AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 10:47:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix some broken API calls after RBAC update

Browse Source
This commit is contained in:
johnnyq
2026-07-25 16:59:03 -04:00
parent c509b7f693
commit e6daf00528
7 changed files with 12 additions and 602 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/v1/clients/read.php
View File

@@ -7,11 +7,11 @@ require_once '../require_get_method.php';
// Specific client via name (single)
if (isset($_GET['client_name'])) {
$name = mysqli_real_escape_string($mysqli, $_GET['client_name']);
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_name = '$name' AND client_id LIKE '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_name = '$name' AND 1=1 " . apiClientScopeSql('client_id') . "");
} else {
// All clients (by client ID if given, or all in general if key permits)
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id LIKE '$client_id' ORDER BY client_id LIMIT $limit OFFSET $offset");
$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE 1=1 " . apiClientScopeSql('client_id') . " ORDER BY client_id LIMIT $limit OFFSET $offset");
}
// Output

6
api/v1/expenses/read.php
View File

@@ -5,15 +5,15 @@ require_once '../validate_api_key.php';
require_once '../require_get_method.php';
// Expenses aren't stored against client IDs, so we instead validate the API key is for All Clients
// Expenses aren't client-scoped; access is gated by module_financial in enforce_api_rbac.php
if (isset($_GET['expense_id']) && $client_id == "%") {
if (isset($_GET['expense_id'])) {
// Expense via ID (single)
$id = intval($_GET['expense_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id'");
} elseif ($client_id == "%") {
} else {
// All expenses
$sql = mysqli_query($mysqli, "SELECT * FROM expenses ORDER BY expense_id LIMIT $limit OFFSET $offset");

4
api/v1/invoice_items/read.php
View File

@@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) {
FROM invoice_items ii
INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
WHERE ii.item_id = '$item_id'
AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
AND 1=1 " . apiClientScopeSql('i.invoice_client_id') . "
LIMIT 1"
);
} elseif (isset($_GET['invoice_id'])) {
@@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) {
FROM invoice_items ii
INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
WHERE ii.item_invoice_id = '$invoice_id'
AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
AND 1=1 " . apiClientScopeSql('i.invoice_client_id') . "
ORDER BY ii.item_order ASC, ii.item_id ASC
LIMIT $limit OFFSET $offset"
);

6
api/v1/products/read.php
View File

@@ -5,14 +5,14 @@ require_once '../validate_api_key.php';
require_once '../require_get_method.php';
// Products aren't stored against client IDs, so we instead validate the API key is for All Clients
// Products aren't client-scoped; access is gated by module_sales in enforce_api_rbac.php
if (isset($_GET['product_id']) && $client_id == "%") {
if (isset($_GET['product_id'])) {
// product via ID (single)
$id = intval($_GET['product_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM products WHERE product_id = '$id'");
} elseif ($client_id == "%") {
} else {
// All products
$sql = mysqli_query($mysqli, "SELECT * FROM products ORDER BY product_id LIMIT $limit OFFSET $offset");
}

2
api/v1/quotes/read.php
View File

@@ -8,7 +8,7 @@ require_once '../require_get_method.php';
if (isset($_GET['quote_id'])) {
// quote via ID (single)
$id = intval($_GET['quote_id']);
$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id LIKE '$id' AND quote_client_id = '$client_id'");
$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id LIKE '$id' AND 1=1 " . apiClientScopeSql('quote_client_id') . "");
} else {
// All quotes (by client ID if given, or all in general if key permits)

2
api/v1/technicians/time.php
View File

@@ -62,7 +62,7 @@ $sql = mysqli_query(
WHERE tr.ticket_reply_time_worked IS NOT NULL
AND tr.ticket_reply_time_worked != '00:00:00'
AND $date_conditions
AND t.1=1 " . apiClientScopeSql('ticket_client_id') . "
AND 1=1 " . apiClientScopeSql('t.ticket_client_id') . "
$technician_condition
GROUP BY t.ticket_id, u.user_id
ORDER BY c.client_name ASC, t.ticket_number ASC, u.user_name ASC