diff --git a/api/v1/assets/asset_model.php b/api/v1/assets/asset_model.php new file mode 100644 index 00000000..feb177ba --- /dev/null +++ b/api/v1/assets/asset_model.php @@ -0,0 +1,27 @@ +insert_id; + $insert_id = mysqli_insert_id($mysqli); //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Asset', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created asset $name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Asset', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), log_client_id = '$client_id', company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created asset $name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), log_client_id = '$client_id', company_id = $company_id"); } } -else{ - $insert_id = FALSE; -} // Output include('../create_output.php'); \ No newline at end of file diff --git a/api/v1/assets/read.php b/api/v1/assets/read.php index 419ecfb1..5102f32b 100644 --- a/api/v1/assets/read.php +++ b/api/v1/assets/read.php @@ -5,37 +5,37 @@ require('../require_get_method.php'); // Asset via ID (single) if(isset($_GET['asset_id'])){ - $id = intval($_GET['asset_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = '$id' AND company_id = '$company_id'"); + $id = intval($_GET['asset_id']); + $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = '$id' AND asset_client_id LIKE '$client_id' AND company_id = '$company_id'"); } // Asset query via type elseif(isset($_GET['asset_type'])){ - $type = mysqli_real_escape_string($mysqli,ucfirst($_GET['asset_type'])); - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); + $type = mysqli_real_escape_string($mysqli,ucfirst($_GET['asset_type'])); + $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND asset_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); } // Asset query via name elseif(isset($_GET['asset_name'])){ - $name = mysqli_real_escape_string($mysqli,$_GET['asset_name']); - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); + $name = mysqli_real_escape_string($mysqli,$_GET['asset_name']); + $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); } // Asset query via serial elseif(isset($_GET['asset_serial'])){ - $serial = mysqli_real_escape_string($mysqli,$_GET['asset_serial']); - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); + $serial = mysqli_real_escape_string($mysqli,$_GET['asset_serial']); + $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND asset_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); } // Asset query via client ID -elseif(isset($_GET['asset_client_id'])){ - $client = intval($_GET['asset_client_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_client_id = '$client' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); +elseif(isset($_GET['client_id']) && $client_id == "%"){ + $client_id = intval($_GET['client_id']); + $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); } // All assets else{ - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); + $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); } // Output diff --git a/api/v1/certificates/read.php b/api/v1/certificates/read.php index f07ef6bc..25b9b343 100644 --- a/api/v1/certificates/read.php +++ b/api/v1/certificates/read.php @@ -5,25 +5,25 @@ require('../require_get_method.php'); // Specific certificate via ID (single) if(isset($_GET['certificate_id'])){ - $id = intval($_GET['certificate_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND company_id = '$company_id'"); + $id = intval($_GET['certificate_id']); + $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND certificate_client_id LIKE '$client_id' AND company_id = '$company_id'"); } // Certificate by name elseif(isset($_GET['certificate_name'])){ - $name = mysqli_real_escape_string($mysqli,$_GET['certificate_name']); - $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND company_id = '$company_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); + $name = mysqli_real_escape_string($mysqli,$_GET['certificate_name']); + $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND certificate_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); } -// Certificate via client ID -elseif(isset($_GET['certificate_client_id'])){ - $client = intval($_GET['certificate_client_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = '$client' AND company_id = '$company_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); +// Certificate via client ID (if allowed) +elseif(isset($_GET['client_id']) && $client_id == "%"){ + $client_id = intval($_GET['client_id']); + $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = '$client_id' AND company_id = '$company_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); } // All certificates else{ - $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE company_id = '$company_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); + $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); } // Output diff --git a/api/v1/contacts/contact_model.php b/api/v1/contacts/contact_model.php new file mode 100644 index 00000000..fb35f365 --- /dev/null +++ b/api/v1/contacts/contact_model.php @@ -0,0 +1,11 @@ +insert_id; +// Default +$insert_id = FALSE; + +if(!empty($name) && !empty($email) && !empty($client_id)){ + + // Check contact with $email doesn't already exist + $email_duplication_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id = '$client_id'"); + + if(mysqli_num_rows($email_duplication_sql) == 0){ + + // Insert contact + $insert_sql = mysqli_query($mysqli,"INSERT INTO contacts SET contact_name = '$name', contact_title = '$title', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile', contact_email = '$email', contact_notes = '$notes', contact_auth_method = '$auth_method', contact_created_at = NOW(), contact_department_id = $department, contact_location_id = $location_id, contact_client_id = $client_id, company_id = $company_id"); + + // Check insert & get insert ID + if($insert_sql){ + $insert_id = mysqli_insert_id($mysqli); + //Logging + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Contact', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), log_client_id = $client_id, company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created contact $name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), log_client_id = $client_id, company_id = $company_id"); + } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Contact', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created contact $name via API ($api_key_name)', log_ip = '$ip', log_created_at = NOW(), company_id = $company_id"); } } -else{ - $insert_id = FALSE; -} // Output include('../create_output.php'); \ No newline at end of file diff --git a/api/v1/contacts/read.php b/api/v1/contacts/read.php index 72bf3314..2de010b5 100644 --- a/api/v1/contacts/read.php +++ b/api/v1/contacts/read.php @@ -6,18 +6,18 @@ require('../require_get_method.php'); // Specific contact via ID (single) if(isset($_GET['contact_id'])){ $id = intval($_GET['contact_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND company_id = '$company_id'"); + $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND contact_client_id LIKE '$client_id' AND company_id = '$company_id'"); } // Specific contact via email (single) elseif(isset($_GET['contact_email'])){ $email = trim(strip_tags(mysqli_real_escape_string($mysqli,$_GET['contact_email']))); - $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND company_id = '$company_id'"); + $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id LIKE '$client_id' AND company_id = '$company_id'"); } // All contacts else{ - $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE company_id = '$company_id' ORDER BY contact_id LIMIT $limit OFFSET $offset"); + $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY contact_id LIMIT $limit OFFSET $offset"); } // Output diff --git a/api/v1/contacts/update.php b/api/v1/contacts/update.php new file mode 100644 index 00000000..bf5c3152 --- /dev/null +++ b/api/v1/contacts/update.php @@ -0,0 +1,28 @@ + 0){ } else{ $return_arr['success'] = "False"; - $return_arr['message'] = "No resource (for this company) with the specified parameter(s)."; + $return_arr['message'] = "No resource (for this client and company) with the specified parameter(s)."; echo json_encode($return_arr); exit(); } \ No newline at end of file diff --git a/api/v1/require_get_method.php b/api/v1/require_get_method.php index a6391c9f..4667bed7 100644 --- a/api/v1/require_get_method.php +++ b/api/v1/require_get_method.php @@ -5,4 +5,9 @@ if($_SERVER['REQUEST_METHOD'] !== "GET"){ $return_arr['message'] = "Can only send GET requests to this endpoint."; echo json_encode($return_arr); exit(); +} + +// Wildcard client ID for most SELECT queries +if($client_id == 0){ + $client_id = "%"; } \ No newline at end of file diff --git a/api/v1/require_post_method.php b/api/v1/require_post_method.php index 10f500e7..cb13d64b 100644 --- a/api/v1/require_post_method.php +++ b/api/v1/require_post_method.php @@ -5,4 +5,11 @@ if($_SERVER['REQUEST_METHOD'] !== "POST"){ $return_arr['message'] = "Can only send POST requests to this endpoint."; echo json_encode($return_arr); exit(); +} + +// Client ID must be specific for INSERT/UPDATE/DELETE queries +// If this API key allows any client, set $client_id to the one specified, else leave it +if($client_id == 0){ + // + $client_id = intval($_POST['client_id']); } \ No newline at end of file diff --git a/api/v1/software/read.php b/api/v1/software/read.php index 52b16404..df229a48 100644 --- a/api/v1/software/read.php +++ b/api/v1/software/read.php @@ -5,37 +5,37 @@ require('../require_get_method.php'); // Specific software via ID (single) if(isset($_GET['software_id'])){ - $id = intval($_GET['software_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND company_id = '$company_id'"); + $id = intval($_GET['software_id']); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id' AND company_id = '$company_id'"); } // Specific software via License ID if(isset($_GET['software_license'])){ - $license = mysqli_real_escape_string($mysqli,$_GET['software_license']); - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_license = '$license' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); + $license = mysqli_real_escape_string($mysqli,$_GET['software_license']); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_license_type = '$license' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); } // Software by name elseif(isset($_GET['software_name'])){ - $name = mysqli_real_escape_string($mysqli,$_GET['software_name']); - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); + $name = mysqli_real_escape_string($mysqli,$_GET['software_name']); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); } // Software via type elseif(isset($_GET['software_type'])){ - $type = intval($_GET['software_type']); - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); + $type = intval($_GET['software_type']); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); } -// Software via client ID -elseif(isset($_GET['software_client_id'])){ - $client = intval($_GET['software_client_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = '$client' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); +// Software via client ID (if allowed) +elseif(isset($_GET['client_id']) && $client_id == "%"){ + $client_id = intval($_GET['client_id']); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); } // All software(s) else{ - $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); + $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); } // Output diff --git a/api/v1/tickets/read.php b/api/v1/tickets/read.php index 74ccfa0e..4fa7247a 100644 --- a/api/v1/tickets/read.php +++ b/api/v1/tickets/read.php @@ -6,12 +6,12 @@ require('../require_get_method.php'); // Specific ticket via ID (single) if(isset($_GET['ticket_id'])){ $id = intval($_GET['ticket_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$id' AND company_id = '$company_id'"); + $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$id' AND ticket_client_id LIKE '$client_id' AND company_id = '$company_id'"); } // All tickets else{ - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE company_id = '$company_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset"); + $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id LIKE '$client_id' AND company_id = '$company_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset"); } // Output diff --git a/api/v1/update_output.php b/api/v1/update_output.php new file mode 100644 index 00000000..9c7802f0 --- /dev/null +++ b/api/v1/update_output.php @@ -0,0 +1,23 @@ + 0){ + // Insert successful + $return_arr['success'] = "True"; + $return_arr['count'] = $update_id; +} + +// Query returned false: something went wrong, or it was declined due to required variables missing +else{ + $return_arr['success'] = "False"; + $return_arr['message'] = "Auth success but update query failed/returned no results. Ensure ALL required variables are provided and database schema is up-to-date. Most likely cause: non-existent module (contact/ticket/etc) id"; +} + +echo json_encode($return_arr); +exit(); \ No newline at end of file diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index 46ec587b..a026e42b 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -86,10 +86,11 @@ if(isset($api_key)){ // Success else{ - // Set company ID & key name + // Set client ID, company ID & key name $row = mysqli_fetch_array($sql); - $company_id = $row['company_id']; $api_key_name = $row['api_key_name']; + $client_id = $row['api_key_client_id']; + $company_id = $row['company_id']; // Set limit & offset for queries if(isset($_GET['limit'])){ diff --git a/api_key_add_modal.php b/api_key_add_modal.php index e72ecc7f..a06dc3aa 100644 --- a/api_key_add_modal.php +++ b/api_key_add_modal.php @@ -1,3 +1,6 @@ + \ No newline at end of file