput($ticket_details['ticket_prefix']);
$ticket_prefix = escapeSql($ticket_details['ticket_prefix']);
$ticket_number = intval($ticket_details['ticket_number']);
appNotify("Feedback", "Guest rated ticket number $ticket_prefix$ticket_number (ID: $ticket_id) as bad", "/agent/ticket.php?ticket_id=$ticket_id");
@@ -229,7 +229,7 @@ if (isset($_GET['approve_ticket_task'])) {
$task_id = intval($_GET['approve_ticket_task']);
$approval_id = intval($_GET['approval_id']);
$url_key = sanitizeInput($_GET['approval_url_key']);
$url_key = escapeSql($_GET['approval_url_key']);
$approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending'"));
@@ -261,7 +261,7 @@ if (isset($_GET['approve_ticket_task'])) {
if (isset($_GET['export_quote_pdf'])) {
$quote_id = intval($_GET['export_quote_pdf']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
$sql = mysqli_query(
$mysqli,
@@ -462,7 +462,7 @@ if (isset($_GET['export_quote_pdf'])) {
if (isset($_GET['export_invoice_pdf'])) {
$invoice_id = intval($_GET['export_invoice_pdf']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
$sql = mysqli_query(
$mysqli,
@@ -691,14 +691,14 @@ if (isset($_GET['export_invoice_pdf'])) {
if (isset($_POST['guest_quote_upload_file'])) {
$quote_id = intval($_POST['quote_id']);
$url_key = sanitizeInput($_POST['url_key']);
$url_key = escapeSql($_POST['url_key']);
// Select only the necessary fields
$sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'");
if (mysqli_num_rows($sql) == 1) {
$row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']);
$quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$client_id = intval($row['client_id']);
@@ -723,12 +723,12 @@ if (isset($_POST['guest_quote_upload_file'])) {
$file_tmp_path = $_FILES['file']['tmp_name'][$i];
$file_name = sanitizeInput($_FILES['file']['name'][$i]);
$file_name = escapeSql($_FILES['file']['name'][$i]);
$extarr = explode('.', $_FILES['file']['name'][$i]);
$file_extension = sanitizeInput(strtolower(end($extarr)));
$file_extension = escapeSql(strtolower(end($extarr)));
// Extract the file mime type and size
$file_mime_type = sanitizeInput($single_file['type']);
$file_mime_type = escapeSql($single_file['type']);
$file_size = intval($single_file['size']);
// Define destination file path

4
guest/guest_view_invoice.php
View File

@@ -9,7 +9,7 @@ if (!isset($_GET['invoice_id'], $_GET['url_key'])) {
exit();
}
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
$invoice_id = intval($_GET['invoice_id']);
$sql = mysqli_query(
@@ -45,7 +45,7 @@ $invoice_note = escapeHtml($row['invoice_note']);
$invoice_category_id = intval($row['invoice_category_id']);
$client_id = intval($row['client_id']);
$client_name = escapeHtml($row['client_name']);
$client_name_escaped = sanitizeInput($row['client_name']);
$client_name_escaped = escapeSql($row['client_name']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);

10
guest/guest_view_item.php
View File

@@ -45,7 +45,7 @@ if (!isset($_GET['id']) || !isset($_GET['key'])) {
}
$item_id = intval($_GET['id']);
$item_key = sanitizeInput($_GET['key']);
$item_key = escapeSql($_GET['key']);
$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
$row = mysqli_fetch_assoc($sql);
@@ -80,8 +80,8 @@ $item_expire = date('Y-m-d h:i A', strtotime($row['item_expire_at']));
$client_id = intval($row['item_client_id']);
// Create in-app notification
$item_type_sql_escaped = sanitizeInput($row['item_type']);
$item_recipient_sql_escaped = sanitizeInput($row['item_recipient']);
$item_type_sql_escaped = escapeSql($row['item_type']);
$item_recipient_sql_escaped = escapeSql($row['item_recipient']);
appNotify("Share Viewed", "$item_type_sql_escaped has been viewed by $item_recipient_sql_escaped", "/agent/client_overview.php?client_id=$client_id", $client_id);
@@ -129,7 +129,7 @@ if ($item_type == "Document") {
}
$doc_title = escapeHtml($doc_row['document_name']);
$doc_title_escaped = sanitizeInput($doc_row['document_name']);
$doc_title_escaped = escapeSql($doc_row['document_name']);
$doc_content = $purifier->purify($doc_row['document_content']);
echo "<h3>$doc_title</h3>";
@@ -256,7 +256,7 @@ if ($item_type == "Document") {
mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id");
// Logging
$name = sanitizeInput($credential_row['credential_name']);
$name = escapeSql($credential_row['credential_name']);
logAction("Share", "View", "Viewed shared $item_type $name via link", $client_id);
}

4
guest/guest_view_quote.php
View File

@@ -11,7 +11,7 @@ if (!isset($_GET['quote_id'], $_GET['url_key'])) {
}
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
$quote_id = intval($_GET['quote_id']);
$sql = mysqli_query(
@@ -46,7 +46,7 @@ $quote_currency_code = escapeHtml($row['quote_currency_code']);
$quote_note = escapeHtml($row['quote_note']);
$client_id = intval($row['client_id']);
$client_name = escapeHtml($row['client_name']);
$client_name_escaped = sanitizeInput($row['client_name']);
$client_name_escaped = escapeSql($row['client_name']);
$location_address = escapeHtml($row['location_address']);
$location_city = escapeHtml($row['location_city']);
$location_state = escapeHtml($row['location_state']);

2
guest/guest_view_ticket.php
View File

@@ -34,7 +34,7 @@ $company_phone_country_code = escapeHtml($company_sql_row['company_phone_country
$company_phone = escapeHtml(formatPhoneNumber($company_sql_row['company_phone'], $company_phone_country_code));
$company_website = escapeHtml($company_sql_row['company_website']);
$url_key = sanitizeInput($_GET['url_key']);
$url_key = escapeSql($_GET['url_key']);
$ticket_id = intval($_GET['ticket_id']);
$ticket_sql = mysqli_query($mysqli,

8
guest/includes/inc_all_guest.php
View File

@@ -9,10 +9,10 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/session_init.php';
// Set Timezone
require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/inc_set_timezone.php';
$ip = sanitizeInput(getIP());
$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']);
$os = sanitizeInput(getOS($user_agent));
$browser = sanitizeInput(getWebBrowser($user_agent));
$ip = escapeSql(getIP());
$user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']);
$os = escapeSql(getOS($user_agent));
$browser = escapeSql(getWebBrowser($user_agent));
// Get Company Name
$sql = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1");