From e6daf0052810e19417259d998892abc3562fe45a Mon Sep 17 00:00:00 2001 From: johnnyq Date: Sat, 25 Jul 2026 16:59:03 -0400 Subject: [PATCH] Fix some broken API calls after RBAC update --- api/v1/clients/read.php | 4 +- api/v1/expenses/read.php | 6 +- api/v1/invoice_items/read.php | 4 +- api/v1/products/read.php | 6 +- api/v1/quotes/read.php | 2 +- api/v1/technicians/time.php | 2 +- api_rbac_edits.patch | 590 ---------------------------------- 7 files changed, 12 insertions(+), 602 deletions(-) delete mode 100644 api_rbac_edits.patch diff --git a/api/v1/clients/read.php b/api/v1/clients/read.php index a6f0bdae..141d4e87 100644 --- a/api/v1/clients/read.php +++ b/api/v1/clients/read.php @@ -7,11 +7,11 @@ require_once '../require_get_method.php'; // Specific client via name (single) if (isset($_GET['client_name'])) { $name = mysqli_real_escape_string($mysqli, $_GET['client_name']); - $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_name = '$name' AND client_id LIKE '$client_id'"); + $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_name = '$name' AND 1=1 " . apiClientScopeSql('client_id') . ""); } else { // All clients (by client ID if given, or all in general if key permits) - $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id LIKE '$client_id' ORDER BY client_id LIMIT $limit OFFSET $offset"); + $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE 1=1 " . apiClientScopeSql('client_id') . " ORDER BY client_id LIMIT $limit OFFSET $offset"); } // Output diff --git a/api/v1/expenses/read.php b/api/v1/expenses/read.php index d972200b..ddcd47c7 100644 --- a/api/v1/expenses/read.php +++ b/api/v1/expenses/read.php @@ -5,15 +5,15 @@ require_once '../validate_api_key.php'; require_once '../require_get_method.php'; -// Expenses aren't stored against client IDs, so we instead validate the API key is for All Clients +// Expenses aren't client-scoped; access is gated by module_financial in enforce_api_rbac.php -if (isset($_GET['expense_id']) && $client_id == "%") { +if (isset($_GET['expense_id'])) { // Expense via ID (single) $id = intval($_GET['expense_id']); $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id'"); -} elseif ($client_id == "%") { +} else { // All expenses $sql = mysqli_query($mysqli, "SELECT * FROM expenses ORDER BY expense_id LIMIT $limit OFFSET $offset"); diff --git a/api/v1/invoice_items/read.php b/api/v1/invoice_items/read.php index eca3276f..67011614 100644 --- a/api/v1/invoice_items/read.php +++ b/api/v1/invoice_items/read.php @@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) { FROM invoice_items ii INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id WHERE ii.item_id = '$item_id' - AND i.1=1 " . apiClientScopeSql('invoice_client_id') . " + AND 1=1 " . apiClientScopeSql('i.invoice_client_id') . " LIMIT 1" ); } elseif (isset($_GET['invoice_id'])) { @@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) { FROM invoice_items ii INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id WHERE ii.item_invoice_id = '$invoice_id' - AND i.1=1 " . apiClientScopeSql('invoice_client_id') . " + AND 1=1 " . apiClientScopeSql('i.invoice_client_id') . " ORDER BY ii.item_order ASC, ii.item_id ASC LIMIT $limit OFFSET $offset" ); diff --git a/api/v1/products/read.php b/api/v1/products/read.php index 71b4985f..0cc46baf 100644 --- a/api/v1/products/read.php +++ b/api/v1/products/read.php @@ -5,14 +5,14 @@ require_once '../validate_api_key.php'; require_once '../require_get_method.php'; -// Products aren't stored against client IDs, so we instead validate the API key is for All Clients +// Products aren't client-scoped; access is gated by module_sales in enforce_api_rbac.php -if (isset($_GET['product_id']) && $client_id == "%") { +if (isset($_GET['product_id'])) { // product via ID (single) $id = intval($_GET['product_id']); $sql = mysqli_query($mysqli, "SELECT * FROM products WHERE product_id = '$id'"); -} elseif ($client_id == "%") { +} else { // All products $sql = mysqli_query($mysqli, "SELECT * FROM products ORDER BY product_id LIMIT $limit OFFSET $offset"); } diff --git a/api/v1/quotes/read.php b/api/v1/quotes/read.php index 194c7800..0dd5a913 100644 --- a/api/v1/quotes/read.php +++ b/api/v1/quotes/read.php @@ -8,7 +8,7 @@ require_once '../require_get_method.php'; if (isset($_GET['quote_id'])) { // quote via ID (single) $id = intval($_GET['quote_id']); - $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id LIKE '$id' AND quote_client_id = '$client_id'"); + $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id LIKE '$id' AND 1=1 " . apiClientScopeSql('quote_client_id') . ""); } else { // All quotes (by client ID if given, or all in general if key permits) diff --git a/api/v1/technicians/time.php b/api/v1/technicians/time.php index 3e67ea6d..e9e771a1 100644 --- a/api/v1/technicians/time.php +++ b/api/v1/technicians/time.php @@ -62,7 +62,7 @@ $sql = mysqli_query( WHERE tr.ticket_reply_time_worked IS NOT NULL AND tr.ticket_reply_time_worked != '00:00:00' AND $date_conditions - AND t.1=1 " . apiClientScopeSql('ticket_client_id') . " + AND 1=1 " . apiClientScopeSql('t.ticket_client_id') . " $technician_condition GROUP BY t.ticket_id, u.user_id ORDER BY c.client_name ASC, t.ticket_number ASC, u.user_name ASC diff --git a/api_rbac_edits.patch b/api_rbac_edits.patch deleted file mode 100644 index c079b5c4..00000000 --- a/api_rbac_edits.patch +++ /dev/null @@ -1,590 +0,0 @@ -diff --git a/admin/api_keys.php b/admin/api_keys.php -index 387ae257..009f8cce 100644 ---- a/admin/api_keys.php -+++ b/admin/api_keys.php -@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php"; - $sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys -- LEFT JOIN clients on api_keys.api_key_client_id = clients.client_id -+ LEFT JOIN users on api_keys.api_key_user_id = users.user_id - WHERE (api_key_name LIKE '%$q%') - ORDER BY $sort $order LIMIT $record_from, $record_to" - ); -@@ -80,8 +80,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - - -- -- Client -+ -+ User - - - -@@ -115,11 +115,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - $api_key_expire = $api_key_expire . " (Expired)"; - } - -- if ($row['api_key_client_id'] == 0) { -- $api_key_client = "All Clients"; -- } else { -- $api_key_client = escapeHtml($row['client_name']); -- } -+ $api_key_user = !empty($row['user_name']) ? escapeHtml($row['user_name']) : "None"; - - ?> - -@@ -129,7 +125,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - - -- -+ - - - -@@ -139,6 +135,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - -
-+ -+ Edit -+ - date("Y-m-d H:i:s")) { ?> - - Revoke -diff --git a/admin/modals/api/api_key_add.php b/admin/modals/api/api_key_add.php -index bb46853a..0cb64a76 100644 ---- a/admin/modals/api/api_key_add.php -+++ b/admin/modals/api/api_key_add.php -@@ -55,22 +55,23 @@ ob_start(); -
- -
-- -+ -
-
-- -+ -
-- -+ - -- -+ $sql_run_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name ASC"); -+ while ($run_user = mysqli_fetch_assoc($sql_run_users)) { -+ $run_user_id = intval($run_user['user_id']); -+ $run_user_name = escapeHtml($run_user['user_name']); ?> -+ - - -
-+ The key inherits this user's module permissions and client access. -
- - -diff --git a/admin/post/api_keys.php b/admin/post/api_keys.php -index c36751d3..659f36c6 100644 ---- a/admin/post/api_keys.php -+++ b/admin/post/api_keys.php -@@ -12,17 +12,17 @@ if (isset($_POST['add_api_key'])) { - - $name = escapeSql($_POST['name']); - $expire = escapeSql($_POST['expire']); -- $client_id = intval($_POST['client']); -+ $user_id = intval($_POST['run_as_user']); - $secret = escapeSql($_POST['key']); // API Key - - // Credential decryption password - $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password'])); - -- mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client_id"); -+ mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_user_id = $user_id"); - - $api_key_id = mysqli_insert_id($mysqli); - -- logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id); -+ logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", 0, $api_key_id); - - flashAlert("API Key $name created"); - -@@ -30,6 +30,25 @@ if (isset($_POST['add_api_key'])) { - - } - -+if (isset($_POST['edit_api_key'])) { -+ -+ validateCSRFToken(); -+ -+ $api_key_id = intval($_POST['api_key_id']); -+ $name = escapeSql($_POST['name']); -+ $expire = escapeSql($_POST['expire']); -+ $user_id = intval($_POST['run_as_user']); -+ -+ mysqli_query($mysqli,"UPDATE api_keys SET api_key_name = '$name', api_key_expire = '$expire', api_key_user_id = $user_id WHERE api_key_id = $api_key_id"); -+ -+ logAudit("API Key", "Edit", "$session_name edited API key $name", 0, $api_key_id); -+ -+ flashAlert("API Key $name updated"); -+ -+ redirect(); -+ -+} -+ - if (isset($_GET['revoke_api_key'])) { - - validateCSRFToken(); -@@ -37,13 +56,12 @@ if (isset($_GET['revoke_api_key'])) { - $api_key_id = intval($_GET['revoke_api_key']); - - // Get API Key Name -- $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); -+ $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id")); - $api_key_name = escapeSql($row['api_key_name']); -- $client_id = intval($row['api_key_client_id']); - - mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id"); - -- logAudit("API Key", "Revoke", "$session_name revoked API key $name", $client_id); -+ logAudit("API Key", "Revoke", "$session_name revoked API key $name", 0); - - flashAlert("API Key $name revoked", 'error'); - -@@ -58,13 +76,12 @@ if (isset($_GET['delete_api_key'])) { - $api_key_id = intval($_GET['delete_api_key']); - - // Get API Key Name -- $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); -+ $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id")); - $api_key_name = escapeSql($row['api_key_name']); -- $client_id = intval($row['api_key_client_id']); - - mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id"); - -- logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id); -+ logAudit("API Key", "Delete", "$session_name deleted API key $name", 0); - - flashAlert("API Key $name deleted", 'error'); - -@@ -86,13 +103,12 @@ if (isset($_POST['bulk_delete_api_keys'])) { - $api_key_id = intval($api_key_id); - - // Get API Key Name -- $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); -+ $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id")); - $api_key_name = escapeSql($row['api_key_name']); -- $client_id = intval($row['api_key_client_id']); - - mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); - -- logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id); -+ logAudit("API Key", "Delete", "$session_name deleted API key $name", 0); - - } - -diff --git a/agent/post/client.php b/agent/post/client.php -index 00a0050f..1a43d33f 100644 ---- a/agent/post/client.php -+++ b/agent/post/client.php -@@ -394,7 +394,6 @@ if (isset($_GET['delete_client'])) { - - // Delete Associations - // Delete Client Data -- mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_client_id = $client_id"); - mysqli_query($mysqli, "DELETE FROM certificates WHERE certificate_client_id = $client_id"); - mysqli_query($mysqli, "DELETE FROM documents WHERE document_client_id = $client_id"); - -diff --git a/api/v1/assets/read.php b/api/v1/assets/read.php -index 1dc1d9d0..0ba013a7 100644 ---- a/api/v1/assets/read.php -+++ b/api/v1/assets/read.php -@@ -8,41 +8,41 @@ require_once '../require_get_method.php'; - // Asset via ID (single) - if (isset($_GET['asset_id'])) { - $id = intval($_GET['asset_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND asset_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND 1=1 " . apiClientScopeSql('asset_client_id') . ""); - - } elseif (isset($_GET['asset_type'])) { - // Asset query via type - $type = mysqli_real_escape_string($mysqli, ucfirst($_GET['asset_type'])); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['asset_name'])) { - // Asset query via name - $name = mysqli_real_escape_string($mysqli, $_GET['asset_name']); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['asset_serial'])) { - // Asset query via serial - $serial = mysqli_real_escape_string($mysqli, $_GET['asset_serial']); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['asset_mac'])) { - // Asset query via mac - $mac = mysqli_real_escape_string($mysqli, $_GET['asset_mac']); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['asset_uri'])) { - // Asset query via uri - $uri = mysqli_real_escape_string($mysqli, $_GET['asset_uri']); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['asset_uri_2'])) { - // Asset query via uri2 - $uri2 = mysqli_real_escape_string($mysqli, $_GET['asset_uri_2']); -- $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - }else { - // All assets (by client ID or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/certificates/read.php b/api/v1/certificates/read.php -index 7d08673c..210680b3 100644 ---- a/api/v1/certificates/read.php -+++ b/api/v1/certificates/read.php -@@ -8,16 +8,16 @@ require_once '../require_get_method.php'; - // Specific certificate via ID (single) - if (isset($_GET['certificate_id'])) { - $id = intval($_GET['certificate_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND certificate_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND 1=1 " . apiClientScopeSql('certificate_client_id') . ""); - - } elseif (isset($_GET['certificate_name'])) { - // Certificate by name - $name = mysqli_real_escape_string($mysqli, $_GET['certificate_name']); -- $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset"); - - } else { - // All certificates (by client ID or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/contacts/read.php b/api/v1/contacts/read.php -index 114c11dd..730e88a2 100644 ---- a/api/v1/contacts/read.php -+++ b/api/v1/contacts/read.php -@@ -8,21 +8,21 @@ require_once '../require_get_method.php'; - // Specific contact via ID (single) - if (isset($_GET['contact_id'])) { - $id = intval($_GET['contact_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND contact_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND 1=1 " . apiClientScopeSql('contact_client_id') . ""); - - } elseif (isset($_GET['contact_email'])) { - // Specific contact via email (single) - $email = mysqli_real_escape_string($mysqli, $_GET['contact_email']); -- $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND 1=1 " . apiClientScopeSql('contact_client_id') . ""); - - } elseif (isset($_GET['contact_phone_or_mobile'])) { - // Specific contact via phone number or mobile (single) - $phone_or_mob = mysqli_real_escape_string($mysqli, $_GET['contact_phone_or_mobile']); -- $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND contact_client_id LIKE '$client_id' LIMIT 1"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND 1=1 " . apiClientScopeSql('contact_client_id') . " LIMIT 1"); - - } else { - // All contacts (by client ID, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id LIKE '$client_id' ORDER BY contact_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE 1=1 " . apiClientScopeSql('contact_client_id') . " ORDER BY contact_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php -index 6d540af3..d6bd98c0 100644 ---- a/api/v1/credentials/read.php -+++ b/api/v1/credentials/read.php -@@ -17,13 +17,13 @@ if (isset($_GET['credential_id']) && !empty($api_key_decrypt_password)) { - - $id = intval($_GET['credential_id']); - -- $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND credential_client_id LIKE '$client_id' LIMIT 1"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND 1=1 " . apiClientScopeSql('credential_client_id') . " LIMIT 1"); - - - } elseif (!empty($api_key_decrypt_password)) { - // All credentials ("credentials") - -- $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id LIKE '$client_id' ORDER BY credential_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE 1=1 " . apiClientScopeSql('credential_client_id') . " ORDER BY credential_id LIMIT $limit OFFSET $offset"); - - } - -diff --git a/api/v1/documents/read.php b/api/v1/documents/read.php -index a376381b..5abe9d10 100644 ---- a/api/v1/documents/read.php -+++ b/api/v1/documents/read.php -@@ -8,11 +8,11 @@ require_once '../require_get_method.php'; - if (isset($_GET['document_id'])) { - // Document via ID (single) - $id = intval($_GET['document_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND document_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND 1=1 " . apiClientScopeSql('document_client_id') . ""); - - } else { - // All documents (by client ID if given, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_client_id LIKE '$client_id' ORDER BY document_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE 1=1 " . apiClientScopeSql('document_client_id') . " ORDER BY document_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/domains/read.php b/api/v1/domains/read.php -index 6bbd96a2..e75b31c0 100644 ---- a/api/v1/domains/read.php -+++ b/api/v1/domains/read.php -@@ -8,16 +8,16 @@ require_once '../require_get_method.php'; - // Specific domain via ID (single) - if (isset($_GET['domain_id'])) { - $id = intval($_GET['domain_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND domain_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND 1=1 " . apiClientScopeSql('domain_client_id') . ""); - - } elseif (isset($_GET['domain_name'])) { - // Domain by name - $name = mysqli_real_escape_string($mysqli, $_GET['domain_name']); -- $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset"); - - } else { - // All domains (by client ID or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/invoice_items/read.php b/api/v1/invoice_items/read.php -index 9b6a435b..eca3276f 100644 ---- a/api/v1/invoice_items/read.php -+++ b/api/v1/invoice_items/read.php -@@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) { - FROM invoice_items ii - INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id - WHERE ii.item_id = '$item_id' -- AND i.invoice_client_id LIKE '$client_id' -+ AND i.1=1 " . apiClientScopeSql('invoice_client_id') . " - LIMIT 1" - ); - } elseif (isset($_GET['invoice_id'])) { -@@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) { - FROM invoice_items ii - INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id - WHERE ii.item_invoice_id = '$invoice_id' -- AND i.invoice_client_id LIKE '$client_id' -+ AND i.1=1 " . apiClientScopeSql('invoice_client_id') . " - ORDER BY ii.item_order ASC, ii.item_id ASC - LIMIT $limit OFFSET $offset" - ); -diff --git a/api/v1/invoices/read.php b/api/v1/invoices/read.php -index f9f40425..072489e6 100644 ---- a/api/v1/invoices/read.php -+++ b/api/v1/invoices/read.php -@@ -8,11 +8,11 @@ require_once '../require_get_method.php'; - if (isset($_GET['invoice_id'])) { - // Invoice via ID (single) - $id = intval($_GET['invoice_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND invoice_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND 1=1 " . apiClientScopeSql('invoice_client_id') . ""); - - } else { - // All invoices (by client ID if given, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id LIKE '$client_id' ORDER BY invoice_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE 1=1 " . apiClientScopeSql('invoice_client_id') . " ORDER BY invoice_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/locations/read.php b/api/v1/locations/read.php -index d26efd0d..516fad78 100644 ---- a/api/v1/locations/read.php -+++ b/api/v1/locations/read.php -@@ -8,11 +8,11 @@ require_once '../require_get_method.php'; - if (isset($_GET['location_id'])) { - // Location via ID (single) - $id = intval($_GET['location_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND location_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND 1=1 " . apiClientScopeSql('location_client_id') . ""); - - } else { - // All locations (by client ID if given, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id LIKE '$client_id' ORDER BY location_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE 1=1 " . apiClientScopeSql('location_client_id') . " ORDER BY location_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/networks/read.php b/api/v1/networks/read.php -index 168757ae..28b01756 100644 ---- a/api/v1/networks/read.php -+++ b/api/v1/networks/read.php -@@ -8,16 +8,16 @@ require_once '../require_get_method.php'; - // Specific network via ID (single) - if (isset($_GET['network_id'])) { - $id = intval($_GET['network_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND network_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND 1=1 " . apiClientScopeSql('network_client_id') . ""); - - } elseif (isset($_GET['network_name'])) { - // Network by name - $name = mysqli_real_escape_string($mysqli, $_GET['network_name']); -- $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset"); - - } else { - // All networks (by client ID or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/quotes/read.php b/api/v1/quotes/read.php -index 7331de49..194c7800 100644 ---- a/api/v1/quotes/read.php -+++ b/api/v1/quotes/read.php -@@ -12,7 +12,7 @@ if (isset($_GET['quote_id'])) { - - } else { - // All quotes (by client ID if given, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_client_id LIKE '$client_id' ORDER BY quote_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE 1=1 " . apiClientScopeSql('quote_client_id') . " ORDER BY quote_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/software/read.php b/api/v1/software/read.php -index 7ff2dbf5..e738d22e 100644 ---- a/api/v1/software/read.php -+++ b/api/v1/software/read.php -@@ -8,26 +8,26 @@ require_once '../require_get_method.php'; - // Specific software via ID (single) - if (isset($_GET['software_id'])) { - $id = intval($_GET['software_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND 1=1 " . apiClientScopeSql('software_client_id') . ""); - - } elseif (isset($_GET['software_key'])) { - // Specific software via key - $key = mysqli_real_escape_string($mysqli, $_GET['software_license']); -- $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['software_name'])) { - // Software by name - $name = mysqli_real_escape_string($mysqli, $_GET['software_name']); -- $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND software_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset"); - - } elseif (isset($_GET['software_type'])) { - // Software via type - $type = intval($_GET['software_type']); -- $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset"); - - } else { - // All software(s) (by client ID if given, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/technicians/time.php b/api/v1/technicians/time.php -index 5d17be98..3e67ea6d 100644 ---- a/api/v1/technicians/time.php -+++ b/api/v1/technicians/time.php -@@ -62,7 +62,7 @@ $sql = mysqli_query( - WHERE tr.ticket_reply_time_worked IS NOT NULL - AND tr.ticket_reply_time_worked != '00:00:00' - AND $date_conditions -- AND t.ticket_client_id LIKE '$client_id' -+ AND t.1=1 " . apiClientScopeSql('ticket_client_id') . " - $technician_condition - GROUP BY t.ticket_id, u.user_id - ORDER BY c.client_name ASC, t.ticket_number ASC, u.user_name ASC -diff --git a/api/v1/tickets/read.php b/api/v1/tickets/read.php -index 408190ae..d6a28a32 100644 ---- a/api/v1/tickets/read.php -+++ b/api/v1/tickets/read.php -@@ -12,12 +12,12 @@ if (isset($_GET['ticket_id'])) { - $mysqli, - "SELECT * FROM tickets - LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id -- WHERE ticket_id = '$id' AND ticket_client_id LIKE '$client_id'" -+ WHERE ticket_id = '$id' AND 1=1 " . apiClientScopeSql('ticket_client_id') . "" - ); - - } else { - // All tickets (by client ID if given, or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id LIKE '$client_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE 1=1 " . apiClientScopeSql('ticket_client_id') . " ORDER BY ticket_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php -index 2945a321..2404bc8c 100644 ---- a/api/v1/validate_api_key.php -+++ b/api/v1/validate_api_key.php -@@ -94,7 +94,7 @@ if (isset($api_key)) { - $row = mysqli_fetch_assoc($sql); - $api_key_name = htmlentities($row['api_key_name']); - $api_key_decrypt_hash = $row['api_key_decrypt_hash']; // No sanitization -- $client_id = intval($row['api_key_client_id']); -+ $api_key_user_id = intval($row['api_key_user_id']); - - // Set limit & offset for queries - if (isset($_GET['limit'])) { -@@ -113,5 +113,8 @@ if (isset($api_key)) { - $offset = 0; - } - -+ // When the key is tied to a user, enforce that user's RBAC (module + operation + client scope) -+ require __DIR__ . '/enforce_api_rbac.php'; -+ - } - } -diff --git a/api/v1/vendors/read.php b/api/v1/vendors/read.php -index e6971f52..f12d572c 100644 ---- a/api/v1/vendors/read.php -+++ b/api/v1/vendors/read.php -@@ -7,11 +7,11 @@ require_once '../require_get_method.php'; - // Specific vendor via their ID (single) - if (isset($_GET['vendor_id'])) { - $id = intval($_GET['vendor_id']); -- $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND vendor_client_id LIKE '$client_id'"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND 1=1 " . apiClientScopeSql('vendor_client_id') . ""); - - } else { - // All Vendors (by client ID or all in general if key permits) -- $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id LIKE '$client_id' ORDER BY vendor_id LIMIT $limit OFFSET $offset"); -+ $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE 1=1 " . apiClientScopeSql('vendor_client_id') . " ORDER BY vendor_id LIMIT $limit OFFSET $offset"); - } - - // Output -diff --git a/db.sql b/db.sql -index 832e141b..5a6abded 100644 ---- a/db.sql -+++ b/db.sql -@@ -91,7 +91,7 @@ CREATE TABLE `api_keys` ( - `api_key_decrypt_hash` varchar(200) NOT NULL, - `api_key_created_at` datetime NOT NULL DEFAULT current_timestamp(), - `api_key_expire` date NOT NULL, -- `api_key_client_id` int(11) NOT NULL DEFAULT 0, -+ `api_key_user_id` int(11) NOT NULL DEFAULT 0, - PRIMARY KEY (`api_key_id`) - ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; - /*!40101 SET character_set_client = @saved_cs_client */;