AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add user-based RBAC for API keys

Browse Source 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
This commit is contained in:
johnnyq
2026-07-25 16:50:58 -04:00
parent 8d46e2a7db
commit c509b7f693
25 changed files with 954 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
api/v1/assets/read.php
View File

@@ -8,41 +8,41 @@ require_once '../require_get_method.php';
// Asset via ID (single)
if (isset($_GET['asset_id'])) {
$id = intval($_GET['asset_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND asset_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND 1=1 " . apiClientScopeSql('asset_client_id') . "");
} elseif (isset($_GET['asset_type'])) {
// Asset query via type
$type = mysqli_real_escape_string($mysqli, ucfirst($_GET['asset_type']));
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['asset_name'])) {
// Asset query via name
$name = mysqli_real_escape_string($mysqli, $_GET['asset_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['asset_serial'])) {
// Asset query via serial
$serial = mysqli_real_escape_string($mysqli, $_GET['asset_serial']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['asset_mac'])) {
// Asset query via mac
$mac = mysqli_real_escape_string($mysqli, $_GET['asset_mac']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['asset_uri'])) {
// Asset query via uri
$uri = mysqli_real_escape_string($mysqli, $_GET['asset_uri']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['asset_uri_2'])) {
// Asset query via uri2
$uri2 = mysqli_real_escape_string($mysqli, $_GET['asset_uri_2']);
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
}else {
// All assets (by client ID or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
}
// Output

6
api/v1/certificates/read.php
View File

@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
// Specific certificate via ID (single)
if (isset($_GET['certificate_id'])) {
$id = intval($_GET['certificate_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND certificate_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND 1=1 " . apiClientScopeSql('certificate_client_id') . "");
} elseif (isset($_GET['certificate_name'])) {
// Certificate by name
$name = mysqli_real_escape_string($mysqli, $_GET['certificate_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset");
} else {
// All certificates (by client ID or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset");
}
// Output

8
api/v1/contacts/read.php
View File

@@ -8,21 +8,21 @@ require_once '../require_get_method.php';
// Specific contact via ID (single)
if (isset($_GET['contact_id'])) {
$id = intval($_GET['contact_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND contact_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND 1=1 " . apiClientScopeSql('contact_client_id') . "");
} elseif (isset($_GET['contact_email'])) {
// Specific contact via email (single)
$email = mysqli_real_escape_string($mysqli, $_GET['contact_email']);
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND 1=1 " . apiClientScopeSql('contact_client_id') . "");
} elseif (isset($_GET['contact_phone_or_mobile'])) {
// Specific contact via phone number or mobile (single)
$phone_or_mob = mysqli_real_escape_string($mysqli, $_GET['contact_phone_or_mobile']);
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND contact_client_id LIKE '$client_id' LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND 1=1 " . apiClientScopeSql('contact_client_id') . " LIMIT 1");
} else {
// All contacts (by client ID, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id LIKE '$client_id' ORDER BY contact_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE 1=1 " . apiClientScopeSql('contact_client_id') . " ORDER BY contact_id LIMIT $limit OFFSET $offset");
}
// Output

4
api/v1/credentials/read.php
View File

@@ -17,13 +17,13 @@ if (isset($_GET['credential_id']) && !empty($api_key_decrypt_password)) {
$id = intval($_GET['credential_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND credential_client_id LIKE '$client_id' LIMIT 1");
$sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND 1=1 " . apiClientScopeSql('credential_client_id') . " LIMIT 1");
} elseif (!empty($api_key_decrypt_password)) {
// All credentials ("credentials")
$sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id LIKE '$client_id' ORDER BY credential_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE 1=1 " . apiClientScopeSql('credential_client_id') . " ORDER BY credential_id LIMIT $limit OFFSET $offset");
}

4
api/v1/documents/read.php
View File

@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
if (isset($_GET['document_id'])) {
// Document via ID (single)
$id = intval($_GET['document_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND document_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND 1=1 " . apiClientScopeSql('document_client_id') . "");
} else {
// All documents (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_client_id LIKE '$client_id' ORDER BY document_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE 1=1 " . apiClientScopeSql('document_client_id') . " ORDER BY document_id LIMIT $limit OFFSET $offset");
}
// Output

6
api/v1/domains/read.php
View File

@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
// Specific domain via ID (single)
if (isset($_GET['domain_id'])) {
$id = intval($_GET['domain_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND domain_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND 1=1 " . apiClientScopeSql('domain_client_id') . "");
} elseif (isset($_GET['domain_name'])) {
// Domain by name
$name = mysqli_real_escape_string($mysqli, $_GET['domain_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
} else {
// All domains (by client ID or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
}
// Output

173
api/v1/enforce_api_rbac.php Normal file
View File

@@ -0,0 +1,173 @@
<?php
/*
* API - enforce_api_rbac.php
*
* Every API key runs as a user (api_key_user_id). This loads that user's role and
* client access, then enforces the SAME permissions the UI uses:
* - module + operation (read/write/full) via lookupUserPermission()
* - client access via the user's allow / deny lists
*
* There is no per-key client scope anymore - client access derives entirely from
* the user. Reads are scoped with apiClientScopeSql(); writes act on a single
* target client supplied in the request and validated against the user's access.
*
* Reuses the existing RBAC machinery so there is no parallel permission model.
* Included by validate_api_key.php - runs in global scope with $mysqli,
* $api_key_user_id and $return_arr available.
*/
// --- Helpers (defined first so they exist for the endpoint that includes us) ---
// JSON 403 + stop.
function apiDeny($message) {
global $return_arr;
$return_arr['success'] = "False";
$return_arr['message'] = $message;
header("HTTP/1.1 403 Forbidden");
echo json_encode($return_arr);
exit();
}
// Can the signed-in (key's) user access this single client? Mirrors enforceClientAccess:
// admin -> yes; explicit deny -> no; otherwise allowed if in the allow list or the
// user has no allow list (unrestricted).
function apiUserCanAccessClient($client_id) {
global $session_is_admin, $client_access_array, $client_deny_array;
$client_id = intval($client_id);
if ($session_is_admin) {
return true;
}
if (in_array($client_id, $client_deny_array, true)) {
return false;
}
return empty($client_access_array) || in_array($client_id, $client_access_array, true);
}
// Client-scope SQL fragment for a read query, from the user's allow / deny lists.
// Admin and unrestricted users get no restriction. Column-aware, so it works on any
// resource. Returns " AND ..." or "" (used after a "WHERE 1=1" anchor).
function apiClientScopeSql($column) {
global $session_is_admin, $client_access_array, $client_deny_array;
if ($session_is_admin) {
return '';
}
if (empty($client_access_array) && empty($client_deny_array)) {
return ''; // unrestricted user - all clients
}
$sql = '';
if (!empty($client_access_array)) {
$sql .= " AND $column IN (" . implode(',', array_map('intval', $client_access_array)) . ")";
}
if (!empty($client_deny_array)) {
$sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
}
return $sql;
}
// --- Every key must be tied to a user (legacy keys were removed in the 2.4.7 migration) ---
if (empty($api_key_user_id)) {
apiDeny("This API key is not tied to a user and is no longer valid. Please recreate it.");
}
// --- 1) Load the linked user's session context (mirrors load_user_session.php) ---
$sql_api_user = mysqli_query($mysqli,
"SELECT users.user_id, user_name, user_type, user_status, user_archived_at,
user_role_id, role_is_admin
FROM users
LEFT JOIN user_roles ON user_role_id = role_id
WHERE users.user_id = $api_key_user_id
LIMIT 1");
$api_user = $sql_api_user ? mysqli_fetch_assoc($sql_api_user) : null;
// Linked user must exist, be an active agent (user_type 1), and not be archived.
if (!$api_user
|| intval($api_user['user_type']) !== 1
|| intval($api_user['user_status']) !== 1
|| $api_user['user_archived_at'] !== null) {
apiDeny("The user linked to this API key is inactive, archived, or invalid.");
}
$session_user_id = intval($api_user['user_id']);
$session_name = escapeSql($api_user['user_name']);
$session_user_role = intval($api_user['user_role_id']);
$session_is_admin = isset($api_user['role_is_admin']) && $api_user['role_is_admin'] == 1;
// Load the user's client allow / deny lists.
$client_access_array = [];
$client_deny_array = [];
$sql_api_perms = mysqli_query($mysqli,
"SELECT client_id, permission_type FROM user_client_permissions WHERE user_id = $session_user_id");
while ($sql_api_perms && $prow = mysqli_fetch_assoc($sql_api_perms)) {
if ($prow['permission_type'] === 'deny') {
$client_deny_array[] = (int) $prow['client_id'];
} else {
$client_access_array[] = (int) $prow['client_id'];
}
}
// --- 2) Enforce module + operation permission for the requested endpoint ---
// SCRIPT_NAME is the file actually executed, so rewrites can't spoof the resource.
$script = $_SERVER['SCRIPT_NAME'] ?? $_SERVER['PHP_SELF'] ?? '';
$parts = array_values(array_filter(explode('/', $script), 'strlen'));
$n = count($parts);
$operation_file = $n >= 1 ? strtolower($parts[$n - 1]) : '';
$resource = $n >= 2 ? strtolower($parts[$n - 2]) : '';
// API resource -> UI module (matches the mapping used across the app).
$resource_module = [
'assets' => 'module_support',
'certificates' => 'module_support',
'documents' => 'module_support',
'domains' => 'module_support',
'networks' => 'module_support',
'software' => 'module_support',
'tickets' => 'module_support',
'technicians' => 'module_support',
'clients' => 'module_client',
'contacts' => 'module_client',
'locations' => 'module_client',
'vendors' => 'module_client',
'invoices' => 'module_sales',
'invoice_items' => 'module_sales',
'quotes' => 'module_sales',
'products' => 'module_sales',
'expenses' => 'module_financial',
'credentials' => 'module_credential',
];
// Operation -> required permission level (read = 1, create/update = 2, delete = 3).
$operation_level = [
'read.php' => 1,
'create.php' => 2,
'update.php' => 2,
'delete.php' => 3,
];
if (!isset($resource_module[$resource])) {
// Fail closed: any endpoint that reaches the enforcer must map to a module. When
// you add a new API resource, add it to $resource_module above - that deliberate
// step is what brings it under RBAC, so nothing can slip through ungated.
apiDeny("This API resource is not mapped to a permission module.");
}
$required_level = $operation_level[$operation_file] ?? 2;
if (lookupUserPermission($resource_module[$resource]) < $required_level) {
apiDeny("The user linked to this API key does not have permission for this action.");
}
// --- 3) Target client for writes: taken from the request, validated against the user ---
// Reads ignore this and use apiClientScopeSql(). Create/update/delete act on a single
// client the caller names (client_id in the body/query); it must be within the user's
// access. Callers that omit it get $client_id = 0 (creates that require a client fail
// their own !empty($client_id) guard, which is the intended "must name a client").
$client_id = intval($_POST['client_id'] ?? $_GET['client_id'] ?? 0);
$is_write = in_array($operation_file, ['create.php', 'update.php', 'delete.php'], true);
if ($is_write && !apiUserCanAccessClient($client_id)) {
// Writes act on a single client the caller names (client_id 0 = a global record).
// The user must be able to access it - this also blocks a restricted user from
// writing global (client_id 0) records, which their access does not include.
apiDeny("The user linked to this API key does not have access to the target client for this write.");
}
// Reads ignore $client_id entirely and are scoped by apiClientScopeSql().

4
api/v1/invoice_items/read.php
View File

@@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) {
FROM invoice_items ii
INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
WHERE ii.item_id = '$item_id'
AND i.invoice_client_id LIKE '$client_id'
AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
LIMIT 1"
);
} elseif (isset($_GET['invoice_id'])) {
@@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) {
FROM invoice_items ii
INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
WHERE ii.item_invoice_id = '$invoice_id'
AND i.invoice_client_id LIKE '$client_id'
AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
ORDER BY ii.item_order ASC, ii.item_id ASC
LIMIT $limit OFFSET $offset"
);

4
api/v1/invoices/read.php
View File

@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
if (isset($_GET['invoice_id'])) {
// Invoice via ID (single)
$id = intval($_GET['invoice_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND invoice_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND 1=1 " . apiClientScopeSql('invoice_client_id') . "");
} else {
// All invoices (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id LIKE '$client_id' ORDER BY invoice_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE 1=1 " . apiClientScopeSql('invoice_client_id') . " ORDER BY invoice_id LIMIT $limit OFFSET $offset");
}
// Output

4
api/v1/locations/read.php
View File

@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
if (isset($_GET['location_id'])) {
// Location via ID (single)
$id = intval($_GET['location_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND location_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND 1=1 " . apiClientScopeSql('location_client_id') . "");
} else {
// All locations (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id LIKE '$client_id' ORDER BY location_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE 1=1 " . apiClientScopeSql('location_client_id') . " ORDER BY location_id LIMIT $limit OFFSET $offset");
}
// Output

6
api/v1/networks/read.php
View File

@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
// Specific network via ID (single)
if (isset($_GET['network_id'])) {
$id = intval($_GET['network_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND network_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND 1=1 " . apiClientScopeSql('network_client_id') . "");
} elseif (isset($_GET['network_name'])) {
// Network by name
$name = mysqli_real_escape_string($mysqli, $_GET['network_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset");
} else {
// All networks (by client ID or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset");
}
// Output

2
api/v1/quotes/read.php
View File

@@ -12,7 +12,7 @@ if (isset($_GET['quote_id'])) {
} else {
// All quotes (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_client_id LIKE '$client_id' ORDER BY quote_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE 1=1 " . apiClientScopeSql('quote_client_id') . " ORDER BY quote_id LIMIT $limit OFFSET $offset");
}
// Output

10
api/v1/software/read.php
View File

@@ -8,26 +8,26 @@ require_once '../require_get_method.php';
// Specific software via ID (single)
if (isset($_GET['software_id'])) {
$id = intval($_GET['software_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND 1=1 " . apiClientScopeSql('software_client_id') . "");
} elseif (isset($_GET['software_key'])) {
// Specific software via key
$key = mysqli_real_escape_string($mysqli, $_GET['software_license']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['software_name'])) {
// Software by name
$name = mysqli_real_escape_string($mysqli, $_GET['software_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND software_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
} elseif (isset($_GET['software_type'])) {
// Software via type
$type = intval($_GET['software_type']);
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
} else {
// All software(s) (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
}
// Output

2
api/v1/technicians/time.php
View File

@@ -62,7 +62,7 @@ $sql = mysqli_query(
WHERE tr.ticket_reply_time_worked IS NOT NULL
AND tr.ticket_reply_time_worked != '00:00:00'
AND $date_conditions
AND t.ticket_client_id LIKE '$client_id'
AND t.1=1 " . apiClientScopeSql('ticket_client_id') . "
$technician_condition
GROUP BY t.ticket_id, u.user_id
ORDER BY c.client_name ASC, t.ticket_number ASC, u.user_name ASC

4
api/v1/tickets/read.php
View File

@@ -12,12 +12,12 @@ if (isset($_GET['ticket_id'])) {
$mysqli,
"SELECT * FROM tickets
LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
WHERE ticket_id = '$id' AND ticket_client_id LIKE '$client_id'"
WHERE ticket_id = '$id' AND 1=1 " . apiClientScopeSql('ticket_client_id') . ""
);
} else {
// All tickets (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id LIKE '$client_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE 1=1 " . apiClientScopeSql('ticket_client_id') . " ORDER BY ticket_id LIMIT $limit OFFSET $offset");
}
// Output

5
api/v1/validate_api_key.php
View File

@@ -94,7 +94,7 @@ if (isset($api_key)) {
$row = mysqli_fetch_assoc($sql);
$api_key_name = htmlentities($row['api_key_name']);
$api_key_decrypt_hash = $row['api_key_decrypt_hash']; // No sanitization
$client_id = intval($row['api_key_client_id']);
$api_key_user_id = intval($row['api_key_user_id']);
// Set limit & offset for queries
if (isset($_GET['limit'])) {
@@ -113,5 +113,8 @@ if (isset($api_key)) {
$offset = 0;
}
// When the key is tied to a user, enforce that user's RBAC (module + operation + client scope)
require __DIR__ . '/enforce_api_rbac.php';
}
}

4
api/v1/vendors/read.php vendored
View File

@@ -7,11 +7,11 @@ require_once '../require_get_method.php';
// Specific vendor via their ID (single)
if (isset($_GET['vendor_id'])) {
$id = intval($_GET['vendor_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND vendor_client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND 1=1 " . apiClientScopeSql('vendor_client_id') . "");
} else {
// All Vendors (by client ID or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id LIKE '$client_id' ORDER BY vendor_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE 1=1 " . apiClientScopeSql('vendor_client_id') . " ORDER BY vendor_id LIMIT $limit OFFSET $offset");
}
// Output