From c01645c4e2c8ba4a7f302c956543049cd6e796a3 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Wed, 8 Jul 2026 18:13:14 -0400
Subject: [PATCH] Expense: On create enforce client Access only if Client is
 selected

---
 agent/post/expense.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/agent/post/expense.php b/agent/post/expense.php
index 28f286ad..4b0a50cc 100644
--- a/agent/post/expense.php
+++ b/agent/post/expense.php
@@ -14,6 +14,10 @@ if (isset($_POST['add_expense'])) {
 
     require_once 'expense_model.php';
 
+    if ($client_id) {
+        enforceClientAccess();
+    }
+    
     mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = $amount, expense_currency_code = '$session_company_currency', expense_account_id = $account, expense_vendor_id = $vendor, expense_client_id = $client_id, expense_category_id = $category, expense_description = '$description', expense_reference = '$reference'");
 
     $expense_id = mysqli_insert_id($mysqli);