AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-23 00:40:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update skipped function renames in anything named vendor

Browse Source
This commit is contained in:
johnnyq
2026-07-14 19:09:32 -04:00
parent cddcedbf1c
commit bcb244c245
12 changed files with 160 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
admin/modals/vendor_template/vendor_template_edit.php
View File

@@ -6,19 +6,19 @@ $vendor_template_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$vendor_name = nullable_htmlentities($row['vendor_template_name']);
$vendor_description = nullable_htmlentities($row['vendor_template_description']);
$vendor_account_number = nullable_htmlentities($row['vendor_template_account_number']);
$vendor_contact_name = nullable_htmlentities($row['vendor_template_contact_name']);
$vendor_name = escapeHtml($row['vendor_template_name']);
$vendor_description = escapeHtml($row['vendor_template_description']);
$vendor_account_number = escapeHtml($row['vendor_template_account_number']);
$vendor_contact_name = escapeHtml($row['vendor_template_contact_name']);
$vendor_phone_country_code = intval($row['vendor_template_phone_country_code']);
$vendor_phone = formatPhoneNumber($row['vendor_template_phone'], $vendor_phone_country_code);
$vendor_extension = nullable_htmlentities($row['vendor_template_extension']);
$vendor_email = nullable_htmlentities($row['vendor_template_email']);
$vendor_website = nullable_htmlentities($row['vendor_template_website']);
$vendor_hours = nullable_htmlentities($row['vendor_template_hours']);
$vendor_sla = nullable_htmlentities($row['vendor_template_sla']);
$vendor_code = nullable_htmlentities($row['vendor_template_code']);
$vendor_notes = nullable_htmlentities($row['vendor_template_notes']);
$vendor_extension = escapeHtml($row['vendor_template_extension']);
$vendor_email = escapeHtml($row['vendor_template_email']);
$vendor_website = escapeHtml($row['vendor_template_website']);
$vendor_hours = escapeHtml($row['vendor_template_hours']);
$vendor_sla = escapeHtml($row['vendor_template_sla']);
$vendor_code = escapeHtml($row['vendor_template_code']);
$vendor_notes = escapeHtml($row['vendor_template_notes']);
// Generate the HTML form content using output buffering.
ob_start();

54
admin/post/vendor_template.php
View File

@@ -11,27 +11,27 @@ if (isset($_POST['add_vendor_template'])) {
validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$account_number = sanitizeInput($_POST['account_number']);
$contact_name = sanitizeInput($_POST['contact_name']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$account_number = escapeSql($_POST['account_number']);
$contact_name = escapeSql($_POST['contact_name']);
$phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']);
$phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
$extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
$email = sanitizeInput($_POST['email']);
$website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website']));
$hours = sanitizeInput($_POST['hours']);
$sla = sanitizeInput($_POST['sla']);
$code = sanitizeInput($_POST['code']);
$notes = sanitizeInput($_POST['notes']);
$email = escapeSql($_POST['email']);
$website = preg_replace("(^https?://)", "", escapeSql($_POST['website']));
$hours = escapeSql($_POST['hours']);
$sla = escapeSql($_POST['sla']);
$code = escapeSql($_POST['code']);
$notes = escapeSql($_POST['notes']);
mysqli_query($mysqli,"INSERT INTO vendor_templates SET vendor_template_name = '$name', vendor_template_description = '$description', vendor_template_contact_name = '$contact_name', vendor_template_phone = '$phone', vendor_template_extension = '$extension', vendor_template_email = '$email', vendor_template_website = '$website', vendor_template_hours = '$hours', vendor_template_sla = '$sla', vendor_template_code = '$code', vendor_template_account_number = '$account_number', vendor_template_notes = '$notes'");
$vendor_template_id = mysqli_insert_id($mysqli);
logAction("Vendor Template", "Create", "$session_name created vendor template $name", 0, $vendor_template_id);
logAudit("Vendor Template", "Create", "$session_name created vendor template $name", 0, $vendor_template_id);
flash_alert("Vendor template <strong>$name</strong> created");
flashAlert("Vendor template <strong>$name</strong> created");
redirect();
@@ -42,19 +42,19 @@ if (isset($_POST['edit_vendor_template'])) {
validateCSRFToken($_POST['csrf_token']);
$vendor_template_id = intval($_POST['vendor_template_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$account_number = sanitizeInput($_POST['account_number']);
$contact_name = sanitizeInput($_POST['contact_name']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$account_number = escapeSql($_POST['account_number']);
$contact_name = escapeSql($_POST['contact_name']);
$phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']);
$phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
$extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
$email = sanitizeInput($_POST['email']);
$website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website']));
$hours = sanitizeInput($_POST['hours']);
$sla = sanitizeInput($_POST['sla']);
$code = sanitizeInput($_POST['code']);
$notes = sanitizeInput($_POST['notes']);
$email = escapeSql($_POST['email']);
$website = preg_replace("(^https?://)", "", escapeSql($_POST['website']));
$hours = escapeSql($_POST['hours']);
$sla = escapeSql($_POST['sla']);
$code = escapeSql($_POST['code']);
$notes = escapeSql($_POST['notes']);
if ($_POST['global_update_vendor_name'] == 1 ?? 0) {
$sql_global_update_vendor_name = ", vendor_name = '$name'";
@@ -135,9 +135,9 @@ if (isset($_POST['edit_vendor_template'])) {
mysqli_query($mysqli,"UPDATE vendors SET $sql WHERE vendor_template_id = $vendor_template_id");
}
logAction("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id);
logAudit("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id);
flash_alert("Vendor template <strong>$name</strong> edited");
flashAlert("Vendor template <strong>$name</strong> edited");
redirect();
@@ -149,16 +149,16 @@ if (isset($_GET['delete_vendor_template'])) {
$vendor_template_id = intval($_GET['delete_vendor_template']);
$vendor_template_name = sanitizeInput(getFieldById('vendor_templates', $vendor_template_id, 'vendor_template_name'));
$vendor_template_name = escapeSql(getFieldById('vendor_templates', $vendor_template_id, 'vendor_template_name'));
// If its a template reset all vendors based off this template to no template base
mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id");
mysqli_query($mysqli,"DELETE FROM vendor_templates WHERE vendor_template_id = $vendor_template_id");
logAction("Vendor Template", "Delete", "$session_name deleted vendor template $vendor_template_name");
logAudit("Vendor Template", "Delete", "$session_name deleted vendor template $vendor_template_name");
flash_alert("Vendor Template <strong>$vendor_template_name</strong> deleted", 'error');
flashAlert("Vendor Template <strong>$vendor_template_name</strong> deleted", 'error');
redirect();

24
admin/vendor_template.php
View File

@@ -33,7 +33,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Vendors Templates">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Vendors Templates">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -66,28 +66,28 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_template_id = intval($row['vendor_template_id']);
$vendor_template_name = nullable_htmlentities($row['vendor_template_name']);
$vendor_template_description = nullable_htmlentities($row['vendor_template_description']);
$vendor_template_name = escapeHtml($row['vendor_template_name']);
$vendor_template_description = escapeHtml($row['vendor_template_description']);
if (empty($vendor_template_description)) {
$vendor_template_description_display = "-";
} else {
$vendor_template_description_display = $vendor_template_description;
}
$vendor_template_account_number = nullable_htmlentities($row['vendor_template_account_number']);
$vendor_template_contact_name = nullable_htmlentities($row['vendor_template_contact_name']);
$vendor_template_account_number = escapeHtml($row['vendor_template_account_number']);
$vendor_template_contact_name = escapeHtml($row['vendor_template_contact_name']);
if (empty($vendor_template_contact_name)) {
$vendor_template_contact_name_display = "-";
} else {
$vendor_template_contact_name_display = $vendor_template_contact_name;
}
$vendor_template_phone = formatPhoneNumber($row['vendor_template_phone']);
$vendor_template_extension = nullable_htmlentities($row['vendor_template_extension']);
$vendor_template_email = nullable_htmlentities($row['vendor_template_email']);
$vendor_template_website = nullable_htmlentities($row['vendor_template_website']);
$vendor_template_hours = nullable_htmlentities($row['vendor_template_hours']);
$vendor_template_sla = nullable_htmlentities($row['vendor_template_sla']);
$vendor_template_code = nullable_htmlentities($row['vendor_template_code']);
$vendor_template_notes = nullable_htmlentities($row['vendor_template_notes']);
$vendor_template_extension = escapeHtml($row['vendor_template_extension']);
$vendor_template_email = escapeHtml($row['vendor_template_email']);
$vendor_template_website = escapeHtml($row['vendor_template_website']);
$vendor_template_hours = escapeHtml($row['vendor_template_hours']);
$vendor_template_sla = escapeHtml($row['vendor_template_sla']);
$vendor_template_code = escapeHtml($row['vendor_template_code']);
$vendor_template_notes = escapeHtml($row['vendor_template_notes']);
?>
<tr>

2
agent/modals/vendor/vendor_add_from_template.php vendored
View File

@@ -32,7 +32,7 @@ ob_start();
$sql_vendor_templates = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendor_templates)) {
$vendor_template_id = intval($row['vendor_template_id']);
$vendor_template_name = nullable_htmlentities($row['vendor_template_name']);
$vendor_template_name = escapeHtml($row['vendor_template_name']);
?>
<option value="<?= $vendor_template_id ?>"><?= $vendor_template_name ?></option>

38
agent/modals/vendor/vendor_details.php vendored
View File

@@ -7,21 +7,21 @@ $vendor_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$name = sanitizeInput($row['vendor_name']);
$description = sanitizeInput($row['vendor_description']);
$account_number = sanitizeInput($row['vendor_account_number']);
$contact_name = sanitizeInput($row['vendor_contact_name']);
$name = escapeSql($row['vendor_name']);
$description = escapeSql($row['vendor_description']);
$account_number = escapeSql($row['vendor_account_number']);
$contact_name = escapeSql($row['vendor_contact_name']);
$phone = preg_replace("/[^0-9]/", '',$row['vendor_phone']);
$extension = preg_replace("/[^0-9]/", '',$row['vendor_extension']);
$email = sanitizeInput($row['vendor_email']);
$website = sanitizeInput($row['vendor_website']);
$hours = sanitizeInput($row['vendor_hours']);
$sla = sanitizeInput($row['vendor_sla']);
$code = sanitizeInput($row['vendor_code']);
$notes = sanitizeInput($row['vendor_notes']);
$email = escapeSql($row['vendor_email']);
$website = escapeSql($row['vendor_website']);
$hours = escapeSql($row['vendor_hours']);
$sla = escapeSql($row['vendor_sla']);
$code = escapeSql($row['vendor_code']);
$notes = escapeSql($row['vendor_notes']);
// Generate the HTML form content using output buffering.
ob_start();
?>
<div class="modal-header bg-dark text-white">
@@ -29,7 +29,7 @@ ob_start();
<i class="fas fa-fw fa-building fa-2x mr-3"></i>
<div>
<h5 class="modal-title mb-0"><?php echo $name; ?></h5>
<div class="text-muted"><?php echo getFallback($description); ?></div>
<div class="text-muted"><?= $description ?: '-'; ?></div>
</div>
</div>
<button type="button" class="close text-white" data-dismiss="modal">
@@ -45,12 +45,12 @@ ob_start();
<h6 class="text-secondary"><i class="fas fa-info-circle mr-2"></i>Vendor Details</h6>
<div class="row">
<div class="col-sm-6">
<div><strong>Account Number:</strong> <?php echo getFallback($account_number); ?></div>
<div><strong>Hours:</strong> <?php echo getFallback($hours); ?></div>
<div><strong>SLA:</strong> <?php echo getFallback($sla); ?></div>
<div><strong>Account Number:</strong> <?= $account_number ?: '-'; ?></div>
<div><strong>Hours:</strong> <?= $hours ?: '-'; ?></div>
<div><strong>SLA:</strong> <?= $sla ?: '-'; ?></div>
</div>
<div class="col-sm-6">
<div><strong>Code:</strong> <?php echo getFallback($code); ?></div>
<div><strong>Code:</strong> <?= $code ?: '-'; ?></div>
<div><strong>Website:</strong> <?php echo !empty($website) ? '<a href="https://' . $website . '" target="_blank" class="text-primary">' . $website . '</a>' : '<span class="text-muted">Not Available</span>'; ?></div>
</div>
</div>
@@ -63,8 +63,8 @@ ob_start();
<h6 class="text-secondary"><i class="fas fa-user mr-2"></i>Contact Information</h6>
<div class="row">
<div class="col-sm-6">
<div><strong>Contact Name:</strong> <?php echo getFallback($contact_name); ?></div>
<div><strong>Phone:</strong> <?php echo getFallback($phone); ?></div>
<div><strong>Contact Name:</strong> <?= $contact_name ?: '-'; ?></div>
<div><strong>Phone:</strong> <?= $phone ?: '-'; ?></div>
</div>
<div class="col-sm-6">
<div><strong>Email:</strong> <?php echo !empty($email) ? '<a href="mailto:' . $email . '" class="text-primary">' . $email . '</a>' : '<span class="text-muted">Not Available</span>'; ?></div>
@@ -78,7 +78,7 @@ ob_start();
<div class="card-body">
<h6 class="text-secondary"><i class="fas fa-sticky-note mr-2"></i>Notes</h6>
<div>
<?php echo getFallback($notes); ?>
<?= $notes ?: '-'; ?>
</div>
</div>
</div>

30
agent/modals/vendor/vendor_edit.php vendored
View File

@@ -7,23 +7,23 @@ $vendor_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_description = nullable_htmlentities($row['vendor_description']);
$vendor_account_number = nullable_htmlentities($row['vendor_account_number']);
$vendor_contact_name = nullable_htmlentities($row['vendor_contact_name']);
$vendor_phone_country_code = nullable_htmlentities($row['vendor_phone_country_code']);
$vendor_phone = nullable_htmlentities(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
$vendor_extension = nullable_htmlentities($row['vendor_extension']);
$vendor_email = nullable_htmlentities($row['vendor_email']);
$vendor_website = nullable_htmlentities($row['vendor_website']);
$vendor_hours = nullable_htmlentities($row['vendor_hours']);
$vendor_sla = nullable_htmlentities($row['vendor_sla']);
$vendor_code = nullable_htmlentities($row['vendor_code']);
$vendor_notes = nullable_htmlentities($row['vendor_notes']);
$vendor_name = escapeHtml($row['vendor_name']);
$vendor_description = escapeHtml($row['vendor_description']);
$vendor_account_number = escapeHtml($row['vendor_account_number']);
$vendor_contact_name = escapeHtml($row['vendor_contact_name']);
$vendor_phone_country_code = escapeHtml($row['vendor_phone_country_code']);
$vendor_phone = escapeHtml(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
$vendor_extension = escapeHtml($row['vendor_extension']);
$vendor_email = escapeHtml($row['vendor_email']);
$vendor_website = escapeHtml($row['vendor_website']);
$vendor_hours = escapeHtml($row['vendor_hours']);
$vendor_sla = escapeHtml($row['vendor_sla']);
$vendor_code = escapeHtml($row['vendor_code']);
$vendor_notes = escapeHtml($row['vendor_notes']);
$vendor_template_id = intval($row['vendor_template_id']);
// Generate the HTML form content using output buffering.
ob_start();
?>
<div class="modal-header bg-dark">
@@ -108,7 +108,7 @@ ob_start();
$sql_vendor_templates = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC");
while ($row = mysqli_fetch_assoc($sql_vendor_templates)) {
$vendor_template_id_select = $row['vendor_template_id'];
$vendor_template_name_select = nullable_htmlentities($row['vendor_template_name']); ?>
$vendor_template_name_select = escapeHtml($row['vendor_template_name']); ?>
<option <?php if ($vendor_template_id == $vendor_template_id_select) { echo "selected"; } ?> value="<?php echo $vendor_template_id_select; ?>"><?php echo $vendor_template_name_select; ?></option>
<?php } ?>

78
agent/post/vendor.php
View File

@@ -30,28 +30,28 @@ if (isset($_POST['add_vendor_from_template'])) {
$row = mysqli_fetch_assoc($sql_vendor_templates);
$name = sanitizeInput($row['vendor_template_name']);
$description = sanitizeInput($row['vendor_template_description']);
$account_number = sanitizeInput($row['vendor_template_account_number']);
$contact_name = sanitizeInput($row['vendor_template_contact_name']);
$name = escapeSql($row['vendor_template_name']);
$description = escapeSql($row['vendor_template_description']);
$account_number = escapeSql($row['vendor_template_account_number']);
$contact_name = escapeSql($row['vendor_template_contact_name']);
$phone_country_code = preg_replace("/[^0-9]/", '',$row['vendor_template_phone_country_code']);
$phone = preg_replace("/[^0-9]/", '',$row['vendor_template_phone']);
$extension = preg_replace("/[^0-9]/", '',$row['vendor_template_extension']);
$email = sanitizeInput($row['vendor_template_email']);
$website = sanitizeInput($row['vendor_template_website']);
$hours = sanitizeInput($row['vendor_template_hours']);
$sla = sanitizeInput($row['vendor_template_sla']);
$code = sanitizeInput($row['vendor_template_code']);
$notes = sanitizeInput($row['vendor_template_notes']);
$email = escapeSql($row['vendor_template_email']);
$website = escapeSql($row['vendor_template_website']);
$hours = escapeSql($row['vendor_template_hours']);
$sla = escapeSql($row['vendor_template_sla']);
$code = escapeSql($row['vendor_template_code']);
$notes = escapeSql($row['vendor_template_notes']);
// Vendor add query
mysqli_query($mysqli,"INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id, vendor_template_id = $vendor_template_id");
$vendor_id = mysqli_insert_id($mysqli);
logAction("Vendor", "Create", "$session_name created vendor $name using a template", $client_id, $vendor_id);
logAudit("Vendor", "Create", "$session_name created vendor $name using a template", $client_id, $vendor_id);
flash_alert("Vendor <strong>$name</strong> created from template");
flashAlert("Vendor <strong>$name</strong> created from template");
redirect();
@@ -79,9 +79,9 @@ if (isset($_POST['add_vendor'])) {
$vendor_id = mysqli_insert_id($mysqli);
logAction("Vendor", "Create", "$session_name created vendor $name", $client_id, $vendor_id);
logAudit("Vendor", "Create", "$session_name created vendor $name", $client_id, $vendor_id);
flash_alert("Vendor <strong>$name</strong> created");
flashAlert("Vendor <strong>$name</strong> created");
redirect();
@@ -109,9 +109,9 @@ if (isset($_POST['edit_vendor'])) {
mysqli_query($mysqli,"UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code',vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_template_id = $vendor_template_id WHERE vendor_id = $vendor_id");
logAction("Vendor", "Edit", "$session_name edited vendor $name", $client_id, $vendor_id);
logAudit("Vendor", "Edit", "$session_name edited vendor $name", $client_id, $vendor_id);
flash_alert("Vendor <strong>$name</strong> edited");
flashAlert("Vendor <strong>$name</strong> edited");
redirect();
@@ -126,7 +126,7 @@ if (isset($_GET['archive_vendor'])) {
//Get Vendor Name
$sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id");
$row = mysqli_fetch_assoc($sql);
$vendor_name = sanitizeInput($row['vendor_name']);
$vendor_name = escapeSql($row['vendor_name']);
$client_id = intval($row['vendor_client_id']);
// Permission check
@@ -139,9 +139,9 @@ if (isset($_GET['archive_vendor'])) {
mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id");
logAction("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id);
logAudit("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id);
flash_alert("Vendor <strong>$vendor_name</strong> archived", 'error');
flashAlert("Vendor <strong>$vendor_name</strong> archived", 'error');
redirect();
@@ -156,7 +156,7 @@ if(isset($_GET['restore_vendor'])){
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id");
$row = mysqli_fetch_assoc($sql);
$vendor_name = sanitizeInput($row['vendor_name']);
$vendor_name = escapeSql($row['vendor_name']);
$client_id = intval($row['vendor_client_id']);
// Permission check
@@ -169,9 +169,9 @@ if(isset($_GET['restore_vendor'])){
mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id");
logAction("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id);
logAudit("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id);
flash_alert("Vendor <strong>$vendor_name</strong> restored");
flashAlert("Vendor <strong>$vendor_name</strong> restored");
redirect();
@@ -186,7 +186,7 @@ if (isset($_GET['delete_vendor'])) {
//Get Vendor Name
$sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id");
$row = mysqli_fetch_assoc($sql);
$vendor_name = sanitizeInput($row['vendor_name']);
$vendor_name = escapeSql($row['vendor_name']);
$client_id = intval($row['vendor_client_id']);
$vendor_template_id = intval($row['vendor_template_id']);
@@ -205,9 +205,9 @@ if (isset($_GET['delete_vendor'])) {
mysqli_query($mysqli,"DELETE FROM vendors WHERE vendor_id = $vendor_id");
logAction("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id);
logAudit("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id);
flash_alert("Vendor <strong>$vendor_name</strong> deleted", 'error');
flashAlert("Vendor <strong>$vendor_name</strong> deleted", 'error');
redirect();
@@ -230,7 +230,7 @@ if (isset($_POST['bulk_archive_vendors'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id");
$row = mysqli_fetch_assoc($sql);
$vendor_name = sanitizeInput($row['vendor_name']);
$vendor_name = escapeSql($row['vendor_name']);
$client_id = intval($row['vendor_client_id']);
// Permission check
@@ -243,12 +243,12 @@ if (isset($_POST['bulk_archive_vendors'])) {
mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id");
logAction("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id);
logAudit("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id);
}
logAction("Vendor", "Bulk Archive", "$session_name archived $count vendor(s)");
logAudit("Vendor", "Bulk Archive", "$session_name archived $count vendor(s)");
flash_alert("Archived <strong>$count</strong> vendor(s)", 'error');
flashAlert("Archived <strong>$count</strong> vendor(s)", 'error');
}
@@ -273,7 +273,7 @@ if (isset($_POST['bulk_restore_vendors'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id FROM vendors WHERE vendor_id = $vendor_id");
$row = mysqli_fetch_assoc($sql);
$vendor_name = sanitizeInput($row['vendor_name']);
$vendor_name = escapeSql($row['vendor_name']);
$client_id = intval($row['vendor_client_id']);
// Permission check
@@ -286,13 +286,13 @@ if (isset($_POST['bulk_restore_vendors'])) {
mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id");
logAction("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id);
logAudit("Vendor", "Restore", "$session_name restored vendor $vendor_name", $client_id, $vendor_id);
}
logAction("Vendor", "Bulk Restore", "$session_name restored $count vendor(s)");
logAudit("Vendor", "Bulk Restore", "$session_name restored $count vendor(s)");
flash_alert("Restored <strong>$count</strong> vendor(s)");
flashAlert("Restored <strong>$count</strong> vendor(s)");
}
@@ -317,7 +317,7 @@ if (isset($_POST['bulk_delete_vendors'])) {
// Get Name and Client ID for logging and alert message
$sql = mysqli_query($mysqli,"SELECT vendor_name, vendor_client_id, vendor_template_id FROM vendors WHERE vendor_id = $vendor_id");
$row = mysqli_fetch_assoc($sql);
$vendor_name = sanitizeInput($row['vendor_name']);
$vendor_name = escapeSql($row['vendor_name']);
$client_id = intval($row['vendor_client_id']);
$vendor_template_id = intval($row['vendor_template_id']);
@@ -336,13 +336,13 @@ if (isset($_POST['bulk_delete_vendors'])) {
mysqli_query($mysqli, "DELETE FROM vendors WHERE vendor_id = $vendor_id AND vendor_client_id = $client_id");
logAction("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id);
logAudit("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id);
}
logAction("Vendor", "Bulk Delete", "$session_name deleted $count vendor(s)");
logAudit("Vendor", "Bulk Delete", "$session_name deleted $count vendor(s)");
flash_alert("Deleted <strong>$count</strong> vendor(s)", 'error');
flashAlert("Deleted <strong>$count</strong> vendor(s)", 'error');
}
@@ -376,7 +376,7 @@ if (isset($_POST['export_vendors_csv'])) {
$delimiter = ",";
$enclosure = '"';
$escape = '\\'; // backslash
$filename = sanitize_filename($file_name_prepend . "Vendors-" . date('Y-m-d_H-i-s') . ".csv");
$filename = sanitizeFilename($file_name_prepend . "Vendors-" . date('Y-m-d_H-i-s') . ".csv");
//create a file pointer
$f = fopen('php://memory', 'w');
@@ -402,7 +402,7 @@ if (isset($_POST['export_vendors_csv'])) {
fpassthru($f);
}
logAction("Vendor", "Export", "$session_name exported $count vendor(s) to a CSV file");
logAudit("Vendor", "Export", "$session_name exported $count vendor(s) to a CSV file");
exit;

10
agent/post/vendor_contact_model.php
View File

@@ -3,11 +3,11 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$client_id = intval($_POST['client_id']);
$vendor_id = intval($_POST['vendor_id']);
$name = sanitizeInput($_POST['name']);
$title = sanitizeInput($_POST['title']);
$department = sanitizeInput($_POST['department']);
$name = escapeSql($_POST['name']);
$title = escapeSql($_POST['title']);
$department = escapeSql($_POST['department']);
$phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
$extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
$mobile = preg_replace("/[^0-9]/", '', $_POST['mobile']);
$email = sanitizeInput($_POST['email']);
$notes = sanitizeInput($_POST['notes']);
$email = escapeSql($_POST['email']);
$notes = escapeSql($_POST['notes']);

20
agent/post/vendor_model.php
View File

@@ -1,16 +1,16 @@
<?php
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$account_number = sanitizeInput($_POST['account_number']);
$contact_name = sanitizeInput($_POST['contact_name']);
$name = escapeSql($_POST['name']);
$description = escapeSql($_POST['description']);
$account_number = escapeSql($_POST['account_number']);
$contact_name = escapeSql($_POST['contact_name']);
$phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']);
$phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
$extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
$email = sanitizeInput($_POST['email']);
$website = preg_replace("(^https?://)", "", sanitizeInput($_POST['website']));
$hours = sanitizeInput($_POST['hours']);
$sla = sanitizeInput($_POST['sla']);
$code = sanitizeInput($_POST['code']);
$notes = sanitizeInput($_POST['notes']);
$email = escapeSql($_POST['email']);
$website = preg_replace("(^https?://)", "", escapeSql($_POST['website']));
$hours = escapeSql($_POST['hours']);
$sla = escapeSql($_POST['sla']);
$code = escapeSql($_POST['code']);
$notes = escapeSql($_POST['notes']);

4
agent/products.php
View File

@@ -237,7 +237,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
}
$product_qty = intval($row['product_qty']);
$product_code = escapeHtml($row['product_code']);
$product_location = escapeHtml(getFallBack($row['product_location']));
$product_location = escapeHtml($row['product_location']) ?: '-';
$product_price = floatval($row['product_price']);
$product_currency_code = escapeHtml($row['product_currency_code']);
$product_created_at = escapeHtml($row['product_created_at']);
@@ -245,7 +245,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
$category_id = intval($row['category_id']);
$category_name = escapeHtml($row['category_name']);
$product_tax_id = intval($row['product_tax_id']);
$tax_name = escapeHtml(getFallBack($row['tax_name']));
$tax_name = escapeHtml($row['tax_name']) ?: '-';
$tax_percent = floatval($row['tax_percent']);

4
agent/recurring_tickets.php
View File

@@ -291,9 +291,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
} else {
$recurring_ticket_billable_display = "-";
}
$recurring_ticket_category = getFallBack(escapeHtml($row['category_name']));
$recurring_ticket_category = escapeHtml($row['category_name']) ?: '-';
$recurring_ticket_client_name = escapeHtml($row['client_name']);
$assigned_to = getFallBack(escapeHtml($row['user_name']));
$assigned_to = escapeHtml($row['user_name']) ?: '-';
?>
<tr>

34
agent/vendors.php
View File

@@ -68,7 +68,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
<div class="col-md-4">
<div class="input-group mb-3 mb-md-0">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Vendors">
<input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search Vendors">
<div class="input-group-append">
<button class="btn btn-dark"><i class="fa fa-search"></i></button>
</div>
@@ -151,43 +151,43 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
while ($row = mysqli_fetch_assoc($sql)) {
$vendor_id = intval($row['vendor_id']);
$vendor_name = nullable_htmlentities($row['vendor_name']);
$vendor_description = nullable_htmlentities($row['vendor_description']);
$vendor_name = escapeHtml($row['vendor_name']);
$vendor_description = escapeHtml($row['vendor_description']);
if ($vendor_description) {
$vendor_description_display = $vendor_description;
} else {
$vendor_description_display = "-";
}
$vendor_account_number = nullable_htmlentities($row['vendor_account_number']);
$vendor_account_number = escapeHtml($row['vendor_account_number']);
if ($vendor_account_number) {
$vendor_account_number_display = "<div class='text-secondary'>Account #: <span class='text-monospace'>$vendor_account_number</span></div>";
} else {
$vendor_account_number_display = '';
}
$vendor_contact_name = nullable_htmlentities($row['vendor_contact_name']);
$vendor_contact_name = escapeHtml($row['vendor_contact_name']);
if ($vendor_contact_name) {
$vendor_contact_name_display = $vendor_contact_name;
} else {
$vendor_contact_name_display = "-";
}
$vendor_phone_country_code = nullable_htmlentities($row['vendor_phone_country_code']);
$vendor_phone = nullable_htmlentities(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
$vendor_extension = nullable_htmlentities($row['vendor_extension']);
$vendor_email = nullable_htmlentities($row['vendor_email']);
$vendor_website = nullable_htmlentities($row['vendor_website']);
$vendor_phone_country_code = escapeHtml($row['vendor_phone_country_code']);
$vendor_phone = escapeHtml(formatPhoneNumber($row['vendor_phone'], $vendor_phone_country_code));
$vendor_extension = escapeHtml($row['vendor_extension']);
$vendor_email = escapeHtml($row['vendor_email']);
$vendor_website = escapeHtml($row['vendor_website']);
if ($vendor_website) {
$vendor_website_display = "<a href='https://$vendor_website' target='_blank'>$vendor_website <i class='fa fa-external-link-alt'></i></a><button type='button' class='btn btn-sm clipboardjs' data-clipboard-text='$vendor_website'><i class='far fa-copy text-secondary'></i></button>";
} else {
$vendor_website_display = "-";
}
$vendor_hours = nullable_htmlentities($row['vendor_hours']);
$vendor_sla = nullable_htmlentities($row['vendor_sla']);
$vendor_code = nullable_htmlentities($row['vendor_code']);
$vendor_notes = nullable_htmlentities($row['vendor_notes']);
$vendor_created_at = nullable_htmlentities($row['vendor_created_at']);
$vendor_archived_at = nullable_htmlentities($row['vendor_archived_at']);
$vendor_hours = escapeHtml($row['vendor_hours']);
$vendor_sla = escapeHtml($row['vendor_sla']);
$vendor_code = escapeHtml($row['vendor_code']);
$vendor_notes = escapeHtml($row['vendor_notes']);
$vendor_created_at = escapeHtml($row['vendor_created_at']);
$vendor_archived_at = escapeHtml($row['vendor_archived_at']);
$vendor_template_id = intval($row['vendor_template_id']);
$vendor_template_name = nullable_htmlentities($row['vendor_template_name']);
$vendor_template_name = escapeHtml($row['vendor_template_name']);
if ($vendor_template_id) {
$vendor_template_display = "<div class='text-secondary' title='Base Vendor Template'><i class='fas fa-puzzle-piece mr-1'></i>$vendor_template_name</div>";
} else {