From e7b70c79922c22034d9ab1333c4c592ea9439a97 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Fri, 6 Mar 2026 16:59:15 -0500
Subject: [PATCH] domains: remove client_id post from edit domain modal as it
 should get the client_id in post, enforceClientAccess

---
 agent/modals/domain/domain_edit.php |  2 +-
 agent/post/domain.php               | 24 ++++++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/agent/modals/domain/domain_edit.php b/agent/modals/domain/domain_edit.php
index fbe6cdde..c6079ea9 100644
--- a/agent/modals/domain/domain_edit.php
+++ b/agent/modals/domain/domain_edit.php
@@ -39,7 +39,7 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="domain_id" value="<?php echo $domain_id; ?>">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
+
     <div class="modal-body">
 
         <ul class="nav nav-pills nav-justified mb-3">
diff --git a/agent/post/domain.php b/agent/post/domain.php
index 38d65f65..98ce03b3 100644
--- a/agent/post/domain.php
+++ b/agent/post/domain.php
@@ -16,6 +16,8 @@ if (isset($_POST['add_domain'])) {
     $extended_log_description = '';
     $client_id = intval($_POST['client_id']);
 
+    enforceClientAccess();
+
     // Set/check/lookup expiry date
     if (strtotime($expire)) {
         $expire = "'" . $expire . "'";
@@ -69,8 +71,13 @@ if (isset($_POST['edit_domain'])) {
     enforceUserPermission('module_support', 2);
 
     require_once 'domain_model.php';
+
     $domain_id = intval($_POST['domain_id']);
 
+    $client_id = intval(getFieldById('domains', $domain_id, 'domain_client_id'));
+
+    enforceClientAccess();
+
     // Set/check/lookup expiry date
     if (strtotime($expire) && (new DateTime($expire)) > (new DateTime())) {
         $expire = "'" . $expire . "'";
@@ -163,6 +170,8 @@ if (isset($_GET['archive_domain'])) {
     $domain_name = sanitizeInput($row['domain_name']);
     $client_id = intval($row['domain_client_id']);
 
+    enforceClientAccess();
+
     mysqli_query($mysqli,"UPDATE domains SET domain_archived_at = NOW() WHERE domain_id = $domain_id");
 
     logAction("Domain", "Archive", "$session_name archived domain $domain_name", $client_id, $domain_id);
@@ -187,6 +196,8 @@ if(isset($_GET['restore_domain'])){
     $domain_name = sanitizeInput($row['domain_name']);
     $client_id = intval($row['domain_client_id']);
 
+    enforceClientAccess();
+
     mysqli_query($mysqli,"UPDATE domains SET domain_archived_at = NULL WHERE domain_id = $domain_id");
 
     logAction("Domain", "Restore", "$session_name restored domain $domain_name", $client_id, $domain_id);
@@ -211,6 +222,8 @@ if (isset($_GET['delete_domain'])) {
     $domain_name = sanitizeInput($row['domain_name']);
     $client_id = intval($row['domain_client_id']);
 
+    enforceClientAccess();
+
     mysqli_query($mysqli,"DELETE FROM domains WHERE domain_id = $domain_id");
 
     logAction("Domain", "Delete", "$session_name deleted domain $domain_name", $client_id);
@@ -243,6 +256,8 @@ if (isset($_POST['bulk_archive_domains'])) {
             $domain_name = sanitizeInput($row['domain_name']);
             $client_id = intval($row['domain_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE domains SET domain_archived_at = NOW() WHERE domain_id = $domain_id");
 
             logAction("Domain", "Archive", "$session_name archived domain $domain_name", $client_id, $domain_id);
@@ -280,6 +295,8 @@ if (isset($_POST['bulk_restore_domains'])) {
             $domain_name = sanitizeInput($row['domain_name']);
             $client_id = intval($row['domain_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli,"UPDATE domains SET domain_archived_at = NULL WHERE domain_id = $domain_id");
 
             logAction("Domain", "Restore", "$session_name restored domain $domain_name", $client_id, $domain_id);
@@ -318,6 +335,8 @@ if (isset($_POST['bulk_delete_domains'])) {
             $domain_name = sanitizeInput($row['domain_name']);
             $client_id = intval($row['domain_client_id']);
 
+            enforceClientAccess();
+
             mysqli_query($mysqli, "DELETE FROM domains WHERE domain_id = $domain_id AND domain_client_id = $client_id");
 
             logAction("Domain", "Delete", "$session_name deleted domain $domain_name", $client_id);
@@ -341,16 +360,17 @@ if (isset($_POST['export_domains_csv'])) {
 
     if ($_POST['client_id']) {
         $client_id = intval($_POST['client_id']);
-        $client_query = "WHERE domain_client_id = $client_id";
+        $client_query = "AND domain_client_id = $client_id";
         $client_name = getFieldById('clients', $client_id, 'client_name');
         $file_name_prepend = "$client_name-";
+        enforceClientAccess();
     } else {
         $client_query = '';
         $client_id = 0;
         $file_name_prepend = "$session_company_name-";
     }
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM domains $client_query ORDER BY domain_name ASC");
+    $sql = mysqli_query($mysqli,"SELECT * FROM domains LEFT JOIN clients ON client_id = domain_client_id WHERE domain_archived_at IS NULL $client_query $access_permission_query ORDER BY domain_name ASC");
 
     $num_rows = mysqli_num_rows($sql);