AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-16 20:45:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

Browse Source
This commit is contained in:
johnnyq
2026-07-14 17:17:50 -04:00
parent 7bc47a58fe
commit b57ddc0e5c
148 changed files with 1945 additions and 1945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
admin/app_log.php
View File

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
// Log Type Filter // Log Type Filter
if (isset($_GET['type']) & !empty($_GET['type'])) { if (isset($_GET['type']) & !empty($_GET['type'])) {
$log_type_query = "AND (app_log_type = '" . sanitizeInput($_GET['type']) . "')"; $log_type_query = "AND (app_log_type = '" . escapeSql($_GET['type']) . "')";
$type_filter = escapeHtml($_GET['type']); $type_filter = escapeHtml($_GET['type']);
} else { } else {
// Default - any // Default - any
@@ -18,7 +18,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) {
// Log Category Filter // Log Category Filter
if (isset($_GET['category']) & !empty($_GET['catergory'])) { if (isset($_GET['category']) & !empty($_GET['catergory'])) {
$log_category_query = "AND (app_log_category = '" . sanitizeInput($_GET['category']) . "')"; $log_category_query = "AND (app_log_category = '" . escapeSql($_GET['category']) . "')";
$category_filter = escapeHtml($_GET['category']); $category_filter = escapeHtml($_GET['category']);
} else { } else {
// Default - any // Default - any

4
admin/audit_log.php
View File

@@ -28,7 +28,7 @@ if (isset($_GET['client']) & !empty($_GET['client'])) {
// Log Type Filter // Log Type Filter
if (isset($_GET['type']) & !empty($_GET['type'])) { if (isset($_GET['type']) & !empty($_GET['type'])) {
$log_type_query = "AND (log_type = '" . sanitizeInput($_GET['type']) . "')"; $log_type_query = "AND (log_type = '" . escapeSql($_GET['type']) . "')";
$type_filter = escapeHtml($_GET['type']); $type_filter = escapeHtml($_GET['type']);
} else { } else {
// Default - any // Default - any
@@ -38,7 +38,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) {
// Log Action Filter // Log Action Filter
if (isset($_GET['action']) & !empty($_GET['action'])) { if (isset($_GET['action']) & !empty($_GET['action'])) {
$log_action_query = "AND (log_action = '" . sanitizeInput($_GET['action']) . "')"; $log_action_query = "AND (log_action = '" . escapeSql($_GET['action']) . "')";
$action_filter = escapeHtml($_GET['action']); $action_filter = escapeHtml($_GET['action']);
} else { } else {
// Default - any // Default - any

2
admin/category.php
View File

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
if (isset($_GET['category'])) { if (isset($_GET['category'])) {
$category = sanitizeInput($_GET['category']); $category = escapeSql($_GET['category']);
} else { } else {
$category = "Expense"; $category = "Expense";
} }

14
admin/database_updates.php
View File

@@ -1668,10 +1668,10 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
$sql = mysqli_query($mysqli, "SELECT * FROM assets"); $sql = mysqli_query($mysqli, "SELECT * FROM assets");
while ($row = mysqli_fetch_assoc($sql)) { while ($row = mysqli_fetch_assoc($sql)) {
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$mac = sanitizeInput($row['asset_mac']); $mac = escapeSql($row['asset_mac']);
$ip = sanitizeInput($row['asset_ip']); $ip = escapeSql($row['asset_ip']);
$nat_ip = sanitizeInput($row['asset_nat_ip']); $nat_ip = escapeSql($row['asset_nat_ip']);
$ipv6 = sanitizeInput($row['asset_ipv6']); $ipv6 = escapeSql($row['asset_ipv6']);
$network = intval($row['asset_network_id']); $network = intval($row['asset_network_id']);
mysqli_query($mysqli, "INSERT INTO `asset_interfaces` SET interface_name = 'Primary', interface_mac = '$mac', interface_ip = '$ip', interface_nat_ip = '$nat_ip', interface_ipv6 = '$ipv6', interface_port = 'eth0', interface_primary = 1, interface_network_id = $network, interface_asset_id = $asset_id"); mysqli_query($mysqli, "INSERT INTO `asset_interfaces` SET interface_name = 'Primary', interface_mac = '$mac', interface_ip = '$ip', interface_nat_ip = '$nat_ip', interface_ipv6 = '$ipv6', interface_port = 'eth0', interface_primary = 1, interface_network_id = $network, interface_asset_id = $asset_id");
@@ -1793,8 +1793,8 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
$sql_tickets_2 = mysqli_query($mysqli, "SELECT ticket_id, ticket_updated_at, ticket_closed_at FROM tickets WHERE tickets.ticket_closed_at IS NOT NULL"); $sql_tickets_2 = mysqli_query($mysqli, "SELECT ticket_id, ticket_updated_at, ticket_closed_at FROM tickets WHERE tickets.ticket_closed_at IS NOT NULL");
foreach ($sql_tickets_2 as $row) { foreach ($sql_tickets_2 as $row) {
$ticket_id = intval($row['ticket_id']); $ticket_id = intval($row['ticket_id']);
$ticket_updated_at = sanitizeInput($row['ticket_updated_at']); // To keep old updated_at time $ticket_updated_at = escapeSql($row['ticket_updated_at']); // To keep old updated_at time
$ticket_closed_at = sanitizeInput($row['ticket_closed_at']); $ticket_closed_at = escapeSql($row['ticket_closed_at']);
mysqli_query($mysqli, "UPDATE tickets SET ticket_resolved_at = '$ticket_closed_at', ticket_updated_at = '$ticket_updated_at' WHERE ticket_id = '$ticket_id'"); mysqli_query($mysqli, "UPDATE tickets SET ticket_resolved_at = '$ticket_closed_at', ticket_updated_at = '$ticket_updated_at' WHERE ticket_id = '$ticket_id'");
} }
@@ -3933,7 +3933,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
$sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL"); $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
while ($row = mysqli_fetch_assoc($sql_categories)) { while ($row = mysqli_fetch_assoc($sql_categories)) {
$category_name = sanitizeInput($row['category_name']); $category_name = escapeSql($row['category_name']);
mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$category_name'"); mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$category_name'");
} }

6
admin/oauth_microsoft_mail_callback.php
View File

@@ -11,10 +11,10 @@ if (!isset($session_is_admin) || !$session_is_admin) {
redirect($settings_mail_path); redirect($settings_mail_path);
} }
$state = sanitizeInput($_GET['state'] ?? ''); $state = escapeSql($_GET['state'] ?? '');
$code = $_GET['code'] ?? ''; $code = $_GET['code'] ?? '';
$error = sanitizeInput($_GET['error'] ?? ''); $error = escapeSql($_GET['error'] ?? '');
$error_description = sanitizeInput($_GET['error_description'] ?? ''); $error_description = escapeSql($_GET['error_description'] ?? '');
$session_state = $_SESSION['mail_oauth_state'] ?? ''; $session_state = $_SESSION['mail_oauth_state'] ?? '';
$session_state_expires = intval($_SESSION['mail_oauth_state_expires_at'] ?? 0); $session_state_expires = intval($_SESSION['mail_oauth_state_expires_at'] ?? 0);

14
admin/post/ai_model.php
View File

@@ -11,9 +11,9 @@ if (isset($_POST['add_ai_model'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider_id = intval($_POST['provider']); $provider_id = intval($_POST['provider']);
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$prompt = sanitizeInput($_POST['prompt']); $prompt = escapeSql($_POST['prompt']);
$use_case = sanitizeInput($_POST['use_case']); $use_case = escapeSql($_POST['use_case']);
mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id"); mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id");
@@ -32,9 +32,9 @@ if (isset($_POST['edit_ai_model'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$model_id = intval($_POST['model_id']); $model_id = intval($_POST['model_id']);
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$prompt = sanitizeInput($_POST['prompt']); $prompt = escapeSql($_POST['prompt']);
$use_case = sanitizeInput($_POST['use_case']); $use_case = escapeSql($_POST['use_case']);
mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id"); mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id");
@@ -52,7 +52,7 @@ if (isset($_GET['delete_ai_model'])) {
$model_id = intval($_GET['delete_ai_model']); $model_id = intval($_GET['delete_ai_model']);
$model_name = sanitizeInput(getFieldById('ai_models', $model_id, 'ai_model_name')); $model_name = escapeSql(getFieldById('ai_models', $model_id, 'ai_model_name'));
mysqli_query($mysqli,"DELETE FROM ai_models WHERE ai_model_id = $model_id"); mysqli_query($mysqli,"DELETE FROM ai_models WHERE ai_model_id = $model_id");

16
admin/post/ai_provider.php
View File

@@ -10,10 +10,10 @@ if (isset($_POST['add_ai_provider'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider = sanitizeInput($_POST['provider']); $provider = escapeSql($_POST['provider']);
$url = sanitizeInput($_POST['url']); $url = escapeSql($_POST['url']);
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$api_key = sanitizeInput($_POST['api_key']); $api_key = escapeSql($_POST['api_key']);
mysqli_query($mysqli,"INSERT INTO ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key'"); mysqli_query($mysqli,"INSERT INTO ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key'");
@@ -32,9 +32,9 @@ if (isset($_POST['edit_ai_provider'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider_id = intval($_POST['provider_id']); $provider_id = intval($_POST['provider_id']);
$provider = sanitizeInput($_POST['provider']); $provider = escapeSql($_POST['provider']);
$url = sanitizeInput($_POST['url']); $url = escapeSql($_POST['url']);
$api_key = sanitizeInput($_POST['api_key']); $api_key = escapeSql($_POST['api_key']);
mysqli_query($mysqli,"UPDATE ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key' WHERE ai_provider_id = $provider_id"); mysqli_query($mysqli,"UPDATE ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key' WHERE ai_provider_id = $provider_id");
@@ -52,7 +52,7 @@ if (isset($_GET['delete_ai_provider'])) {
$provider_id = intval($_GET['delete_ai_provider']); $provider_id = intval($_GET['delete_ai_provider']);
$provider_name = sanitizeInput(getFieldById('ai_providers', $provider_id, 'ai_provider_name')); $provider_name = escapeSql(getFieldById('ai_providers', $provider_id, 'ai_provider_name'));
mysqli_query($mysqli,"DELETE FROM ai_providers WHERE ai_provider_id = $provider_id"); mysqli_query($mysqli,"DELETE FROM ai_providers WHERE ai_provider_id = $provider_id");

12
admin/post/api_keys.php
View File

@@ -10,10 +10,10 @@ if (isset($_POST['add_api_key'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
$client_id = intval($_POST['client']); $client_id = intval($_POST['client']);
$secret = sanitizeInput($_POST['key']); // API Key $secret = escapeSql($_POST['key']); // API Key
// Credential decryption password // Credential decryption password
$password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT); $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT);
@@ -39,7 +39,7 @@ if (isset($_GET['revoke_api_key'])) {
// Get API Key Name // Get API Key Name
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
$api_key_name = sanitizeInput($row['api_key_name']); $api_key_name = escapeSql($row['api_key_name']);
$client_id = intval($row['api_key_client_id']); $client_id = intval($row['api_key_client_id']);
mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id"); mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id");
@@ -60,7 +60,7 @@ if (isset($_GET['delete_api_key'])) {
// Get API Key Name // Get API Key Name
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
$api_key_name = sanitizeInput($row['api_key_name']); $api_key_name = escapeSql($row['api_key_name']);
$client_id = intval($row['api_key_client_id']); $client_id = intval($row['api_key_client_id']);
mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id"); mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id");
@@ -88,7 +88,7 @@ if (isset($_POST['bulk_delete_api_keys'])) {
// Get API Key Name // Get API Key Name
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
$api_key_name = sanitizeInput($row['api_key_name']); $api_key_name = escapeSql($row['api_key_name']);
$client_id = intval($row['api_key_client_id']); $client_id = intval($row['api_key_client_id']);
mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id");

12
admin/post/category.php
View File

@@ -51,8 +51,8 @@ if (isset($_GET['archive_category'])) {
// Get Category Name and Type for logging // Get Category Name and Type for logging
$sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$category_name = sanitizeInput($row['category_name']); $category_name = escapeSql($row['category_name']);
$category_type = sanitizeInput($row['category_type']); $category_type = escapeSql($row['category_type']);
mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NOW() WHERE category_id = $category_id"); mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NOW() WHERE category_id = $category_id");
@@ -73,8 +73,8 @@ if (isset($_GET['restore_category'])) {
// Get Category Name and Type for logging // Get Category Name and Type for logging
$sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$category_name = sanitizeInput($row['category_name']); $category_name = escapeSql($row['category_name']);
$category_type = sanitizeInput($row['category_type']); $category_type = escapeSql($row['category_type']);
mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NULL WHERE category_id = $category_id"); mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NULL WHERE category_id = $category_id");
@@ -95,8 +95,8 @@ if (isset($_GET['delete_category'])) {
// Get Category Name and Type for logging // Get Category Name and Type for logging
$sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$category_name = sanitizeInput($row['category_name']); $category_name = escapeSql($row['category_name']);
$category_type = sanitizeInput($row['category_type']); $category_type = escapeSql($row['category_type']);
mysqli_query($mysqli,"DELETE FROM categories WHERE category_id = $category_id"); mysqli_query($mysqli,"DELETE FROM categories WHERE category_id = $category_id");

8
admin/post/category_model.php
View File

@@ -1,7 +1,7 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);

20
admin/post/contract_template.php
View File

@@ -9,11 +9,11 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_POST['add_contract_template'])) { if (isset($_POST['add_contract_template'])) {
// Sanitize text inputs // Sanitize text inputs
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$renewal_frequency = sanitizeInput($_POST['renewal_frequency']); $renewal_frequency = escapeSql($_POST['renewal_frequency']);
$support_hours = sanitizeInput($_POST['support_hours']); $support_hours = escapeSql($_POST['support_hours']);
$details = mysqli_escape_string($mysqli, $_POST['details']); $details = mysqli_escape_string($mysqli, $_POST['details']);
// Numeric fields cast to integer // Numeric fields cast to integer
@@ -62,11 +62,11 @@ if (isset($_POST['add_contract_template'])) {
if (isset($_POST['edit_contract_template'])) { if (isset($_POST['edit_contract_template'])) {
$contract_template_id = intval($_POST['contract_template_id']); $contract_template_id = intval($_POST['contract_template_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$renewal_frequency= sanitizeInput($_POST['renewal_frequency']); $renewal_frequency= escapeSql($_POST['renewal_frequency']);
$support_hours = sanitizeInput($_POST['support_hours']); $support_hours = escapeSql($_POST['support_hours']);
$details = mysqli_escape_string($mysqli, $_POST['details']); $details = mysqli_escape_string($mysqli, $_POST['details']);
$sla_low_resp = intval($_POST['sla_low_response_time']); $sla_low_resp = intval($_POST['sla_low_response_time']);
$sla_med_resp = intval($_POST['sla_medium_response_time']); $sla_med_resp = intval($_POST['sla_medium_response_time']);

4
admin/post/custom_field.php
View File

@@ -10,7 +10,7 @@ if(isset($_POST['create_custom_field'])){
require_once 'custom_field_model.php'; require_once 'custom_field_model.php';
$table = sanitizeInput($_POST['table']); $table = escapeSql($_POST['table']);
mysqli_query($mysqli,"INSERT INTO custom_fields SET custom_field_table = '$table', custom_field_label = '$label', custom_field_type = '$type'"); mysqli_query($mysqli,"INSERT INTO custom_fields SET custom_field_table = '$table', custom_field_label = '$label', custom_field_type = '$type'");
@@ -44,7 +44,7 @@ if(isset($_GET['delete_custom_field'])){
$custom_field_id = intval($_GET['delete_custom_field']); $custom_field_id = intval($_GET['delete_custom_field']);
$label = sanitizeInput(getFieldById('custom_fields', $custom_field_id, 'custom_field_label')); $label = escapeSql(getFieldById('custom_fields', $custom_field_id, 'custom_field_label'));
mysqli_query($mysqli,"DELETE FROM custom_fields WHERE custom_field_id = $custom_field_id"); mysqli_query($mysqli,"DELETE FROM custom_fields WHERE custom_field_id = $custom_field_id");

4
admin/post/custom_field_model.php
View File

@@ -1,5 +1,5 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$label = sanitizeInput($_POST['label']); $label = escapeSql($_POST['label']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);

16
admin/post/custom_link.php
View File

@@ -10,10 +10,10 @@ if (isset($_POST['add_custom_link'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$uri = sanitizeInput($_POST['uri']); $uri = escapeSql($_POST['uri']);
$new_tab = intval($_POST['new_tab'] ?? 0); $new_tab = intval($_POST['new_tab'] ?? 0);
$icon = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['icon'])); $icon = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['icon']));
$order = intval($_POST['order'] ?? 0); $order = intval($_POST['order'] ?? 0);
$location = intval($_POST['location']); $location = intval($_POST['location']);
@@ -34,10 +34,10 @@ if (isset($_POST['edit_custom_link'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$custom_link_id = intval($_POST['custom_link_id']); $custom_link_id = intval($_POST['custom_link_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$uri = sanitizeInput($_POST['uri']); $uri = escapeSql($_POST['uri']);
$new_tab = intval($_POST['new_tab'] ?? 0); $new_tab = intval($_POST['new_tab'] ?? 0);
$icon = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['icon'])); $icon = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['icon']));
$order = intval($_POST['order'] ?? 0); $order = intval($_POST['order'] ?? 0);
$location = intval($_POST['location']); $location = intval($_POST['location']);
@@ -60,8 +60,8 @@ if (isset($_GET['delete_custom_link'])) {
// Get Custom Link name and uri for logging // Get Custom Link name and uri for logging
$sql = mysqli_query($mysqli,"SELECT custom_link_name, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id"); $sql = mysqli_query($mysqli,"SELECT custom_link_name, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$custom_link_name = sanitizeInput($row['custom_link_name']); $custom_link_name = escapeSql($row['custom_link_name']);
$custom_link_uri = sanitizeInput($row['custom_link_uri']); $custom_link_uri = escapeSql($row['custom_link_uri']);
mysqli_query($mysqli,"DELETE FROM custom_links WHERE custom_link_id = $custom_link_id"); mysqli_query($mysqli,"DELETE FROM custom_links WHERE custom_link_id = $custom_link_id");

10
admin/post/document_template.php
View File

@@ -8,8 +8,8 @@ if (isset($_POST['add_document_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
mysqli_query($mysqli,"INSERT INTO document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '', document_template_created_by = $session_user_id"); mysqli_query($mysqli,"INSERT INTO document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '', document_template_created_by = $session_user_id");
@@ -41,8 +41,8 @@ if (isset($_POST['edit_document_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$document_template_id = intval($_POST['document_template_id']); $document_template_id = intval($_POST['document_template_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$processed_content = saveBase64Images( $processed_content = saveBase64Images(
$_POST['content'], $_POST['content'],
@@ -77,7 +77,7 @@ if (isset($_GET['delete_document_template'])) {
$document_template_id = intval($_GET['delete_document_template']); $document_template_id = intval($_GET['delete_document_template']);
$document_template_name = sanitizeInput(getFieldById('document_templates', $document_template_id, 'document_template_name')); $document_template_name = escapeSql(getFieldById('document_templates', $document_template_id, 'document_template_name'));
mysqli_query($mysqli,"DELETE FROM document_templates WHERE document_template_id = $document_template_id"); mysqli_query($mysqli,"DELETE FROM document_templates WHERE document_template_id = $document_template_id");

4
admin/post/identity_provider.php
View File

@@ -6,8 +6,8 @@ if (isset($_POST['edit_identity_provider'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$azure_client_id = sanitizeInput($_POST['azure_client_id']); $azure_client_id = escapeSql($_POST['azure_client_id']);
$azure_client_secret = sanitizeInput($_POST['azure_client_secret']); $azure_client_secret = escapeSql($_POST['azure_client_secret']);
mysqli_query($mysqli,"UPDATE settings SET config_azure_client_id = '$azure_client_id', config_azure_client_secret = '$azure_client_secret' WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_azure_client_id = '$azure_client_id', config_azure_client_secret = '$azure_client_secret' WHERE company_id = 1");

2
admin/post/payment_method.php
View File

@@ -63,7 +63,7 @@ if (isset($_GET['delete_payment_method'])) {
$payment_method_id = intval($_GET['delete_payment_method']); $payment_method_id = intval($_GET['delete_payment_method']);
$payment_method_name = sanitizeInput(getFieldById('payment_methods', $payment_method_is, 'payment_method_name')); $payment_method_name = escapeSql(getFieldById('payment_methods', $payment_method_is, 'payment_method_name'));
mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id"); mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id");

14
admin/post/payment_provider.php
View File

@@ -10,9 +10,9 @@ if (isset($_POST['add_payment_provider'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider = sanitizeInput($_POST['provider']); $provider = escapeSql($_POST['provider']);
$public_key = sanitizeInput($_POST['public_key']); $public_key = escapeSql($_POST['public_key']);
$private_key = sanitizeInput($_POST['private_key']); $private_key = escapeSql($_POST['private_key']);
$threshold = floatval($_POST['threshold']); $threshold = floatval($_POST['threshold']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$expense_vendor = intval($_POST['expense_vendor']) ?? 0; $expense_vendor = intval($_POST['expense_vendor']) ?? 0;
@@ -44,9 +44,9 @@ if (isset($_POST['edit_payment_provider'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider_id = intval($_POST['provider_id']); $provider_id = intval($_POST['provider_id']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$public_key = sanitizeInput($_POST['public_key']); $public_key = escapeSql($_POST['public_key']);
$private_key = sanitizeInput($_POST['private_key']); $private_key = escapeSql($_POST['private_key']);
$threshold = floatval($_POST['threshold']); $threshold = floatval($_POST['threshold']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$expense_vendor = intval($_POST['expense_vendor']) ?? 0; $expense_vendor = intval($_POST['expense_vendor']) ?? 0;
@@ -75,7 +75,7 @@ if (isset($_GET['delete_payment_provider'])) {
// Delete all Saved Cards related // Delete all Saved Cards related
// Delete Client Payment Provider Releation // Delete Client Payment Provider Releation
$provider_name = sanitizeInput(getFieldById('payment_providers', $provider_id, 'provider_name')); $provider_name = escapeSql(getFieldById('payment_providers', $provider_id, 'provider_name'));
// Delete provider // Delete provider
mysqli_query($mysqli,"DELETE FROM payment_providers WHERE payment_provider_id = $provider_id"); mysqli_query($mysqli,"DELETE FROM payment_providers WHERE payment_provider_id = $provider_id");

10
admin/post/project_template.php
View File

@@ -6,8 +6,8 @@ if (isset($_POST['add_project_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
mysqli_query($mysqli, "INSERT INTO project_templates SET project_template_name = '$name', project_template_description = '$description'"); mysqli_query($mysqli, "INSERT INTO project_templates SET project_template_name = '$name', project_template_description = '$description'");
@@ -26,8 +26,8 @@ if (isset($_POST['edit_project_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$project_template_id = intval($_POST['project_template_id']); $project_template_id = intval($_POST['project_template_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
mysqli_query($mysqli, "UPDATE project_templates SET project_template_name = '$name', project_template_description = '$description' WHERE project_template_id = $project_template_id"); mysqli_query($mysqli, "UPDATE project_templates SET project_template_name = '$name', project_template_description = '$description' WHERE project_template_id = $project_template_id");
@@ -94,7 +94,7 @@ if (isset($_GET['delete_project_template'])) {
$project_template_id = intval($_GET['delete_project_template']); $project_template_id = intval($_GET['delete_project_template']);
$project_template_name = sanitizeInput(getFieldById('project_templates', $project_template_id, 'project_template_name')); $project_template_name = escapeSql(getFieldById('project_templates', $project_template_id, 'project_template_name'));
mysqli_query($mysqli, "DELETE FROM project_templates WHERE project_template_id = $project_template_id"); mysqli_query($mysqli, "DELETE FROM project_templates WHERE project_template_id = $project_template_id");

10
admin/post/roles.php
View File

@@ -10,8 +10,8 @@ if (isset($_POST['add_role'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['role_name']); $name = escapeSql($_POST['role_name']);
$description = sanitizeInput($_POST['role_description']); $description = escapeSql($_POST['role_description']);
$admin = intval($_POST['role_is_admin']); $admin = intval($_POST['role_is_admin']);
mysqli_query($mysqli, "INSERT INTO user_roles SET role_name = '$name', role_description = '$description', role_is_admin = $admin"); mysqli_query($mysqli, "INSERT INTO user_roles SET role_name = '$name', role_description = '$description', role_is_admin = $admin");
@@ -45,8 +45,8 @@ if (isset($_POST['edit_role'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$role_id = intval($_POST['role_id']); $role_id = intval($_POST['role_id']);
$name = sanitizeInput($_POST['role_name']); $name = escapeSql($_POST['role_name']);
$description = sanitizeInput($_POST['role_description']); $description = escapeSql($_POST['role_description']);
$admin = intval($_POST['role_is_admin']); $admin = intval($_POST['role_is_admin']);
mysqli_query($mysqli, "UPDATE user_roles SET role_name = '$name', role_description = '$description', role_is_admin = $admin WHERE role_id = $role_id"); mysqli_query($mysqli, "UPDATE user_roles SET role_name = '$name', role_description = '$description', role_is_admin = $admin WHERE role_id = $role_id");
@@ -90,7 +90,7 @@ if (isset($_GET['archive_role'])) {
mysqli_query($mysqli, "UPDATE user_roles SET role_archived_at = NOW() WHERE role_id = $role_id"); mysqli_query($mysqli, "UPDATE user_roles SET role_archived_at = NOW() WHERE role_id = $role_id");
$role_name = sanitizeInput(getFieldById('user_roles', $role_id, 'role_name')); $role_name = escapeSql(getFieldById('user_roles', $role_id, 'role_name'));
logAction("User Role", "Archive", "$session_name archived user role $role_name", 0, $role_id); logAction("User Role", "Archive", "$session_name archived user role $role_name", 0, $role_id);

8
admin/post/settings_ai.php
View File

@@ -6,15 +6,15 @@ if (isset($_POST['edit_ai_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider = sanitizeInput($_POST['provider']); $provider = escapeSql($_POST['provider']);
if($provider){ if($provider){
$ai_enable = 1; $ai_enable = 1;
} else { } else {
$ai_enable = 0; $ai_enable = 0;
} }
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$url = sanitizeInput($_POST['url']); $url = escapeSql($_POST['url']);
$api_key = sanitizeInput($_POST['api_key']); $api_key = escapeSql($_POST['api_key']);
mysqli_query($mysqli,"UPDATE settings SET config_ai_enable = $ai_enable, config_ai_provider = '$provider', config_ai_model = '$model', config_ai_url = '$url', config_ai_api_key = '$api_key' WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_ai_enable = $ai_enable, config_ai_provider = '$provider', config_ai_model = '$model', config_ai_url = '$url', config_ai_api_key = '$api_key' WHERE company_id = 1");

20
admin/post/settings_company.php
View File

@@ -6,21 +6,21 @@ if (isset($_POST['edit_company'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$address = sanitizeInput($_POST['address']); $address = escapeSql($_POST['address']);
$city = sanitizeInput($_POST['city']); $city = escapeSql($_POST['city']);
$state = sanitizeInput($_POST['state']); $state = escapeSql($_POST['state']);
$zip = sanitizeInput($_POST['zip']); $zip = escapeSql($_POST['zip']);
$country = sanitizeInput($_POST['country']); $country = escapeSql($_POST['country']);
$phone_country_code = preg_replace("/[^0-9]/", '',$_POST['phone_country_code']); $phone_country_code = preg_replace("/[^0-9]/", '',$_POST['phone_country_code']);
$phone = preg_replace("/[^0-9]/", '',$_POST['phone']); $phone = preg_replace("/[^0-9]/", '',$_POST['phone']);
$email = sanitizeInput($_POST['email']); $email = escapeSql($_POST['email']);
$website = sanitizeInput($_POST['website']); $website = escapeSql($_POST['website']);
$tax_id = sanitizeInput($_POST['tax_id']); $tax_id = escapeSql($_POST['tax_id']);
$sql = mysqli_query($mysqli,"SELECT company_logo FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT company_logo FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['company_logo']); $existing_file_name = escapeSql($row['company_logo']);
// Company logo // Company logo
if (isset($_FILES['file']['tmp_name'])) { if (isset($_FILES['file']['tmp_name'])) {

6
admin/post/settings_default.php
View File

@@ -6,11 +6,11 @@ if (isset($_POST['edit_default_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$start_page = sanitizeInput($_POST['start_page']); $start_page = escapeSql($_POST['start_page']);
$expense_account = intval($_POST['expense_account']); $expense_account = intval($_POST['expense_account']);
$payment_account = intval($_POST['payment_account']); $payment_account = intval($_POST['payment_account']);
$payment_method = sanitizeInput($_POST['payment_method']); $payment_method = escapeSql($_POST['payment_method']);
$expense_payment_method = sanitizeInput($_POST['expense_payment_method']); $expense_payment_method = escapeSql($_POST['expense_payment_method']);
$transfer_from_account = intval($_POST['transfer_from_account']); $transfer_from_account = intval($_POST['transfer_from_account']);
$transfer_to_account = intval($_POST['transfer_to_account']); $transfer_to_account = intval($_POST['transfer_to_account']);
$calendar = intval($_POST['calendar']); $calendar = intval($_POST['calendar']);

8
admin/post/settings_invoice.php
View File

@@ -6,17 +6,17 @@ if (isset($_POST['edit_invoice_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_invoice_prefix = sanitizeInput($_POST['config_invoice_prefix']); $config_invoice_prefix = escapeSql($_POST['config_invoice_prefix']);
$config_invoice_next_number = intval($_POST['config_invoice_next_number']); $config_invoice_next_number = intval($_POST['config_invoice_next_number']);
$config_invoice_footer = sanitizeInput($_POST['config_invoice_footer']); $config_invoice_footer = escapeSql($_POST['config_invoice_footer']);
$config_invoice_show_tax_id = intval($_POST['config_invoice_show_tax_id'] ?? 0); $config_invoice_show_tax_id = intval($_POST['config_invoice_show_tax_id'] ?? 0);
$config_invoice_late_fee_enable = intval($_POST['config_invoice_late_fee_enable'] ?? 0); $config_invoice_late_fee_enable = intval($_POST['config_invoice_late_fee_enable'] ?? 0);
$config_invoice_late_fee_percent = floatval($_POST['config_invoice_late_fee_percent']); $config_invoice_late_fee_percent = floatval($_POST['config_invoice_late_fee_percent']);
$config_recurring_invoice_prefix = sanitizeInput($_POST['config_recurring_invoice_prefix']); $config_recurring_invoice_prefix = escapeSql($_POST['config_recurring_invoice_prefix']);
$config_recurring_invoice_next_number = intval($_POST['config_recurring_invoice_next_number']); $config_recurring_invoice_next_number = intval($_POST['config_recurring_invoice_next_number']);
$config_invoice_paid_notification_email = ''; $config_invoice_paid_notification_email = '';
if (filter_var($_POST['config_invoice_paid_notification_email'], FILTER_VALIDATE_EMAIL)) { if (filter_var($_POST['config_invoice_paid_notification_email'], FILTER_VALIDATE_EMAIL)) {
$config_invoice_paid_notification_email = sanitizeInput($_POST['config_invoice_paid_notification_email']); $config_invoice_paid_notification_email = escapeSql($_POST['config_invoice_paid_notification_email']);
} }
mysqli_query($mysqli,"UPDATE settings SET config_invoice_prefix = '$config_invoice_prefix', config_invoice_next_number = $config_invoice_next_number, config_invoice_footer = '$config_invoice_footer', config_invoice_show_tax_id = $config_invoice_show_tax_id, config_invoice_late_fee_enable = $config_invoice_late_fee_enable, config_invoice_late_fee_percent = $config_invoice_late_fee_percent, config_invoice_paid_notification_email = '$config_invoice_paid_notification_email', config_recurring_invoice_prefix = '$config_recurring_invoice_prefix', config_recurring_invoice_next_number = $config_recurring_invoice_next_number WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_invoice_prefix = '$config_invoice_prefix', config_invoice_next_number = $config_invoice_next_number, config_invoice_footer = '$config_invoice_footer', config_invoice_show_tax_id = $config_invoice_show_tax_id, config_invoice_late_fee_enable = $config_invoice_late_fee_enable, config_invoice_late_fee_percent = $config_invoice_late_fee_percent, config_invoice_paid_notification_email = '$config_invoice_paid_notification_email', config_recurring_invoice_prefix = '$config_recurring_invoice_prefix', config_recurring_invoice_next_number = $config_recurring_invoice_next_number WHERE company_id = 1");

6
admin/post/settings_localization.php
View File

@@ -6,9 +6,9 @@ if (isset($_POST['edit_localization'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$locale = sanitizeInput($_POST['locale']); $locale = escapeSql($_POST['locale']);
$currency_code = sanitizeInput($_POST['currency_code']); $currency_code = escapeSql($_POST['currency_code']);
$timezone = sanitizeInput($_POST['timezone']); $timezone = escapeSql($_POST['timezone']);
mysqli_query($mysqli,"UPDATE companies SET company_locale = '$locale', company_currency = '$currency_code' WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE companies SET company_locale = '$locale', company_currency = '$currency_code' WHERE company_id = 1");

90
admin/post/settings_mail.php
View File

@@ -11,11 +11,11 @@ if (isset($_POST['oauth_connect_microsoft_mail'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
// Save the OAuth credential fields from this form so the auth flow uses the latest inputs // Save the OAuth credential fields from this form so the auth flow uses the latest inputs
$config_mail_oauth_client_id = sanitizeInput($_POST['config_mail_oauth_client_id'] ?? ''); $config_mail_oauth_client_id = escapeSql($_POST['config_mail_oauth_client_id'] ?? '');
$config_mail_oauth_client_secret = sanitizeInput($_POST['config_mail_oauth_client_secret'] ?? ''); $config_mail_oauth_client_secret = escapeSql($_POST['config_mail_oauth_client_secret'] ?? '');
$config_mail_oauth_tenant_id = sanitizeInput($_POST['config_mail_oauth_tenant_id'] ?? $config_mail_oauth_tenant_id); $config_mail_oauth_tenant_id = escapeSql($_POST['config_mail_oauth_tenant_id'] ?? $config_mail_oauth_tenant_id);
$config_mail_oauth_refresh_token = sanitizeInput($_POST['config_mail_oauth_refresh_token'] ?? ''); $config_mail_oauth_refresh_token = escapeSql($_POST['config_mail_oauth_refresh_token'] ?? '');
$config_mail_oauth_access_token = sanitizeInput($_POST['config_mail_oauth_access_token'] ?? ''); $config_mail_oauth_access_token = escapeSql($_POST['config_mail_oauth_access_token'] ?? '');
mysqli_query($mysqli, "UPDATE settings SET mysqli_query($mysqli, "UPDATE settings SET
config_mail_oauth_client_id = '$config_mail_oauth_client_id', config_mail_oauth_client_id = '$config_mail_oauth_client_id',
@@ -77,12 +77,12 @@ if (isset($_POST['edit_mail_smtp_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_smtp_provider = sanitizeInput($_POST['config_smtp_provider']); $config_smtp_provider = escapeSql($_POST['config_smtp_provider']);
$config_smtp_host = sanitizeInput($_POST['config_smtp_host'] ?? $config_smtp_host); $config_smtp_host = escapeSql($_POST['config_smtp_host'] ?? $config_smtp_host);
$config_smtp_port = intval($_POST['config_smtp_port'] ?? $config_smtp_port); $config_smtp_port = intval($_POST['config_smtp_port'] ?? $config_smtp_port);
$config_smtp_encryption = sanitizeInput($_POST['config_smtp_encryption'] ?? $config_smtp_encryption); $config_smtp_encryption = escapeSql($_POST['config_smtp_encryption'] ?? $config_smtp_encryption);
$config_smtp_username = sanitizeInput($_POST['config_smtp_username'] ?? $config_smtp_username); $config_smtp_username = escapeSql($_POST['config_smtp_username'] ?? $config_smtp_username);
$config_smtp_password = sanitizeInput($_POST['config_smtp_password'] ?? $config_smtp_password); $config_smtp_password = escapeSql($_POST['config_smtp_password'] ?? $config_smtp_password);
mysqli_query($mysqli, " mysqli_query($mysqli, "
UPDATE settings SET UPDATE settings SET
@@ -107,12 +107,12 @@ if (isset($_POST['edit_mail_imap_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_imap_provider = sanitizeInput($_POST['config_imap_provider']); $config_imap_provider = escapeSql($_POST['config_imap_provider']);
$config_imap_host = sanitizeInput($_POST['config_imap_host'] ?? $config_imap_host); $config_imap_host = escapeSql($_POST['config_imap_host'] ?? $config_imap_host);
$config_imap_port = intval($_POST['config_imap_port'] ?? $config_imap_port); $config_imap_port = intval($_POST['config_imap_port'] ?? $config_imap_port);
$config_imap_encryption = sanitizeInput($_POST['config_imap_encryption'] ?? $config_imap_encryption); $config_imap_encryption = escapeSql($_POST['config_imap_encryption'] ?? $config_imap_encryption);
$config_imap_username = sanitizeInput($_POST['config_imap_username'] ?? $config_imap_username); $config_imap_username = escapeSql($_POST['config_imap_username'] ?? $config_imap_username);
$config_imap_password = sanitizeInput($_POST['config_imap_password'] ?? $config_imap_password); $config_imap_password = escapeSql($_POST['config_imap_password'] ?? $config_imap_password);
mysqli_query($mysqli, " mysqli_query($mysqli, "
UPDATE settings SET UPDATE settings SET
@@ -137,11 +137,11 @@ if (isset($_POST['edit_mail_oauth_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_mail_oauth_client_id = sanitizeInput($_POST['config_mail_oauth_client_id'] ?? ''); $config_mail_oauth_client_id = escapeSql($_POST['config_mail_oauth_client_id'] ?? '');
$config_mail_oauth_client_secret = sanitizeInput($_POST['config_mail_oauth_client_secret'] ?? ''); $config_mail_oauth_client_secret = escapeSql($_POST['config_mail_oauth_client_secret'] ?? '');
$config_mail_oauth_tenant_id = sanitizeInput($_POST['config_mail_oauth_tenant_id'] ?? $config_mail_oauth_tenant_id); $config_mail_oauth_tenant_id = escapeSql($_POST['config_mail_oauth_tenant_id'] ?? $config_mail_oauth_tenant_id);
$config_mail_oauth_refresh_token = sanitizeInput($_POST['config_mail_oauth_refresh_token'] ?? ''); $config_mail_oauth_refresh_token = escapeSql($_POST['config_mail_oauth_refresh_token'] ?? '');
$config_mail_oauth_access_token = sanitizeInput($_POST['config_mail_oauth_access_token'] ?? ''); $config_mail_oauth_access_token = escapeSql($_POST['config_mail_oauth_access_token'] ?? '');
mysqli_query($mysqli, "UPDATE settings SET mysqli_query($mysqli, "UPDATE settings SET
config_mail_oauth_client_id = '$config_mail_oauth_client_id', config_mail_oauth_client_id = '$config_mail_oauth_client_id',
@@ -161,17 +161,17 @@ if (isset($_POST['edit_mail_from_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_mail_from_email = sanitizeInput(filter_var($_POST['config_mail_from_email'], FILTER_VALIDATE_EMAIL)); $config_mail_from_email = escapeSql(filter_var($_POST['config_mail_from_email'], FILTER_VALIDATE_EMAIL));
$config_mail_from_name = sanitizeInput(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_mail_from_name'])); $config_mail_from_name = escapeSql(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_mail_from_name']));
$config_invoice_from_email = sanitizeInput(filter_var($_POST['config_invoice_from_email'], FILTER_VALIDATE_EMAIL)); $config_invoice_from_email = escapeSql(filter_var($_POST['config_invoice_from_email'], FILTER_VALIDATE_EMAIL));
$config_invoice_from_name = sanitizeInput(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_invoice_from_name'])); $config_invoice_from_name = escapeSql(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_invoice_from_name']));
$config_quote_from_email = sanitizeInput(filter_var($_POST['config_quote_from_email'], FILTER_VALIDATE_EMAIL)); $config_quote_from_email = escapeSql(filter_var($_POST['config_quote_from_email'], FILTER_VALIDATE_EMAIL));
$config_quote_from_name = sanitizeInput(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_quote_from_name'])); $config_quote_from_name = escapeSql(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_quote_from_name']));
$config_ticket_from_email = sanitizeInput(filter_var($_POST['config_ticket_from_email'], FILTER_VALIDATE_EMAIL)); $config_ticket_from_email = escapeSql(filter_var($_POST['config_ticket_from_email'], FILTER_VALIDATE_EMAIL));
$config_ticket_from_name = sanitizeInput(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_ticket_from_name'])); $config_ticket_from_name = escapeSql(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_ticket_from_name']));
mysqli_query($mysqli,"UPDATE settings SET config_mail_from_email = '$config_mail_from_email', config_mail_from_name = '$config_mail_from_name', config_invoice_from_email = '$config_invoice_from_email', config_invoice_from_name = '$config_invoice_from_name', config_quote_from_email = '$config_quote_from_email', config_quote_from_name = '$config_quote_from_name', config_ticket_from_email = '$config_ticket_from_email', config_ticket_from_name = '$config_ticket_from_name' WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_mail_from_email = '$config_mail_from_email', config_mail_from_name = '$config_mail_from_name', config_invoice_from_email = '$config_invoice_from_email', config_invoice_from_name = '$config_invoice_from_name', config_quote_from_email = '$config_quote_from_email', config_quote_from_name = '$config_quote_from_name', config_ticket_from_email = '$config_ticket_from_email', config_ticket_from_name = '$config_ticket_from_name' WHERE company_id = 1");
@@ -190,20 +190,20 @@ if (isset($_POST['test_email_smtp'])) {
$test_email = intval($_POST['test_email']); $test_email = intval($_POST['test_email']);
if($test_email == 1) { if($test_email == 1) {
$email_from = sanitizeInput($config_mail_from_email); $email_from = escapeSql($config_mail_from_email);
$email_from_name = sanitizeInput($config_mail_from_name); $email_from_name = escapeSql($config_mail_from_name);
} elseif ($test_email == 2) { } elseif ($test_email == 2) {
$email_from = sanitizeInput($config_invoice_from_email); $email_from = escapeSql($config_invoice_from_email);
$email_from_name = sanitizeInput($config_invoice_from_name); $email_from_name = escapeSql($config_invoice_from_name);
} elseif ($test_email == 3) { } elseif ($test_email == 3) {
$email_from = sanitizeInput($config_quote_from_email); $email_from = escapeSql($config_quote_from_email);
$email_from_name = sanitizeInput($config_quote_from_name); $email_from_name = escapeSql($config_quote_from_name);
} else { } else {
$email_from = sanitizeInput($config_ticket_from_email); $email_from = escapeSql($config_ticket_from_email);
$email_from_name = sanitizeInput($config_ticket_from_name); $email_from_name = escapeSql($config_ticket_from_name);
} }
$email_to = sanitizeInput($_POST['email_to']); $email_to = escapeSql($_POST['email_to']);
$subject = "Test email from ITFlow"; $subject = "Test email from ITFlow";
$body = "This is a test email from ITFlow. If you are reading this, it worked!"; $body = "This is a test email from ITFlow. If you are reading this, it worked!";
@@ -234,7 +234,7 @@ if (isset($_POST['test_email_imap'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider = sanitizeInput($config_imap_provider ?? ''); $provider = escapeSql($config_imap_provider ?? '');
$host = $config_imap_host; $host = $config_imap_host;
$port = (int) $config_imap_port; $port = (int) $config_imap_port;
@@ -499,17 +499,17 @@ if (isset($_POST['test_oauth_token_refresh'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$provider = sanitizeInput($_POST['oauth_provider'] ?? ''); $provider = escapeSql($_POST['oauth_provider'] ?? '');
if ($provider !== 'google_oauth' && $provider !== 'microsoft_oauth') { if ($provider !== 'google_oauth' && $provider !== 'microsoft_oauth') {
flash_alert("OAuth token test failed: unsupported provider.", 'error'); flash_alert("OAuth token test failed: unsupported provider.", 'error');
redirect(); redirect();
} }
$oauth_client_id = sanitizeInput($config_mail_oauth_client_id ?? ''); $oauth_client_id = escapeSql($config_mail_oauth_client_id ?? '');
$oauth_client_secret = sanitizeInput($config_mail_oauth_client_secret ?? ''); $oauth_client_secret = escapeSql($config_mail_oauth_client_secret ?? '');
$oauth_tenant_id = sanitizeInput($config_mail_oauth_tenant_id ?? ''); $oauth_tenant_id = escapeSql($config_mail_oauth_tenant_id ?? '');
$oauth_refresh_token = sanitizeInput($config_mail_oauth_refresh_token ?? ''); $oauth_refresh_token = escapeSql($config_mail_oauth_refresh_token ?? '');
if (empty($oauth_client_id) || empty($oauth_client_secret) || empty($oauth_refresh_token)) { if (empty($oauth_client_id) || empty($oauth_client_secret) || empty($oauth_refresh_token)) {
flash_alert("OAuth token test failed: missing client ID, client secret, or refresh token.", 'error'); flash_alert("OAuth token test failed: missing client ID, client secret, or refresh token.", 'error');
@@ -557,9 +557,9 @@ if (isset($_POST['test_oauth_token_refresh'])) {
redirect(); redirect();
} }
$new_access_token = sanitizeInput($json['access_token']); $new_access_token = escapeSql($json['access_token']);
$new_expires_at = date('Y-m-d H:i:s', time() + (int)($json['expires_in'] ?? 3600)); $new_expires_at = date('Y-m-d H:i:s', time() + (int)($json['expires_in'] ?? 3600));
$new_refresh_token = !empty($json['refresh_token']) ? sanitizeInput($json['refresh_token']) : ''; $new_refresh_token = !empty($json['refresh_token']) ? escapeSql($json['refresh_token']) : '';
$new_access_token_esc = mysqli_real_escape_string($mysqli, $new_access_token); $new_access_token_esc = mysqli_real_escape_string($mysqli, $new_access_token);
$new_expires_at_esc = mysqli_real_escape_string($mysqli, $new_expires_at); $new_expires_at_esc = mysqli_real_escape_string($mysqli, $new_expires_at);

2
admin/post/settings_module.php
View File

@@ -10,7 +10,7 @@ if (isset($_POST['edit_module_settings'])) {
$config_module_enable_ticketing = intval($_POST['config_module_enable_ticketing'] ?? 0); $config_module_enable_ticketing = intval($_POST['config_module_enable_ticketing'] ?? 0);
$config_module_enable_accounting = intval($_POST['config_module_enable_accounting'] ?? 0); $config_module_enable_accounting = intval($_POST['config_module_enable_accounting'] ?? 0);
$config_client_portal_enable = intval($_POST['config_client_portal_enable'] ?? 0); $config_client_portal_enable = intval($_POST['config_client_portal_enable'] ?? 0);
$config_whitelabel_key = sanitizeInput($_POST['config_whitelabel_key']); $config_whitelabel_key = escapeSql($_POST['config_whitelabel_key']);
mysqli_query($mysqli,"UPDATE settings SET config_module_enable_itdoc = $config_module_enable_itdoc, config_module_enable_ticketing = $config_module_enable_ticketing, config_module_enable_accounting = $config_module_enable_accounting, config_client_portal_enable = $config_client_portal_enable WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_module_enable_itdoc = $config_module_enable_itdoc, config_module_enable_ticketing = $config_module_enable_ticketing, config_module_enable_accounting = $config_module_enable_accounting, config_client_portal_enable = $config_client_portal_enable WHERE company_id = 1");

4
admin/post/settings_online_payment.php
View File

@@ -7,8 +7,8 @@ if (isset($_POST['edit_online_payment_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_stripe_enable = intval($_POST['config_stripe_enable'] ?? 0); $config_stripe_enable = intval($_POST['config_stripe_enable'] ?? 0);
$config_stripe_publishable = sanitizeInput($_POST['config_stripe_publishable']); $config_stripe_publishable = escapeSql($_POST['config_stripe_publishable']);
$config_stripe_secret = sanitizeInput($_POST['config_stripe_secret']); $config_stripe_secret = escapeSql($_POST['config_stripe_secret']);
$config_stripe_account = intval($_POST['config_stripe_account']); $config_stripe_account = intval($_POST['config_stripe_account']);
$config_stripe_expense_vendor = intval($_POST['config_stripe_expense_vendor']); $config_stripe_expense_vendor = intval($_POST['config_stripe_expense_vendor']);
$config_stripe_expense_category = intval($_POST['config_stripe_expense_category']); $config_stripe_expense_category = intval($_POST['config_stripe_expense_category']);

2
admin/post/settings_online_payment_clients.php
View File

@@ -12,7 +12,7 @@ if (isset($_GET['stripe_remove_pm'])) {
} }
$client_id = intval($_GET['client_id']); $client_id = intval($_GET['client_id']);
$payment_method = sanitizeInput($_GET['pm']); $payment_method = escapeSql($_GET['pm']);
try { try {
// Initialize stripe // Initialize stripe

2
admin/post/settings_project.php
View File

@@ -6,7 +6,7 @@ if (isset($_POST['edit_project_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_project_prefix = sanitizeInput($_POST['config_project_prefix']); $config_project_prefix = escapeSql($_POST['config_project_prefix']);
$config_project_next_number = intval($_POST['config_project_next_number']); $config_project_next_number = intval($_POST['config_project_next_number']);
mysqli_query($mysqli,"UPDATE settings SET config_project_prefix = '$config_project_prefix', config_project_next_number = $config_project_next_number WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_project_prefix = '$config_project_prefix', config_project_next_number = $config_project_next_number WHERE company_id = 1");

6
admin/post/settings_quote.php
View File

@@ -6,12 +6,12 @@ if (isset($_POST['edit_quote_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_quote_prefix = sanitizeInput($_POST['config_quote_prefix']); $config_quote_prefix = escapeSql($_POST['config_quote_prefix']);
$config_quote_next_number = intval($_POST['config_quote_next_number']); $config_quote_next_number = intval($_POST['config_quote_next_number']);
$config_quote_footer = sanitizeInput($_POST['config_quote_footer']); $config_quote_footer = escapeSql($_POST['config_quote_footer']);
$config_quote_notification_email = ''; $config_quote_notification_email = '';
if (filter_var($_POST['config_quote_notification_email'], FILTER_VALIDATE_EMAIL)) { if (filter_var($_POST['config_quote_notification_email'], FILTER_VALIDATE_EMAIL)) {
$config_quote_notification_email = sanitizeInput($_POST['config_quote_notification_email']); $config_quote_notification_email = escapeSql($_POST['config_quote_notification_email']);
} }
mysqli_query($mysqli,"UPDATE settings SET config_quote_prefix = '$config_quote_prefix', config_quote_next_number = $config_quote_next_number, config_quote_footer = '$config_quote_footer', config_quote_notification_email = '$config_quote_notification_email' WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_quote_prefix = '$config_quote_prefix', config_quote_next_number = $config_quote_next_number, config_quote_footer = '$config_quote_footer', config_quote_notification_email = '$config_quote_notification_email' WHERE company_id = 1");

4
admin/post/settings_security.php
View File

@@ -6,9 +6,9 @@ if (isset($_POST['edit_security_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_login_message = sanitizeInput($_POST['config_login_message']); $config_login_message = escapeSql($_POST['config_login_message']);
$config_login_key_required = intval($_POST['config_login_key_required'] ?? 0); $config_login_key_required = intval($_POST['config_login_key_required'] ?? 0);
$config_login_key_secret = sanitizeInput($_POST['config_login_key_secret']); $config_login_key_secret = escapeSql($_POST['config_login_key_secret']);
$config_login_remember_me_expire = intval($_POST['config_login_remember_me_expire']); $config_login_remember_me_expire = intval($_POST['config_login_remember_me_expire']);
$config_log_retention = intval($_POST['config_log_retention']); $config_log_retention = intval($_POST['config_log_retention']);

2
admin/post/settings_theme.php
View File

@@ -6,7 +6,7 @@ if (isset($_POST['edit_theme_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$theme = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['edit_theme_settings'])); $theme = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['edit_theme_settings']));
mysqli_query($mysqli,"UPDATE settings SET config_theme = '$theme' WHERE company_id = 1"); mysqli_query($mysqli,"UPDATE settings SET config_theme = '$theme' WHERE company_id = 1");

4
admin/post/settings_ticket.php
View File

@@ -6,7 +6,7 @@ if (isset($_POST['edit_ticket_settings'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$config_ticket_prefix = sanitizeInput($_POST['config_ticket_prefix']); $config_ticket_prefix = escapeSql($_POST['config_ticket_prefix']);
$config_ticket_next_number = intval($_POST['config_ticket_next_number']); $config_ticket_next_number = intval($_POST['config_ticket_next_number']);
$config_ticket_email_parse = intval($_POST['config_ticket_email_parse'] ?? 0); $config_ticket_email_parse = intval($_POST['config_ticket_email_parse'] ?? 0);
$config_ticket_email_parse_unknown_senders = intval($_POST['config_ticket_email_parse_unknown_senders'] ?? 0); $config_ticket_email_parse_unknown_senders = intval($_POST['config_ticket_email_parse_unknown_senders'] ?? 0);
@@ -14,7 +14,7 @@ if (isset($_POST['edit_ticket_settings'])) {
$config_ticket_autoclose_hours = intval($_POST['config_ticket_autoclose_hours']); $config_ticket_autoclose_hours = intval($_POST['config_ticket_autoclose_hours']);
$config_ticket_new_ticket_notification_email = ''; $config_ticket_new_ticket_notification_email = '';
if (filter_var($_POST['config_ticket_new_ticket_notification_email'], FILTER_VALIDATE_EMAIL)) { if (filter_var($_POST['config_ticket_new_ticket_notification_email'], FILTER_VALIDATE_EMAIL)) {
$config_ticket_new_ticket_notification_email = sanitizeInput($_POST['config_ticket_new_ticket_notification_email']); $config_ticket_new_ticket_notification_email = escapeSql($_POST['config_ticket_new_ticket_notification_email']);
} }
$config_ticket_default_view = intval($_POST['config_ticket_default_view']); $config_ticket_default_view = intval($_POST['config_ticket_default_view']);
$config_ticket_moving_columns = intval($_POST['config_ticket_moving_columns']); $config_ticket_moving_columns = intval($_POST['config_ticket_moving_columns']);

26
admin/post/software_template.php
View File

@@ -8,12 +8,12 @@ if (isset($_POST['add_software_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$version = sanitizeInput($_POST['version']); $version = escapeSql($_POST['version']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$license_type = sanitizeInput($_POST['license_type']); $license_type = escapeSql($_POST['license_type']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"INSERT INTO software_templates SET software_template_name = '$name', software_template_version = '$version', software_template_description = '$description', software_template_type = '$type', software_template_license_type = '$license_type', software_template_notes = '$notes'"); mysqli_query($mysqli,"INSERT INTO software_templates SET software_template_name = '$name', software_template_version = '$version', software_template_description = '$description', software_template_type = '$type', software_template_license_type = '$license_type', software_template_notes = '$notes'");
@@ -32,12 +32,12 @@ if (isset($_POST['edit_software_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$software_template_id = intval($_POST['software_template_id']); $software_template_id = intval($_POST['software_template_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$version = sanitizeInput($_POST['version']); $version = escapeSql($_POST['version']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$license_type = sanitizeInput($_POST['license_type']); $license_type = escapeSql($_POST['license_type']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"UPDATE software_templates SET software_template_name = '$name', software_template_version = '$version', software_template_description = '$description', software_template_type = '$type', software_template_license_type = '$license_type', software_template_notes = '$notes' WHERE software_template_id = $software_template_id"); mysqli_query($mysqli,"UPDATE software_templates SET software_template_name = '$name', software_template_version = '$version', software_template_description = '$description', software_template_type = '$type', software_template_license_type = '$license_type', software_template_notes = '$notes' WHERE software_template_id = $software_template_id");
@@ -58,7 +58,7 @@ if (isset($_GET['delete_software_template'])) {
// Get Software Template Name for logging and alert message // Get Software Template Name for logging and alert message
$sql = mysqli_query($mysqli,"SELECT software_template_name FROM software_templates WHERE software_template_id = $software_template_id"); $sql = mysqli_query($mysqli,"SELECT software_template_name FROM software_templates WHERE software_template_id = $software_template_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$software_template_name = sanitizeInput($row['software_template_name']); $software_template_name = escapeSql($row['software_template_name']);
mysqli_query($mysqli,"DELETE FROM software_templates WHERE software_template_id = $software_template_id"); mysqli_query($mysqli,"DELETE FROM software_templates WHERE software_template_id = $software_template_id");

2
admin/post/tag.php
View File

@@ -48,7 +48,7 @@ if (isset($_GET['delete_tag'])) {
$tag_id = intval($_GET['delete_tag']); $tag_id = intval($_GET['delete_tag']);
$tag_name = sanitizeInput(getFieldById('tags', $tag_id, 'tag_name')); $tag_name = escapeSql(getFieldById('tags', $tag_id, 'tag_name'));
mysqli_query($mysqli,"DELETE FROM tags WHERE tag_id = $tag_id"); mysqli_query($mysqli,"DELETE FROM tags WHERE tag_id = $tag_id");

6
admin/post/tag_model.php
View File

@@ -1,7 +1,7 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$type = intval($_POST['type']); $type = intval($_POST['type']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);
$icon = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['icon'])); $icon = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['icon']));

8
admin/post/tax.php
View File

@@ -10,7 +10,7 @@ if (isset($_POST['add_tax'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$percent = floatval($_POST['percent']); $percent = floatval($_POST['percent']);
mysqli_query($mysqli,"INSERT INTO taxes SET tax_name = '$name', tax_percent = $percent"); mysqli_query($mysqli,"INSERT INTO taxes SET tax_name = '$name', tax_percent = $percent");
@@ -30,7 +30,7 @@ if (isset($_POST['edit_tax'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$percent = floatval($_POST['percent']); $percent = floatval($_POST['percent']);
mysqli_query($mysqli,"UPDATE taxes SET tax_name = '$name', tax_percent = $percent WHERE tax_id = $tax_id"); mysqli_query($mysqli,"UPDATE taxes SET tax_name = '$name', tax_percent = $percent WHERE tax_id = $tax_id");
@@ -49,7 +49,7 @@ if (isset($_GET['archive_tax'])) {
$tax_id = intval($_GET['archive_tax']); $tax_id = intval($_GET['archive_tax']);
$tax_name = sanitizeInput(getFieldById('taxes', $tax_id, 'tax_name')); $tax_name = escapeSql(getFieldById('taxes', $tax_id, 'tax_name'));
mysqli_query($mysqli,"UPDATE taxes SET tax_archived_at = NOW() WHERE tax_id = $tax_id"); mysqli_query($mysqli,"UPDATE taxes SET tax_archived_at = NOW() WHERE tax_id = $tax_id");
@@ -67,7 +67,7 @@ if (isset($_GET['delete_tax'])) {
$tax_id = intval($_GET['delete_tax']); $tax_id = intval($_GET['delete_tax']);
$tax_name = sanitizeInput(getFieldById('taxes', $tax_id, 'tax_name')); $tax_name = escapeSql(getFieldById('taxes', $tax_id, 'tax_name'));
mysqli_query($mysqli,"DELETE FROM taxes WHERE tax_id = $tax_id"); mysqli_query($mysqli,"DELETE FROM taxes WHERE tax_id = $tax_id");

10
admin/post/ticket_status.php
View File

@@ -6,8 +6,8 @@ if (isset($_POST['add_ticket_status'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);
mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = '$name', ticket_status_color = '$color'"); mysqli_query($mysqli, "INSERT INTO ticket_statuses SET ticket_status_name = '$name', ticket_status_color = '$color'");
@@ -26,8 +26,8 @@ if (isset($_POST['edit_ticket_status'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$ticket_status_id = intval($_POST['ticket_status_id']); $ticket_status_id = intval($_POST['ticket_status_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);
$order = intval($_POST['order']); $order = intval($_POST['order']);
$status = intval($_POST['status']); $status = intval($_POST['status']);
@@ -51,7 +51,7 @@ if (isset($_GET['delete_ticket_status'])) {
exit("Can't delete built-in statuses"); exit("Can't delete built-in statuses");
} }
$ticlet_status_name = sanitizeInput(getFieldById('ticket_statuses', $ticket_status_id, 'ticket_status_name')); $ticlet_status_name = escapeSql(getFieldById('ticket_statuses', $ticket_status_id, 'ticket_status_name'));
mysqli_query($mysqli, "DELETE FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id"); mysqli_query($mysqli, "DELETE FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id");

18
admin/post/ticket_template.php
View File

@@ -12,9 +12,9 @@ if (isset($_POST['add_ticket_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$subject = sanitizeInput($_POST['subject']); $subject = escapeSql($_POST['subject']);
$details = mysqli_real_escape_string($mysqli, $_POST['details']); $details = mysqli_real_escape_string($mysqli, $_POST['details']);
$project_template_id = intval($_POST['project_template']); $project_template_id = intval($_POST['project_template']);
@@ -39,9 +39,9 @@ if (isset($_POST['edit_ticket_template'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$ticket_template_id = intval($_POST['ticket_template_id']); $ticket_template_id = intval($_POST['ticket_template_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$subject = sanitizeInput($_POST['subject']); $subject = escapeSql($_POST['subject']);
$details = mysqli_real_escape_string($mysqli, $_POST['details']); $details = mysqli_real_escape_string($mysqli, $_POST['details']);
mysqli_query($mysqli, "UPDATE ticket_templates SET ticket_template_name = '$name', ticket_template_description = '$description', ticket_template_subject = '$subject', ticket_template_details = '$details' WHERE ticket_template_id = $ticket_template_id"); mysqli_query($mysqli, "UPDATE ticket_templates SET ticket_template_name = '$name', ticket_template_description = '$description', ticket_template_subject = '$subject', ticket_template_details = '$details' WHERE ticket_template_id = $ticket_template_id");
@@ -60,7 +60,7 @@ if (isset($_GET['delete_ticket_template'])) {
$ticket_template_id = intval($_GET['delete_ticket_template']); $ticket_template_id = intval($_GET['delete_ticket_template']);
$ticket_template_name = sanitizeInput(getFieldById('ticket_templates', $ticket_template_id, 'ticket_template_name')); $ticket_template_name = escapeSql(getFieldById('ticket_templates', $ticket_template_id, 'ticket_template_name'));
mysqli_query($mysqli, "DELETE FROM ticket_templates WHERE ticket_template_id = $ticket_template_id"); mysqli_query($mysqli, "DELETE FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
@@ -81,7 +81,7 @@ if (isset($_POST['add_ticket_template_task'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$ticket_template_id = intval($_POST['ticket_template_id']); $ticket_template_id = intval($_POST['ticket_template_id']);
$task_name = sanitizeInput($_POST['task_name']); $task_name = escapeSql($_POST['task_name']);
mysqli_query($mysqli, "INSERT INTO task_templates SET task_template_name = '$task_name', task_template_ticket_template_id = $ticket_template_id"); mysqli_query($mysqli, "INSERT INTO task_templates SET task_template_name = '$task_name', task_template_ticket_template_id = $ticket_template_id");
@@ -101,7 +101,7 @@ if (isset($_GET['delete_task_template'])) {
$task_template_id = intval($_GET['delete_task_template']); $task_template_id = intval($_GET['delete_task_template']);
$task_template_name = sanitizeInput(getFieldById('tags', $task_template_id, 'task_template_name')); $task_template_name = escapeSql(getFieldById('tags', $task_template_id, 'task_template_name'));
mysqli_query($mysqli, "DELETE FROM task_templates WHERE task_template_id = $task_template_id"); mysqli_query($mysqli, "DELETE FROM task_templates WHERE task_template_id = $task_template_id");

12
admin/post/update.php
View File

@@ -23,12 +23,12 @@ if (isset($_GET['update'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$website = sanitizeInput($row['company_website']); $website = escapeSql($row['company_website']);
$city = sanitizeInput($row['company_city']); $city = escapeSql($row['company_city']);
$state = sanitizeInput($row['company_state']); $state = escapeSql($row['company_state']);
$country = sanitizeInput($row['company_country']); $country = escapeSql($row['company_country']);
$currency = sanitizeInput($row['company_currency']); $currency = escapeSql($row['company_currency']);
$current_version = exec("git rev-parse HEAD"); $current_version = exec("git rev-parse HEAD");
// Client Count // Client Count

4
admin/post/user_model.php
View File

@@ -2,7 +2,7 @@
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$email = sanitizeInput($_POST['email']); $email = escapeSql($_POST['email']);
$role = intval($_POST['role']); $role = intval($_POST['role']);
$force_mfa = intval($_POST['force_mfa'] ?? 0); $force_mfa = intval($_POST['force_mfa'] ?? 0);

24
admin/post/users.php
View File

@@ -54,14 +54,14 @@ if (isset($_POST['add_user'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
// Sanitize Config vars from load_global_settings.php // Sanitize Config vars from load_global_settings.php
$config_mail_from_name = sanitizeInput($config_mail_from_name); $config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email); $config_mail_from_email = escapeSql($config_mail_from_email);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_login_key_secret = mysqli_real_escape_string($mysqli, $config_login_key_secret); $config_login_key_secret = mysqli_real_escape_string($mysqli, $config_login_key_secret);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
// Send user e-mail, if specified // Send user e-mail, if specified
if (isset($_POST['send_email']) && !empty($config_smtp_host) && filter_var($email, FILTER_VALIDATE_EMAIL)) { if (isset($_POST['send_email']) && !empty($config_smtp_host) && filter_var($email, FILTER_VALIDATE_EMAIL)) {
@@ -119,7 +119,7 @@ if (isset($_POST['edit_user'])) {
// Get current Avatar // Get current Avatar
$sql = mysqli_query($mysqli, "SELECT user_avatar FROM users WHERE user_id = $user_id"); $sql = mysqli_query($mysqli, "SELECT user_avatar FROM users WHERE user_id = $user_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['user_avatar']); $existing_file_name = escapeSql($row['user_avatar']);
$extended_log_description = ''; $extended_log_description = '';
if (!empty($_POST['2fa'])) { if (!empty($_POST['2fa'])) {
@@ -184,7 +184,7 @@ if (isset($_GET['activate_user'])) {
$user_id = intval($_GET['activate_user']); $user_id = intval($_GET['activate_user']);
$user_name = sanitizeInput(getFieldById('users', $user_id, 'user_name')); $user_name = escapeSql(getFieldById('users', $user_id, 'user_name'));
mysqli_query($mysqli, "UPDATE users SET user_status = 1 WHERE user_id = $user_id"); mysqli_query($mysqli, "UPDATE users SET user_status = 1 WHERE user_id = $user_id");
@@ -202,7 +202,7 @@ if (isset($_GET['disable_user'])) {
$user_id = intval($_GET['disable_user']); $user_id = intval($_GET['disable_user']);
$user_name = sanitizeInput(getFieldById('users', $user_id, 'user_name')); $user_name = escapeSql(getFieldById('users', $user_id, 'user_name'));
mysqli_query($mysqli, "UPDATE users SET user_status = 0 WHERE user_id = $user_id"); mysqli_query($mysqli, "UPDATE users SET user_status = 0 WHERE user_id = $user_id");
@@ -224,7 +224,7 @@ if (isset($_GET['revoke_remember_me'])) {
$user_id = intval($_GET['revoke_remember_me']); $user_id = intval($_GET['revoke_remember_me']);
$user_name = sanitizeInput(getFieldById('users', $user_id, 'user_name')); $user_name = escapeSql(getFieldById('users', $user_id, 'user_name'));
mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id"); mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id");
@@ -244,7 +244,7 @@ if (isset($_POST['archive_user'])) {
$ticket_assign = intval($_POST['ticket_assign']); $ticket_assign = intval($_POST['ticket_assign']);
$password = password_hash(randomString(), PASSWORD_DEFAULT); $password = password_hash(randomString(), PASSWORD_DEFAULT);
$user_name = sanitizeInput(getFieldById('users', $user_id, 'user_name')); $user_name = escapeSql(getFieldById('users', $user_id, 'user_name'));
// Un-assign / Re-assign tickets // Un-assign / Re-assign tickets
mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $ticket_assign WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL AND ticket_resolved_at IS NULL"); mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $ticket_assign WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL AND ticket_resolved_at IS NULL");
@@ -270,7 +270,7 @@ if (isset($_POST['restore_user'])) {
$role = intval($_POST['role']); $role = intval($_POST['role']);
$user_name = getFieldById('users', $user_id, 'user_name'); $user_name = getFieldById('users', $user_id, 'user_name');
$user_name = sanitizeInput(str_replace(" (archived)", "", $user_name)); //Removed (archived) from user_name $user_name = escapeSql(str_replace(" (archived)", "", $user_name)); //Removed (archived) from user_name
// Restore user query // Restore user query
mysqli_query($mysqli, "UPDATE users SET user_name = '$user_name', user_status = 1, user_role_id = $role, user_archived_at = NULL WHERE user_id = $user_id"); mysqli_query($mysqli, "UPDATE users SET user_name = '$user_name', user_status = 1, user_role_id = $role, user_archived_at = NULL WHERE user_id = $user_id");
@@ -366,7 +366,7 @@ if (isset($_POST['ir_reset_user_password'])) {
// Reset passwords // Reset passwords
while ($row = mysqli_fetch_assoc($sql_users)) { while ($row = mysqli_fetch_assoc($sql_users)) {
$user_id = intval($row['user_id']); $user_id = intval($row['user_id']);
$user_email = sanitizeInput($row['user_email']); $user_email = escapeSql($row['user_email']);
$new_password = randomString(); $new_password = randomString();
$user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($new_password)); $user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($new_password));

2
admin/settings_custom_fields.php
View File

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
if (isset($_GET['table'])) { if (isset($_GET['table'])) {
$table = sanitizeInput($_GET['table']); $table = escapeSql($_GET['table']);
} else { } else {
$table = "client_assets"; $table = "client_assets";
} }

68
agent/ajax.php
View File

@@ -47,7 +47,7 @@ if (isset($_POST['client_set_notes'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
// Update notes // Update notes
mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id"); mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id");
@@ -64,14 +64,14 @@ if (isset($_POST['contact_set_notes'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$contact_id = intval($_POST['contact_id']); $contact_id = intval($_POST['contact_id']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
// Get Contact Details and Client ID for Logging // Get Contact Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id
FROM contacts WHERE contact_id = $contact_id" FROM contacts WHERE contact_id = $contact_id"
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
// Update notes // Update notes
@@ -89,14 +89,14 @@ if (isset($_POST['asset_set_notes'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$asset_id = intval($_POST['asset_id']); $asset_id = intval($_POST['asset_id']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
// Get Asset Details and Client ID for Logging // Get Asset Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id
FROM assets WHERE asset_id = $asset_id" FROM assets WHERE asset_id = $asset_id"
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
// Update notes // Update notes
@@ -161,10 +161,10 @@ if (isset($_GET['share_generate_link'])) {
$item_encrypted_credential = ''; // Default empty $item_encrypted_credential = ''; // Default empty
$client_id = intval($_GET['client_id']); $client_id = intval($_GET['client_id']);
$item_type = sanitizeInput($_GET['type']); $item_type = escapeSql($_GET['type']);
$item_id = intval($_GET['id']); $item_id = intval($_GET['id']);
$item_email = sanitizeInput($_GET['contact_email']); $item_email = escapeSql($_GET['contact_email']);
$item_note = sanitizeInput($_GET['note']); $item_note = escapeSql($_GET['note']);
$item_view_limit = intval($_GET['views']); $item_view_limit = intval($_GET['views']);
$item_view_limit_wording = ""; $item_view_limit_wording = "";
if ($item_view_limit == 1) { if ($item_view_limit == 1) {
@@ -188,19 +188,19 @@ if (isset($_GET['share_generate_link'])) {
if ($item_type == "Document") { if ($item_type == "Document") {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = $item_id AND document_client_id = $client_id LIMIT 1")); $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT document_name FROM documents WHERE document_id = $item_id AND document_client_id = $client_id LIMIT 1"));
$item_name = sanitizeInput($row['document_name']); $item_name = escapeSql($row['document_name']);
} }
if ($item_type == "File") { if ($item_type == "File") {
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = $item_id AND file_client_id = $client_id LIMIT 1")); $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT file_name FROM files WHERE file_id = $item_id AND file_client_id = $client_id LIMIT 1"));
$item_name = sanitizeInput($row['file_name']); $item_name = escapeSql($row['file_name']);
} }
if ($item_type == "Credential") { if ($item_type == "Credential") {
$credential = mysqli_query($mysqli, "SELECT credential_name, credential_username, credential_password FROM credentials WHERE credential_id = $item_id AND credential_client_id = $client_id LIMIT 1"); $credential = mysqli_query($mysqli, "SELECT credential_name, credential_username, credential_password FROM credentials WHERE credential_id = $item_id AND credential_client_id = $client_id LIMIT 1");
$row = mysqli_fetch_assoc($credential); $row = mysqli_fetch_assoc($credential);
$item_name = sanitizeInput($row['credential_name']); $item_name = escapeSql($row['credential_name']);
// Decrypt & re-encrypt username/password for sharing // Decrypt & re-encrypt username/password for sharing
$credential_encryption_key = randomString(); $credential_encryption_key = randomString();
@@ -230,14 +230,14 @@ if (isset($_GET['share_generate_link'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_mail_from_name = sanitizeInput($config_mail_from_name); $config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email); $config_mail_from_email = escapeSql($config_mail_from_email);
// Send user e-mail, if specified // Send user e-mail, if specified
if(!empty($config_smtp_host) && filter_var($item_email, FILTER_VALIDATE_EMAIL)){ if(!empty($config_smtp_host) && filter_var($item_email, FILTER_VALIDATE_EMAIL)){
@@ -401,7 +401,7 @@ if (isset($_GET['get_totp_token_via_id'])) {
$credential_id = intval($_GET['credential_id']); $credential_id = intval($_GET['credential_id']);
$sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_otp_secret, credential_client_id FROM credentials WHERE credential_id = $credential_id")); $sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT credential_name, credential_otp_secret, credential_client_id FROM credentials WHERE credential_id = $credential_id"));
$name = sanitizeInput($sql['credential_name']); $name = escapeSql($sql['credential_name']);
$totp_secret = $sql['credential_otp_secret']; $totp_secret = $sql['credential_otp_secret'];
$client_id = intval($sql['credential_client_id']); $client_id = intval($sql['credential_client_id']);
@@ -501,26 +501,26 @@ if (isset($_POST['update_kanban_ticket'])) {
"); ");
$row = mysqli_fetch_assoc($ticket_sql); $row = mysqli_fetch_assoc($ticket_sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']); $ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']); $ticket_subject = escapeSql($row['ticket_subject']);
$client_id = intval($row['ticket_client_id']); $client_id = intval($row['ticket_client_id']);
$ticket_assigned_to = intval($row['ticket_assigned_to']); $ticket_assigned_to = intval($row['ticket_assigned_to']);
$ticket_status = sanitizeInput($row['ticket_status_name']); $ticket_status = escapeSql($row['ticket_status_name']);
$url_key = sanitizeInput($row['ticket_url_key']); $url_key = escapeSql($row['ticket_url_key']);
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
// Get Company Info // Get Company Info
$sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// EMAIL // EMAIL
$subject = "Ticket resolved - [$ticket_prefix$ticket_number] - $ticket_subject | (pending closure)"; $subject = "Ticket resolved - [$ticket_prefix$ticket_number] - $ticket_subject | (pending closure)";
@@ -548,7 +548,7 @@ if (isset($_POST['update_kanban_ticket'])) {
$sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id");
$body .= "<br><br>----------------------------------------<br>YOU ARE A COLLABORATOR ON THIS TICKET"; $body .= "<br><br>----------------------------------------<br>YOU ARE A COLLABORATOR ON THIS TICKET";
while ($row = mysqli_fetch_assoc($sql_watchers)) { while ($row = mysqli_fetch_assoc($sql_watchers)) {
$watcher_email = sanitizeInput($row['watcher_email']); $watcher_email = escapeSql($row['watcher_email']);
// Queue Mail // Queue Mail
$data[] = [ $data[] = [
@@ -712,7 +712,7 @@ if (isset($_POST['update_recurring_invoice_items_order'])) {
if (isset($_GET['client_duplicate_check'])) { if (isset($_GET['client_duplicate_check'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$name = sanitizeInput($_GET['name']); $name = escapeSql($_GET['name']);
$response['message'] = ""; // default $response['message'] = ""; // default
@@ -736,8 +736,8 @@ if (isset($_GET['client_duplicate_check'])) {
if (isset($_GET['contact_email_check'])) { if (isset($_GET['contact_email_check'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$email = sanitizeInput($_GET['email']); $email = escapeSql($_GET['email']);
$domain = sanitizeInput(substr($_GET['email'], strpos($_GET['email'], '@') + 1)); $domain = escapeSql(substr($_GET['email'], strpos($_GET['email'], '@') + 1));
$response['message'] = ""; // default $response['message'] = ""; // default
@@ -1014,7 +1014,7 @@ if (isset($_GET['ai_ticket_summary'])) {
if (isset($_GET['apex_domain_check'])) { if (isset($_GET['apex_domain_check'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$domain = sanitizeInput($_GET['domain']); $domain = escapeSql($_GET['domain']);
$response['message'] = ""; // default $response['message'] = ""; // default

4
agent/client_autopay.php
View File

@@ -17,8 +17,8 @@ $config_stripe_secret = escapeHtml($stripe_vars['config_stripe_secret']);
// Get client's StripeID from database // Get client's StripeID from database
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1")); $stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
if ($stripe_client_details) { if ($stripe_client_details) {
$stripe_id = sanitizeInput($stripe_client_details['stripe_id']); $stripe_id = escapeSql($stripe_client_details['stripe_id']);
$stripe_pm = sanitizeInput($stripe_client_details['stripe_pm']); $stripe_pm = escapeSql($stripe_client_details['stripe_pm']);
} }
// Stripe not enabled in settings // Stripe not enabled in settings

4
agent/clients.php
View File

@@ -32,7 +32,7 @@ if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) {
// Industry Filter // Industry Filter
if (isset($_GET['industry']) & !empty($_GET['industry'])) { if (isset($_GET['industry']) & !empty($_GET['industry'])) {
$industry_query = "AND (clients.client_type = '" . sanitizeInput($_GET['industry']) . "')"; $industry_query = "AND (clients.client_type = '" . escapeSql($_GET['industry']) . "')";
$industry_filter = escapeHtml($_GET['industry']); $industry_filter = escapeHtml($_GET['industry']);
} else { } else {
// Default - any // Default - any
@@ -42,7 +42,7 @@ if (isset($_GET['industry']) & !empty($_GET['industry'])) {
// Referral Filter // Referral Filter
if (isset($_GET['referral']) & !empty($_GET['referral'])) { if (isset($_GET['referral']) & !empty($_GET['referral'])) {
$referral_query = "AND (clients.client_referral = '" . sanitizeInput($_GET['referral']) . "')"; $referral_query = "AND (clients.client_referral = '" . escapeSql($_GET['referral']) . "')";
$referral_filter = escapeHtml($_GET['referral']); $referral_filter = escapeHtml($_GET['referral']);
} else { } else {
// Default - any // Default - any

2
agent/global_search.php
View File

@@ -11,7 +11,7 @@ $purifier = new HTMLPurifier($purifier_config);
if (isset($_GET['query'])) { if (isset($_GET['query'])) {
$query = sanitizeInput($_GET['query']); $query = escapeSql($_GET['query']);
$phone_query = preg_replace("/[^0-9]/", '', $query); $phone_query = preg_replace("/[^0-9]/", '', $query);
if (empty($phone_query)) { if (empty($phone_query)) {

2
agent/modals/product/product_stock_add.php
View File

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
$product_id = intval($_GET['id']); $product_id = intval($_GET['id']);
// Get product name // Get product name
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
// Generate the HTML form content using output buffering. // Generate the HTML form content using output buffering.
ob_start(); ob_start();

2
agent/payments.php
View File

@@ -20,7 +20,7 @@ enforceUserPermission('module_financial');
// Payment Method Filter // Payment Method Filter
if (isset($_GET['method']) & !empty($_GET['method'])) { if (isset($_GET['method']) & !empty($_GET['method'])) {
$payment_method_query = "AND (payment_method = '" . sanitizeInput($_GET['method']) . "')"; $payment_method_query = "AND (payment_method = '" . escapeSql($_GET['method']) . "')";
$method_filter = escapeHtml($_GET['method']); $method_filter = escapeHtml($_GET['method']);
} else { } else {
// Default - any // Default - any

14
agent/post/account.php
View File

@@ -12,10 +12,10 @@ if (isset($_POST['add_account'])) {
enforceUserPermission('module_financial', 2); enforceUserPermission('module_financial', 2);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$opening_balance = floatval($_POST['opening_balance']); $opening_balance = floatval($_POST['opening_balance']);
$currency_code = sanitizeInput($_POST['currency_code']); $currency_code = escapeSql($_POST['currency_code']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"INSERT INTO accounts SET account_name = '$name', opening_balance = $opening_balance, account_currency_code = '$currency_code', account_notes = '$notes'"); mysqli_query($mysqli,"INSERT INTO accounts SET account_name = '$name', opening_balance = $opening_balance, account_currency_code = '$currency_code', account_notes = '$notes'");
@@ -34,8 +34,8 @@ if (isset($_POST['edit_account'])) {
enforceUserPermission('module_financial', 2); enforceUserPermission('module_financial', 2);
$account_id = intval($_POST['account_id']); $account_id = intval($_POST['account_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"UPDATE accounts SET account_name = '$name', account_notes = '$notes' WHERE account_id = $account_id"); mysqli_query($mysqli,"UPDATE accounts SET account_name = '$name', account_notes = '$notes' WHERE account_id = $account_id");
@@ -55,7 +55,7 @@ if (isset($_GET['archive_account'])) {
$account_id = intval($_GET['archive_account']); $account_id = intval($_GET['archive_account']);
$account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name')); $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name'));
mysqli_query($mysqli,"UPDATE accounts SET account_archived_at = NOW() WHERE account_id = $account_id"); mysqli_query($mysqli,"UPDATE accounts SET account_archived_at = NOW() WHERE account_id = $account_id");
@@ -76,7 +76,7 @@ if (isset($_GET['delete_account'])) {
$account_id = intval($_GET['delete_account']); $account_id = intval($_GET['delete_account']);
$account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name')); $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name'));
mysqli_query($mysqli,"DELETE FROM accounts WHERE account_id = $account_id"); mysqli_query($mysqli,"DELETE FROM accounts WHERE account_id = $account_id");

152
agent/post/asset.php
View File

@@ -91,7 +91,7 @@ if (isset($_POST['edit_asset'])) {
// Get Existing Photo and assigned client_id // Get Existing Photo and assigned client_id
$sql = mysqli_query($mysqli,"SELECT asset_photo, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_photo, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['asset_photo']); $existing_file_name = escapeSql($row['asset_photo']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -158,7 +158,7 @@ if (isset($_GET['archive_asset'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -187,7 +187,7 @@ if (isset($_GET['restore_asset'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -216,7 +216,7 @@ if (isset($_GET['delete_asset'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -246,7 +246,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) {
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -290,7 +290,7 @@ if (isset($_POST['bulk_assign_asset_location'])) {
// Get Location name and client id for logging and alert // Get Location name and client id for logging and alert
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -307,7 +307,7 @@ if (isset($_POST['bulk_assign_asset_location'])) {
// Get Asset Details for Logging // Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -333,7 +333,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$physical_location = sanitizeInput($_POST['physical_location']); $physical_location = escapeSql($_POST['physical_location']);
// Assign Physical Location to Selected Assets // Assign Physical Location to Selected Assets
if (isset($_POST['asset_ids'])) { if (isset($_POST['asset_ids'])) {
@@ -347,7 +347,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) {
// Get Asset Details for Logging // Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -392,15 +392,15 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
LEFT JOIN clients ON client_id = asset_client_id LEFT JOIN clients ON client_id = asset_client_id
WHERE asset_id = $current_asset_id") WHERE asset_id = $current_asset_id")
); );
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$asset_notes = sanitizeInput($row['asset_notes']); $asset_notes = escapeSql($row['asset_notes']);
$current_client_id = intval($row['asset_client_id']); $current_client_id = intval($row['asset_client_id']);
$current_client_name = sanitizeInput($row['client_name']); $current_client_name = escapeSql($row['client_name']);
enforceClientAccess($current_client_id); enforceClientAccess($current_client_id);
// Get new client name for logging // Get new client name for logging
$new_client_name = sanitizeInput(getFieldById('clients', $new_client_id, 'client_name')); $new_client_name = escapeSql(getFieldById('clients', $new_client_id, 'client_name'));
// Create new asset // Create new asset
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -415,8 +415,8 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
$sql_interfaces = mysqli_query($mysqli, "SELECT * FROM asset_interfaces WHERE interface_asset_id = $current_asset_id"); $sql_interfaces = mysqli_query($mysqli, "SELECT * FROM asset_interfaces WHERE interface_asset_id = $current_asset_id");
while ($row = mysqli_fetch_assoc($sql_interfaces)) { while ($row = mysqli_fetch_assoc($sql_interfaces)) {
$interface_name = sanitizeInput($row['interface_name']); $interface_name = escapeSql($row['interface_name']);
$interface_mac = sanitizeInput($row['interface_mac']); $interface_mac = escapeSql($row['interface_mac']);
$interface_primary = intval($row['interface_primary']); $interface_primary = intval($row['interface_primary']);
mysqli_query($mysqli,"INSERT INTO asset_interfaces SET interface_name = '$interface_name', interface_mac = '$interface_mac', interface_primary = $interface_primary, interface_asset_id = $new_asset_id"); mysqli_query($mysqli,"INSERT INTO asset_interfaces SET interface_name = '$interface_name', interface_mac = '$interface_mac', interface_primary = $interface_primary, interface_asset_id = $new_asset_id");
@@ -468,7 +468,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) {
// Get Contact name and client id for logging and Notification // Get Contact name and client id for logging and Notification
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -485,7 +485,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) {
// Get Asset Details for Logging // Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id"); mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id");
@@ -508,7 +508,7 @@ if (isset($_POST['bulk_edit_asset_status'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$status = sanitizeInput($_POST['bulk_status']); $status = escapeSql($_POST['bulk_status']);
if (isset($_POST['asset_ids'])) { if (isset($_POST['asset_ids'])) {
@@ -520,7 +520,7 @@ if (isset($_POST['bulk_edit_asset_status'])) {
// Get Asset Details for Logging // Get Asset Details for Logging
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -560,7 +560,7 @@ if (isset($_POST['bulk_favorite_assets'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -598,7 +598,7 @@ if (isset($_POST['bulk_unfavorite_assets'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -636,7 +636,7 @@ if (isset($_POST['bulk_archive_assets'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -677,7 +677,7 @@ if (isset($_POST['bulk_restore_assets'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -719,7 +719,7 @@ if (isset($_POST['bulk_delete_assets'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -752,13 +752,13 @@ if (isset($_POST['link_software_to_asset'])) {
// Get software Name and Client ID for logging // Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software); $row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']); $software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']); $client_id = intval($row['software_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"INSERT INTO software_assets SET asset_id = $asset_id, software_id = $software_id"); mysqli_query($mysqli,"INSERT INTO software_assets SET asset_id = $asset_id, software_id = $software_id");
@@ -782,13 +782,13 @@ if (isset($_GET['unlink_software_from_asset'])) {
// Get software Name and Client ID for logging // Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software); $row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']); $software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']); $client_id = intval($row['software_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM software_assets WHERE asset_id = $asset_id AND software_id = $software_id"); mysqli_query($mysqli,"DELETE FROM software_assets WHERE asset_id = $asset_id AND software_id = $software_id");
@@ -813,13 +813,13 @@ if (isset($_POST['link_asset_to_credential'])) {
// Get credential Name and Client ID for logging // Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential); $row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = $asset_id WHERE credential_id = $credential_id"); mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = $asset_id WHERE credential_id = $credential_id");
@@ -843,13 +843,13 @@ if (isset($_GET['unlink_credential_from_asset'])) {
// Get credential Name and Client ID for logging // Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential); $row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = 0 WHERE credential_id = $credential_id"); mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = 0 WHERE credential_id = $credential_id");
@@ -873,13 +873,13 @@ if (isset($_POST['link_service_to_asset'])) {
// Get service Name and Client ID for logging // Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service); $row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']); $service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']); $client_id = intval($row['service_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"INSERT INTO service_assets SET asset_id = $asset_id, service_id = $service_id"); mysqli_query($mysqli,"INSERT INTO service_assets SET asset_id = $asset_id, service_id = $service_id");
@@ -903,13 +903,13 @@ if (isset($_GET['unlink_service_from_asset'])) {
// Get service Name and Client ID for logging // Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service); $row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']); $service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']); $client_id = intval($row['service_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM service_assets WHERE asset_id = $asset_id AND service_id = $service_id"); mysqli_query($mysqli,"DELETE FROM service_assets WHERE asset_id = $asset_id AND service_id = $service_id");
@@ -933,13 +933,13 @@ if (isset($_POST['link_asset_to_file'])) {
// Get file Name and Client ID for logging // Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
// asset add query // asset add query
mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id"); mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id");
@@ -964,13 +964,13 @@ if (isset($_GET['unlink_asset_from_file'])) {
// Get file Name and Client ID for logging // Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id"); mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id");
@@ -1045,7 +1045,7 @@ if (isset($_POST["import_assets_csv"])) {
// Name // Name
if (isset($column[0])) { if (isset($column[0])) {
$name = sanitizeInput($column[0]); $name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id = $client_id")) > 0) { if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id = $client_id")) > 0) {
$duplicate_detect = 1; $duplicate_detect = 1;
} }
@@ -1053,37 +1053,37 @@ if (isset($_POST["import_assets_csv"])) {
// Desc // Desc
if (!empty($column[1])) { if (!empty($column[1])) {
$description = sanitizeInput($column[1]); $description = escapeSql($column[1]);
} }
// Type // Type
if (!empty($column[2])) { if (!empty($column[2])) {
$type = sanitizeInput($column[2]); $type = escapeSql($column[2]);
} }
// Make // Make
if (!empty($column[3])) { if (!empty($column[3])) {
$make = sanitizeInput($column[3]); $make = escapeSql($column[3]);
} }
// Model // Model
if (!empty($column[4])) { if (!empty($column[4])) {
$model = sanitizeInput($column[4]); $model = escapeSql($column[4]);
} }
// Serial // Serial
if (!empty($column[5])) { if (!empty($column[5])) {
$serial = sanitizeInput($column[5]); $serial = escapeSql($column[5]);
} }
// OS // OS
if (!empty($column[6])) { if (!empty($column[6])) {
$os = sanitizeInput($column[6]); $os = escapeSql($column[6]);
} }
// Purchase date // Purchase date
if (!empty($column[7])) { if (!empty($column[7])) {
$purchase_date = sanitizeInput($column[7]); $purchase_date = escapeSql($column[7]);
if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $purchase_date) || empty($purchase_date)) { if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $purchase_date) || empty($purchase_date)) {
$purchase_date = "NULL"; $purchase_date = "NULL";
@@ -1094,7 +1094,7 @@ if (isset($_POST["import_assets_csv"])) {
// Assigned to (contact) // Assigned to (contact)
if (!empty($column[8])) { if (!empty($column[8])) {
$contact = sanitizeInput($column[8]); $contact = escapeSql($column[8]);
if ($contact) { if ($contact) {
$sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id"); $sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_contact); $row = mysqli_fetch_assoc($sql_contact);
@@ -1104,7 +1104,7 @@ if (isset($_POST["import_assets_csv"])) {
// Location (lookup) // Location (lookup)
if (!empty($column[9])) { if (!empty($column[9])) {
$location = sanitizeInput($column[9]); $location = escapeSql($column[9]);
if ($location) { if ($location) {
$sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_location); $row = mysqli_fetch_assoc($sql_location);
@@ -1114,12 +1114,12 @@ if (isset($_POST["import_assets_csv"])) {
// Physical location (varchar) // Physical location (varchar)
if (!empty($column[10])) { if (!empty($column[10])) {
$physical_location = sanitizeInput($column[10]); $physical_location = escapeSql($column[10]);
} }
// Notes (varchar) // Notes (varchar)
if (!empty($column[11])) { if (!empty($column[11])) {
$notes = sanitizeInput($column[11]); $notes = escapeSql($column[11]);
} }
// Check if duplicate was detected // Check if duplicate was detected
@@ -1271,7 +1271,7 @@ if (isset($_POST['add_asset_interface'])) {
WHERE asset_id = $asset_id WHERE asset_id = $asset_id
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1335,14 +1335,14 @@ if (isset($_POST['add_asset_multiple_interfaces'])) {
$asset_id = intval($_POST['asset_id']); $asset_id = intval($_POST['asset_id']);
$interface_start = intval($_POST['interface_start']); $interface_start = intval($_POST['interface_start']);
$interfaces = intval($_POST['interfaces']); $interfaces = intval($_POST['interfaces']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$name_prefix = sanitizeInput($_POST['name_prefix']); $name_prefix = escapeSql($_POST['name_prefix']);
$network = intval($_POST['network']); $network = intval($_POST['network']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$sql = mysqli_query($mysqli, "SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql = mysqli_query($mysqli, "SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1393,7 +1393,7 @@ if (isset($_POST['edit_asset_interface'])) {
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']); $asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1471,8 +1471,8 @@ if (isset($_GET['delete_asset_interface'])) {
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$interface_name = sanitizeInput($row['interface_name']); $interface_name = escapeSql($row['interface_name']);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1505,7 +1505,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$type = sanitizeInput($_POST['bulk_type']); $type = escapeSql($_POST['bulk_type']);
if (isset($_POST['interface_ids'])) { if (isset($_POST['interface_ids'])) {
@@ -1524,7 +1524,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) {
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']); $asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1554,7 +1554,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) {
$network_id = intval($_POST['bulk_network']); $network_id = intval($_POST['bulk_network']);
// Get Network Name for logging // Get Network Name for logging
$network_name = sanitizeInput(getFieldById('networks', $network_id, 'network_name')); $network_name = escapeSql(getFieldById('networks', $network_id, 'network_name'));
if (isset($_POST['interface_ids'])) { if (isset($_POST['interface_ids'])) {
@@ -1573,7 +1573,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) {
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']); $asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1616,7 +1616,7 @@ if (isset($_POST['bulk_edit_asset_interface_ip_dhcp'])) {
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$asset_name= sanitizeInput($row['asset_name']); $asset_name= escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1660,8 +1660,8 @@ if (isset($_POST['bulk_delete_asset_interfaces'])) {
"); ");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$asset_id = intval($row['asset_id']); $asset_id = intval($row['asset_id']);
$interface_name = sanitizeInput($row['interface_name']); $interface_name = escapeSql($row['interface_name']);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -1693,7 +1693,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
$sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id"); $sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql_asset); $row = mysqli_fetch_assoc($sql_asset);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
enforceClientAccess(); enforceClientAccess();
@@ -1742,31 +1742,31 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
$duplicate_detect = 0; $duplicate_detect = 0;
if (isset($column[0])) { if (isset($column[0])) {
$name = sanitizeInput($column[0]); $name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT interface_name FROM asset_interfaces WHERE interface_asset_id = $asset_id AND interface_name = '$name'")) > 0) { if (mysqli_num_rows(mysqli_query($mysqli,"SELECT interface_name FROM asset_interfaces WHERE interface_asset_id = $asset_id AND interface_name = '$name'")) > 0) {
$duplicate_detect = 1; $duplicate_detect = 1;
} }
} }
if (!empty($column[1])) { if (!empty($column[1])) {
$description = sanitizeInput($column[1]); $description = escapeSql($column[1]);
} }
if (!empty($column[2])) { if (!empty($column[2])) {
$type = sanitizeInput($column[2]); $type = escapeSql($column[2]);
} }
if (!empty($column[3])) { if (!empty($column[3])) {
$mac = sanitizeInput($column[3]); $mac = escapeSql($column[3]);
} }
if (!empty($column[4])) { if (!empty($column[4])) {
$ip = sanitizeInput($column[4]); $ip = escapeSql($column[4]);
} }
if (!empty($column[5])) { if (!empty($column[5])) {
$nat_ip = sanitizeInput($column[5]); $nat_ip = escapeSql($column[5]);
} }
if (!empty($column[6])) { if (!empty($column[6])) {
$ipv6 = sanitizeInput($column[6]); $ipv6 = escapeSql($column[6]);
} }
if (!empty($column[7])) { if (!empty($column[7])) {
$network = sanitizeInput($column[7]); $network = escapeSql($column[7]);
if ($network) { if ($network) {
$sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id"); $sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_network); $row = mysqli_fetch_assoc($sql_network);

18
agent/post/asset_interface_model.php
View File

@@ -1,17 +1,17 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$primary_interface = sanitizeInput($_POST['primary_interface']) ?? 0; $primary_interface = escapeSql($_POST['primary_interface']) ?? 0;
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$mac = sanitizeInput($_POST['mac']); $mac = escapeSql($_POST['mac']);
$ip = sanitizeInput($_POST['ip']); $ip = escapeSql($_POST['ip']);
if ($_POST['dhcp'] == 1){ if ($_POST['dhcp'] == 1){
$ip = 'DHCP'; $ip = 'DHCP';
} }
$nat_ip = sanitizeInput($_POST['nat_ip']); $nat_ip = escapeSql($_POST['nat_ip']);
$ipv6 = sanitizeInput($_POST['ipv6']); $ipv6 = escapeSql($_POST['ipv6']);
$network = intval($_POST['network']); $network = intval($_POST['network']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$connected_to = intval($_POST['connected_to']); $connected_to = intval($_POST['connected_to']);

42
agent/post/asset_model.php
View File

@@ -1,48 +1,48 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$make = sanitizeInput($_POST['make']); $make = escapeSql($_POST['make']);
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$serial = sanitizeInput($_POST['serial']); $serial = escapeSql($_POST['serial']);
$os = sanitizeInput($_POST['os']); $os = escapeSql($_POST['os']);
$ip = sanitizeInput($_POST['ip']); $ip = escapeSql($_POST['ip']);
$dhcp = intval($_POST['dhcp'] ?? 0); $dhcp = intval($_POST['dhcp'] ?? 0);
if ($dhcp == 1) { if ($dhcp == 1) {
$ip = 'DHCP'; $ip = 'DHCP';
} }
$ipv6 = sanitizeInput($_POST['ipv6']); $ipv6 = escapeSql($_POST['ipv6']);
$nat_ip = sanitizeInput($_POST['nat_ip']); $nat_ip = escapeSql($_POST['nat_ip']);
$mac = sanitizeInput($_POST['mac']); $mac = escapeSql($_POST['mac']);
$uri = sanitizeInput($_POST['uri']); $uri = escapeSql($_POST['uri']);
$uri_2 = sanitizeInput($_POST['uri_2']); $uri_2 = escapeSql($_POST['uri_2']);
$uri_client = sanitizeInput($_POST['uri_client']); $uri_client = escapeSql($_POST['uri_client']);
$status = sanitizeInput($_POST['status']); $status = escapeSql($_POST['status']);
$location = intval($_POST['location'] ?? 0); $location = intval($_POST['location'] ?? 0);
$physical_location = sanitizeInput($_POST['physical_location']); $physical_location = escapeSql($_POST['physical_location']);
$vendor = intval($_POST['vendor'] ?? 0); $vendor = intval($_POST['vendor'] ?? 0);
$contact = intval($_POST['contact'] ?? 0); $contact = intval($_POST['contact'] ?? 0);
$network = intval($_POST['network'] ?? 0); $network = intval($_POST['network'] ?? 0);
$purchase_reference = sanitizeInput($_POST['purchase_reference']); $purchase_reference = escapeSql($_POST['purchase_reference']);
$purchase_date = sanitizeInput($_POST['purchase_date']); $purchase_date = escapeSql($_POST['purchase_date']);
if (empty($purchase_date)) { if (empty($purchase_date)) {
$purchase_date = "NULL"; $purchase_date = "NULL";
} else { } else {
$purchase_date = "'" . $purchase_date . "'"; $purchase_date = "'" . $purchase_date . "'";
} }
$warranty_expire = sanitizeInput($_POST['warranty_expire']); $warranty_expire = escapeSql($_POST['warranty_expire']);
if (empty($warranty_expire)) { if (empty($warranty_expire)) {
$warranty_expire = "NULL"; $warranty_expire = "NULL";
} else { } else {
$warranty_expire = "'" . $warranty_expire . "'"; $warranty_expire = "'" . $warranty_expire . "'";
} }
$install_date = sanitizeInput($_POST['install_date']); $install_date = escapeSql($_POST['install_date']);
if (empty($install_date)) { if (empty($install_date)) {
$install_date = "NULL"; $install_date = "NULL";
} else { } else {
$install_date = "'" . $install_date . "'"; $install_date = "'" . $install_date . "'";
} }
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$favorite = intval($_POST['favorite'] ?? 0); $favorite = intval($_POST['favorite'] ?? 0);

6
agent/post/category_model.php
View File

@@ -1,6 +1,6 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);

18
agent/post/certificate.php
View File

@@ -24,7 +24,7 @@ if (isset($_POST['add_certificate'])) {
$public_key_obj = openssl_x509_parse($_POST['public_key']); $public_key_obj = openssl_x509_parse($_POST['public_key']);
if ($public_key_obj) { if ($public_key_obj) {
$expire = date('Y-m-d', $public_key_obj['validTo_time_t']); $expire = date('Y-m-d', $public_key_obj['validTo_time_t']);
$issued_by = sanitizeInput($public_key_obj['issuer']['O']); $issued_by = escapeSql($public_key_obj['issuer']['O']);
} }
} }
@@ -66,7 +66,7 @@ if (isset($_POST['edit_certificate'])) {
$public_key_obj = openssl_x509_parse($_POST['public_key']); $public_key_obj = openssl_x509_parse($_POST['public_key']);
if ($public_key_obj) { if ($public_key_obj) {
$expire = date('Y-m-d', $public_key_obj['validTo_time_t']); $expire = date('Y-m-d', $public_key_obj['validTo_time_t']);
$issued_by = sanitizeInput($public_key_obj['issuer']['O']); $issued_by = escapeSql($public_key_obj['issuer']['O']);
} }
} }
@@ -104,9 +104,9 @@ if (isset($_POST['edit_certificate'])) {
foreach ($original_certificate_info as $column => $old_value) { foreach ($original_certificate_info as $column => $old_value) {
$new_value = $new_certificate_info[$column]; $new_value = $new_certificate_info[$column];
if ($old_value != $new_value && !in_array($column, $ignored_columns)) { if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
$column = sanitizeInput($column); $column = escapeSql($column);
$old_value = sanitizeInput($old_value); $old_value = escapeSql($old_value);
$new_value = sanitizeInput($new_value); $new_value = escapeSql($new_value);
mysqli_query($mysqli,"INSERT INTO certificate_history SET certificate_history_column = '$column', certificate_history_old_value = '$old_value', certificate_history_new_value = '$new_value', certificate_history_certificate_id = $certificate_id"); mysqli_query($mysqli,"INSERT INTO certificate_history SET certificate_history_column = '$column', certificate_history_old_value = '$old_value', certificate_history_new_value = '$new_value', certificate_history_certificate_id = $certificate_id");
} }
} }
@@ -130,7 +130,7 @@ if (isset($_GET['archive_certificate'])) {
// Get Certificate Name and Client ID for logging and alert message // Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']); $certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']); $client_id = intval($row['certificate_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -156,7 +156,7 @@ if (isset($_GET['restore_certificate'])) {
// Get Certificate Name and Client ID for logging and alert message // Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']); $certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']); $client_id = intval($row['certificate_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -182,7 +182,7 @@ if (isset($_GET['delete_certificate'])) {
// Get Certificate Name and Client ID for logging and alert message // Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']); $certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']); $client_id = intval($row['certificate_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -216,7 +216,7 @@ if (isset($_POST['bulk_delete_certificates'])) {
// Get Certificate Name and Client ID for logging and alert message // Get Certificate Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$certificate_name = sanitizeInput($row['certificate_name']); $certificate_name = escapeSql($row['certificate_name']);
$client_id = intval($row['certificate_client_id']); $client_id = intval($row['certificate_client_id']);
enforceClientAccess(); enforceClientAccess();

14
agent/post/certificate_model.php
View File

@@ -1,11 +1,11 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$domain = sanitizeInput($_POST['domain']); $domain = escapeSql($_POST['domain']);
$issued_by = sanitizeInput($_POST['issued_by']); $issued_by = escapeSql($_POST['issued_by']);
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
$public_key = sanitizeInput($_POST['public_key']); $public_key = escapeSql($_POST['public_key']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$domain_id = intval($_POST['domain_id'] ?? 0); $domain_id = intval($_POST['domain_id'] ?? 0);

92
agent/post/client.php
View File

@@ -350,7 +350,7 @@ if (isset($_GET['archive_client'])) {
} }
// Get Client Name // Get Client Name
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name')); $client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
logAction("Client", "Archive", "$session_name archived client $client_name", $client_id, $client_id); logAction("Client", "Archive", "$session_name archived client $client_name", $client_id, $client_id);
@@ -369,7 +369,7 @@ if (isset($_GET['restore_client'])) {
$client_id = intval($_GET['restore_client']); $client_id = intval($_GET['restore_client']);
// Get Client Name // Get Client Name
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name')); $client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
mysqli_query($mysqli, "UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id"); mysqli_query($mysqli, "UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id");
@@ -390,7 +390,7 @@ if (isset($_GET['delete_client'])) {
$client_id = intval($_GET['delete_client']); $client_id = intval($_GET['delete_client']);
// Get Client Name // Get Client Name
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name')); $client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
// Delete Associations // Delete Associations
// Delete Client Data // Delete Client Data
@@ -580,7 +580,7 @@ if (isset($_POST["import_clients_csv"])) {
while(($column = fgetcsv($file, 1000, ",")) !== false) { while(($column = fgetcsv($file, 1000, ",")) !== false) {
$duplicate_detect = 0; $duplicate_detect = 0;
if (isset($column[0])) { if (isset($column[0])) {
$name = sanitizeInput($column[0]); $name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM clients WHERE client_name = '$name'")) > 0) { if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM clients WHERE client_name = '$name'")) > 0) {
$duplicate_detect = 1; $duplicate_detect = 1;
} }
@@ -588,22 +588,22 @@ if (isset($_POST["import_clients_csv"])) {
$industry = ''; $industry = '';
if (isset($column[1])) { if (isset($column[1])) {
$industry = sanitizeInput($column[1]); $industry = escapeSql($column[1]);
} }
$referral = ''; $referral = '';
if (isset($column[2])) { if (isset($column[2])) {
$referral = sanitizeInput($column[2]); $referral = escapeSql($column[2]);
} }
$website = ''; $website = '';
if (isset($column[3])) { if (isset($column[3])) {
$website = sanitizeInput(preg_replace("(^https?://)", "", $column[3])); $website = escapeSql(preg_replace("(^https?://)", "", $column[3]));
} }
$location_name = ''; $location_name = '';
if (isset($column[4])) { if (isset($column[4])) {
$location_name = sanitizeInput($column[4]); $location_name = escapeSql($column[4]);
} }
$location_phone = ''; $location_phone = '';
@@ -613,37 +613,37 @@ if (isset($_POST["import_clients_csv"])) {
$address = ''; $address = '';
if (isset($column[6])) { if (isset($column[6])) {
$address = sanitizeInput($column[6]); $address = escapeSql($column[6]);
} }
$city = ''; $city = '';
if (isset($column[7])) { if (isset($column[7])) {
$city = sanitizeInput($column[7]); $city = escapeSql($column[7]);
} }
$state = ''; $state = '';
if (isset($column[8])) { if (isset($column[8])) {
$state = sanitizeInput($column[8]); $state = escapeSql($column[8]);
} }
$zip = ''; $zip = '';
if (isset($column[9])) { if (isset($column[9])) {
$zip = sanitizeInput($column[9]); $zip = escapeSql($column[9]);
} }
$country = ''; $country = '';
if (isset($column[10])) { if (isset($column[10])) {
$country = sanitizeInput($column[10]); $country = escapeSql($column[10]);
} }
$contact_name = ''; $contact_name = '';
if (isset($column[11])) { if (isset($column[11])) {
$contact_name = sanitizeInput($column[11]); $contact_name = escapeSql($column[11]);
} }
$title = ''; $title = '';
if (isset($column[12])) { if (isset($column[12])) {
$title = sanitizeInput($column[12]); $title = escapeSql($column[12]);
} }
$contact_phone = ''; $contact_phone = '';
@@ -663,7 +663,7 @@ if (isset($_POST["import_clients_csv"])) {
$contact_email = ''; $contact_email = '';
if (isset($column[16])) { if (isset($column[16])) {
$contact_email = sanitizeInput($column[16]); $contact_email = escapeSql($column[16]);
} }
$hourly_rate = $config_default_hourly_rate; $hourly_rate = $config_default_hourly_rate;
@@ -671,24 +671,24 @@ if (isset($_POST["import_clients_csv"])) {
$hourly_rate = floatval($column[17]); $hourly_rate = floatval($column[17]);
} }
$currency_code = sanitizeInput($session_company_currency); $currency_code = escapeSql($session_company_currency);
if (isset($column[18])) { if (isset($column[18])) {
$currency_code = sanitizeInput($column[18]); $currency_code = escapeSql($column[18]);
} }
$payment_terms = sanitizeInput($config_default_net_terms); $payment_terms = escapeSql($config_default_net_terms);
if (isset($column[19])) { if (isset($column[19])) {
$payment_terms = intval($column[19]); $payment_terms = intval($column[19]);
} }
$tax_id_number = ''; $tax_id_number = '';
if (isset($column[20])) { if (isset($column[20])) {
$tax_id_number = sanitizeInput($column[20]); $tax_id_number = escapeSql($column[20]);
} }
$abbreviation = ''; $abbreviation = '';
if (isset($column[21])) { if (isset($column[21])) {
$abbreviation = sanitizeInput($column[21]); $abbreviation = escapeSql($column[21]);
} }
// Check if duplicate was detected // Check if duplicate was detected
@@ -783,8 +783,8 @@ if (isset($_POST['bulk_add_client_ticket'])) {
} else { } else {
$ticket_status = 2; $ticket_status = 2;
} }
$subject = sanitizeInput($_POST['bulk_subject']); $subject = escapeSql($_POST['bulk_subject']);
$priority = sanitizeInput($_POST['bulk_priority']); $priority = escapeSql($_POST['bulk_priority']);
$category_id = intval($_POST['bulk_category']); $category_id = intval($_POST['bulk_category']);
$details = mysqli_real_escape_string($mysqli, $_POST['bulk_details']); $details = mysqli_real_escape_string($mysqli, $_POST['bulk_details']);
$project_id = intval($_POST['bulk_project']); $project_id = intval($_POST['bulk_project']);
@@ -799,7 +799,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
// Override Template Subject // Override Template Subject
if(empty($subject)) { if(empty($subject)) {
$subject = sanitizeInput($row['ticket_template_subject']); $subject = escapeSql($row['ticket_template_subject']);
} }
$details = mysqli_escape_string($mysqli, $row['ticket_template_details']); $details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
@@ -820,7 +820,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
// Atomically increment and get the new ticket number // Atomically increment and get the new ticket number
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -834,10 +834,10 @@ if (isset($_POST['bulk_add_client_ticket'])) {
$ticket_number = mysqli_insert_id($mysqli); $ticket_number = mysqli_insert_id($mysqli);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix); $config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
//Generate a unique URL key for clients to access //Generate a unique URL key for clients to access
$url_key = randomString(32); $url_key = randomString(32);
@@ -849,7 +849,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
// Add Tasks // Add Tasks
if (!empty($_POST['tasks'])) { if (!empty($_POST['tasks'])) {
foreach ($_POST['tasks'] as $task) { foreach ($_POST['tasks'] as $task) {
$task_name = sanitizeInput($task); $task_name = escapeSql($task);
// Check that task_name is not-empty (For some reason the !empty on the array doesnt work here like in watchers) // Check that task_name is not-empty (For some reason the !empty on the array doesnt work here like in watchers)
if (!empty($task_name)) { if (!empty($task_name)) {
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_ticket_id = $ticket_id"); mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_ticket_id = $ticket_id");
@@ -862,7 +862,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
if (mysqli_num_rows($sql_task_templates) > 0) { if (mysqli_num_rows($sql_task_templates) > 0) {
while ($row = mysqli_fetch_assoc($sql_task_templates)) { while ($row = mysqli_fetch_assoc($sql_task_templates)) {
$task_order = intval($row['task_template_order']); $task_order = intval($row['task_template_order']);
$task_name = sanitizeInput($row['task_template_name']); $task_name = escapeSql($row['task_template_name']);
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_order = $task_order, task_ticket_id = $ticket_id"); mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_order = $task_order, task_ticket_id = $ticket_id");
} }
@@ -889,7 +889,7 @@ if (isset($_POST['bulk_edit_client_industry'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$industry = sanitizeInput($_POST['bulk_industry']); $industry = escapeSql($_POST['bulk_industry']);
if (isset($_POST['client_ids'])) { if (isset($_POST['client_ids'])) {
@@ -900,7 +900,7 @@ if (isset($_POST['bulk_edit_client_industry'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_type = '$industry' WHERE client_id = $client_id"); mysqli_query($mysqli,"UPDATE clients SET client_type = '$industry' WHERE client_id = $client_id");
@@ -923,7 +923,7 @@ if (isset($_POST['bulk_edit_client_referral'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$referral = sanitizeInput($_POST['bulk_referral']); $referral = escapeSql($_POST['bulk_referral']);
if (isset($_POST['client_ids'])) { if (isset($_POST['client_ids'])) {
@@ -934,7 +934,7 @@ if (isset($_POST['bulk_edit_client_referral'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_referral = '$referral' WHERE client_id = $client_id"); mysqli_query($mysqli,"UPDATE clients SET client_referral = '$referral' WHERE client_id = $client_id");
@@ -968,7 +968,7 @@ if (isset($_POST['bulk_edit_client_hourly_rate'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_rate = '$rate' WHERE client_id = $client_id"); mysqli_query($mysqli,"UPDATE clients SET client_rate = '$rate' WHERE client_id = $client_id");
@@ -1002,7 +1002,7 @@ if (isset($_POST['bulk_edit_client_net_terms'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_net_terms = $net_terms WHERE client_id = $client_id"); mysqli_query($mysqli,"UPDATE clients SET client_net_terms = $net_terms WHERE client_id = $client_id");
@@ -1034,7 +1034,7 @@ if (isset($_POST['bulk_assign_client_tags'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
if ($_POST['bulk_remove_tags']) { if ($_POST['bulk_remove_tags']) {
mysqli_query($mysqli, "DELETE FROM client_tags WHERE client_id = $client_id"); mysqli_query($mysqli, "DELETE FROM client_tags WHERE client_id = $client_id");
@@ -1074,11 +1074,11 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
$count = count($client_ids); $count = count($client_ids);
// Email metadata // Email metadata
$mail_from = sanitizeInput($_POST['mail_from']); $mail_from = escapeSql($_POST['mail_from']);
$mail_from_name = sanitizeInput($_POST['mail_from_name']); $mail_from_name = escapeSql($_POST['mail_from_name']);
$subject = sanitizeInput($_POST['subject']); $subject = escapeSql($_POST['subject']);
$body = mysqli_real_escape_string($mysqli, $_POST['body']); $body = mysqli_real_escape_string($mysqli, $_POST['body']);
$queued_at = sanitizeInput($_POST['queued_at']); $queued_at = escapeSql($_POST['queued_at']);
// Build contact type filters // Build contact type filters
$filters = []; $filters = [];
@@ -1115,7 +1115,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
$unique_contacts = []; $unique_contacts = [];
while ($row = mysqli_fetch_assoc($result)) { while ($row = mysqli_fetch_assoc($result)) {
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
// Skip if email is missing or invalid // Skip if email is missing or invalid
if (empty($contact_email) || !filter_var($contact_email, FILTER_VALIDATE_EMAIL)) { if (empty($contact_email) || !filter_var($contact_email, FILTER_VALIDATE_EMAIL)) {
@@ -1128,7 +1128,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
} }
$unique_contacts[$contact_email] = true; $unique_contacts[$contact_email] = true;
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$data[] = [ $data[] = [
'from' => $mail_from, 'from' => $mail_from,
@@ -1169,7 +1169,7 @@ if (isset($_POST['bulk_archive_clients'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NOW() WHERE client_id = $client_id"); mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NOW() WHERE client_id = $client_id");
@@ -1205,7 +1205,7 @@ if (isset($_POST['bulk_unarchive_clients'])) {
$sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id"); mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id");

136
agent/post/contact.php
View File

@@ -96,7 +96,7 @@ if (isset($_POST['edit_contact'])) {
// Get Contact Info // Get Contact Info
$sql = mysqli_query($mysqli,"SELECT contact_photo, contact_user_id, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_photo, contact_user_id, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['contact_photo']); $existing_file_name = escapeSql($row['contact_photo']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
@@ -175,17 +175,17 @@ if (isset($_POST['edit_contact'])) {
if ($send_email && $auth_method && $config_smtp_provider && $contact_user_id) { if ($send_email && $auth_method && $config_smtp_provider && $contact_user_id) {
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email); $config_mail_from_email = escapeSql($config_mail_from_email);
$config_mail_from_name = sanitizeInput($config_mail_from_name); $config_mail_from_name = escapeSql($config_mail_from_name);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
// Get Company Phone Number // Get Company Phone Number
$sql = mysqli_query($mysqli,"SELECT company_name, company_phone FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT company_name, company_phone FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
// Authentication info (azure, reset password, or tech-provided temporary password) // Authentication info (azure, reset password, or tech-provided temporary password)
@@ -234,13 +234,13 @@ if (isset($_POST['add_contact_note'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$contact_id = intval($_POST['contact_id']); $contact_id = intval($_POST['contact_id']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
// Get Contact details for logging and alerting // Get Contact details for logging and alerting
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -269,8 +269,8 @@ if (isset($_GET['archive_contact_note'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id"); $sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_note_type = sanitizeInput($row['contact_note_type']); $contact_note_type = escapeSql($row['contact_note_type']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_id = intval($row['contact_id']); $contact_id = intval($row['contact_id']);
@@ -297,8 +297,8 @@ if (isset($_GET['restore_contact_note'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id"); $sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_note_type = sanitizeInput($row['contact_note_type']); $contact_note_type = escapeSql($row['contact_note_type']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_id = intval($row['contact_id']); $contact_id = intval($row['contact_id']);
@@ -325,8 +325,8 @@ if (isset($_GET['delete_contact_note'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id"); $sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_note_type = sanitizeInput($row['contact_note_type']); $contact_note_type = escapeSql($row['contact_note_type']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_id = intval($row['contact_id']); $contact_id = intval($row['contact_id']);
@@ -353,7 +353,7 @@ if (isset($_POST['bulk_assign_contact_location'])) {
// Get Location name for logging and Notification // Get Location name for logging and Notification
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -370,7 +370,7 @@ if (isset($_POST['bulk_assign_contact_location'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
mysqli_query($mysqli,"UPDATE contacts SET contact_location_id = $location_id WHERE contact_id = $contact_id"); mysqli_query($mysqli,"UPDATE contacts SET contact_location_id = $location_id WHERE contact_id = $contact_id");
@@ -407,7 +407,7 @@ if (isset($_POST['bulk_edit_contact_phone'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -433,7 +433,7 @@ if (isset($_POST['bulk_edit_contact_department'])) {
enforceUserPermission('module_client', 2); enforceUserPermission('module_client', 2);
$department = sanitizeInput($_POST['bulk_department']); $department = escapeSql($_POST['bulk_department']);
// Assign Location to Selected Contacts // Assign Location to Selected Contacts
if (isset($_POST['contact_ids'])) { if (isset($_POST['contact_ids'])) {
@@ -447,7 +447,7 @@ if (isset($_POST['bulk_edit_contact_department'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -489,7 +489,7 @@ if (isset($_POST['bulk_edit_contact_role'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -529,7 +529,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -574,11 +574,11 @@ if (isset($_POST['send_bulk_mail_now'])) {
$count = count($_POST['contact_ids']); $count = count($_POST['contact_ids']);
$mail_from = sanitizeInput($_POST['mail_from']); $mail_from = escapeSql($_POST['mail_from']);
$mail_from_name = sanitizeInput($_POST['mail_from_name']); $mail_from_name = escapeSql($_POST['mail_from_name']);
$subject = sanitizeInput($_POST['subject']); $subject = escapeSql($_POST['subject']);
$body = mysqli_escape_string($mysqli, $_POST['body']); $body = mysqli_escape_string($mysqli, $_POST['body']);
$queued_at = sanitizeInput($_POST['queued_at']); $queued_at = escapeSql($_POST['queued_at']);
// Add Emails // Add Emails
foreach($_POST['contact_ids'] as $contact_id) { foreach($_POST['contact_ids'] as $contact_id) {
@@ -586,8 +586,8 @@ if (isset($_POST['send_bulk_mail_now'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -633,7 +633,7 @@ if (isset($_POST['bulk_archive_contacts'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_primary, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_primary, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_primary = intval($row['contact_primary']); $contact_primary = intval($row['contact_primary']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
@@ -685,7 +685,7 @@ if (isset($_POST['bulk_restore_contacts'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
@@ -730,7 +730,7 @@ if (isset($_POST['bulk_delete_contacts'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
@@ -769,10 +769,10 @@ if (isset($_GET['anonymize_contact'])) {
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_email, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_email, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_first_name = explode(" ", $contact_name)[0]; $contact_first_name = explode(" ", $contact_name)[0];
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$contact_phone = sanitizeInput($row['contact_phone']); $contact_phone = escapeSql($row['contact_phone']);
$info_to_redact = array($contact_name, $contact_first_name, $contact_email, $contact_phone); $info_to_redact = array($contact_name, $contact_first_name, $contact_email, $contact_phone);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
@@ -813,7 +813,7 @@ if (isset($_GET['anonymize_contact'])) {
$log_id = intval($log['log_id']); $log_id = intval($log['log_id']);
$description = $log['log_description']; $description = $log['log_description'];
$description = str_ireplace($info_to_redact, "*****", $description); $description = str_ireplace($info_to_redact, "*****", $description);
$description = sanitizeInput($description); $description = escapeSql($description);
mysqli_query($mysqli,"UPDATE logs SET log_description = '$description' WHERE log_id = $log_id AND log_client_id = $client_id"); mysqli_query($mysqli,"UPDATE logs SET log_description = '$description' WHERE log_id = $log_id AND log_client_id = $client_id");
} }
@@ -828,14 +828,14 @@ if (isset($_GET['anonymize_contact'])) {
// Redact contact name or email in the subject of all tickets they raised // Redact contact name or email in the subject of all tickets they raised
$subject = $ticket['ticket_subject']; $subject = $ticket['ticket_subject'];
$subject = str_ireplace($info_to_redact, "*****", $subject); $subject = str_ireplace($info_to_redact, "*****", $subject);
$subject = sanitizeInput($subject); $subject = escapeSql($subject);
mysqli_query($mysqli,"UPDATE tickets SET ticket_subject = '$subject' WHERE ticket_id = $ticket_id"); mysqli_query($mysqli,"UPDATE tickets SET ticket_subject = '$subject' WHERE ticket_id = $ticket_id");
// Redact contact name or email in the description of all tickets they raised // Redact contact name or email in the description of all tickets they raised
$details = $ticket['ticket_details']; $details = $ticket['ticket_details'];
$details = str_ireplace($info_to_redact, "*****", $details); $details = str_ireplace($info_to_redact, "*****", $details);
$details = sanitizeInput($details); $details = escapeSql($details);
mysqli_query($mysqli,"UPDATE tickets SET ticket_details = '$details' WHERE ticket_id = $ticket_id"); mysqli_query($mysqli,"UPDATE tickets SET ticket_details = '$details' WHERE ticket_id = $ticket_id");
// Redact contact name or email in the replies of all tickets they raised // Redact contact name or email in the replies of all tickets they raised
@@ -845,7 +845,7 @@ if (isset($_GET['anonymize_contact'])) {
$ticket_reply_id = intval($ticket_reply['ticket_reply_id']); $ticket_reply_id = intval($ticket_reply['ticket_reply_id']);
$ticket_reply_details = $ticket_reply['ticket_reply']; $ticket_reply_details = $ticket_reply['ticket_reply'];
$ticket_reply_details = str_ireplace($info_to_redact, "*****", $ticket_reply_details); $ticket_reply_details = str_ireplace($info_to_redact, "*****", $ticket_reply_details);
$ticket_reply_details = sanitizeInput($ticket_reply_details); $ticket_reply_details = escapeSql($ticket_reply_details);
mysqli_query($mysqli,"UPDATE ticket_replies SET ticket_reply = '$ticket_reply_details' mysqli_query($mysqli,"UPDATE ticket_replies SET ticket_reply = '$ticket_reply_details'
WHERE ticket_reply_id = $ticket_reply_id" WHERE ticket_reply_id = $ticket_reply_id"
@@ -876,7 +876,7 @@ if (isset($_GET['archive_contact'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
@@ -908,7 +908,7 @@ if (isset($_GET['restore_contact'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
@@ -940,7 +940,7 @@ if (isset($_GET['delete_contact'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$client_id = intval($row['contact_client_id']); $client_id = intval($row['contact_client_id']);
$contact_user_id = intval($row['contact_user_id']); $contact_user_id = intval($row['contact_user_id']);
@@ -973,13 +973,13 @@ if (isset($_POST['link_contact_to_asset'])) {
// Get Asset Name and Client ID for logging // Get Asset Name and Client ID for logging
$sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql_asset); $row = mysqli_fetch_assoc($sql_asset);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id"); mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id");
@@ -1003,13 +1003,13 @@ if (isset($_GET['unlink_asset_from_contact'])) {
// Get asset Name and Client ID for logging // Get asset Name and Client ID for logging
$sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id");
$row = mysqli_fetch_assoc($sql_asset); $row = mysqli_fetch_assoc($sql_asset);
$asset_name = sanitizeInput($row['asset_name']); $asset_name = escapeSql($row['asset_name']);
$client_id = intval($row['asset_client_id']); $client_id = intval($row['asset_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = 0 WHERE asset_id = $asset_id"); mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = 0 WHERE asset_id = $asset_id");
@@ -1033,13 +1033,13 @@ if (isset($_POST['link_software_to_contact'])) {
// Get software Name and Client ID for logging // Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software); $row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']); $software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']); $client_id = intval($row['software_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"INSERT INTO software_contacts SET contact_id = $contact_id, software_id = $software_id"); mysqli_query($mysqli,"INSERT INTO software_contacts SET contact_id = $contact_id, software_id = $software_id");
@@ -1063,13 +1063,13 @@ if (isset($_GET['unlink_software_from_contact'])) {
// Get software Name and Client ID for logging // Get software Name and Client ID for logging
$sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql_software); $row = mysqli_fetch_assoc($sql_software);
$software_name = sanitizeInput($row['software_name']); $software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']); $client_id = intval($row['software_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM software_contacts WHERE contact_id = $contact_id AND software_id = $software_id"); mysqli_query($mysqli,"DELETE FROM software_contacts WHERE contact_id = $contact_id AND software_id = $software_id");
@@ -1093,13 +1093,13 @@ if (isset($_POST['link_contact_to_credential'])) {
// Get credential Name and Client ID for logging // Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential); $row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = $contact_id WHERE credential_id = $credential_id"); mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = $contact_id WHERE credential_id = $credential_id");
@@ -1123,13 +1123,13 @@ if (isset($_GET['unlink_credential_from_contact'])) {
// Get credential Name and Client ID for logging // Get credential Name and Client ID for logging
$sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql_credential); $row = mysqli_fetch_assoc($sql_credential);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = 0 WHERE credential_id = $credential_id"); mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = 0 WHERE credential_id = $credential_id");
@@ -1153,13 +1153,13 @@ if (isset($_POST['link_service_to_contact'])) {
// Get service Name and Client ID for logging // Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service); $row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']); $service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']); $client_id = intval($row['service_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"INSERT INTO service_contacts SET contact_id = $contact_id, service_id = $service_id"); mysqli_query($mysqli,"INSERT INTO service_contacts SET contact_id = $contact_id, service_id = $service_id");
@@ -1183,13 +1183,13 @@ if (isset($_GET['unlink_service_from_contact'])) {
// Get service Name and Client ID for logging // Get service Name and Client ID for logging
$sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql_service); $row = mysqli_fetch_assoc($sql_service);
$service_name = sanitizeInput($row['service_name']); $service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']); $client_id = intval($row['service_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM service_contacts WHERE contact_id = $contact_id AND service_id = $service_id"); mysqli_query($mysqli,"DELETE FROM service_contacts WHERE contact_id = $contact_id AND service_id = $service_id");
@@ -1213,13 +1213,13 @@ if (isset($_POST['link_contact_to_file'])) {
// Get file Name and Client ID for logging // Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
// Contact add query // Contact add query
mysqli_query($mysqli,"INSERT INTO contact_files SET contact_id = $contact_id, file_id = $file_id"); mysqli_query($mysqli,"INSERT INTO contact_files SET contact_id = $contact_id, file_id = $file_id");
@@ -1244,13 +1244,13 @@ if (isset($_GET['unlink_contact_from_file'])) {
// Get file Name and Client ID for logging // Get file Name and Client ID for logging
$sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM contact_files WHERE contact_id = $contact_id AND file_id = $file_id"); mysqli_query($mysqli,"DELETE FROM contact_files WHERE contact_id = $contact_id AND file_id = $file_id");
@@ -1370,19 +1370,19 @@ if (isset($_POST["import_contacts_csv"])) {
while(($column = fgetcsv($file, 1000, ",")) !== false) { while(($column = fgetcsv($file, 1000, ",")) !== false) {
$duplicate_detect = 0; $duplicate_detect = 0;
if (isset($column[0])) { if (isset($column[0])) {
$name = sanitizeInput($column[0]); $name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$name' AND contact_client_id = $client_id")) > 0) { if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$name' AND contact_client_id = $client_id")) > 0) {
$duplicate_detect = 1; $duplicate_detect = 1;
} }
} }
if (isset($column[1])) { if (isset($column[1])) {
$title = sanitizeInput($column[1]); $title = escapeSql($column[1]);
} }
if (isset($column[2])) { if (isset($column[2])) {
$department = sanitizeInput($column[2]); $department = escapeSql($column[2]);
} }
if (isset($column[3])) { if (isset($column[3])) {
$email = sanitizeInput($column[3]); $email = escapeSql($column[3]);
} }
if (isset($column[4])) { if (isset($column[4])) {
$phone = preg_replace("/[^0-9]/", '',$column[4]); $phone = preg_replace("/[^0-9]/", '',$column[4]);
@@ -1394,7 +1394,7 @@ if (isset($_POST["import_contacts_csv"])) {
$mobile = preg_replace("/[^0-9]/", '',$column[6]); $mobile = preg_replace("/[^0-9]/", '',$column[6]);
} }
if (isset($column[7])) { if (isset($column[7])) {
$location = sanitizeInput($column[7]); $location = escapeSql($column[7]);
$sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
$row = mysqli_fetch_assoc($sql_location); $row = mysqli_fetch_assoc($sql_location);
$location_id = intval($row['location_id']); $location_id = intval($row['location_id']);

14
agent/post/contact_model.php
View File

@@ -1,20 +1,20 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$title = sanitizeInput($_POST['title']); $title = escapeSql($_POST['title']);
$department = sanitizeInput($_POST['department']); $department = escapeSql($_POST['department']);
$phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']); $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']);
$phone = preg_replace("/[^0-9]/", '', $_POST['phone']); $phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
$extension = preg_replace("/[^0-9]/", '', $_POST['extension']); $extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
$mobile_country_code = preg_replace("/[^0-9]/", '', $_POST['mobile_country_code']); $mobile_country_code = preg_replace("/[^0-9]/", '', $_POST['mobile_country_code']);
$mobile = preg_replace("/[^0-9]/", '', $_POST['mobile']); $mobile = preg_replace("/[^0-9]/", '', $_POST['mobile']);
$email = sanitizeInput($_POST['email']); $email = escapeSql($_POST['email']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$contact_primary = intval($_POST['contact_primary'] ?? 0); $contact_primary = intval($_POST['contact_primary'] ?? 0);
$contact_important = intval($_POST['contact_important'] ?? 0); $contact_important = intval($_POST['contact_important'] ?? 0);
$contact_billing = intval($_POST['contact_billing'] ?? 0); $contact_billing = intval($_POST['contact_billing'] ?? 0);
$contact_technical = intval($_POST['contact_technical'] ?? 0); $contact_technical = intval($_POST['contact_technical'] ?? 0);
$location_id = intval($_POST['location'] ?? 0); $location_id = intval($_POST['location'] ?? 0);
$pin = sanitizeInput($_POST['pin']); $pin = escapeSql($_POST['pin']);
$auth_method = sanitizeInput($_POST['auth_method']); $auth_method = escapeSql($_POST['auth_method']);

30
agent/post/credential.php
View File

@@ -94,7 +94,7 @@ if(isset($_GET['archive_credential'])){
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -120,7 +120,7 @@ if(isset($_GET['restore_credential'])){
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -146,7 +146,7 @@ if (isset($_GET['delete_credential'])) {
// Get Credential Name and Client ID for logging and alert message // Get Credential Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -179,7 +179,7 @@ if (isset($_POST['bulk_assign_credential_tags'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -232,7 +232,7 @@ if (isset($_POST['bulk_favorite_credentials'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -270,7 +270,7 @@ if (isset($_POST['bulk_unfavorite_credentials'])) {
// Get Asset Name and Client ID for logging and alert message // Get Asset Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -310,7 +310,7 @@ if (isset($_POST['bulk_archive_credentials'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -349,7 +349,7 @@ if (isset($_POST['bulk_restore_credentials'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -389,7 +389,7 @@ if (isset($_POST['bulk_delete_credentials'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $sql = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$credential_name = sanitizeInput($row['credential_name']); $credential_name = escapeSql($row['credential_name']);
$client_id = intval($row['credential_client_id']); $client_id = intval($row['credential_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -521,30 +521,30 @@ if (isset($_POST["import_credentials_csv"])) {
$duplicate_detect = 0; $duplicate_detect = 0;
// Name // Name
if (isset($column[0])) { if (isset($column[0])) {
$name = sanitizeInput($column[0]); $name = escapeSql($column[0]);
if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM credentials WHERE credential_name = '$name' AND credential_client_id = $client_id")) > 0){ if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM credentials WHERE credential_name = '$name' AND credential_client_id = $client_id")) > 0){
$duplicate_detect = 1; $duplicate_detect = 1;
} }
} }
// Desc // Desc
if (isset($column[1])) { if (isset($column[1])) {
$description = sanitizeInput($column[1]); $description = escapeSql($column[1]);
} }
// User // User
if (isset($column[2])) { if (isset($column[2])) {
$username = sanitizeInput(encryptCredentialEntry($column[2])); $username = escapeSql(encryptCredentialEntry($column[2]));
} }
// Pass // Pass
if (isset($column[3])) { if (isset($column[3])) {
$password = sanitizeInput(encryptCredentialEntry($column[3])); $password = escapeSql(encryptCredentialEntry($column[3]));
} }
// OTP // OTP
if (isset($column[4])) { if (isset($column[4])) {
$totp = sanitizeInput($column[4]); $totp = escapeSql($column[4]);
} }
// URL // URL
if (isset($column[4])) { if (isset($column[4])) {
$uri = sanitizeInput($column[5]); $uri = escapeSql($column[5]);
} }
// Check if duplicate was detected // Check if duplicate was detected

12
agent/post/credential_model.php
View File

@@ -2,14 +2,14 @@
// Model of reusable variables for client credentials - not to be confused with the ITFLow login process // Model of reusable variables for client credentials - not to be confused with the ITFLow login process
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$uri = sanitizeInput($_POST['uri']); $uri = escapeSql($_POST['uri']);
$uri_2 = sanitizeInput($_POST['uri_2']); $uri_2 = escapeSql($_POST['uri_2']);
$username = encryptCredentialEntry(trim($_POST['username'])); $username = encryptCredentialEntry(trim($_POST['username']));
$password = encryptCredentialEntry(trim($_POST['password'])); $password = encryptCredentialEntry(trim($_POST['password']));
$otp_secret = sanitizeInput($_POST['otp_secret']); $otp_secret = escapeSql($_POST['otp_secret']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
$favorite = intval($_POST['favorite'] ?? 0); $favorite = intval($_POST['favorite'] ?? 0);
$contact_id = intval($_POST['contact'] ?? 0); $contact_id = intval($_POST['contact'] ?? 0);
$asset_id = intval($_POST['asset'] ?? 0); $asset_id = intval($_POST['asset'] ?? 0);

6
agent/post/credit.php
View File

@@ -14,9 +14,9 @@ if (isset($_POST['add_credit'])) {
$client_id = intval($_POST['client']); $client_id = intval($_POST['client']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
mysqli_query($mysqli,"INSERT INTO credits SET credit_amount = $amount, credit_type = '$type', credit_note = '$note', credit_created_by = $session_user_id, credit_client_id = $client_id"); mysqli_query($mysqli,"INSERT INTO credits SET credit_amount = $amount, credit_type = '$type', credit_note = '$note', credit_created_by = $session_user_id, credit_client_id = $client_id");

82
agent/post/document.php
View File

@@ -60,8 +60,8 @@ if (isset($_POST['add_document_from_template'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$document_name = sanitizeInput($_POST['name']); $document_name = escapeSql($_POST['name']);
$document_description = sanitizeInput($_POST['description']); $document_description = escapeSql($_POST['description']);
$document_template_id = intval($_POST['document_template_id']); $document_template_id = intval($_POST['document_template_id']);
$folder = intval($_POST['folder']); $folder = intval($_POST['folder']);
@@ -76,7 +76,7 @@ if (isset($_POST['add_document_from_template'])) {
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_template_name = sanitizeInput($row['document_template_name']); $document_template_name = escapeSql($row['document_template_name']);
$template_content_html = $row['document_template_content']; // raw HTML from template $template_content_html = $row['document_template_content']; // raw HTML from template
// 1) Create the new document with placeholder content to get an ID // 1) Create the new document with placeholder content to get an ID
@@ -110,7 +110,7 @@ if (isset($_POST['add_document_from_template'])) {
// 4) Prepare content + content_raw // 4) Prepare content + content_raw
$content = mysqli_real_escape_string($mysqli, $processed_html); $content = mysqli_real_escape_string($mysqli, $processed_html);
$content_raw = sanitizeInput( $content_raw = escapeSql(
$document_name . " " . str_replace("<", " <", $processed_html) $document_name . " " . str_replace("<", " <", $processed_html)
); );
$content_raw = mysqli_real_escape_string($mysqli, $content_raw); $content_raw = mysqli_real_escape_string($mysqli, $content_raw);
@@ -161,13 +161,13 @@ if (isset($_POST['edit_document'])) {
$row = mysqli_fetch_assoc($sql_original_document); $row = mysqli_fetch_assoc($sql_original_document);
$original_document_name = sanitizeInput($row['document_name']); $original_document_name = escapeSql($row['document_name']);
$original_document_description = sanitizeInput($row['document_description']); $original_document_description = escapeSql($row['document_description']);
$original_document_content = mysqli_real_escape_string($mysqli, $row['document_content']); $original_document_content = mysqli_real_escape_string($mysqli, $row['document_content']);
$original_document_created_by = intval($row['document_created_by']); $original_document_created_by = intval($row['document_created_by']);
$original_document_updated_by = intval($row['document_updated_by']); $original_document_updated_by = intval($row['document_updated_by']);
$original_document_created_at = sanitizeInput($row['document_created_at']); $original_document_created_at = escapeSql($row['document_created_at']);
$original_document_updated_at = sanitizeInput($row['document_updated_at']); $original_document_updated_at = escapeSql($row['document_updated_at']);
if ($original_document_updated_at) { if ($original_document_updated_at) {
$document_version_created_at = $original_document_updated_at; $document_version_created_at = $original_document_updated_at;
@@ -211,7 +211,7 @@ if (isset($_POST['edit_document'])) {
$content = mysqli_real_escape_string($mysqli, $processed_html); $content = mysqli_real_escape_string($mysqli, $processed_html);
// Rebuild content_raw for full-text search // Rebuild content_raw for full-text search
$content_raw = sanitizeInput( $content_raw = escapeSql(
$name . " " . str_replace("<", " <", $processed_html) $name . " " . str_replace("<", " <", $processed_html)
); );
$content_raw = mysqli_real_escape_string($mysqli, $content_raw); $content_raw = mysqli_real_escape_string($mysqli, $content_raw);
@@ -254,7 +254,7 @@ if (isset($_POST['move_document'])) {
// Get Document Name Client ID for logging // Get Document Name Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -262,7 +262,7 @@ if (isset($_POST['move_document'])) {
// Get Folder Name for logging // Get Folder Name for logging
$sql_folder = mysqli_query($mysqli,"SELECT folder_name FROM folders WHERE folder_id = $folder_id"); $sql_folder = mysqli_query($mysqli,"SELECT folder_name FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql_folder); $row = mysqli_fetch_assoc($sql_folder);
$folder_name = sanitizeInput($row['folder_name']); $folder_name = escapeSql($row['folder_name']);
// Document edit query // Document edit query
mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id"); mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id");
@@ -282,7 +282,7 @@ if (isset($_POST['rename_document'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$document_id = intval($_POST['document_id']); $document_id = intval($_POST['document_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$client_id = intval(getFieldById('documents', $document_id, 'document_client_id')); $client_id = intval(getFieldById('documents', $document_id, 'document_client_id'));
@@ -291,7 +291,7 @@ if (isset($_POST['rename_document'])) {
// Get Document Name before renaming for logging // Get Document Name before renaming for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$old_document_name = sanitizeInput($row['document_name']); $old_document_name = escapeSql($row['document_name']);
// Document edit query // Document edit query
mysqli_query($mysqli,"UPDATE documents SET document_name = '$name', document_updated_at = document_updated_at WHERE document_id = $document_id"); mysqli_query($mysqli,"UPDATE documents SET document_name = '$name', document_updated_at = document_updated_at WHERE document_id = $document_id");
@@ -316,7 +316,7 @@ if (isset($_POST['bulk_move_document'])) {
// Get folder name for logging and Notification // Get folder name for logging and Notification
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$folder_name = sanitizeInput($row['folder_name']); $folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']); $client_id = intval($row['folder_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -330,7 +330,7 @@ if (isset($_POST['bulk_move_document'])) {
foreach($_POST['document_ids'] as $document_id) { foreach($_POST['document_ids'] as $document_id) {
$document_id = intval($document_id); $document_id = intval($document_id);
// Get document name for logging // Get document name for logging
$document_name = sanitizeInput(getFieldById('documents', $document_id, 'document_name')); $document_name = escapeSql(getFieldById('documents', $document_id, 'document_name'));
// Document move query // Document move query
mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id"); mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id");
@@ -359,13 +359,13 @@ if (isset($_POST['link_file_to_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get File Name for logging // Get File Name for logging
$file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name')); $file_name = escapeSql(getFieldById('files', $file_id, 'file_name'));
// Document add query // Document add query
mysqli_query($mysqli,"INSERT INTO document_files SET file_id = $file_id, document_id = $document_id"); mysqli_query($mysqli,"INSERT INTO document_files SET file_id = $file_id, document_id = $document_id");
@@ -390,13 +390,13 @@ if (isset($_GET['unlink_file_from_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get File Name for logging // Get File Name for logging
$file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name')); $file_name = escapeSql(getFieldById('files', $file_id, 'file_name'));
mysqli_query($mysqli,"DELETE FROM document_files WHERE file_id = $file_id AND document_id = $document_id"); mysqli_query($mysqli,"DELETE FROM document_files WHERE file_id = $file_id AND document_id = $document_id");
@@ -420,13 +420,13 @@ if (isset($_POST['link_vendor_to_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Vendor Name for logging // Get Vendor Name for logging
$vendor_name = sanitizeInput(getFieldById('vendors', $vendor_id, 'vendor_name')); $vendor_name = escapeSql(getFieldById('vendors', $vendor_id, 'vendor_name'));
// Document add query // Document add query
mysqli_query($mysqli,"INSERT INTO vendor_documents SET vendor_id = $vendor_id, document_id = $document_id"); mysqli_query($mysqli,"INSERT INTO vendor_documents SET vendor_id = $vendor_id, document_id = $document_id");
@@ -451,13 +451,13 @@ if (isset($_GET['unlink_vendor_from_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Vendor Name for logging // Get Vendor Name for logging
$vendor_name = sanitizeInput(getFieldById('vendors', $vendor_id, 'vendor_name')); $vendor_name = escapeSql(getFieldById('vendors', $vendor_id, 'vendor_name'));
mysqli_query($mysqli,"DELETE FROM vendor_documents WHERE vendor_id = $vendor_id AND document_id = $document_id"); mysqli_query($mysqli,"DELETE FROM vendor_documents WHERE vendor_id = $vendor_id AND document_id = $document_id");
@@ -482,13 +482,13 @@ if (isset($_POST['link_contact_to_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
// Contact add query // Contact add query
mysqli_query($mysqli,"INSERT INTO contact_documents SET contact_id = $contact_id, document_id = $document_id"); mysqli_query($mysqli,"INSERT INTO contact_documents SET contact_id = $contact_id, document_id = $document_id");
@@ -513,13 +513,13 @@ if (isset($_GET['unlink_contact_from_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Contact Name for logging // Get Contact Name for logging
$contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name'));
mysqli_query($mysqli,"DELETE FROM contact_documents WHERE contact_id = $contact_id AND document_id = $document_id"); mysqli_query($mysqli,"DELETE FROM contact_documents WHERE contact_id = $contact_id AND document_id = $document_id");
@@ -543,13 +543,13 @@ if (isset($_POST['link_asset_to_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"INSERT INTO asset_documents SET asset_id = $asset_id, document_id = $document_id"); mysqli_query($mysqli,"INSERT INTO asset_documents SET asset_id = $asset_id, document_id = $document_id");
@@ -573,13 +573,13 @@ if (isset($_GET['unlink_asset_from_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for logging // Get Asset Name for logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM asset_documents WHERE asset_id = $asset_id AND document_id = $document_id"); mysqli_query($mysqli,"DELETE FROM asset_documents WHERE asset_id = $asset_id AND document_id = $document_id");
@@ -603,13 +603,13 @@ if (isset($_POST['link_software_to_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Software Name for logging // Get Software Name for logging
$software_name = sanitizeInput(getFieldById('software', $software_id, 'software_name')); $software_name = escapeSql(getFieldById('software', $software_id, 'software_name'));
// Contact add query // Contact add query
mysqli_query($mysqli,"INSERT INTO software_documents SET software_id = $software_id, document_id = $document_id"); mysqli_query($mysqli,"INSERT INTO software_documents SET software_id = $software_id, document_id = $document_id");
@@ -634,13 +634,13 @@ if (isset($_GET['unlink_software_from_document'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Software Name for logging // Get Software Name for logging
$software_name = sanitizeInput(getFieldById('software', $software_id, 'software_name')); $software_name = escapeSql(getFieldById('software', $software_id, 'software_name'));
mysqli_query($mysqli,"DELETE FROM software_documents WHERE software_id = $software_id AND document_id = $document_id"); mysqli_query($mysqli,"DELETE FROM software_documents WHERE software_id = $software_id AND document_id = $document_id");
@@ -670,7 +670,7 @@ if (isset($_POST['toggle_document_visibility'])) {
// Get Document Name and Client ID for logging // Get Document Name and Client ID for logging
$sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql_document); $row = mysqli_fetch_assoc($sql_document);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -696,7 +696,7 @@ if (isset($_GET['export_document'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT document_name, document_content, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_content, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$document_content = $row['document_content']; $document_content = $row['document_content'];
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
@@ -744,7 +744,7 @@ if (isset($_GET['archive_document'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -789,7 +789,7 @@ if (isset($_GET['restore_document'])) {
// Get Document Name and Client ID for logging and alert message // Get Document Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -816,7 +816,7 @@ if (isset($_GET['delete_document_version'])) {
$sql = mysqli_query($mysqli,"SELECT document_version_name, document_client_id FROM documents, document_versions WHERE document_version_document_id = document_id AND document_version_id = $document_version_id"); $sql = mysqli_query($mysqli,"SELECT document_version_name, document_client_id FROM documents, document_versions WHERE document_version_document_id = document_id AND document_version_id = $document_version_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
$document_version_name = sanitizeInput($row['document_version_name']); $document_version_name = escapeSql($row['document_version_name']);
enforceClientAccess(); enforceClientAccess();
@@ -842,7 +842,7 @@ if (isset($_GET['delete_document'])) {
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
enforceClientAccess(); enforceClientAccess();

6
agent/post/document_model.php
View File

@@ -1,9 +1,9 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$folder = intval($_POST['folder']); $folder = intval($_POST['folder']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$content = mysqli_real_escape_string($mysqli,$_POST['content']); $content = mysqli_real_escape_string($mysqli,$_POST['content']);
$content_raw = sanitizeInput($_POST['name'] . " " . str_replace("<", " <", $_POST['content'])); $content_raw = escapeSql($_POST['name'] . " " . str_replace("<", " <", $_POST['content']));
// Content Raw is used for FULL INDEX searching. Adding a space before HTML tags to allow spaces between newlines, bulletpoints, etc. for searching. // Content Raw is used for FULL INDEX searching. Adding a space before HTML tags to allow spaces between newlines, bulletpoints, etc. for searching.

44
agent/post/domain.php
View File

@@ -33,11 +33,11 @@ if (isset($_POST['add_domain'])) {
// NS, MX, A and WHOIS records/data // NS, MX, A and WHOIS records/data
$records = getDomainRecords($name); $records = getDomainRecords($name);
$a = sanitizeInput($records['a']); $a = escapeSql($records['a']);
$ns = sanitizeInput($records['ns']); $ns = escapeSql($records['ns']);
$mx = sanitizeInput($records['mx']); $mx = escapeSql($records['mx']);
$txt = sanitizeInput($records['txt']); $txt = escapeSql($records['txt']);
$whois = sanitizeInput($records['whois']); $whois = escapeSql($records['whois']);
// Add domain record // Add domain record
mysqli_query($mysqli,"INSERT INTO domains SET domain_name = '$name', domain_description = '$description', domain_registrar = $registrar, domain_webhost = $webhost, domain_dnshost = $dnshost, domain_mailhost = $mailhost, domain_expire = $expire, domain_ip = '$a', domain_name_servers = '$ns', domain_mail_servers = '$mx', domain_txt = '$txt', domain_raw_whois = '$whois', domain_notes = '$notes', domain_client_id = $client_id"); mysqli_query($mysqli,"INSERT INTO domains SET domain_name = '$name', domain_description = '$description', domain_registrar = $registrar, domain_webhost = $webhost, domain_dnshost = $dnshost, domain_mailhost = $mailhost, domain_expire = $expire, domain_ip = '$a', domain_name_servers = '$ns', domain_mail_servers = '$mx', domain_txt = '$txt', domain_raw_whois = '$whois', domain_notes = '$notes', domain_client_id = $client_id");
@@ -48,9 +48,9 @@ if (isset($_POST['add_domain'])) {
// Get SSL cert for domain (if exists) // Get SSL cert for domain (if exists)
$certificate = getSSL($name); $certificate = getSSL($name);
if ($certificate['success'] == "TRUE") { if ($certificate['success'] == "TRUE") {
$expire = sanitizeInput($certificate['expire']); $expire = escapeSql($certificate['expire']);
$issued_by = sanitizeInput($certificate['issued_by']); $issued_by = escapeSql($certificate['issued_by']);
$public_key = sanitizeInput($certificate['public_key']); $public_key = escapeSql($certificate['public_key']);
mysqli_query($mysqli,"INSERT INTO certificates SET certificate_name = '$name', certificate_domain = '$name', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_public_key = '$public_key', certificate_domain_id = $domain_id, certificate_client_id = $client_id"); mysqli_query($mysqli,"INSERT INTO certificates SET certificate_name = '$name', certificate_domain = '$name', certificate_issued_by = '$issued_by', certificate_expire = '$expire', certificate_public_key = '$public_key', certificate_domain_id = $domain_id, certificate_client_id = $client_id");
$extended_log_description = ', with associated SSL cert'; $extended_log_description = ', with associated SSL cert';
@@ -95,11 +95,11 @@ if (isset($_POST['edit_domain'])) {
// Update NS, MX, A and WHOIS records/data // Update NS, MX, A and WHOIS records/data
$records = getDomainRecords($name); $records = getDomainRecords($name);
$a = sanitizeInput($records['a']); $a = escapeSql($records['a']);
$ns = sanitizeInput($records['ns']); $ns = escapeSql($records['ns']);
$mx = sanitizeInput($records['mx']); $mx = escapeSql($records['mx']);
$txt = sanitizeInput($records['txt']); $txt = escapeSql($records['txt']);
$whois = sanitizeInput($records['whois']); $whois = escapeSql($records['whois']);
// Current domain info // Current domain info
$original_domain_info = mysqli_fetch_assoc(mysqli_query($mysqli," $original_domain_info = mysqli_fetch_assoc(mysqli_query($mysqli,"
@@ -141,9 +141,9 @@ if (isset($_POST['edit_domain'])) {
foreach ($original_domain_info as $column => $old_value) { foreach ($original_domain_info as $column => $old_value) {
$new_value = $new_domain_info[$column]; $new_value = $new_domain_info[$column];
if ($old_value != $new_value && !in_array($column, $ignored_columns)) { if ($old_value != $new_value && !in_array($column, $ignored_columns)) {
$column = sanitizeInput($column); $column = escapeSql($column);
$old_value = sanitizeInput($old_value); $old_value = escapeSql($old_value);
$new_value = sanitizeInput($new_value); $new_value = escapeSql($new_value);
mysqli_query($mysqli,"INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id"); mysqli_query($mysqli,"INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id");
} }
} }
@@ -167,7 +167,7 @@ if (isset($_GET['archive_domain'])) {
//Get domain Name //Get domain Name
$sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id"); $sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']); $domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']); $client_id = intval($row['domain_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -193,7 +193,7 @@ if(isset($_GET['restore_domain'])){
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']); $domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']); $client_id = intval($row['domain_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -219,7 +219,7 @@ if (isset($_GET['delete_domain'])) {
// Get Domain Name and Client ID for logging and alert message // Get Domain Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']); $domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']); $client_id = intval($row['domain_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -253,7 +253,7 @@ if (isset($_POST['bulk_archive_domains'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']); $domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']); $client_id = intval($row['domain_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -292,7 +292,7 @@ if (isset($_POST['bulk_restore_domains'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']); $domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']); $client_id = intval($row['domain_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -332,7 +332,7 @@ if (isset($_POST['bulk_delete_domains'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$domain_name = sanitizeInput($row['domain_name']); $domain_name = escapeSql($row['domain_name']);
$client_id = intval($row['domain_client_id']); $client_id = intval($row['domain_client_id']);
enforceClientAccess(); enforceClientAccess();

8
agent/post/domain_model.php
View File

@@ -1,11 +1,11 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = preg_replace("(^https?://)", "", sanitizeInput($_POST['name'])); $name = preg_replace("(^https?://)", "", escapeSql($_POST['name']));
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$registrar = intval($_POST['registrar'] ?? 0); $registrar = intval($_POST['registrar'] ?? 0);
$dnshost = intval($_POST['dnshost'] ?? 0); $dnshost = intval($_POST['dnshost'] ?? 0);
$webhost = intval($_POST['webhost'] ?? 0); $webhost = intval($_POST['webhost'] ?? 0);
$mailhost = intval($_POST['mailhost'] ?? 0); $mailhost = intval($_POST['mailhost'] ?? 0);
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);

74
agent/post/event.php
View File

@@ -10,8 +10,8 @@ if (isset($_POST['add_calendar'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);
mysqli_query($mysqli,"INSERT INTO calendars SET calendar_name = '$name', calendar_color = '$color'"); mysqli_query($mysqli,"INSERT INTO calendars SET calendar_name = '$name', calendar_color = '$color'");
@@ -30,8 +30,8 @@ if (isset($_POST['edit_calendar'])) {
validateCSRFToken($_POST['csrf_token']); validateCSRFToken($_POST['csrf_token']);
$calendar_id = intval($_POST['calendar_id']); $calendar_id = intval($_POST['calendar_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);
mysqli_query($mysqli,"UPDATE calendars SET calendar_name = '$name', calendar_color = '$color' WHERE calendar_id = $calendar_id"); mysqli_query($mysqli,"UPDATE calendars SET calendar_name = '$name', calendar_color = '$color' WHERE calendar_id = $calendar_id");
@@ -52,7 +52,7 @@ if (isset($_GET['delete_calendar'])) {
// Get Calendar Name // Get Calendar Name
$sql = mysqli_query($mysqli,"SELECT * FROM calendars WHERE calendar_id = $calendar_id"); $sql = mysqli_query($mysqli,"SELECT * FROM calendars WHERE calendar_id = $calendar_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$calendar_name = sanitizeInput($row['calendar_name']); $calendar_name = escapeSql($row['calendar_name']);
// Delete Calendar // Delete Calendar
mysqli_query($mysqli,"DELETE FROM calendars WHERE calendar_id = $calendar_id"); mysqli_query($mysqli,"DELETE FROM calendars WHERE calendar_id = $calendar_id");
@@ -84,33 +84,33 @@ if (isset($_POST['add_event'])) {
$event_id = mysqli_insert_id($mysqli); $event_id = mysqli_insert_id($mysqli);
// Get Calendar Name // Get Calendar Name
$calendar_name = sanitizeInput(getFieldById('calendars', $calendar_id, 'calendar_name')); $calendar_name = escapeSql(getFieldById('calendars', $calendar_id, 'calendar_name'));
//If email is checked //If email is checked
if ($email_event == 1) { if ($email_event == 1) {
$sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id"); $sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id");
$row = mysqli_fetch_assoc($sql_client); $row = mysqli_fetch_assoc($sql_client);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company); $row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']); $company_logo = escapeSql($row['company_logo']);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name); $config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email); $config_mail_from_email = escapeSql($config_mail_from_email);
$subject = "New Calendar Event"; $subject = "New Calendar Event";
$body = "Hello $contact_name,<br><br>A calendar event has been scheduled:<br><br>Event Title: $title<br>Event Date: $start<br><br><br>--<br>$company_name<br>$company_phone"; $body = "Hello $contact_name,<br><br>A calendar event has been scheduled:<br><br>Event Title: $title<br>Event Date: $start<br><br><br>--<br>$company_name<br>$company_phone";
@@ -165,26 +165,26 @@ if (isset($_POST['edit_event'])) {
$sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id"); $sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id");
$row = mysqli_fetch_assoc($sql_client); $row = mysqli_fetch_assoc($sql_client);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company); $row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']); $company_logo = escapeSql($row['company_logo']);
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_mail_from_name = sanitizeInput($config_mail_from_name); $config_mail_from_name = escapeSql($config_mail_from_name);
$config_mail_from_email = sanitizeInput($config_mail_from_email); $config_mail_from_email = escapeSql($config_mail_from_email);
$subject = "Calendar Event Rescheduled"; $subject = "Calendar Event Rescheduled";
@@ -228,7 +228,7 @@ if (isset($_GET['delete_event'])) {
// Get Event Title // Get Event Title
$sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id"); $sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$event_title = sanitizeInput($row['event_title']); $event_title = escapeSql($row['event_title']);
$client_id = intval($row['event_client_id']); $client_id = intval($row['event_client_id']);
// Don't Enforce Client Access if Calendar event doesn't have a client // Don't Enforce Client Access if Calendar event doesn't have a client

12
agent/post/event_model.php
View File

@@ -2,11 +2,11 @@
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$calendar_id = intval($_POST['calendar']); $calendar_id = intval($_POST['calendar']);
$title = sanitizeInput($_POST['title']); $title = escapeSql($_POST['title']);
$location = sanitizeInput($_POST['location']); $location = escapeSql($_POST['location']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$start = sanitizeInput($_POST['start']); $start = escapeSql($_POST['start']);
$end = sanitizeInput($_POST['end']); $end = escapeSql($_POST['end']);
$repeat = sanitizeInput($_POST['repeat'] ?? 0); $repeat = escapeSql($_POST['repeat'] ?? 0);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$email_event = intval($_POST['email_event'] ?? 0); $email_event = intval($_POST['email_event'] ?? 0);

26
agent/post/expense.php
View File

@@ -64,7 +64,7 @@ if (isset($_POST['edit_expense'])) {
$expense_id = intval($_POST['expense_id']); $expense_id = intval($_POST['expense_id']);
// Get old receipt // Get old receipt
$existing_file_name = sanitizeInput(getFieldById('expenses', $expense_id, 'expense_receipt')); $existing_file_name = escapeSql(getFieldById('expenses', $expense_id, 'expense_receipt'));
// Check for and process attachment // Check for and process attachment
$extended_alert_description = ''; $extended_alert_description = '';
@@ -106,8 +106,8 @@ if (isset($_GET['delete_expense'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id"); $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$expense_receipt = sanitizeInput($row['expense_receipt']); $expense_receipt = escapeSql($row['expense_receipt']);
$expense_description = sanitizeInput($row['expense_description']); $expense_description = escapeSql($row['expense_description']);
$client_id = intval($row['expense_client_id']); $client_id = intval($row['expense_client_id']);
if ($client_id) { if ($client_id) {
@@ -135,7 +135,7 @@ if (isset($_POST['bulk_edit_expense_category'])) {
$category_id = intval($_POST['bulk_category_id']); $category_id = intval($_POST['bulk_category_id']);
// Get Category name for logging and Notification // Get Category name for logging and Notification
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
// Assign category to Selected Expenses // Assign category to Selected Expenses
if (isset($_POST['expense_ids'])) { if (isset($_POST['expense_ids'])) {
@@ -149,7 +149,7 @@ if (isset($_POST['bulk_edit_expense_category'])) {
// Get Expense Details for Logging // Get Expense Details for Logging
$sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id"); $sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$expense_description = sanitizeInput($row['expense_description']); $expense_description = escapeSql($row['expense_description']);
$client_id = intval($row['expense_client_id']); $client_id = intval($row['expense_client_id']);
if ($client_id) { if ($client_id) {
@@ -180,7 +180,7 @@ if (isset($_POST['bulk_edit_expense_account'])) {
$account_id = intval($_POST['bulk_account_id']); $account_id = intval($_POST['bulk_account_id']);
// Get Account name for logging and Notification // Get Account name for logging and Notification
$account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name')); $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name'));
// Assign account to Selected Expenses // Assign account to Selected Expenses
if (isset($_POST['expense_ids'])) { if (isset($_POST['expense_ids'])) {
@@ -194,7 +194,7 @@ if (isset($_POST['bulk_edit_expense_account'])) {
// Get Expense Details for Logging // Get Expense Details for Logging
$sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id"); $sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$expense_description = sanitizeInput($row['expense_description']); $expense_description = escapeSql($row['expense_description']);
$client_id = intval($row['expense_client_id']); $client_id = intval($row['expense_client_id']);
if ($client_id) { if ($client_id) {
@@ -227,7 +227,7 @@ if (isset($_POST['bulk_edit_expense_client'])) {
enforceClientAccess(); enforceClientAccess();
// Get Client name for logging and Notification // Get Client name for logging and Notification
$client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name')); $client_name = escapeSql(getFieldById('clients', $client_id, 'client_name'));
// Assign Client to Selected Expenses // Assign Client to Selected Expenses
if (isset($_POST['expense_ids'])) { if (isset($_POST['expense_ids'])) {
@@ -239,7 +239,7 @@ if (isset($_POST['bulk_edit_expense_client'])) {
$expense_id = intval($expense_id); $expense_id = intval($expense_id);
// Get Expense Details for Logging // Get Expense Details for Logging
$expense_description = sanitizeInput(getFieldById('expenses', $expense_id, 'expense_description')); $expense_description = escapeSql(getFieldById('expenses', $expense_id, 'expense_description'));
mysqli_query($mysqli,"UPDATE expenses SET expense_client_id = $client_id WHERE expense_id = $expense_id"); mysqli_query($mysqli,"UPDATE expenses SET expense_client_id = $client_id WHERE expense_id = $expense_id");
@@ -272,8 +272,8 @@ if (isset($_POST['bulk_delete_expenses'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id"); $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$expense_description = sanitizeInput($row['expense_description']); $expense_description = escapeSql($row['expense_description']);
$expense_receipt = sanitizeInput($row['expense_receipt']); $expense_receipt = escapeSql($row['expense_receipt']);
$client_id = intval($row['expense_client_id']); $client_id = intval($row['expense_client_id']);
if ($client_id) { if ($client_id) {
@@ -304,8 +304,8 @@ if (isset($_POST['export_expenses_csv'])) {
enforceUserPermission('module_financial'); enforceUserPermission('module_financial');
$date_from = sanitizeInput($_POST['date_from']); $date_from = escapeSql($_POST['date_from']);
$date_to = sanitizeInput($_POST['date_to']); $date_to = escapeSql($_POST['date_to']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$vendor = intval($_POST['vendor']); $vendor = intval($_POST['vendor']);
$category = intval($_POST['category']); $category = intval($_POST['category']);

6
agent/post/expense_model.php
View File

@@ -1,11 +1,11 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$vendor = intval($_POST['vendor']); $vendor = intval($_POST['vendor']);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);

52
agent/post/file.php
View File

@@ -15,7 +15,7 @@ if (isset($_POST['upload_files'])) {
// Sanitize and initialize inputs // Sanitize and initialize inputs
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$folder_id = intval($_POST['folder_id']); $folder_id = intval($_POST['folder_id']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$contact_id = intval($_POST['contact_id'] ?? 0); $contact_id = intval($_POST['contact_id'] ?? 0);
$asset_id = intval($_POST['asset_id'] ?? 0); $asset_id = intval($_POST['asset_id'] ?? 0);
$client_dir = "../uploads/clients/$client_id"; $client_dir = "../uploads/clients/$client_id";
@@ -52,10 +52,10 @@ if (isset($_POST['upload_files'])) {
if ($file_reference_name = checkFileUpload($single_file, $allowedExtensions)) { if ($file_reference_name = checkFileUpload($single_file, $allowedExtensions)) {
$file_tmp_path = $single_file['tmp_name']; $file_tmp_path = $single_file['tmp_name'];
$file_name = sanitizeInput($originalName); $file_name = escapeSql($originalName);
$extParts = explode('.', $file_name); $extParts = explode('.', $file_name);
$file_extension = strtolower(end($extParts)); $file_extension = strtolower(end($extParts));
$file_mime_type = sanitizeInput($single_file['type']); $file_mime_type = escapeSql($single_file['type']);
$file_size = intval($single_file['size']); $file_size = intval($single_file['size']);
// Define destination path and move the uploaded file // Define destination path and move the uploaded file
@@ -110,13 +110,13 @@ if (isset($_POST['rename_file'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$file_id = intval($_POST['file_id']); $file_id = intval($_POST['file_id']);
$file_name = sanitizeInput($_POST['file_name']); $file_name = escapeSql($_POST['file_name']);
$file_description = sanitizeInput($_POST['file_description']); $file_description = escapeSql($_POST['file_description']);
// Get File Details Client ID for Logging // Get File Details Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$old_file_name = sanitizeInput($row['file_name']); $old_file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -144,13 +144,13 @@ if (isset($_POST['move_file'])) {
// Get File Name and Client ID for Logging // Get File Name and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Folder Name for Logging // Get Folder Name for Logging
$folder_name = sanitizeInput(getFieldById('folders', $folder_id, 'folder_name')); $folder_name = escapeSql(getFieldById('folders', $folder_id, 'folder_name'));
mysqli_query($mysqli,"UPDATE files SET file_folder_id = $folder_id WHERE file_id = $file_id"); mysqli_query($mysqli,"UPDATE files SET file_folder_id = $folder_id WHERE file_id = $file_id");
@@ -173,7 +173,7 @@ if (isset($_GET['archive_file'])) {
// Get Contact Name and Client ID for logging and alert message // Get Contact Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -199,7 +199,7 @@ if (isset($_GET['restore_file'])) {
// Get Document Name and Client ID for logging and alert message // Get Document Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -225,8 +225,8 @@ if (isset($_POST['delete_file'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$file_reference_name = sanitizeInput($row['file_reference_name']); $file_reference_name = escapeSql($row['file_reference_name']);
$file_has_thumbnail = intval($row['file_has_thumbnail']); $file_has_thumbnail = intval($row['file_has_thumbnail']);
$file_has_preview = intval($row['file_has_preview']); $file_has_preview = intval($row['file_has_preview']);
@@ -270,7 +270,7 @@ if (isset($_POST['bulk_archive_files'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
enforceClientAccess(); enforceClientAccess();
@@ -293,7 +293,7 @@ if (isset($_POST['bulk_archive_files'])) {
// Get document name for logging // Get document name for logging
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -333,8 +333,8 @@ if (isset($_POST['bulk_delete_files'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$file_reference_name = sanitizeInput($row['file_reference_name']); $file_reference_name = escapeSql($row['file_reference_name']);
$file_has_thumbnail = intval($row['file_has_thumbnail']); $file_has_thumbnail = intval($row['file_has_thumbnail']);
$file_has_preview = intval($row['file_has_preview']); $file_has_preview = intval($row['file_has_preview']);
@@ -369,7 +369,7 @@ if (isset($_POST['bulk_delete_files'])) {
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
enforceClientAccess(); enforceClientAccess();
@@ -414,7 +414,7 @@ if (isset($_POST['bulk_restore_files'])) {
$sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id"); $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql_file); $row = mysqli_fetch_assoc($sql_file);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
enforceClientAccess(); enforceClientAccess();
@@ -437,7 +437,7 @@ if (isset($_POST['bulk_restore_files'])) {
// Get document name for logging // Get document name for logging
$sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$document_name = sanitizeInput($row['document_name']); $document_name = escapeSql($row['document_name']);
$client_id = intval($row['document_client_id']); $client_id = intval($row['document_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -475,7 +475,7 @@ if (isset($_POST['bulk_move_files'])) {
if ($folder_id > 0) { if ($folder_id > 0) {
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
if ($row = mysqli_fetch_assoc($sql)) { if ($row = mysqli_fetch_assoc($sql)) {
$folder_name = sanitizeInput($row['folder_name']); $folder_name = escapeSql($row['folder_name']);
$log_client_id = intval($row['folder_client_id']); $log_client_id = intval($row['folder_client_id']);
} }
} }
@@ -494,7 +494,7 @@ if (isset($_POST['bulk_move_files'])) {
foreach ($file_ids as $file_id) { foreach ($file_ids as $file_id) {
// Get file name for logging // Get file name for logging
$file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name')); $file_name = escapeSql(getFieldById('files', $file_id, 'file_name'));
$client_id = intval(getFieldById('files', $file_id, 'file_client_id')); $client_id = intval(getFieldById('files', $file_id, 'file_client_id'));
enforceClientAccess(); enforceClientAccess();
@@ -532,7 +532,7 @@ if (isset($_POST['bulk_move_files'])) {
foreach ($document_ids as $document_id) { foreach ($document_ids as $document_id) {
// Get document name for logging // Get document name for logging
$document_name = sanitizeInput(getFieldById('documents', $document_id, 'document_name')); $document_name = escapeSql(getFieldById('documents', $document_id, 'document_name'));
$client_id = intval(getFieldById('documents', $document_id, 'document_client_id')); $client_id = intval(getFieldById('documents', $document_id, 'document_client_id'));
enforceClientAccess(); enforceClientAccess();
@@ -588,13 +588,13 @@ if (isset($_POST['link_asset_to_file'])) {
// Get File Name and Client ID for Logging // Get File Name and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for Logging // Get Asset Name for Logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
// Contact add query // Contact add query
mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id"); mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id");
@@ -619,13 +619,13 @@ if (isset($_GET['unlink_asset_from_file'])) {
// Get File Name and Client ID for Logging // Get File Name and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$file_name = sanitizeInput($row['file_name']); $file_name = escapeSql($row['file_name']);
$client_id = intval($row['file_client_id']); $client_id = intval($row['file_client_id']);
enforceClientAccess(); enforceClientAccess();
// Get Asset Name for Logging // Get Asset Name for Logging
$asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name'));
mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id"); mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id");

8
agent/post/folder.php
View File

@@ -14,7 +14,7 @@ if (isset($_POST['create_folder'])) {
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$folder_location = intval($_POST['folder_location']); $folder_location = intval($_POST['folder_location']);
$folder_name = sanitizeInput($_POST['folder_name']); $folder_name = escapeSql($_POST['folder_name']);
$parent_folder = intval($_POST['parent_folder']); $parent_folder = intval($_POST['parent_folder']);
enforceClientAccess(); enforceClientAccess();
@@ -38,12 +38,12 @@ if (isset($_POST['rename_folder'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$folder_id = intval($_POST['folder_id']); $folder_id = intval($_POST['folder_id']);
$folder_name = sanitizeInput($_POST['folder_name']); $folder_name = escapeSql($_POST['folder_name']);
// Get old Folder Name Client ID for Logging // Get old Folder Name Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$old_folder_name = sanitizeInput($row['folder_name']); $old_folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']); $client_id = intval($row['folder_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -70,7 +70,7 @@ if (isset($_GET['delete_folder'])) {
// Get Folder Name Client ID for Logging // Get Folder Name Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$folder_name = sanitizeInput($row['folder_name']); $folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']); $client_id = intval($row['folder_client_id']);
enforceClientAccess(); enforceClientAccess();

106
agent/post/invoice.php
View File

@@ -62,12 +62,12 @@ if (isset($_POST['edit_invoice'])) {
require_once 'invoice_model.php'; require_once 'invoice_model.php';
$invoice_id = intval($_POST['invoice_id']); $invoice_id = intval($_POST['invoice_id']);
$due = sanitizeInput($_POST['due']); $due = escapeSql($_POST['due']);
// Get Invoice Number and Prefix and Client ID for Logging // Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -100,20 +100,20 @@ if (isset($_POST['add_invoice_copy'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']); $invoice_id = intval($_POST['invoice_id']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
//Get Net Terms //Get Net Terms
$sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_net_terms = intval($row['client_net_terms']); $client_net_terms = intval($row['client_net_terms']);
$invoice_scope = sanitizeInput($row['invoice_scope']); $invoice_scope = escapeSql($row['invoice_scope']);
$invoice_discount_amount = floatval($row['invoice_discount_amount']); $invoice_discount_amount = floatval($row['invoice_discount_amount']);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']); $invoice_currency_code = escapeSql($row['invoice_currency_code']);
$invoice_note = sanitizeInput($row['invoice_note']); $invoice_note = escapeSql($row['invoice_note']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
$category_id = intval($row['invoice_category_id']); $category_id = intval($row['invoice_category_id']);
$old_invoice_prefix = sanitizeInput($row['invoice_prefix']); $old_invoice_prefix = escapeSql($row['invoice_prefix']);
$old_invoice_number = intval($row['invoice_number']); $old_invoice_number = intval($row['invoice_number']);
enforceClientAccess(); enforceClientAccess();
@@ -141,8 +141,8 @@ if (isset($_POST['add_invoice_copy'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id"); $sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
while($row = mysqli_fetch_assoc($sql_items)) { while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']); $item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_description = sanitizeInput($row['item_description']); $item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']); $item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']); $item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
@@ -175,7 +175,7 @@ if (isset($_GET['mark_invoice_sent'])) {
// Get Invoice Number and Prefix and Client ID for Logging // Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -204,7 +204,7 @@ if (isset($_GET['mark_invoice_non-billable'])) {
// Get Invoice Number and Prefix and Client ID for Logging // Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -233,7 +233,7 @@ if (isset($_GET['cancel_invoice'])) {
// Get Invoice Number and Prefix and Client ID for Logging // Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -262,7 +262,7 @@ if (isset($_GET['delete_invoice'])) {
// Get Invoice Number and Prefix and Client ID for Logging // Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -309,8 +309,8 @@ if (isset($_POST['add_invoice_item'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']); $invoice_id = intval($_POST['invoice_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']); $qty = floatval($_POST['qty']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
@@ -326,7 +326,7 @@ if (isset($_POST['add_invoice_item'])) {
// Update Product Inventory // Update Product Inventory
if ($product_id) { if ($product_id) {
// Only enforce stock for tangible products // Only enforce stock for tangible products
$product_type = sanitizeInput(getFieldById('products', $product_id, 'product_type')); $product_type = escapeSql(getFieldById('products', $product_id, 'product_type'));
if ($product_type === 'product') { if ($product_type === 'product') {
// Current available stock // Current available stock
@@ -367,7 +367,7 @@ if (isset($_POST['add_invoice_item'])) {
// Get Discount and Invoice Details // Get Discount and Invoice Details
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_discount = floatval($row['invoice_discount_amount']); $invoice_discount = floatval($row['invoice_discount_amount']);
@@ -397,12 +397,12 @@ if (isset($_POST['invoice_note'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$invoice_id = intval($_POST['invoice_id']); $invoice_id = intval($_POST['invoice_id']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
// Get Invoice Details for logging // Get Invoice Details for logging
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -425,8 +425,8 @@ if (isset($_POST['edit_invoice_item'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$item_id = intval($_POST['item_id']); $item_id = intval($_POST['item_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']); $qty = floatval($_POST['qty']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
@@ -453,7 +453,7 @@ if (isset($_POST['edit_invoice_item'])) {
//Get Discount Amount //Get Discount Amount
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
$invoice_discount = floatval($row['invoice_discount_amount']); $invoice_discount = floatval($row['invoice_discount_amount']);
@@ -488,7 +488,7 @@ if (isset($_GET['delete_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_id = intval($row['item_invoice_id']); $invoice_id = intval($row['item_invoice_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_quantity = floatval($row['item_quantity']); $item_quantity = floatval($row['item_quantity']);
$item_product_id = intval($row['item_product_id']); $item_product_id = intval($row['item_product_id']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
@@ -497,7 +497,7 @@ if (isset($_GET['delete_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -538,39 +538,39 @@ if (isset($_GET['email_invoice'])) {
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_id = intval($row['invoice_id']); $invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']); $invoice_scope = escapeSql($row['invoice_scope']);
$invoice_status = sanitizeInput($row['invoice_status']); $invoice_status = escapeSql($row['invoice_status']);
$invoice_date = sanitizeInput(validateDate($row['invoice_date'])); $invoice_date = escapeSql(validateDate($row['invoice_date']));
$invoice_due = sanitizeInput(validateDate($row['invoice_due'])); $invoice_due = escapeSql(validateDate($row['invoice_due']));
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']); $invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']); $invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']); $client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
enforceClientAccess(); enforceClientAccess();
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']); $company_logo = escapeSql($row['company_logo']);
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name); $config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email); $config_invoice_from_email = escapeSql($config_invoice_from_email);
$sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payment_id DESC"); $sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payment_id DESC");
@@ -628,8 +628,8 @@ if (isset($_GET['email_invoice'])) {
$data = []; $data = [];
while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) { while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) {
$billing_contact_name = sanitizeInput($billing_contact['contact_name']); $billing_contact_name = escapeSql($billing_contact['contact_name']);
$billing_contact_email = sanitizeInput($billing_contact['contact_email']); $billing_contact_email = escapeSql($billing_contact['contact_email']);
$data[] = [ $data[] = [
'from' => $config_invoice_from_email, 'from' => $config_invoice_from_email,
@@ -668,8 +668,8 @@ if (isset($_POST['export_invoices_csv'])) {
$file_name_prepend = "$session_company_name-"; $file_name_prepend = "$session_company_name-";
} }
$date_from = sanitizeInput($_POST['date_from']); $date_from = escapeSql($_POST['date_from']);
$date_to = sanitizeInput($_POST['date_to']); $date_to = escapeSql($_POST['date_to']);
if (!empty($date_from) && !empty($date_to)) { if (!empty($date_from) && !empty($date_to)) {
$date_query = "DATE(invoice_date) BETWEEN '$date_from' AND '$date_to'"; $date_query = "DATE(invoice_date) BETWEEN '$date_from' AND '$date_to'";
$file_name_date = "$date_from-to-$date_to"; $file_name_date = "$date_from-to-$date_to";
@@ -1145,7 +1145,7 @@ if (isset($_POST['bulk_edit_invoice_category'])) {
$category_id = intval($_POST['bulk_category_id']); $category_id = intval($_POST['bulk_category_id']);
// Get Category name for logging and Notification // Get Category name for logging and Notification
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
// Assign Income category to Selected Invoices // Assign Income category to Selected Invoices
if (isset($_POST['invoice_ids'])) { if (isset($_POST['invoice_ids'])) {
@@ -1159,9 +1159,9 @@ if (isset($_POST['bulk_edit_invoice_category'])) {
// Get Invoice Details for Logging // Get Invoice Details for Logging
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']); $invoice_scope = escapeSql($row['invoice_scope']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
enforceClientAccess(); enforceClientAccess();

6
agent/post/invoice_model.php
View File

@@ -1,10 +1,10 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']); $scope = escapeSql($_POST['scope']);
$invoice_discount = floatval($_POST['invoice_discount']); $invoice_discount = floatval($_POST['invoice_discount']);
$recurring_discount = floatval($_POST['recurring_discount']); $recurring_discount = floatval($_POST['recurring_discount']);
$config_invoice_prefix = sanitizeInput($config_invoice_prefix); $config_invoice_prefix = escapeSql($config_invoice_prefix);

30
agent/post/location.php
View File

@@ -77,7 +77,7 @@ if(isset($_POST['edit_location'])){
// Get old location photo // Get old location photo
$sql = mysqli_query($mysqli,"SELECT location_photo, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_photo, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$existing_file_name = sanitizeInput($row['location_photo']); $existing_file_name = escapeSql($row['location_photo']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -142,7 +142,7 @@ if(isset($_GET['archive_location'])){
// Get Location Name and Client ID for logging and alert message // Get Location Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -168,7 +168,7 @@ if(isset($_GET['restore_location'])){
// Get Location Name and Client ID for logging and alert message // Get Location Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -194,7 +194,7 @@ if(isset($_GET['delete_location'])){
// Get Location Name and Client ID for logging and alert message // Get Location Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -227,7 +227,7 @@ if (isset($_POST['bulk_assign_location_tags'])) {
// Get Contact Details for Logging // Get Contact Details for Logging
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -281,7 +281,7 @@ if (isset($_POST['bulk_archive_locations'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id, location_primary FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id, location_primary FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$location_primary = intval($row['location_primary']); $location_primary = intval($row['location_primary']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
@@ -327,7 +327,7 @@ if (isset($_POST['bulk_restore_locations'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -367,7 +367,7 @@ if (isset($_POST['bulk_delete_locations'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$location_name = sanitizeInput($row['location_name']); $location_name = escapeSql($row['location_name']);
$client_id = intval($row['location_client_id']); $client_id = intval($row['location_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -496,31 +496,31 @@ if (isset($_POST["import_locations_csv"])) {
while(($column = fgetcsv($file, 1000, ",")) !== false){ while(($column = fgetcsv($file, 1000, ",")) !== false){
$duplicate_detect = 0; $duplicate_detect = 0;
if(isset($column[0])){ if(isset($column[0])){
$name = sanitizeInput($column[0]); $name = escapeSql($column[0]);
if(mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$name' AND location_client_id = $client_id")) > 0){ if(mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$name' AND location_client_id = $client_id")) > 0){
$duplicate_detect = 1; $duplicate_detect = 1;
} }
} }
if(isset($column[1])){ if(isset($column[1])){
$description = sanitizeInput($column[1]); $description = escapeSql($column[1]);
} }
if(isset($column[2])){ if(isset($column[2])){
$address = sanitizeInput($column[2]); $address = escapeSql($column[2]);
} }
if(isset($column[3])){ if(isset($column[3])){
$city = sanitizeInput($column[3]); $city = escapeSql($column[3]);
} }
if(isset($column[4])){ if(isset($column[4])){
$state = sanitizeInput($column[4]); $state = escapeSql($column[4]);
} }
if(isset($column[5])){ if(isset($column[5])){
$zip = sanitizeInput($column[5]); $zip = escapeSql($column[5]);
} }
if(isset($column[6])){ if(isset($column[6])){
$phone = preg_replace("/[^0-9]/", '',$column[6]); $phone = preg_replace("/[^0-9]/", '',$column[6]);
} }
if(isset($column[7])){ if(isset($column[7])){
$hours = sanitizeInput($column[7]); $hours = escapeSql($column[7]);
} }
// Check if duplicate was detected // Check if duplicate was detected

18
agent/post/location_model.php
View File

@@ -1,19 +1,19 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$country = sanitizeInput($_POST['country']); $country = escapeSql($_POST['country']);
$address = sanitizeInput($_POST['address']); $address = escapeSql($_POST['address']);
$city = sanitizeInput($_POST['city']); $city = escapeSql($_POST['city']);
$state = sanitizeInput($_POST['state']); $state = escapeSql($_POST['state']);
$zip = sanitizeInput($_POST['zip']); $zip = escapeSql($_POST['zip']);
$phone = preg_replace("/[^0-9]/", '',$_POST['phone']); $phone = preg_replace("/[^0-9]/", '',$_POST['phone']);
$phone_country_code = preg_replace("/[^0-9]/", '',$_POST['phone_country_code']); $phone_country_code = preg_replace("/[^0-9]/", '',$_POST['phone_country_code']);
$extension = preg_replace("/[^0-9]/", '',$_POST['extension']); $extension = preg_replace("/[^0-9]/", '',$_POST['extension']);
$fax = preg_replace("/[^0-9]/", '',$_POST['fax']); $fax = preg_replace("/[^0-9]/", '',$_POST['fax']);
$fax_country_code = preg_replace("/[^0-9]/", '',$_POST['fax_country_code']); $fax_country_code = preg_replace("/[^0-9]/", '',$_POST['fax_country_code']);
$hours = sanitizeInput($_POST['hours']); $hours = escapeSql($_POST['hours']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$contact = intval($_POST['contact'] ?? 0); $contact = intval($_POST['contact'] ?? 0);
$location_primary = intval($_POST['location_primary'] ?? 0); $location_primary = intval($_POST['location_primary'] ?? 0);

22
agent/post/network.php
View File

@@ -65,7 +65,7 @@ if (isset($_GET['archive_network'])) {
// Get Network Name and Client ID for logging and alert message // Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id"); $sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']); $network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']); $client_id = intval($row['network_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -91,7 +91,7 @@ if (isset($_GET['restore_network'])) {
// Get Network Name and Client ID for logging and alert message // Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id"); $sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']); $network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']); $client_id = intval($row['network_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -117,7 +117,7 @@ if (isset($_GET['delete_network'])) {
// Get Network Name and Client ID for logging and alert message // Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id"); $sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']); $network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']); $client_id = intval($row['network_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -151,7 +151,7 @@ if (isset($_POST['bulk_delete_networks'])) {
// Get Network Name and Client ID for logging and alert message // Get Network Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id"); $sql = mysqli_query($mysqli,"SELECT network_name, network_client_id FROM networks WHERE network_id = $network_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$network_name = sanitizeInput($row['network_name']); $network_name = escapeSql($row['network_name']);
$client_id = intval($row['network_client_id']); $client_id = intval($row['network_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -324,14 +324,14 @@ if (isset($_POST['import_networks_csv'])) {
$duplicate_detect = 0; $duplicate_detect = 0;
$name = isset($column[0]) ? sanitizeInput($column[0]) : ''; $name = isset($column[0]) ? escapeSql($column[0]) : '';
$description = isset($column[1]) ? sanitizeInput($column[1]) : ''; $description = isset($column[1]) ? escapeSql($column[1]) : '';
$vlan = isset($column[2]) ? intval($column[2]) : 0; $vlan = isset($column[2]) ? intval($column[2]) : 0;
$network = isset($column[3]) ? sanitizeInput($column[3]) : ''; $network = isset($column[3]) ? escapeSql($column[3]) : '';
$gateway = isset($column[4]) ? sanitizeInput($column[4]) : ''; $gateway = isset($column[4]) ? escapeSql($column[4]) : '';
$dhcp_range = isset($column[5]) ? sanitizeInput($column[5]) : ''; $dhcp_range = isset($column[5]) ? escapeSql($column[5]) : '';
$primary_dns = isset($column[6]) ? sanitizeInput($column[6]) : ''; $primary_dns = isset($column[6]) ? escapeSql($column[6]) : '';
$secondary_dns = isset($column[7]) ? sanitizeInput($column[7]) : ''; $secondary_dns = isset($column[7]) ? escapeSql($column[7]) : '';
// Skip rows with no name // Skip rows with no name
if ($name === '') { if ($name === '') {

16
agent/post/network_model.php
View File

@@ -1,13 +1,13 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$vlan = intval($_POST['vlan']); $vlan = intval($_POST['vlan']);
$network = sanitizeInput($_POST['network']); $network = escapeSql($_POST['network']);
$gateway = sanitizeInput($_POST['gateway']); $gateway = escapeSql($_POST['gateway']);
$primary_dns = sanitizeInput($_POST['primary_dns']); $primary_dns = escapeSql($_POST['primary_dns']);
$secondary_dns = sanitizeInput($_POST['secondary_dns']); $secondary_dns = escapeSql($_POST['secondary_dns']);
$dhcp_range = sanitizeInput($_POST['dhcp_range']); $dhcp_range = escapeSql($_POST['dhcp_range']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$location_id = intval($_POST['location'] ?? 0); $location_id = intval($_POST['location'] ?? 0);

188
agent/post/payment.php
View File

@@ -15,12 +15,12 @@ if (isset($_POST['add_payment'])) {
$invoice_id = intval($_POST['invoice_id']); $invoice_id = intval($_POST['invoice_id']);
$balance = floatval($_POST['balance']); $balance = floatval($_POST['balance']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$currency_code = sanitizeInput($_POST['currency_code']); $currency_code = escapeSql($_POST['currency_code']);
$payment_method = sanitizeInput($_POST['payment_method']); $payment_method = escapeSql($_POST['payment_method']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
$email_receipt = intval($_POST['email_receipt']); $email_receipt = intval($_POST['email_receipt']);
$client_id = intval(getFieldById('invoices', $invoice_id, 'invoice_client_id')); $client_id = intval(getFieldById('invoices', $invoice_id, 'invoice_client_id'));
@@ -51,34 +51,34 @@ if (isset($_POST['add_payment'])) {
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']); $invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']); $invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']); $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']); $company_logo = escapeSql($row['company_logo']);
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name); $config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email); $config_invoice_from_email = escapeSql($config_invoice_from_email);
//Calculate the Invoice balance //Calculate the Invoice balance
$invoice_balance = $invoice_amount - $total_payments_amount; $invoice_balance = $invoice_amount - $total_payments_amount;
@@ -184,11 +184,11 @@ if (isset($_POST['edit_payment'])) {
enforceUserPermission('module_financial', 3); enforceUserPermission('module_financial', 3);
$payment_id = intval($_POST['payment_id']); $payment_id = intval($_POST['payment_id']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$payment_method = sanitizeInput($_POST['payment_method']); $payment_method = escapeSql($_POST['payment_method']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
$client_id = intval(getFieldById('payments', $payment_id, 'payment_client_id')); $client_id = intval(getFieldById('payments', $payment_id, 'payment_client_id'));
@@ -220,9 +220,9 @@ if (isset($_POST['apply_credit'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']); $invoice_status = escapeSql($row['invoice_status']);
$invoice_credit_amount = floatval($row['invoice_credit_amount']); $invoice_credit_amount = floatval($row['invoice_credit_amount']);
$invoice_amount = floatval('invoice_amount'); $invoice_amount = floatval('invoice_amount');
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
@@ -335,53 +335,53 @@ if (isset($_POST['add_payment_stripe'])) {
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']); $invoice_status = escapeSql($row['invoice_status']);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']); $invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']); $invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']); $client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']); $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
enforceClientAccess(); enforceClientAccess();
// Get ITFlow company details // Get ITFlow company details
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name); $config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email); $config_invoice_from_email = escapeSql($config_invoice_from_email);
// Get Client Payment Details // Get Client Payment Details
$sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1"); $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$public_key = sanitizeInput($row['payment_provider_public_key']); $public_key = escapeSql($row['payment_provider_public_key']);
$private_key = sanitizeInput($row['payment_provider_private_key']); $private_key = escapeSql($row['payment_provider_private_key']);
$account_id = intval($row['payment_provider_account']); $account_id = intval($row['payment_provider_account']);
$expense_category_id = intval($row['payment_provider_expense_category']); $expense_category_id = intval($row['payment_provider_expense_category']);
$expense_vendor_id = intval($row['payment_provider_expense_vendor']); $expense_vendor_id = intval($row['payment_provider_expense_vendor']);
$expense_percentage_fee = floatval($row['payment_provider_expense_percentage_fee']); $expense_percentage_fee = floatval($row['payment_provider_expense_percentage_fee']);
$expense_flat_fee = floatval($row['payment_provider_expense_flat_fee']); $expense_flat_fee = floatval($row['payment_provider_expense_flat_fee']);
$payment_provider_client = sanitizeInput($row['payment_provider_client']); $payment_provider_client = escapeSql($row['payment_provider_client']);
$saved_payment_method = sanitizeInput($row['saved_payment_provider_method']); $saved_payment_method = escapeSql($row['saved_payment_provider_method']);
$saved_payment_description = sanitizeInput($row['saved_payment_description']); $saved_payment_description = escapeSql($row['saved_payment_description']);
// Sanity checks // Sanity checks
if (!$payment_provider_client || !$saved_payment_method) { if (!$payment_provider_client || !$saved_payment_method) {
@@ -421,10 +421,10 @@ if (isset($_POST['add_payment_stripe'])) {
]); ]);
// Get details from PI // Get details from PI
$pi_id = sanitizeInput($payment_intent->id); $pi_id = escapeSql($payment_intent->id);
$pi_date = date('Y-m-d', $payment_intent->created); $pi_date = date('Y-m-d', $payment_intent->created);
$pi_amount_paid = floatval(($payment_intent->amount_received / 100)); $pi_amount_paid = floatval(($payment_intent->amount_received / 100));
$pi_currency = strtoupper(sanitizeInput($payment_intent->currency)); $pi_currency = strtoupper(escapeSql($payment_intent->currency));
$pi_livemode = $payment_intent->livemode; $pi_livemode = $payment_intent->livemode;
} catch (Exception $e) { } catch (Exception $e) {
@@ -532,41 +532,41 @@ if (isset($_GET['add_payment_stripe'])) {
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_status = sanitizeInput($row['invoice_status']); $invoice_status = escapeSql($row['invoice_status']);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']); $invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']); $invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']); $client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']); $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
// Get ITFlow company details // Get ITFlow company details
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name); $config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email); $config_invoice_from_email = escapeSql($config_invoice_from_email);
// Get Client Stripe details // Get Client Stripe details
$stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1")); $stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1"));
$stripe_id = sanitizeInput($stripe_client_details['stripe_id']); $stripe_id = escapeSql($stripe_client_details['stripe_id']);
$stripe_pm = sanitizeInput($stripe_client_details['stripe_pm']); $stripe_pm = escapeSql($stripe_client_details['stripe_pm']);
// Sanity checks // Sanity checks
if (!$config_stripe_enable || !$stripe_id || !$stripe_pm) { if (!$config_stripe_enable || !$stripe_id || !$stripe_pm) {
@@ -606,10 +606,10 @@ if (isset($_GET['add_payment_stripe'])) {
]); ]);
// Get details from PI // Get details from PI
$pi_id = sanitizeInput($payment_intent->id); $pi_id = escapeSql($payment_intent->id);
$pi_date = date('Y-m-d', $payment_intent->created); $pi_date = date('Y-m-d', $payment_intent->created);
$pi_amount_paid = floatval(($payment_intent->amount_received / 100)); $pi_amount_paid = floatval(($payment_intent->amount_received / 100));
$pi_currency = strtoupper(sanitizeInput($payment_intent->currency)); $pi_currency = strtoupper(escapeSql($payment_intent->currency));
$pi_livemode = $payment_intent->livemode; $pi_livemode = $payment_intent->livemode;
} catch (Exception $e) { } catch (Exception $e) {
@@ -708,14 +708,14 @@ if (isset($_POST['add_bulk_payment'])) {
enforceUserPermission('module_financial', 2); enforceUserPermission('module_financial', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$bulk_payment_amount = floatval($_POST['amount']); $bulk_payment_amount = floatval($_POST['amount']);
$bulk_payment_amount_static = floatval($_POST['amount']); $bulk_payment_amount_static = floatval($_POST['amount']);
$total_account_balance = floatval($_POST['balance']); $total_account_balance = floatval($_POST['balance']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$currency_code = sanitizeInput($_POST['currency_code']); $currency_code = escapeSql($_POST['currency_code']);
$payment_method = sanitizeInput($_POST['payment_method']); $payment_method = escapeSql($_POST['payment_method']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
$email_receipt = intval($_POST['email_receipt']); $email_receipt = intval($_POST['email_receipt']);
enforceClientAccess(); enforceClientAccess();
@@ -738,10 +738,10 @@ if (isset($_POST['add_bulk_payment'])) {
// Loop Through Each Invoice // Loop Through Each Invoice
while ($row = mysqli_fetch_assoc($result_invoices)) { while ($row = mysqli_fetch_assoc($result_invoices)) {
$invoice_id = intval($row['invoice_id']); $invoice_id = intval($row['invoice_id']);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']); $invoice_url_key = escapeSql($row['invoice_url_key']);
$invoice_balance_query = "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"; $invoice_balance_query = "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id";
$result_amount_paid = mysqli_query($mysqli, $invoice_balance_query); $result_amount_paid = mysqli_query($mysqli, $invoice_balance_query);
$row_amount_paid = mysqli_fetch_assoc($result_amount_paid); $row_amount_paid = mysqli_fetch_assoc($result_amount_paid);
@@ -798,19 +798,19 @@ if (isset($_POST['add_bulk_payment'])) {
); );
$row = mysqli_fetch_assoc($sql_client); $row = mysqli_fetch_assoc($sql_client);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$sql_company = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $sql_company = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql_company); $row = mysqli_fetch_assoc($sql_company);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_invoice_from_name = sanitizeInput($config_invoice_from_name); $config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = sanitizeInput($config_invoice_from_email); $config_invoice_from_email = escapeSql($config_invoice_from_email);
$subject = "Payment Received - Multiple Invoices"; $subject = "Payment Received - Multiple Invoices";
$body = "Hello $contact_name,<br><br>Thank you for your payment of " . numfmt_format_currency($currency_format, $bulk_payment_amount_static, $currency_code) . " We\'ve applied your payment to the following invoices, updating their balances accordingly:<br><br>$email_body_invoices<br><br><br>We appreciate your continued business!<br><br>Sincerely,<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone"; $body = "Hello $contact_name,<br><br>Thank you for your payment of " . numfmt_format_currency($currency_format, $bulk_payment_amount_static, $currency_code) . " We\'ve applied your payment to the following invoices, updating their balances accordingly:<br><br>$email_body_invoices<br><br><br>We appreciate your continued business!<br><br>Sincerely,<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone";
@@ -861,7 +861,7 @@ if (isset($_GET['delete_payment'])) {
// Get the invoice total and details // Get the invoice total and details
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);

22
agent/post/product.php
View File

@@ -13,7 +13,7 @@ if (isset($_POST['add_product'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
require_once 'product_model.php'; require_once 'product_model.php';
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
mysqli_query($mysqli,"INSERT INTO products SET product_name = '$name', product_type = '$type', product_description = '$description', product_code = '$code', product_location = '$location', product_price = '$price', product_currency_code = '$session_company_currency', product_tax_id = $tax, product_category_id = $category"); mysqli_query($mysqli,"INSERT INTO products SET product_name = '$name', product_type = '$type', product_description = '$description', product_code = '$code', product_location = '$location', product_price = '$price', product_currency_code = '$session_company_currency', product_tax_id = $tax, product_category_id = $category");
@@ -55,7 +55,7 @@ if (isset($_GET['archive_product'])) {
$product_id = intval($_GET['archive_product']); $product_id = intval($_GET['archive_product']);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id"); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id");
@@ -75,7 +75,7 @@ if (isset($_GET['restore_product'])) {
$product_id = intval($_GET['restore_product']); $product_id = intval($_GET['restore_product']);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id"); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id");
@@ -96,7 +96,7 @@ if (isset($_GET['delete_product'])) {
$product_id = intval($_GET['delete_product']); $product_id = intval($_GET['delete_product']);
//Get Product Name //Get Product Name
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"DELETE FROM products WHERE product_id = $product_id"); mysqli_query($mysqli,"DELETE FROM products WHERE product_id = $product_id");
@@ -117,7 +117,7 @@ if (isset($_POST['bulk_edit_product_category'])) {
$category_id = intval($_POST['bulk_category_id']); $category_id = intval($_POST['bulk_category_id']);
// Get Category name for logging and Notification // Get Category name for logging and Notification
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
// Assign category to Selected Products // Assign category to Selected Products
if (isset($_POST['product_ids'])) { if (isset($_POST['product_ids'])) {
@@ -129,7 +129,7 @@ if (isset($_POST['bulk_edit_product_category'])) {
$product_id = intval($product_id); $product_id = intval($product_id);
// Get Product Details for Logging // Get Product Details for Logging
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_category_id = $category_id WHERE product_id = $product_id"); mysqli_query($mysqli,"UPDATE products SET product_category_id = $category_id WHERE product_id = $product_id");
@@ -161,7 +161,7 @@ if (isset($_POST['bulk_archive_products'])) {
$product_id = intval($product_id); $product_id = intval($product_id);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id"); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id");
@@ -193,7 +193,7 @@ if (isset($_POST['bulk_restore_products'])) {
$product_id = intval($product_id); $product_id = intval($product_id);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id"); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id");
@@ -226,7 +226,7 @@ if (isset($_POST['bulk_delete_products'])) {
foreach ($_POST['product_ids'] as $product_id) { foreach ($_POST['product_ids'] as $product_id) {
$product_id = intval($product_id); $product_id = intval($product_id);
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli, "DELETE FROM products WHERE product_id = $product_id"); mysqli_query($mysqli, "DELETE FROM products WHERE product_id = $product_id");
@@ -298,10 +298,10 @@ if (isset($_POST['add_product_stock'])) {
$product_id = intval($_POST['product_id']); $product_id = intval($_POST['product_id']);
$qty = intval($_POST['qty']); $qty = intval($_POST['qty']);
$expense = intval($_POST['expense']); $expense = intval($_POST['expense']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
// Get product name // Get product name
$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); $product_name = escapeSql(getFieldById('products', $product_id, 'product_name'));
mysqli_query($mysqli,"INSERT INTO product_stock SET stock_qty = $qty, stock_expense_id = $expense, stock_note = '$note', stock_product_id = $product_id"); mysqli_query($mysqli,"INSERT INTO product_stock SET stock_qty = $qty, stock_expense_id = $expense, stock_note = '$note', stock_product_id = $product_id");

8
agent/post/product_model.php
View File

@@ -1,10 +1,10 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$code = sanitizeInput($_POST['code']); $code = escapeSql($_POST['code']);
$location = sanitizeInput($_POST['location']); $location = escapeSql($_POST['location']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$tax = intval($_POST['tax']); $tax = intval($_POST['tax']);

42
agent/post/project.php
View File

@@ -12,9 +12,9 @@ if (isset($_POST['add_project'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$project_name = sanitizeInput($_POST['name']); $project_name = escapeSql($_POST['name']);
$project_description = sanitizeInput($_POST['description']); $project_description = escapeSql($_POST['description']);
$due_date = sanitizeInput($_POST['due_date']); $due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']); $project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$project_template_id = intval($_POST['project_template_id']); $project_template_id = intval($_POST['project_template_id']);
@@ -25,7 +25,7 @@ if (isset($_POST['add_project'])) {
} }
// Sanitize Project Prefix // Sanitize Project Prefix
$config_project_prefix = sanitizeInput($config_project_prefix); $config_project_prefix = escapeSql($config_project_prefix);
// Atomically increment and get the new project number // Atomically increment and get the new project number
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -53,7 +53,7 @@ if (isset($_POST['add_project'])) {
while ($row = mysqli_fetch_assoc($sql_ticket_templates)) { while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
$ticket_template_id = intval($row['ticket_template_id']); $ticket_template_id = intval($row['ticket_template_id']);
$ticket_template_order = intval($row['ticket_template_order']); $ticket_template_order = intval($row['ticket_template_order']);
$ticket_template_subject = sanitizeInput($row['ticket_template_subject']); $ticket_template_subject = escapeSql($row['ticket_template_subject']);
$ticket_template_details = mysqli_escape_string($mysqli, $row['ticket_template_details']); $ticket_template_details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
// Atomically increment and get the new ticket number // Atomically increment and get the new ticket number
@@ -79,7 +79,7 @@ if (isset($_POST['add_project'])) {
while ($row = mysqli_fetch_assoc($sql_task_templates)) { while ($row = mysqli_fetch_assoc($sql_task_templates)) {
$task_template_id = intval($row['task_template_id']); $task_template_id = intval($row['task_template_id']);
$task_template_order = intval($row['task_template_order']); $task_template_order = intval($row['task_template_order']);
$task_template_name = sanitizeInput($row['task_template_name']); $task_template_name = escapeSql($row['task_template_name']);
mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_template_name', task_order = $task_template_order, task_ticket_id = $ticket_id"); mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_template_name', task_order = $task_template_order, task_ticket_id = $ticket_id");
} // End task Loop } // End task Loop
@@ -101,9 +101,9 @@ if (isset($_POST['edit_project'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$project_id = intval($_POST['project_id']); $project_id = intval($_POST['project_id']);
$project_name = sanitizeInput($_POST['name']); $project_name = escapeSql($_POST['name']);
$project_description = sanitizeInput($_POST['description']); $project_description = escapeSql($_POST['description']);
$due_date = sanitizeInput($_POST['due_date']); $due_date = escapeSql($_POST['due_date']);
$project_manager = intval($_POST['project_manager']); $project_manager = intval($_POST['project_manager']);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
@@ -133,7 +133,7 @@ if (isset($_GET['close_project'])) {
// Get Project Name and Client ID for logging // Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id"); $sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']); $project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']); $client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client // Don't Enforce Client Access if Project doesn't have an assigned client
@@ -162,7 +162,7 @@ if (isset($_GET['archive_project'])) {
// Get Project Name and Client ID for logging // Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id"); $sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']); $project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']); $client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client // Don't Enforce Client Access if Project doesn't have an assigned client
@@ -191,8 +191,8 @@ if (isset($_GET['restore_project'])) {
// Get Project Name and Client ID for logging // Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id"); $sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']); $project_name = escapeSql($row['project_name']);
$client_id = sanitizeInput($row['project_client_id']); $client_id = escapeSql($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client // Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) { if ($client_id) {
@@ -220,7 +220,7 @@ if (isset($_GET['delete_project'])) {
// Get Project Name and Client ID for logging // Get Project Name and Client ID for logging
$sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id"); $sql = mysqli_query($mysqli, "SELECT project_name, project_client_id FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$project_name = sanitizeInput($row['project_name']); $project_name = escapeSql($row['project_name']);
$client_id = intval($row['project_client_id']); $client_id = intval($row['project_client_id']);
// Don't Enforce Client Access if Project doesn't have an assigned client // Don't Enforce Client Access if Project doesn't have an assigned client
@@ -250,7 +250,7 @@ if (isset($_POST['link_ticket_to_project'])) {
$sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id"); $sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['project_client_id']); $client_id = intval($row['project_client_id']);
$project_name = sanitizeInput($row['project_name']); $project_name = escapeSql($row['project_name']);
// Don't Enforce Client Access if Project doesn't have an assigned client // Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) { if ($client_id) {
@@ -269,9 +269,9 @@ if (isset($_POST['link_ticket_to_project'])) {
// Get Ticket Info // Get Ticket Info
$sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject FROM tickets WHERE ticket_id = $ticket_id"); $sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']); $ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']); $ticket_subject = escapeSql($row['ticket_subject']);
mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id WHERE ticket_id = $ticket_id"); mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id WHERE ticket_id = $ticket_id");
@@ -301,7 +301,7 @@ if (isset($_POST['link_closed_ticket_to_project'])) {
$sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id"); $sql = mysqli_query($mysqli, "SELECT project_client_id, project_name FROM projects WHERE project_id = $project_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['project_client_id']); $client_id = intval($row['project_client_id']);
$project_name = sanitizeInput($row['project_name']); $project_name = escapeSql($row['project_name']);
// Don't Enforce Client Access if Project doesn't have an assigned client // Don't Enforce Client Access if Project doesn't have an assigned client
if ($client_id) { if ($client_id) {
@@ -316,10 +316,10 @@ if (isset($_POST['link_closed_ticket_to_project'])) {
} }
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$ticket_id = intval($row['ticket_id']); $ticket_id = intval($row['ticket_id']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']); $ticket_number = intval($row['ticket_number']);
$ticket_subject = sanitizeInput($row['ticket_subject']); $ticket_subject = escapeSql($row['ticket_subject']);
$ticket_updated = sanitizeInput($row['ticket_updated_at']); // So we don't mess with the last response $ticket_updated = escapeSql($row['ticket_updated_at']); // So we don't mess with the last response
mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id, ticket_updated_at = '$ticket_updated' WHERE ticket_id = $ticket_id"); mysqli_query($mysqli, "UPDATE tickets SET ticket_project_id = $project_id, ticket_updated_at = '$ticket_updated' WHERE ticket_id = $ticket_id");

136
agent/post/quote.php
View File

@@ -56,12 +56,12 @@ if (isset($_POST['add_quote_copy'])) {
$quote_id = intval($_POST['quote_id']); $quote_id = intval($_POST['quote_id']);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
enforceClientAccess(); enforceClientAccess();
$config_quote_prefix = sanitizeInput($config_quote_prefix); $config_quote_prefix = escapeSql($config_quote_prefix);
// Atomically increment and get the new quote number // Atomically increment and get the new quote number
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -76,13 +76,13 @@ if (isset($_POST['add_quote_copy'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$original_quote_prefix = sanitizeInput($row['quote_prefix']); $original_quote_prefix = escapeSql($row['quote_prefix']);
$original_quote_number = sanitizeInput($row['quote_number']); $original_quote_number = escapeSql($row['quote_number']);
$quote_discount_amount = floatval($row['quote_discount_amount']); $quote_discount_amount = floatval($row['quote_discount_amount']);
$quote_amount = floatval($row['quote_amount']); $quote_amount = floatval($row['quote_amount']);
$quote_currency_code = sanitizeInput($row['quote_currency_code']); $quote_currency_code = escapeSql($row['quote_currency_code']);
$quote_scope = sanitizeInput($row['quote_scope']); $quote_scope = escapeSql($row['quote_scope']);
$quote_note = sanitizeInput($row['quote_note']); $quote_note = escapeSql($row['quote_note']);
$category_id = intval($row['quote_category_id']); $category_id = intval($row['quote_category_id']);
//Generate a unique URL key for clients to access //Generate a unique URL key for clients to access
@@ -97,8 +97,8 @@ if (isset($_POST['add_quote_copy'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id"); $sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
while($row = mysqli_fetch_assoc($sql_items)) { while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']); $item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_description = sanitizeInput($row['item_description']); $item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']); $item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']); $item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
@@ -127,25 +127,25 @@ if (isset($_POST['add_quote_to_invoice'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']); $quote_id = intval($_POST['quote_id']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$sql = mysqli_query($mysqli,"SELECT * FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_net_terms = intval($row['client_net_terms']); $client_net_terms = intval($row['client_net_terms']);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$quote_discount_amount = floatval($row['quote_discount_amount']); $quote_discount_amount = floatval($row['quote_discount_amount']);
$quote_amount = floatval($row['quote_amount']); $quote_amount = floatval($row['quote_amount']);
$quote_currency_code = sanitizeInput($row['quote_currency_code']); $quote_currency_code = escapeSql($row['quote_currency_code']);
$quote_scope = sanitizeInput($row['quote_scope']); $quote_scope = escapeSql($row['quote_scope']);
$quote_note = sanitizeInput($row['quote_note']); $quote_note = escapeSql($row['quote_note']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
$category_id = intval($row['quote_category_id']); $category_id = intval($row['quote_category_id']);
enforceClientAccess(); enforceClientAccess();
$config_invoice_prefix = sanitizeInput($config_invoice_prefix); $config_invoice_prefix = escapeSql($config_invoice_prefix);
// Atomically increment and get the new invoice number // Atomically increment and get the new invoice number
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -170,8 +170,8 @@ if (isset($_POST['add_quote_to_invoice'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id"); $sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
while($row = mysqli_fetch_assoc($sql_items)) { while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']); $item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_description = sanitizeInput($row['item_description']); $item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']); $item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']); $item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
@@ -199,7 +199,7 @@ if (isset($_POST['add_quote_to_invoice'])) {
if ($result_ticket && $row = mysqli_fetch_assoc($result_ticket)) { if ($result_ticket && $row = mysqli_fetch_assoc($result_ticket)) {
$ticket_id = intval($row['ticket_id']); $ticket_id = intval($row['ticket_id']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']); $ticket_number = intval($row['ticket_number']);
mysqli_query($mysqli, "UPDATE tickets SET ticket_invoice_id = $new_invoice_id WHERE ticket_id = $ticket_id AND ticket_invoice_id = '0'"); // Only if ticket doesn't already have an invoice mysqli_query($mysqli, "UPDATE tickets SET ticket_invoice_id = $new_invoice_id WHERE ticket_id = $ticket_id AND ticket_invoice_id = '0'"); // Only if ticket doesn't already have an invoice
@@ -220,8 +220,8 @@ if (isset($_POST['add_quote_item'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']); $quote_id = intval($_POST['quote_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']); $qty = floatval($_POST['qty']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
@@ -249,8 +249,8 @@ if (isset($_POST['add_quote_item'])) {
// Get Quote Details // Get Quote Details
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$quote_discount_amount = floatval($row['quote_discount_amount']); $quote_discount_amount = floatval($row['quote_discount_amount']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
@@ -280,8 +280,8 @@ if (isset($_POST['edit_quote_item'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$item_id = intval($_POST['item_id']); $item_id = intval($_POST['item_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']); $qty = floatval($_POST['qty']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
@@ -308,7 +308,7 @@ if (isset($_POST['edit_quote_item'])) {
//Get Discount Amount //Get Discount Amount
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']); $quote_number = intval($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
$quote_discount = floatval($row['quote_discount_amount']); $quote_discount = floatval($row['quote_discount_amount']);
@@ -339,13 +339,13 @@ if (isset($_POST['quote_note'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']); $quote_id = intval($_POST['quote_id']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
// Get Quote Details // Get Quote Details
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -373,8 +373,8 @@ if (isset($_POST['edit_quote'])) {
// Get Quote Details for logging // Get Quote Details for logging
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -409,8 +409,8 @@ if (isset($_GET['delete_quote'])) {
// Get Quote Details for logging // Get Quote Details for logging
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -454,7 +454,7 @@ if (isset($_GET['delete_quote_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_id = $item_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_id = $item_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$quote_id = intval($row['item_quote_id']); $quote_id = intval($row['item_quote_id']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
$item_tax = floatval($row['item_tax']); $item_tax = floatval($row['item_tax']);
@@ -462,8 +462,8 @@ if (isset($_GET['delete_quote_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -492,8 +492,8 @@ if (isset($_GET['mark_quote_sent'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -520,8 +520,8 @@ if (isset($_GET['accept_quote'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -550,8 +550,8 @@ if (isset($_GET['decline_quote'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -585,40 +585,40 @@ if (isset($_GET['email_quote'])) {
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = intval($row['quote_number']); $quote_number = intval($row['quote_number']);
$quote_scope = sanitizeInput($row['quote_scope']); $quote_scope = escapeSql($row['quote_scope']);
$quote_status = sanitizeInput($row['quote_status']); $quote_status = escapeSql($row['quote_status']);
$quote_date = sanitizeInput($row['quote_date']); $quote_date = escapeSql($row['quote_date']);
$quote_expire = sanitizeInput($row['quote_expire']); $quote_expire = escapeSql($row['quote_expire']);
$quote_amount = floatval($row['quote_amount']); $quote_amount = floatval($row['quote_amount']);
$quote_url_key = sanitizeInput($row['quote_url_key']); $quote_url_key = escapeSql($row['quote_url_key']);
$quote_currency_code = sanitizeInput($row['quote_currency_code']); $quote_currency_code = escapeSql($row['quote_currency_code']);
$client_id = intval($row['client_id']); $client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
enforceClientAccess(); enforceClientAccess();
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_country = sanitizeInput($row['company_country']); $company_country = escapeSql($row['company_country']);
$company_address = sanitizeInput($row['company_address']); $company_address = escapeSql($row['company_address']);
$company_city = sanitizeInput($row['company_city']); $company_city = escapeSql($row['company_city']);
$company_state = sanitizeInput($row['company_state']); $company_state = escapeSql($row['company_state']);
$company_zip = sanitizeInput($row['company_zip']); $company_zip = escapeSql($row['company_zip']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
$company_logo = sanitizeInput($row['company_logo']); $company_logo = escapeSql($row['company_logo']);
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_quote_from_name = sanitizeInput($config_quote_from_name); $config_quote_from_name = escapeSql($config_quote_from_name);
$config_quote_from_email = sanitizeInput($config_quote_from_email); $config_quote_from_email = escapeSql($config_quote_from_email);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
$subject = "Quote [$quote_scope]"; $subject = "Quote [$quote_scope]";
$body = "Hello $contact_name,<br><br>Thank you for your inquiry, we are pleased to provide you with the following estimate.<br><br><br>$quote_scope<br>Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "<br><br><br>View and accept your estimate online <a href=\'https://$config_base_url/guest/guest_view_quote.php?quote_id=$quote_id&url_key=$quote_url_key\'>here</a><br><br><br>--<br>$company_name - Sales<br>$config_quote_from_email<br>$company_phone"; $body = "Hello $contact_name,<br><br>Thank you for your inquiry, we are pleased to provide you with the following estimate.<br><br><br>$quote_scope<br>Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "<br><br><br>View and accept your estimate online <a href=\'https://$config_base_url/guest/guest_view_quote.php?quote_id=$quote_id&url_key=$quote_url_key\'>here</a><br><br><br>--<br>$company_name - Sales<br>$config_quote_from_email<br>$company_phone";
@@ -662,8 +662,8 @@ if (isset($_GET['mark_quote_invoiced'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$quote_prefix = sanitizeInput($row['quote_prefix']); $quote_prefix = escapeSql($row['quote_prefix']);
$quote_number = sanitizeInput($row['quote_number']); $quote_number = escapeSql($row['quote_number']);
$client_id = intval($row['quote_client_id']); $client_id = intval($row['quote_client_id']);
enforceClientAccess(); enforceClientAccess();

8
agent/post/quote_model.php
View File

@@ -1,10 +1,10 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']); $scope = escapeSql($_POST['scope']);
$quote_discount = floatval($_POST['quote_discount']); $quote_discount = floatval($_POST['quote_discount']);
$config_quote_prefix = sanitizeInput($config_quote_prefix); $config_quote_prefix = escapeSql($config_quote_prefix);

48
agent/post/rack.php
View File

@@ -13,15 +13,15 @@ if (isset($_POST['add_rack'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$depth = sanitizeInput($_POST['depth']); $depth = escapeSql($_POST['depth']);
$units = intval($_POST['units']); $units = intval($_POST['units']);
$physical_location = sanitizeInput($_POST['physical_location']); $physical_location = escapeSql($_POST['physical_location']);
$location = intval($_POST['location']); $location = intval($_POST['location']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
enforceClientAccess(); enforceClientAccess();
@@ -60,15 +60,15 @@ if (isset($_POST['edit_rack'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$rack_id = intval($_POST['rack_id']); $rack_id = intval($_POST['rack_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$model = sanitizeInput($_POST['model']); $model = escapeSql($_POST['model']);
$depth = sanitizeInput($_POST['depth']); $depth = escapeSql($_POST['depth']);
$units = intval($_POST['units']); $units = intval($_POST['units']);
$physical_location = sanitizeInput($_POST['physical_location']); $physical_location = escapeSql($_POST['physical_location']);
$location = intval($_POST['location']); $location = intval($_POST['location']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$client_id = intval(getFieldById('racks', $rack_id, 'rack_client_id')); $client_id = intval(getFieldById('racks', $rack_id, 'rack_client_id'));
@@ -113,7 +113,7 @@ if (isset($_GET['archive_rack'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id"); $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']); $rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']); $client_id = intval($row['rack_client_id']);
mysqli_query($mysqli,"UPDATE racks SET rack_archived_at = NOW() WHERE rack_id = $rack_id"); mysqli_query($mysqli,"UPDATE racks SET rack_archived_at = NOW() WHERE rack_id = $rack_id");
@@ -137,7 +137,7 @@ if (isset($_GET['restore_rack'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id"); $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']); $rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']); $client_id = intval($row['rack_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -163,8 +163,8 @@ if (isset($_GET['delete_rack'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id, rack_photo FROM racks WHERE rack_id = $rack_id"); $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id, rack_photo FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']); $rack_name = escapeSql($row['rack_name']);
$rack_photo = sanitizeInput($row['rack_photo']); $rack_photo = escapeSql($row['rack_photo']);
$client_id = intval($row['rack_client_id']); $client_id = intval($row['rack_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -191,7 +191,7 @@ if (isset($_POST['add_rack_unit'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$rack_id = intval($_POST['rack_id']); $rack_id = intval($_POST['rack_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$unit_start = intval($_POST['unit_start']); $unit_start = intval($_POST['unit_start']);
$unit_end = intval($_POST['unit_end']); $unit_end = intval($_POST['unit_end']);
$asset = intval($_POST['asset']); $asset = intval($_POST['asset']);
@@ -199,7 +199,7 @@ if (isset($_POST['add_rack_unit'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id"); $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']); $rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']); $client_id = intval($row['rack_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -240,7 +240,7 @@ if (isset($_POST['edit_rack_unit'])) {
$unit_id = intval($_POST['unit_id']); $unit_id = intval($_POST['unit_id']);
$rack_id = intval($_POST['rack_id']); $rack_id = intval($_POST['rack_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$unit_start = intval($_POST['unit_start']); $unit_start = intval($_POST['unit_start']);
$unit_end = intval($_POST['unit_end']); $unit_end = intval($_POST['unit_end']);
$asset = intval($_POST['asset']); $asset = intval($_POST['asset']);
@@ -248,7 +248,7 @@ if (isset($_POST['edit_rack_unit'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id"); $sql = mysqli_query($mysqli,"SELECT rack_name, rack_client_id FROM racks WHERE rack_id = $rack_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']); $rack_name = escapeSql($row['rack_name']);
$client_id = intval($row['rack_client_id']); $client_id = intval($row['rack_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -274,8 +274,8 @@ if (isset($_GET['remove_rack_unit'])) {
// Get Name and Client ID for logging and alert message // Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT rack_name, rack_id, rack_client_id FROM racks LEFT JOIN rack_units ON unit_rack_id = rack_id WHERE unit_id = $unit_id"); $sql = mysqli_query($mysqli,"SELECT rack_name, rack_id, rack_client_id FROM racks LEFT JOIN rack_units ON unit_rack_id = rack_id WHERE unit_id = $unit_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$rack_name = sanitizeInput($row['rack_name']); $rack_name = escapeSql($row['rack_name']);
$unit_device = sanitizeInput($row['unit_device']); $unit_device = escapeSql($row['unit_device']);
$client_id = intval($row['rack_client_id']); $client_id = intval($row['rack_client_id']);
$rack_id = intval($row['rack_id']); $rack_id = intval($row['rack_id']);

10
agent/post/recurring_expense.php
View File

@@ -20,8 +20,8 @@ if (isset($_POST['create_recurring_expense'])) {
$vendor = intval($_POST['vendor']); $vendor = intval($_POST['vendor']);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
$year = date('Y'); $year = date('Y');
if (strtotime("$year-$month-$day") < time()) { if (strtotime("$year-$month-$day") < time()) {
@@ -56,8 +56,8 @@ if (isset($_POST['edit_recurring_expense'])) {
$vendor = intval($_POST['vendor']); $vendor = intval($_POST['vendor']);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
$year = date('Y'); $year = date('Y');
if (strtotime("$year-$month-$day") < time()) { if (strtotime("$year-$month-$day") < time()) {
@@ -86,7 +86,7 @@ if (isset($_GET['delete_recurring_expense'])) {
// Get Recurring Expense Details for Logging // Get Recurring Expense Details for Logging
$sql = mysqli_query($mysqli,"SELECT recurring_expense_description, recurring_expense_client_id FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id"); $sql = mysqli_query($mysqli,"SELECT recurring_expense_description, recurring_expense_client_id FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_expense_description = sanitizeInput($row['recurring_expense_description']); $recurring_expense_description = escapeSql($row['recurring_expense_description']);
$client_id = intval($row['recurring_expense_client_id']); $client_id = intval($row['recurring_expense_client_id']);
mysqli_query($mysqli,"DELETE FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id"); mysqli_query($mysqli,"DELETE FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id");

110
agent/post/recurring_invoice.php
View File

@@ -17,13 +17,13 @@ if (isset($_POST['add_invoice_recurring'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_date = sanitizeInput(validateDate($row['invoice_date'])); $invoice_date = escapeSql(validateDate($row['invoice_date']));
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_currency_code = sanitizeInput($row['invoice_currency_code']); $invoice_currency_code = escapeSql($row['invoice_currency_code']);
$invoice_scope = sanitizeInput($row['invoice_scope']); $invoice_scope = escapeSql($row['invoice_scope']);
$invoice_note = sanitizeInput($row['invoice_note']); $invoice_note = escapeSql($row['invoice_note']);
$client_id = intval($row['invoice_client_id']); $client_id = intval($row['invoice_client_id']);
$category_id = intval($row['invoice_category_id']); $category_id = intval($row['invoice_category_id']);
@@ -49,8 +49,8 @@ if (isset($_POST['add_invoice_recurring'])) {
$sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id"); $sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
while($row = mysqli_fetch_assoc($sql_items)) { while($row = mysqli_fetch_assoc($sql_items)) {
$item_id = intval($row['item_id']); $item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_description = sanitizeInput($row['item_description']); $item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']); $item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']); $item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
@@ -77,10 +77,10 @@ if (isset($_POST['add_recurring_invoice'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$frequency = sanitizeInput($_POST['frequency']); $frequency = escapeSql($_POST['frequency']);
$start_date = sanitizeInput($_POST['start_date']); $start_date = escapeSql($_POST['start_date']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']); $scope = escapeSql($_POST['scope']);
enforceClientAccess(); enforceClientAccess();
@@ -116,17 +116,17 @@ if (isset($_POST['edit_recurring_invoice'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']); $recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$frequency = sanitizeInput($_POST['frequency']); $frequency = escapeSql($_POST['frequency']);
$next_date = sanitizeInput($_POST['next_date']); $next_date = escapeSql($_POST['next_date']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$scope = sanitizeInput($_POST['scope']); $scope = escapeSql($_POST['scope']);
$status = intval($_POST['status']); $status = intval($_POST['status']);
$recurring_invoice_discount = floatval($_POST['recurring_invoice_discount']); $recurring_invoice_discount = floatval($_POST['recurring_invoice_discount']);
// Get Recurring Invoice Details and Client ID for Logging // Get Recurring Invoice Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
@@ -164,9 +164,9 @@ if (isset($_GET['delete_recurring_invoice'])) {
// Get Recurring Invoice Details and Client ID for Logging // Get Recurring Invoice Details and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_scope, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_scope, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$recurring_invoice_scope = sanitizeInput($row['recurring_invoice_scope']); $recurring_invoice_scope = escapeSql($row['recurring_invoice_scope']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -202,8 +202,8 @@ if (isset($_POST['add_recurring_invoice_item'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']); $recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']); $qty = floatval($_POST['qty']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
@@ -232,7 +232,7 @@ if (isset($_POST['add_recurring_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']); $recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
@@ -262,8 +262,8 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$item_id = intval($_POST['item_id']); $item_id = intval($_POST['item_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$qty = floatval($_POST['qty']); $qty = floatval($_POST['qty']);
$price = floatval($_POST['price']); $price = floatval($_POST['price']);
$tax_id = intval($_POST['tax_id']); $tax_id = intval($_POST['tax_id']);
@@ -290,7 +290,7 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
//Get Discount Amount //Get Discount Amount
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
$recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']); $recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
@@ -322,12 +322,12 @@ if (isset($_POST['recurring_invoice_note'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$recurring_invoice_id = intval($_POST['recurring_invoice_id']); $recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$note = sanitizeInput($_POST['note']); $note = escapeSql($_POST['note']);
// Get Recurring details for logging // Get Recurring details for logging
$sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT recurring_invoice_prefix, recurring_invoice_number, recurring_invoice_client_id FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
@@ -354,14 +354,14 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_id = $item_id"); $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_id = $item_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_id = intval($row['item_recurring_invoice_id']); $recurring_invoice_id = intval($row['item_recurring_invoice_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
$item_tax = floatval($row['item_tax']); $item_tax = floatval($row['item_tax']);
$item_total = floatval($row['item_total']); $item_total = floatval($row['item_total']);
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
@@ -393,15 +393,15 @@ if (isset($_GET['force_recurring'])) {
$row = mysqli_fetch_assoc($sql_recurring_invoices); $row = mysqli_fetch_assoc($sql_recurring_invoices);
$recurring_invoice_id = intval($row['recurring_invoice_id']); $recurring_invoice_id = intval($row['recurring_invoice_id']);
$recurring_invoice_scope = sanitizeInput($row['recurring_invoice_scope']); $recurring_invoice_scope = escapeSql($row['recurring_invoice_scope']);
$recurring_invoice_frequency = ($_POST['frequency'] === 'year') ? 'year' : 'month'; $recurring_invoice_frequency = ($_POST['frequency'] === 'year') ? 'year' : 'month';
$recurring_invoice_status = sanitizeInput($row['recurring_invoice_status']); $recurring_invoice_status = escapeSql($row['recurring_invoice_status']);
$recurring_invoice_last_sent = sanitizeInput($row['recurring_invoice_last_sent']); $recurring_invoice_last_sent = escapeSql($row['recurring_invoice_last_sent']);
$recurring_invoice_next_date = sanitizeInput($row['recurring_invoice_next_date']); $recurring_invoice_next_date = escapeSql($row['recurring_invoice_next_date']);
$recurring_invoice_discount_amount = floatval($row['recurring_invoice_discount_amount']); $recurring_invoice_discount_amount = floatval($row['recurring_invoice_discount_amount']);
$recurring_invoice_amount = floatval($row['recurring_invoice_amount']); $recurring_invoice_amount = floatval($row['recurring_invoice_amount']);
$recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']); $recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
$recurring_invoice_note = sanitizeInput($row['recurring_invoice_note']); $recurring_invoice_note = escapeSql($row['recurring_invoice_note']);
$category_id = intval($row['recurring_invoice_category_id']); $category_id = intval($row['recurring_invoice_category_id']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
$client_net_terms = intval($row['client_net_terms']); $client_net_terms = intval($row['client_net_terms']);
@@ -431,8 +431,8 @@ if (isset($_GET['force_recurring'])) {
while($row = mysqli_fetch_assoc($sql_invoice_items)) { while($row = mysqli_fetch_assoc($sql_invoice_items)) {
$item_id = intval($row['item_id']); $item_id = intval($row['item_id']);
$item_name = sanitizeInput($row['item_name']); $item_name = escapeSql($row['item_name']);
$item_description = sanitizeInput($row['item_description']); $item_description = escapeSql($row['item_description']);
$item_quantity = floatval($row['item_quantity']); $item_quantity = floatval($row['item_quantity']);
$item_price = floatval($row['item_price']); $item_price = floatval($row['item_price']);
$item_subtotal = floatval($row['item_subtotal']); $item_subtotal = floatval($row['item_subtotal']);
@@ -477,31 +477,31 @@ if (isset($_GET['force_recurring'])) {
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$invoice_prefix = sanitizeInput($row['invoice_prefix']); $invoice_prefix = escapeSql($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']); $invoice_number = intval($row['invoice_number']);
$invoice_scope = sanitizeInput($row['invoice_scope']); $invoice_scope = escapeSql($row['invoice_scope']);
$invoice_date = sanitizeInput(validateDate($row['invoice_date'])); $invoice_date = escapeSql(validateDate($row['invoice_date']));
$invoice_due = sanitizeInput($row['invoice_due']); $invoice_due = escapeSql($row['invoice_due']);
$invoice_amount = floatval($row['invoice_amount']); $invoice_amount = floatval($row['invoice_amount']);
$invoice_url_key = sanitizeInput($row['invoice_url_key']); $invoice_url_key = escapeSql($row['invoice_url_key']);
$client_id = intval($row['client_id']); $client_id = intval($row['client_id']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code']));
$contact_extension = intval($row['contact_extension']); $contact_extension = intval($row['contact_extension']);
$contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
$sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$company_name = sanitizeInput($row['company_name']); $company_name = escapeSql($row['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
$company_email = sanitizeInput($row['company_email']); $company_email = escapeSql($row['company_email']);
$company_website = sanitizeInput($row['company_website']); $company_website = escapeSql($row['company_website']);
// Sanitize Config Vars // Sanitize Config Vars
$config_invoice_from_email = sanitizeInput($config_invoice_from_email); $config_invoice_from_email = escapeSql($config_invoice_from_email);
$config_invoice_from_name = sanitizeInput($config_invoice_from_name); $config_invoice_from_name = escapeSql($config_invoice_from_name);
// Email to client // Email to client
@@ -561,9 +561,9 @@ if (isset($_POST['set_recurring_payment'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']); $recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']);
$recurring_invoice_amount = floatval($row['recurring_invoice_amount']); $recurring_invoice_amount = floatval($row['recurring_invoice_amount']);
enforceClientAccess(); enforceClientAccess();
@@ -580,9 +580,9 @@ if (isset($_POST['set_recurring_payment'])) {
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$provider_id = intval($row['payment_provider_id']); $provider_id = intval($row['payment_provider_id']);
$provider_name = sanitizeInput($row['payment_provider_name']); $provider_name = escapeSql($row['payment_provider_name']);
$account_id = intval($row['payment_provider_account']); $account_id = intval($row['payment_provider_account']);
$saved_payment_description = sanitizeInput($row['saved_payment_description']); $saved_payment_description = escapeSql($row['saved_payment_description']);
mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id"); mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id");
mysqli_query($mysqli,"INSERT INTO recurring_payments SET recurring_payment_currency_code = '$recurring_invoice_currency_code', recurring_payment_account_id = $account_id, recurring_payment_method = 'Credit Card', recurring_payment_recurring_invoice_id = $recurring_invoice_id, recurring_payment_saved_payment_id = $saved_payment_id"); mysqli_query($mysqli,"INSERT INTO recurring_payments SET recurring_payment_currency_code = '$recurring_invoice_currency_code', recurring_payment_account_id = $account_id, recurring_payment_method = 'Credit Card', recurring_payment_recurring_invoice_id = $recurring_invoice_id, recurring_payment_saved_payment_id = $saved_payment_id");
@@ -670,7 +670,7 @@ if (isset($_GET['recurring_invoice_email_notify'])) {
$sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
$recurring_invoice_number = intval($row['recurring_invoice_number']); $recurring_invoice_number = intval($row['recurring_invoice_number']);
$client_id = intval($row['recurring_invoice_client_id']); $client_id = intval($row['recurring_invoice_client_id']);

110
agent/post/recurring_ticket.php
View File

@@ -18,7 +18,7 @@ if (isset($_POST['add_recurring_ticket'])) {
enforceClientAccess(); enforceClientAccess();
$start_date = sanitizeInput($_POST['start_date']); $start_date = escapeSql($_POST['start_date']);
mysqli_query($mysqli, "INSERT INTO recurring_tickets SET recurring_ticket_subject = '$subject', recurring_ticket_details = '$details', recurring_ticket_priority = '$priority', recurring_ticket_frequency = '$frequency', recurring_ticket_billable = $billable, recurring_ticket_start_date = '$start_date', recurring_ticket_next_run = '$start_date', recurring_ticket_assigned_to = $assigned_to, recurring_ticket_created_by = $session_user_id, recurring_ticket_client_id = $client_id, recurring_ticket_contact_id = $contact_id, recurring_ticket_asset_id = $asset_id, recurring_ticket_category = $category_id"); mysqli_query($mysqli, "INSERT INTO recurring_tickets SET recurring_ticket_subject = '$subject', recurring_ticket_details = '$details', recurring_ticket_priority = '$priority', recurring_ticket_frequency = '$frequency', recurring_ticket_billable = $billable, recurring_ticket_start_date = '$start_date', recurring_ticket_next_run = '$start_date', recurring_ticket_assigned_to = $assigned_to, recurring_ticket_created_by = $session_user_id, recurring_ticket_client_id = $client_id, recurring_ticket_contact_id = $contact_id, recurring_ticket_asset_id = $asset_id, recurring_ticket_category = $category_id");
@@ -49,7 +49,7 @@ if (isset($_POST['edit_recurring_ticket'])) {
require_once 'recurring_ticket_model.php'; require_once 'recurring_ticket_model.php';
$recurring_ticket_id = intval($_POST['recurring_ticket_id']); $recurring_ticket_id = intval($_POST['recurring_ticket_id']);
$next_run_date = sanitizeInput($_POST['next_date']); $next_run_date = escapeSql($_POST['next_date']);
$client_id = intval(getFieldById('recurring_tickets', $recurring_ticket_id, 'recurring_ticket_client_id')); $client_id = intval(getFieldById('recurring_tickets', $recurring_ticket_id, 'recurring_ticket_client_id'));
@@ -90,12 +90,12 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
if (mysqli_num_rows($sql) > 0) { if (mysqli_num_rows($sql) > 0) {
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']); $subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']); $details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']); $priority = escapeSql($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency'])); $frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']); $billable = intval($row['recurring_ticket_billable']);
$old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']); $old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']);
$created_id = intval($row['recurring_ticket_created_by']); $created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']); $assigned_id = intval($row['recurring_ticket_assigned_to']);
$contact_id = intval($row['recurring_ticket_contact_id']); $contact_id = intval($row['recurring_ticket_contact_id']);
@@ -112,10 +112,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
} }
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix); $config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
// Atomically increment and get the new ticket number // Atomically increment and get the new ticket number
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -152,15 +152,15 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']); $ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']); $ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']); $ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']); $ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = []; $data = [];
@@ -230,12 +230,12 @@ if (isset($_GET['force_recurring_ticket'])) {
if (mysqli_num_rows($sql) > 0) { if (mysqli_num_rows($sql) > 0) {
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']); $subject = escapeSql($row['recurring_ticket_subject']);
$details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']); $details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']);
$priority = sanitizeInput($row['recurring_ticket_priority']); $priority = escapeSql($row['recurring_ticket_priority']);
$frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency'])); $frequency = escapeSql(strtolower($row['recurring_ticket_frequency']));
$billable = intval($row['recurring_ticket_billable']); $billable = intval($row['recurring_ticket_billable']);
$old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']); $old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']);
$created_id = intval($row['recurring_ticket_created_by']); $created_id = intval($row['recurring_ticket_created_by']);
$assigned_id = intval($row['recurring_ticket_assigned_to']); $assigned_id = intval($row['recurring_ticket_assigned_to']);
$contact_id = intval($row['recurring_ticket_contact_id']); $contact_id = intval($row['recurring_ticket_contact_id']);
@@ -252,10 +252,10 @@ if (isset($_GET['force_recurring_ticket'])) {
} }
// Sanitize Config Vars from get_settings.php and Session Vars from check_login.php // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php
$config_ticket_prefix = sanitizeInput($config_ticket_prefix); $config_ticket_prefix = escapeSql($config_ticket_prefix);
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
// Atomically increment and get the new ticket number // Atomically increment and get the new ticket number
mysqli_query($mysqli, " mysqli_query($mysqli, "
@@ -292,15 +292,15 @@ if (isset($_GET['force_recurring_ticket'])) {
); );
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$client_name = sanitizeInput($row['client_name']); $client_name = escapeSql($row['client_name']);
$contact_name = sanitizeInput($row['contact_name']); $contact_name = escapeSql($row['contact_name']);
$contact_email = sanitizeInput($row['contact_email']); $contact_email = escapeSql($row['contact_email']);
$ticket_prefix = sanitizeInput($row['ticket_prefix']); $ticket_prefix = escapeSql($row['ticket_prefix']);
$ticket_number = intval($row['ticket_number']); $ticket_number = intval($row['ticket_number']);
$ticket_priority = sanitizeInput($row['ticket_priority']); $ticket_priority = escapeSql($row['ticket_priority']);
$ticket_subject = sanitizeInput($row['ticket_subject']); $ticket_subject = escapeSql($row['ticket_subject']);
$ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']); $ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']);
$data = []; $data = [];
@@ -369,8 +369,8 @@ if (isset($_GET['delete_recurring_ticket'])) {
// Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']); $subject = escapeSql($row['recurring_ticket_subject']);
$frequency = sanitizeInput($row['recurring_ticket_frequency']); $frequency = escapeSql($row['recurring_ticket_frequency']);
$client_id = intval($row['recurring_ticket_client_id']); $client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -404,8 +404,8 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) {
// Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$subject = sanitizeInput($row['recurring_ticket_subject']); $subject = escapeSql($row['recurring_ticket_subject']);
$frequency = sanitizeInput($row['recurring_ticket_frequency']); $frequency = escapeSql($row['recurring_ticket_frequency']);
$client_id = intval($row['recurring_ticket_client_id']); $client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -445,8 +445,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_ticket_name = sanitizeInput($row['recurring_ticket_name']); $recurring_ticket_name = escapeSql($row['recurring_ticket_name']);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$client_id = intval($row['recurring_ticket_client_id']); $client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -460,8 +460,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
$agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users LEFT JOIN user_settings ON users.user_id = user_settings.user_id WHERE users.user_id = $assign_to"); $agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users LEFT JOIN user_settings ON users.user_id = user_settings.user_id WHERE users.user_id = $assign_to");
$agent_details = mysqli_fetch_assoc($agent_details_sql); $agent_details = mysqli_fetch_assoc($agent_details_sql);
$agent_name = sanitizeInput($agent_details['user_name']); $agent_name = escapeSql($agent_details['user_name']);
$agent_email = sanitizeInput($agent_details['user_email']); $agent_email = escapeSql($agent_details['user_email']);
if (!$agent_name) { if (!$agent_name) {
flash_alert("Invalid agent!", 'error'); flash_alert("Invalid agent!", 'error');
@@ -487,9 +487,9 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
if (!empty($config_smtp_provider)) { if (!empty($config_smtp_provider)) {
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$company_name = sanitizeInput($session_company_name); $company_name = escapeSql($session_company_name);
$subject = "$config_app_name - $recurring_ticket_count recurring tickets have been assigned to you"; $subject = "$config_app_name - $recurring_ticket_count recurring tickets have been assigned to you";
$body = "Hi $agent_name, <br><br>$session_name assigned $recurring_ticket_count recurring tickets to you!<br><br>$tickets_assigned_body<br>Thanks, <br>$session_name<br>$company_name"; $body = "Hi $agent_name, <br><br>$session_name assigned $recurring_ticket_count recurring tickets to you!<br><br>$tickets_assigned_body<br>Thanks, <br>$session_name<br>$company_name";
@@ -523,7 +523,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$priority = sanitizeInput($_POST['bulk_priority']); $priority = escapeSql($_POST['bulk_priority']);
// Assign Tech to Selected Recurring Tickets // Assign Tech to Selected Recurring Tickets
if (isset($_POST['recurring_ticket_ids'])) { if (isset($_POST['recurring_ticket_ids'])) {
@@ -537,8 +537,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$original_recurring_ticket_priority = sanitizeInput($row['recurring_ticket_priority']); $original_recurring_ticket_priority = escapeSql($row['recurring_ticket_priority']);
$client_id = intval($row['ticket_client_id']); $client_id = intval($row['ticket_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -578,13 +578,13 @@ if (isset($_POST['bulk_edit_recurring_ticket_category'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, category_name, recurring_ticket_client_id FROM recurring_tickets LEFT JOIN categories ON recurring_ticket_category = category_id WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, category_name, recurring_ticket_client_id FROM recurring_tickets LEFT JOIN categories ON recurring_ticket_category = category_id WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_category_name = sanitizeInput($row['category_name']); $previous_recurring_ticket_category_name = escapeSql($row['category_name']);
$client_id = intval($row['recurring_ticket_client_id']); $client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess(); enforceClientAccess();
$category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name'));
mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_category = '$category_id' WHERE recurring_ticket_id = $recurring_ticket_id"); mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_category = '$category_id' WHERE recurring_ticket_id = $recurring_ticket_id");
@@ -626,7 +626,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_billable'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_billable = intval($row['recurring_ticket_billable']); $previous_recurring_ticket_billable = intval($row['recurring_ticket_billable']);
if ($previous_recurring_ticket_billable) { if ($previous_recurring_ticket_billable) {
$previous_billable_status = "Billable"; $previous_billable_status = "Billable";
@@ -659,7 +659,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$next_run_date = sanitizeInput($_POST['next_run_date']); $next_run_date = escapeSql($_POST['next_run_date']);
if (isset($_POST['recurring_ticket_ids'])) { if (isset($_POST['recurring_ticket_ids'])) {
@@ -671,8 +671,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) {
$sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
$previous_recurring_ticket_next_run_date = sanitizeInput($row['recurring_ticket_next_run']); $previous_recurring_ticket_next_run_date = escapeSql($row['recurring_ticket_next_run']);
$client_id = intval($row['recurring_ticket_client_id']); $client_id = intval($row['recurring_ticket_client_id']);
enforceClientAccess(); enforceClientAccess();

6
agent/post/recurring_ticket_model.php
View File

@@ -1,10 +1,10 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$subject = sanitizeInput($_POST['subject']); $subject = escapeSql($_POST['subject']);
$priority = sanitizeInput($_POST['priority']); $priority = escapeSql($_POST['priority']);
$details = mysqli_real_escape_string($mysqli, $_POST['details']); $details = mysqli_real_escape_string($mysqli, $_POST['details']);
$frequency = sanitizeInput($_POST['frequency']); $frequency = escapeSql($_POST['frequency']);
$billable = intval($_POST['billable'] ?? 0); $billable = intval($_POST['billable'] ?? 0);
$asset_id = intval($_POST['asset_id'] ?? 0); $asset_id = intval($_POST['asset_id'] ?? 0);
$contact_id = intval($_POST['contact_id'] ?? 0); $contact_id = intval($_POST['contact_id'] ?? 0);

18
agent/post/revenue.php
View File

@@ -12,13 +12,13 @@ if (isset($_POST['add_revenue'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$payment_method = sanitizeInput($_POST['payment_method']); $payment_method = escapeSql($_POST['payment_method']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
mysqli_query($mysqli,"INSERT INTO revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_currency_code = '$session_company_currency', revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account"); mysqli_query($mysqli,"INSERT INTO revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_currency_code = '$session_company_currency', revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account");
@@ -39,13 +39,13 @@ if (isset($_POST['edit_revenue'])) {
enforceUserPermission('module_sales', 2); enforceUserPermission('module_sales', 2);
$revenue_id = intval($_POST['revenue_id']); $revenue_id = intval($_POST['revenue_id']);
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$account = intval($_POST['account']); $account = intval($_POST['account']);
$category = intval($_POST['category']); $category = intval($_POST['category']);
$payment_method = sanitizeInput($_POST['payment_method']); $payment_method = escapeSql($_POST['payment_method']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$reference = sanitizeInput($_POST['reference']); $reference = escapeSql($_POST['reference']);
mysqli_query($mysqli,"UPDATE revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account WHERE revenue_id = $revenue_id"); mysqli_query($mysqli,"UPDATE revenues SET revenue_date = '$date', revenue_amount = $amount, revenue_payment_method = '$payment_method', revenue_reference = '$reference', revenue_description = '$description', revenue_category_id = $category, revenue_account_id = $account WHERE revenue_id = $revenue_id");
@@ -66,7 +66,7 @@ if (isset($_GET['delete_revenue'])) {
$revenue_id = intval($_GET['delete_revenue']); $revenue_id = intval($_GET['delete_revenue']);
// Get Revenue Details // Get Revenue Details
$revenue_description = sanitizeInput(getFieldById('revenues', $revenue_id, 'revenue_description')); $revenue_description = escapeSql(getFieldById('revenues', $revenue_id, 'revenue_description'));
mysqli_query($mysqli,"DELETE FROM revenues WHERE revenue_id = $revenue_id"); mysqli_query($mysqli,"DELETE FROM revenues WHERE revenue_id = $revenue_id");

26
agent/post/service.php
View File

@@ -13,12 +13,12 @@ if (isset($_POST['add_service'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$service_name = sanitizeInput($_POST['name']); $service_name = escapeSql($_POST['name']);
$service_description = sanitizeInput($_POST['description']); $service_description = escapeSql($_POST['description']);
$service_category = sanitizeInput($_POST['category']); //TODO: Needs integration with company categories $service_category = escapeSql($_POST['category']); //TODO: Needs integration with company categories
$service_importance = sanitizeInput($_POST['importance']); $service_importance = escapeSql($_POST['importance']);
$service_backup = sanitizeInput($_POST['backup']); $service_backup = escapeSql($_POST['backup']);
$service_notes = sanitizeInput($_POST['note']); $service_notes = escapeSql($_POST['note']);
enforceClientAccess(); enforceClientAccess();
@@ -93,12 +93,12 @@ if (isset($_POST['edit_service'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$service_id = intval($_POST['service_id']); $service_id = intval($_POST['service_id']);
$service_name = sanitizeInput($_POST['name']); $service_name = escapeSql($_POST['name']);
$service_description = sanitizeInput($_POST['description']); $service_description = escapeSql($_POST['description']);
$service_category = sanitizeInput($_POST['category']); //TODO: Needs integration with company categories $service_category = escapeSql($_POST['category']); //TODO: Needs integration with company categories
$service_importance = sanitizeInput($_POST['importance']); $service_importance = escapeSql($_POST['importance']);
$service_backup = sanitizeInput($_POST['backup']); $service_backup = escapeSql($_POST['backup']);
$service_notes = sanitizeInput($_POST['note']); $service_notes = escapeSql($_POST['note']);
$client_id = intval(getFieldById('services', $service_id, 'service_client_id')); $client_id = intval(getFieldById('services', $service_id, 'service_client_id'));
@@ -185,7 +185,7 @@ if (isset($_GET['delete_service'])) {
// Get Service Details // Get Service Details
$sql = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $sql = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$service_name = sanitizeInput($row['service_name']); $service_name = escapeSql($row['service_name']);
$client_id = intval($row['service_client_id']); $client_id = intval($row['service_client_id']);
enforceClientAccess(); enforceClientAccess();

60
agent/post/software.php
View File

@@ -21,12 +21,12 @@ if (isset($_POST['add_software_from_template'])) {
// GET Software Template Info // GET Software Template Info
$sql_software_templates = mysqli_query($mysqli,"SELECT * FROM software_templates WHERE software_template_id = $software_template_id"); $sql_software_templates = mysqli_query($mysqli,"SELECT * FROM software_templates WHERE software_template_id = $software_template_id");
$row = mysqli_fetch_assoc($sql_software_templates); $row = mysqli_fetch_assoc($sql_software_templates);
$name = sanitizeInput($row['software_template_name']); $name = escapeSql($row['software_template_name']);
$version = sanitizeInput($row['software_template_version']); $version = escapeSql($row['software_template_version']);
$description = sanitizeInput($row['software_template_description']); $description = escapeSql($row['software_template_description']);
$type = sanitizeInput($row['software_template_type']); $type = escapeSql($row['software_template_type']);
$license_type = sanitizeInput($row['software_template_license_type']); $license_type = escapeSql($row['software_template_license_type']);
$notes = sanitizeInput($row['software_template_notes']); $notes = escapeSql($row['software_template_notes']);
$vendor = intval($_POST['vendor'] ?? 0); $vendor = intval($_POST['vendor'] ?? 0);
// Software add query // Software add query
@@ -49,28 +49,28 @@ if (isset($_POST['add_software'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$client_id = intval($_POST['client_id']); $client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$version = sanitizeInput($_POST['version']); $version = escapeSql($_POST['version']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$license_type = sanitizeInput($_POST['license_type']); $license_type = escapeSql($_POST['license_type']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$key = sanitizeInput($_POST['key']); $key = escapeSql($_POST['key']);
$seats = intval($_POST['seats']); $seats = intval($_POST['seats']);
$purchase_reference = sanitizeInput($_POST['purchase_reference']); $purchase_reference = escapeSql($_POST['purchase_reference']);
$purchase = sanitizeInput($_POST['purchase']); $purchase = escapeSql($_POST['purchase']);
if (empty($purchase)) { if (empty($purchase)) {
$purchase = "NULL"; $purchase = "NULL";
} else { } else {
$purchase = "'" . $purchase . "'"; $purchase = "'" . $purchase . "'";
} }
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
if (empty($expire)) { if (empty($expire)) {
$expire = "NULL"; $expire = "NULL";
} else { } else {
$expire = "'" . $expire . "'"; $expire = "'" . $expire . "'";
} }
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$vendor = intval($_POST['vendor'] ?? 0); $vendor = intval($_POST['vendor'] ?? 0);
enforceClientAccess(); enforceClientAccess();
@@ -112,28 +112,28 @@ if (isset($_POST['edit_software'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$software_id = intval($_POST['software_id']); $software_id = intval($_POST['software_id']);
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$version = sanitizeInput($_POST['version']); $version = escapeSql($_POST['version']);
$description = sanitizeInput($_POST['description']); $description = escapeSql($_POST['description']);
$type = sanitizeInput($_POST['type']); $type = escapeSql($_POST['type']);
$license_type = sanitizeInput($_POST['license_type']); $license_type = escapeSql($_POST['license_type']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$key = sanitizeInput($_POST['key']); $key = escapeSql($_POST['key']);
$seats = intval($_POST['seats']); $seats = intval($_POST['seats']);
$purchase_reference = sanitizeInput($_POST['purchase_reference']); $purchase_reference = escapeSql($_POST['purchase_reference']);
$purchase = sanitizeInput($_POST['purchase']); $purchase = escapeSql($_POST['purchase']);
if (empty($purchase)) { if (empty($purchase)) {
$purchase = "NULL"; $purchase = "NULL";
} else { } else {
$purchase = "'" . $purchase . "'"; $purchase = "'" . $purchase . "'";
} }
$expire = sanitizeInput($_POST['expire']); $expire = escapeSql($_POST['expire']);
if (empty($expire)) { if (empty($expire)) {
$expire = "NULL"; $expire = "NULL";
} else { } else {
$expire = "'" . $expire . "'"; $expire = "'" . $expire . "'";
} }
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);
$vendor = intval($_POST['vendor'] ?? 0); $vendor = intval($_POST['vendor'] ?? 0);
$client_id = intval(getFieldById('software', $software_id, 'software_client_id')); $client_id = intval(getFieldById('software', $software_id, 'software_client_id'));
@@ -180,7 +180,7 @@ if (isset($_GET['archive_software'])) {
// Get Software Name and Client ID for logging and alert message // Get Software Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $sql = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$software_name = sanitizeInput($row['software_name']); $software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']); $client_id = intval($row['software_client_id']);
enforceClientAccess(); enforceClientAccess();
@@ -210,7 +210,7 @@ if (isset($_GET['delete_software'])) {
// Get Software Name and Client ID for logging and alert message // Get Software Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $sql = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$software_name = sanitizeInput($row['software_name']); $software_name = escapeSql($row['software_name']);
$client_id = intval($row['software_client_id']); $client_id = intval($row['software_client_id']);
enforceClientAccess(); enforceClientAccess();

6
agent/post/tag_model.php
View File

@@ -1,7 +1,7 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']); $name = escapeSql($_POST['name']);
$type = intval($_POST['type']); $type = intval($_POST['type']);
$color = sanitizeInput($_POST['color']); $color = escapeSql($_POST['color']);
$icon = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['icon'])); $icon = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['icon']));

52
agent/post/task.php
View File

@@ -13,7 +13,7 @@ if (isset($_POST['add_task'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$ticket_id = intval($_POST['ticket_id']); $ticket_id = intval($_POST['ticket_id']);
$task_name = sanitizeInput($_POST['name']); $task_name = escapeSql($_POST['name']);
// Get Client ID from tickets using the ticket_id // Get Client ID from tickets using the ticket_id
$client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id')); $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));
@@ -37,7 +37,7 @@ if (isset($_POST['edit_ticket_task'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$task_id = intval($_POST['task_id']); $task_id = intval($_POST['task_id']);
$task_name = sanitizeInput($_POST['name']); $task_name = escapeSql($_POST['name']);
$task_order = intval($_POST['order']); $task_order = intval($_POST['order']);
$task_completion_estimate = intval($_POST['completion_estimate']); $task_completion_estimate = intval($_POST['completion_estimate']);
@@ -63,7 +63,7 @@ if (isset($_POST['edit_ticket_template_task'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$task_template_id = intval($_POST['task_template_id']); $task_template_id = intval($_POST['task_template_id']);
$task_name = sanitizeInput($_POST['name']); $task_name = escapeSql($_POST['name']);
$task_order = intval($_POST['order']); $task_order = intval($_POST['order']);
$task_completion_estimate = intval($_POST['completion_estimate']); $task_completion_estimate = intval($_POST['completion_estimate']);
@@ -89,7 +89,7 @@ if (isset($_GET['delete_task'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']); $client_id = intval($row['ticket_client_id']);
$task_name = sanitizeInput($row['task_name']); $task_name = escapeSql($row['task_name']);
mysqli_query($mysqli, "DELETE FROM tasks WHERE task_id = $task_id"); mysqli_query($mysqli, "DELETE FROM tasks WHERE task_id = $task_id");
@@ -113,7 +113,7 @@ if (isset($_GET['complete_task'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']); $client_id = intval($row['ticket_client_id']);
$task_name = sanitizeInput($row['task_name']); $task_name = escapeSql($row['task_name']);
$task_completion_estimate = intval($row['task_completion_estimate']); $task_completion_estimate = intval($row['task_completion_estimate']);
$ticket_id = intval($row['ticket_id']); $ticket_id = intval($row['ticket_id']);
@@ -147,7 +147,7 @@ if (isset($_GET['undo_complete_task'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$client_id = intval($row['ticket_client_id']); $client_id = intval($row['ticket_client_id']);
$task_name = sanitizeInput($row['task_name']); $task_name = escapeSql($row['task_name']);
$ticket_id = intval($row['ticket_id']); $ticket_id = intval($row['ticket_id']);
mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NULL, task_completed_by = NULL WHERE task_id = $task_id"); mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NULL, task_completed_by = NULL WHERE task_id = $task_id");
@@ -172,8 +172,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
enforceUserPermission('module_support', 2); enforceUserPermission('module_support', 2);
$task_id = intval($_POST['task_id']); $task_id = intval($_POST['task_id']);
$scope = sanitizeInput($_POST['approval_scope']); $scope = escapeSql($_POST['approval_scope']);
$type = sanitizeInput($_POST['approval_type']); $type = escapeSql($_POST['approval_type']);
$approval_url_key = randomString(32); $approval_url_key = randomString(32);
$required_user_id = "NULL"; $required_user_id = "NULL";
@@ -193,27 +193,27 @@ if (isset($_POST['add_ticket_task_approver'])) {
WHERE task_id = $task_id LIMIT 1 WHERE task_id = $task_id LIMIT 1
") ")
); );
$task_name = sanitizeInput($tt_row['task_name']); $task_name = escapeSql($tt_row['task_name']);
$ticket_id = intval($tt_row['task_ticket_id']); $ticket_id = intval($tt_row['task_ticket_id']);
$ticket_prefix = sanitizeInput($tt_row['ticket_prefix']); $ticket_prefix = escapeSql($tt_row['ticket_prefix']);
$ticket_number = intval($tt_row['ticket_number']); $ticket_number = intval($tt_row['ticket_number']);
$ticket_subject = sanitizeInput($tt_row['ticket_subject']); $ticket_subject = escapeSql($tt_row['ticket_subject']);
$ticket_status = sanitizeInput($tt_row['ticket_status_name']); $ticket_status = escapeSql($tt_row['ticket_status_name']);
$ticket_url_key = sanitizeInput($tt_row['ticket_url_key']); $ticket_url_key = escapeSql($tt_row['ticket_url_key']);
$ticket_contact_id = intval($tt_row['ticket_contact_id']); $ticket_contact_id = intval($tt_row['ticket_contact_id']);
$client_id = intval($tt_row['ticket_client_id']); $client_id = intval($tt_row['ticket_client_id']);
// --Notifications-- // --Notifications--
// Sanitize Config vars from get_settings.php // Sanitize Config vars from get_settings.php
$config_ticket_from_name = sanitizeInput($config_ticket_from_name); $config_ticket_from_name = escapeSql($config_ticket_from_name);
$config_ticket_from_email = sanitizeInput($config_ticket_from_email); $config_ticket_from_email = escapeSql($config_ticket_from_email);
$config_base_url = sanitizeInput($config_base_url); $config_base_url = escapeSql($config_base_url);
// Get Company Info // Get Company Info
$crow = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1")); $crow = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"));
$company_name = sanitizeInput($crow['company_name']); $company_name = escapeSql($crow['company_name']);
$company_phone = sanitizeInput(formatPhoneNumber($crow['company_phone'], $crow['company_phone_country_code'])); $company_phone = escapeSql(formatPhoneNumber($crow['company_phone'], $crow['company_phone_country_code']));
// Email contents // Email contents
$subject = "Ticket task approval required - [$ticket_prefix$ticket_number] - $ticket_subject"; $subject = "Ticket task approval required - [$ticket_prefix$ticket_number] - $ticket_subject";
@@ -224,8 +224,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
if (!empty($config_smtp_host)) { if (!empty($config_smtp_host)) {
$agent_contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $required_user_id AND user_archived_at IS NULL")); $agent_contact = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $required_user_id AND user_archived_at IS NULL"));
$name = sanitizeInput($agent_contact['user_name']); $name = escapeSql($agent_contact['user_name']);
$email = sanitizeInput($agent_contact['user_email']); $email = escapeSql($agent_contact['user_email']);
// Only add contact to email queue if email is valid // Only add contact to email queue if email is valid
if (filter_var($email, FILTER_VALIDATE_EMAIL)) { if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
@@ -247,8 +247,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
if (!empty($config_smtp_host) && $scope == 'client' && $type == 'any') { if (!empty($config_smtp_host) && $scope == 'client' && $type == 'any') {
$contact_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_email FROM contacts WHERE contact_id = $ticket_contact_id LIMIT 1")); $contact_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name, contact_email FROM contacts WHERE contact_id = $ticket_contact_id LIMIT 1"));
$contact_name = sanitizeInput($contact_row['contact_name']); $contact_name = escapeSql($contact_row['contact_name']);
$contact_email = sanitizeInput($contact_row['contact_email']); $contact_email = escapeSql($contact_row['contact_email']);
$data = []; $data = [];
@@ -279,8 +279,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
$data = []; $data = [];
while ($technical_contact = mysqli_fetch_assoc($sql_technical_contacts)) { while ($technical_contact = mysqli_fetch_assoc($sql_technical_contacts)) {
$technical_contact_name = sanitizeInput($technical_contact['contact_name']); $technical_contact_name = escapeSql($technical_contact['contact_name']);
$technical_contact_email = sanitizeInput($technical_contact['contact_email']); $technical_contact_email = escapeSql($technical_contact['contact_email']);
if (filter_var($technical_contact_email, FILTER_VALIDATE_EMAIL)) { if (filter_var($technical_contact_email, FILTER_VALIDATE_EMAIL)) {
$data[] = [ $data[] = [
@@ -312,8 +312,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
$data = []; $data = [];
while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) { while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) {
$billing_contact_name = sanitizeInput($billing_contact['contact_name']); $billing_contact_name = escapeSql($billing_contact['contact_name']);
$billing_contact_email = sanitizeInput($billing_contact['contact_email']); $billing_contact_email = escapeSql($billing_contact['contact_email']);
if (filter_var($billing_contact_email, FILTER_VALIDATE_EMAIL)) { if (filter_var($billing_contact_email, FILTER_VALIDATE_EMAIL)) {
$data[] = [ $data[] = [

480
agent/post/ticket.php
View File

File diff suppressed because it is too large Load Diff

6
agent/post/transfer.php
View File

@@ -17,13 +17,13 @@ if (isset($_POST['add_transfer'])) {
// Get Source Account Name for logging // Get Source Account Name for logging
$sql = mysqli_query($mysqli,"SELECT account_name, account_currency_code FROM accounts WHERE account_id = $account_from"); $sql = mysqli_query($mysqli,"SELECT account_name, account_currency_code FROM accounts WHERE account_id = $account_from");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$source_account_name = sanitizeInput($row['account_name']); $source_account_name = escapeSql($row['account_name']);
$account_currency_code = sanitizeInput($row['account_currency_code']); $account_currency_code = escapeSql($row['account_currency_code']);
// Get Destination Account Name for logging // Get Destination Account Name for logging
$sql = mysqli_query($mysqli,"SELECT account_name FROM accounts WHERE account_id = $account_to"); $sql = mysqli_query($mysqli,"SELECT account_name FROM accounts WHERE account_id = $account_to");
$row = mysqli_fetch_assoc($sql); $row = mysqli_fetch_assoc($sql);
$destination_account_name = sanitizeInput($row['account_name']); $destination_account_name = escapeSql($row['account_name']);
mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = $amount, expense_currency_code = '$session_company_currency', expense_vendor_id = 0, expense_category_id = 0, expense_account_id = $account_from"); mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = $amount, expense_currency_code = '$session_company_currency', expense_vendor_id = 0, expense_category_id = 0, expense_account_id = $account_from");
$expense_id = mysqli_insert_id($mysqli); $expense_id = mysqli_insert_id($mysqli);

6
agent/post/transfer_model.php
View File

@@ -1,9 +1,9 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$amount = floatval($_POST['amount']); $amount = floatval($_POST['amount']);
$account_from = intval($_POST['account_from']); $account_from = intval($_POST['account_from']);
$account_to = intval($_POST['account_to']); $account_to = intval($_POST['account_to']);
$transfer_method = sanitizeInput($_POST['transfer_method']); $transfer_method = escapeSql($_POST['transfer_method']);
$notes = sanitizeInput($_POST['notes']); $notes = escapeSql($_POST['notes']);

8
agent/post/trip.php
View File

@@ -67,8 +67,8 @@ if (isset($_GET['delete_trip'])) {
// Get Trip Info and Client ID for logging // Get Trip Info and Client ID for logging
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id")); $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id"));
$client_id = intval($row['trip_client_id']); $client_id = intval($row['trip_client_id']);
$trip_source = sanitizeInput($row['trip_source']); $trip_source = escapeSql($row['trip_source']);
$trip_destination = sanitizeInput($row['trip_destination']); $trip_destination = escapeSql($row['trip_destination']);
if ($client_id) { if ($client_id) {
enforceClientAccess(); enforceClientAccess();
@@ -102,8 +102,8 @@ if (isset($_POST['export_trips_csv'])) {
$file_name_prepend = "$session_company_name-"; $file_name_prepend = "$session_company_name-";
} }
$date_from = sanitizeInput($_POST['date_from']); $date_from = escapeSql($_POST['date_from']);
$date_to = sanitizeInput($_POST['date_to']); $date_to = escapeSql($_POST['date_to']);
if (!empty($date_from) && !empty($date_to)){ if (!empty($date_from) && !empty($date_to)){
$date_query = "DATE(trip_date) BETWEEN '$date_from' AND '$date_to'"; $date_query = "DATE(trip_date) BETWEEN '$date_from' AND '$date_to'";
$file_name_date = "$date_from-to-$date_to"; $file_name_date = "$date_from-to-$date_to";

8
agent/post/trip_model.php
View File

@@ -1,10 +1,10 @@
<?php <?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$date = sanitizeInput($_POST['date']); $date = escapeSql($_POST['date']);
$source = sanitizeInput($_POST['source']); $source = escapeSql($_POST['source']);
$destination = sanitizeInput($_POST['destination']); $destination = escapeSql($_POST['destination']);
$miles = floatval($_POST['miles']); $miles = floatval($_POST['miles']);
$roundtrip = intval($_POST['roundtrip'] ?? 0); $roundtrip = intval($_POST['roundtrip'] ?? 0);
$purpose = sanitizeInput($_POST['purpose']); $purpose = escapeSql($_POST['purpose']);
$user_id = intval($_POST['user']); $user_id = intval($_POST['user']);

Some files were not shown because too many files have changed in this diff Show More