From c71d1f190ea4e51553e033e1f47417fe8afefa3d Mon Sep 17 00:00:00 2001 From: johnnyq Date: Mon, 2 Mar 2026 19:15:52 -0500 Subject: [PATCH] locations: Add missing CSRF checks, add missing permission checks, renamed unarchive to restore --- agent/locations.php | 12 ++++---- agent/modals/location/location_add.php | 1 + agent/modals/location/location_edit.php | 1 + agent/modals/location/location_export.php | 1 + agent/modals/location/location_import.php | 1 + agent/post/location.php | 37 +++++++++++++++++------ 6 files changed, 38 insertions(+), 15 deletions(-) diff --git a/agent/locations.php b/agent/locations.php index 85880328..07006655 100644 --- a/agent/locations.php +++ b/agent/locations.php @@ -190,8 +190,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
diff --git a/agent/modals/location/location_edit.php b/agent/modals/location/location_edit.php index c9e6acd1..9b83f322 100644 --- a/agent/modals/location/location_edit.php +++ b/agent/modals/location/location_edit.php @@ -47,6 +47,7 @@ ob_start();
+ diff --git a/agent/modals/location/location_export.php b/agent/modals/location/location_export.php index eaed614a..95e07d88 100644 --- a/agent/modals/location/location_export.php +++ b/agent/modals/location/location_export.php @@ -15,6 +15,7 @@ ob_start(); +
diff --git a/agent/modals/location/location_import.php b/agent/modals/location/location_import.php index 4f3a654b..b381be52 100644 --- a/agent/modals/location/location_import.php +++ b/agent/modals/location/location_import.php @@ -15,6 +15,7 @@ ob_start();
+
diff --git a/agent/post/location.php b/agent/post/location.php index 4d23be57..7b486f72 100644 --- a/agent/post/location.php +++ b/agent/post/location.php @@ -8,6 +8,8 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); if(isset($_POST['add_location'])){ + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); require_once 'location_model.php'; @@ -60,6 +62,8 @@ if(isset($_POST['add_location'])){ if(isset($_POST['edit_location'])){ + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); require_once 'location_model.php'; @@ -122,6 +126,8 @@ if(isset($_POST['edit_location'])){ if(isset($_GET['archive_location'])){ + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_client', 2); $location_id = intval($_GET['archive_location']); @@ -142,11 +148,13 @@ if(isset($_GET['archive_location'])){ } -if(isset($_GET['unarchive_location'])){ +if(isset($_GET['restore_location'])){ + + validateCSRFToken($_GET['csrf_token']); enforceUserPermission('module_client', 2); - $location_id = intval($_GET['unarchive_location']); + $location_id = intval($_GET['restore_location']); // Get Location Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); @@ -156,7 +164,7 @@ if(isset($_GET['unarchive_location'])){ mysqli_query($mysqli,"UPDATE locations SET location_archived_at = NULL WHERE location_id = $location_id"); - logAction("Location", "Unarchive", "$session_name unarchived location $location_name", $client_id, $location_id); + logAction("Location", "Restore", "$session_name restored location $location_name", $client_id, $location_id); flash_alert("Location $location_name restored"); @@ -166,6 +174,8 @@ if(isset($_GET['unarchive_location'])){ if(isset($_GET['delete_location'])){ + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_client', 3); $location_id = intval($_GET['delete_location']); @@ -188,6 +198,8 @@ if(isset($_GET['delete_location'])){ if (isset($_POST['bulk_assign_location_tags'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); // Assign Tags to Selected @@ -238,9 +250,10 @@ if (isset($_POST['bulk_assign_location_tags'])) { if (isset($_POST['bulk_archive_locations'])) { - enforceUserPermission('module_client', 2); validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); + if (isset($_POST['location_ids'])) { $count = 0; // Default 0 @@ -278,7 +291,7 @@ if (isset($_POST['bulk_archive_locations'])) { } -if (isset($_POST['bulk_unarchive_locations'])) { +if (isset($_POST['bulk_restore_locations'])) { validateCSRFToken($_POST['csrf_token']); @@ -289,7 +302,7 @@ if (isset($_POST['bulk_unarchive_locations'])) { // Get Selected Count $count = count($_POST['location_ids']); - // Cycle through array and unarchive + // Cycle through array and restore foreach ($_POST['location_ids'] as $location_id) { $location_id = intval($location_id); @@ -302,13 +315,13 @@ if (isset($_POST['bulk_unarchive_locations'])) { mysqli_query($mysqli,"UPDATE locations SET location_archived_at = NULL WHERE location_id = $location_id"); - logAction("Location", "Unarchive", "$session_name unarchived location $location_name", $client_id, $location_id); + logAction("Location", "Restore", "$session_name restored location $location_name", $client_id, $location_id); } - logAction("Location", "Bulk Unarchive", "$session_name unarchived $count location(s)", $client_id); + logAction("Location", "Bulk Restore", "$session_name restored $count location(s)", $client_id); - flash_alert("Unarchived $count location(s)"); + flash_alert("Restored $count location(s)"); } @@ -356,6 +369,10 @@ if (isset($_POST['bulk_delete_locations'])) { if(isset($_POST['export_locations_csv'])){ + validateCSRFToken($_POST['csrf_token']); + + enforceUserPermission('module_client'); + if ($_POST['client_id']) { $client_id = intval($_POST['client_id']); $client_query = "AND location_client_id = $client_id"; @@ -410,6 +427,8 @@ if(isset($_POST['export_locations_csv'])){ if (isset($_POST["import_locations_csv"])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); $client_id = intval($_POST['client_id']);