From e300907e327bfc0749a0b6d137a46fb208f52132 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Tue, 21 Feb 2023 01:29:04 -0500 Subject: [PATCH] More UI Work, santizeInput conv --- categories.php | 22 ++++++---- category_add_modal.php | 8 ++-- category_edit_modal.php | 8 ++-- client_asset_add_modal.php | 16 +++---- client_asset_copy_modal.php | 14 +++---- client_asset_documents_modal.php | 6 +-- client_asset_edit_modal.php | 14 +++---- client_asset_import_modal.php | 4 +- client_asset_tickets_modal.php | 10 ++--- client_assets.php | 70 ++++++++++++++++++------------- client_certificate_add_modal.php | 6 +-- client_certificate_edit_modal.php | 6 +-- client_certificates.php | 12 +++--- client_contact_add_modal.php | 16 +++---- client_contact_edit_modal.php | 16 +++---- client_contact_import_modal.php | 2 +- client_contact_invite_modal.php | 6 +-- client_contacts.php | 54 ++++++++++++++---------- 18 files changed, 158 insertions(+), 132 deletions(-) diff --git a/categories.php b/categories.php index a20bc85c..969ea761 100644 --- a/categories.php +++ b/categories.php @@ -3,13 +3,13 @@ require_once("inc_all_settings.php"); if (isset($_GET['category'])) { - $category = strip_tags(mysqli_real_escape_string($mysqli, $_GET['category'])); + $category = sanitizeInput($_GET['category']); } else { $category = "Expense"; } if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "category_name"; } @@ -48,9 +48,9 @@ $colors_diff = array_diff($colors_array, $colors_used_array);
-

Categories

+

Categories

- +
@@ -59,7 +59,7 @@ $colors_diff = array_diff($colors_array, $colors_used_array);
- +
@@ -89,14 +89,14 @@ $colors_diff = array_diff($colors_array, $colors_used_array); - +
@@ -104,9 +104,13 @@ $colors_diff = array_diff($colors_array, $colors_used_array);
- Edit + + Edit +
- Archive + + Archive +
diff --git a/category_add_modal.php b/category_add_modal.php index 82341c32..d99eb0b4 100644 --- a/category_add_modal.php +++ b/category_add_modal.php @@ -2,13 +2,13 @@
-
New Category
+
New Category
- +
@@ -38,8 +38,8 @@
- - + +
diff --git a/category_edit_modal.php b/category_edit_modal.php index c8d34098..5a8fd17e 100644 --- a/category_edit_modal.php +++ b/category_edit_modal.php @@ -2,14 +2,14 @@
-
Editing category:
+
Editing category:
- +
@@ -45,8 +45,8 @@
- - + +
diff --git a/client_asset_add_modal.php b/client_asset_add_modal.php index 0031f630..39b7d455 100644 --- a/client_asset_add_modal.php +++ b/client_asset_add_modal.php @@ -2,7 +2,7 @@
-
New
+
New
@@ -66,7 +66,7 @@
- +
@@ -124,7 +124,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $location_id = $row['location_id']; + $location_id = intval($row['location_id']); $location_name = htmlentities($row['location_name']); ?> @@ -147,7 +147,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $contact_id = $row['contact_id']; + $contact_id = intval($row['contact_id']); $contact_name = htmlentities($row['contact_name']); ?> @@ -186,7 +186,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $network_id = $row['network_id']; + $network_id = intval($row['network_id']); $network_name = htmlentities($row['network_name']); $network = htmlentities($row['network']); @@ -234,7 +234,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id AND vendor_template = 0 ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $vendor_id = $row['vendor_id']; + $vendor_id = intval($row['vendor_id']); $vendor_name = htmlentities($row['vendor_name']); ?> @@ -312,8 +312,8 @@
- - + +
diff --git a/client_asset_copy_modal.php b/client_asset_copy_modal.php index b39623fa..7f322248 100644 --- a/client_asset_copy_modal.php +++ b/client_asset_copy_modal.php @@ -2,7 +2,7 @@
-
Copying asset:
+
Copying asset:
@@ -121,7 +121,7 @@ $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id ORDER BY location_name ASC"); while ($row = mysqli_fetch_array($sql_locations)) { - $location_id_select = $row['location_id']; + $location_id_select = intval($row['location_id']); $location_name_select = htmlentities($row['location_name']); ?> @@ -144,7 +144,7 @@ $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql_contacts)) { - $contact_id = $row['contact_id']; + $contact_id = intval($row['contact_id']); $contact_name = htmlentities($row['contact_name']); ?> @@ -181,7 +181,7 @@ $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE (network_archived_at > '$asset_created_at' OR network_archived_at IS NULL) AND network_client_id = $client_id ORDER BY network_name ASC"); while ($row = mysqli_fetch_array($sql_networks)) { - $network_id_select = $row['network_id']; + $network_id_select = intval($row['network_id']); $network_name_select = htmlentities($row['network_name']); $network_select = htmlentities($row['network']); @@ -229,7 +229,7 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE (vendor_archived_at > '$asset_created_at' OR vendor_archived_at IS NULL) AND vendor_client_id = $client_id AND vendor_template = 0 ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql_vendors)) { - $vendor_id_select = $row['vendor_id']; + $vendor_id_select = intval($row['vendor_id']); $vendor_name_select = htmlentities($row['vendor_name']); ?> @@ -308,8 +308,8 @@
- - + +
diff --git a/client_asset_documents_modal.php b/client_asset_documents_modal.php index 6abe904b..1c6e5829 100644 --- a/client_asset_documents_modal.php +++ b/client_asset_documents_modal.php @@ -2,7 +2,7 @@
-
Documents
+
Documents
@@ -11,7 +11,7 @@

@@ -21,7 +21,7 @@

- +
diff --git a/client_asset_edit_modal.php b/client_asset_edit_modal.php index 74ab4a28..ee575ba9 100644 --- a/client_asset_edit_modal.php +++ b/client_asset_edit_modal.php @@ -2,7 +2,7 @@
-
Editing asset:
+
Editing asset:
@@ -123,7 +123,7 @@ $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id ORDER BY location_name ASC"); while ($row = mysqli_fetch_array($sql_locations)) { - $location_id_select = $row['location_id']; + $location_id_select = intval($row['location_id']); $location_name_select = htmlentities($row['location_name']); ?> @@ -145,7 +145,7 @@ $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE (contact_archived_at > '$asset_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql_contacts)) { - $contact_id_select = $row['contact_id']; + $contact_id_select = intval($row['contact_id']); $contact_name_select = htmlentities($row['contact_name']); ?> @@ -310,8 +310,8 @@
- - + +
diff --git a/client_asset_import_modal.php b/client_asset_import_modal.php index 81ce6148..55fb1d6a 100644 --- a/client_asset_import_modal.php +++ b/client_asset_import_modal.php @@ -2,7 +2,7 @@
-
Import Assets
+
Import Assets
@@ -19,7 +19,7 @@
- +
diff --git a/client_asset_tickets_modal.php b/client_asset_tickets_modal.php index 05ccf2b3..d35f515f 100644 --- a/client_asset_tickets_modal.php +++ b/client_asset_tickets_modal.php @@ -12,13 +12,13 @@

@@ -27,7 +27,7 @@

- +
diff --git a/client_assets.php b/client_assets.php index 4e889f87..15e3933b 100644 --- a/client_assets.php +++ b/client_assets.php @@ -4,34 +4,34 @@ require_once("inc_all_client.php"); //Get Asset Counts //All Asset Count $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS count FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id")); -$all_count = $row['count']; +$all_count = intval($row['count']); //Workstation Count $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS count FROM assets WHERE (asset_type = 'laptop' OR asset_type = 'desktop') AND asset_archived_at IS NULL AND asset_client_id = $client_id")); -$workstation_count = $row['count']; +$workstation_count = intval($row['count']); //Server Count $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS count FROM assets WHERE (asset_type = 'server') AND asset_archived_at IS NULL AND asset_client_id = $client_id")); -$server_count = $row['count']; +$server_count = intval($row['count']); //Virtual Server Count $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS count FROM assets WHERE (asset_type = 'virtual machine') AND asset_archived_at IS NULL AND asset_client_id = $client_id")); -$virtual_count = $row['count']; +$virtual_count = intval($row['count']); //Network Device Count $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS count FROM assets WHERE (asset_type = 'Firewall/Router' OR asset_type = 'switch' OR asset_type = 'access point') AND asset_archived_at IS NULL AND asset_client_id = $client_id")); -$network_count = $row['count']; +$network_count = intval($row['count']); //Other Count $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS count FROM assets WHERE (asset_type NOT LIKE 'laptop' AND asset_type NOT LIKE 'desktop' AND asset_type NOT LIKE 'server' AND asset_type NOT LIKE 'virtual machine' AND asset_type NOT LIKE 'firewall/router' AND asset_type NOT LIKE 'switch' AND asset_type NOT LIKE 'access point') AND asset_archived_at IS NULL AND asset_client_id = $client_id")); -$other_count = $row['count']; +$other_count = intval($row['count']); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "asset_name"; } @@ -74,20 +74,20 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Assets

+

Assets

- +
- +
- s"> + s">
@@ -160,7 +160,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
Interfaces - Edit - Copy + + Edit + + + Copy + 0) { ?> - Documents () + + Documents () + 0) { ?> - Tickets () + + Tickets () +
- Archive - Delete + + Archive + +
+ + Delete
diff --git a/client_certificate_add_modal.php b/client_certificate_add_modal.php index 19a9e8d3..1a15124a 100644 --- a/client_certificate_add_modal.php +++ b/client_certificate_add_modal.php @@ -2,7 +2,7 @@
-
New Certificate
+
New Certificate
@@ -75,7 +75,7 @@ $domain_name"; } @@ -86,8 +86,8 @@
- +
diff --git a/client_certificate_edit_modal.php b/client_certificate_edit_modal.php index 04b8abb9..a5d884d5 100644 --- a/client_certificate_edit_modal.php +++ b/client_certificate_edit_modal.php @@ -2,7 +2,7 @@
-
Editing certificate:
+
Editing certificate:
@@ -77,8 +77,8 @@
- - + +
diff --git a/client_certificates.php b/client_certificates.php index d5ea31c7..976ccd7b 100644 --- a/client_certificates.php +++ b/client_certificates.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "certificate_name"; } @@ -20,9 +20,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Certificates

+

Certificates

- +
@@ -32,7 +32,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -41,7 +41,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export + Export
@@ -63,7 +63,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-
New Contact
+
New Contact
@@ -19,16 +19,16 @@ @@ -122,7 +122,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $location_id = $row['location_id']; + $location_id = intval($row['location_id']); $location_name = htmlentities($row['location_name']); ?> @@ -202,8 +202,8 @@
- - + +
diff --git a/client_contact_edit_modal.php b/client_contact_edit_modal.php index 3e9d76a1..1d537805 100644 --- a/client_contact_edit_modal.php +++ b/client_contact_edit_modal.php @@ -2,7 +2,7 @@
-
Editing:
+
Editing:
@@ -21,16 +21,16 @@ @@ -124,7 +124,7 @@ $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE (location_archived_at > '$contact_created_at' OR location_archived_at IS NULL) AND location_client_id = $client_id ORDER BY location_name ASC"); while ($row = mysqli_fetch_array($sql_locations)) { - $location_id_select = $row['location_id']; + $location_id_select = intval($row['location_id']); $location_name_select = htmlentities($row['location_name']); ?> @@ -236,8 +236,8 @@
- - + +
diff --git a/client_contact_import_modal.php b/client_contact_import_modal.php index ec4fc98d..2928e725 100644 --- a/client_contact_import_modal.php +++ b/client_contact_import_modal.php @@ -2,7 +2,7 @@
-
Import Contacts
+
Import Contacts
diff --git a/client_contact_invite_modal.php b/client_contact_invite_modal.php index 3d6fb8b0..baa87a27 100644 --- a/client_contact_invite_modal.php +++ b/client_contact_invite_modal.php @@ -2,7 +2,7 @@
-
Invite Contact
+
Invite Contact
@@ -73,8 +73,8 @@
- - + +
diff --git a/client_contacts.php b/client_contacts.php index 50061218..ffcbe41a 100644 --- a/client_contacts.php +++ b/client_contacts.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $n = preg_replace("/[^0-9]/", '', $q); if (empty($n)) { @@ -16,7 +16,7 @@ if (isset($_GET['q'])) { } if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "contact_name"; } @@ -25,10 +25,12 @@ if (!empty($_GET['sb'])) { $url_query_strings_sb = http_build_query(array_merge($_GET, array('sb' => $sb, 'o' => $o))); $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM contacts - LEFT JOIN locations ON location_id = contact_location_id - WHERE contact_archived_at IS NULL - AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$n%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$n%') - AND contact_client_id = $client_id ORDER BY $sb $o LIMIT $record_from, $record_to"); + LEFT JOIN locations ON location_id = contact_location_id + WHERE contact_archived_at IS NULL + AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$n%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$n%') + AND contact_client_id = $client_id + ORDER BY $sb $o LIMIT $record_from, $record_to" +); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -36,11 +38,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Contacts

+

Contacts

@@ -56,7 +58,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -65,8 +67,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export - + Export +
@@ -90,7 +92,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $contact_title"; } - $contact_department =htmlentities($row['contact_department']); + $contact_department = htmlentities($row['contact_department']); if (empty($contact_department)) { $contact_department_display = "-"; } else { @@ -129,13 +131,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $contact_important = intval($row['contact_important']); $contact_billing = intval($row['contact_billing']); $contact_technical = intval($row['contact_technical']); - $contact_created_at = $row['contact_created_at']; + $contact_created_at = htmlentities($row['contact_created_at']); if ($contact_id == $primary_contact) { $primary_contact_display = "Primary Contact"; } else { $primary_contact_display = false; } - $contact_location_id = $row['contact_location_id']; + $contact_location_id = intval($row['contact_location_id']); $location_name = htmlentities($row['location_name']); if (empty($location_name)) { $location_name_display = "-"; @@ -171,9 +173,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - - + + +
@@ -195,13 +197,21 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- View Details - Edit + + View Details + + + Edit +
- Archive + + Archive +
- Delete + + Delete +