From ef1b65de091f2eb80eb4313543d47df8b3d72bff Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Sun, 1 Mar 2026 20:42:18 -0500
Subject: [PATCH] Client: Add missing CSRF checks, and missing enforcements

---
 agent/assets.php                      |  2 +-
 agent/modals/client/client_edit.php   |  3 ++-
 agent/modals/client/client_export.php |  1 +
 agent/modals/client/client_import.php |  1 +
 agent/post/client.php                 | 12 ++++++++++++
 5 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/agent/assets.php b/agent/assets.php
index a8882ab5..5c95226e 100644
--- a/agent/assets.php
+++ b/agent/assets.php
@@ -550,7 +550,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $asset_model = nullable_htmlentities($row['asset_model']);
                         $asset_serial = nullable_htmlentities($row['asset_serial']);
                         if ($asset_serial) {
-                            $asset_serial_display = $asset_serial;
+                            $asset_serial_display = "<span class='badge badge-light text-monospace'>$asset_serial</span>";
                         } else {
                             $asset_serial_display = "-";
                         }
diff --git a/agent/modals/client/client_edit.php b/agent/modals/client/client_edit.php
index b9220139..35e53b9d 100644
--- a/agent/modals/client/client_edit.php
+++ b/agent/modals/client/client_edit.php
@@ -39,7 +39,8 @@ ob_start();
 </div>
 
 <form action="post.php" method="post" autocomplete="off">
-    <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
+    <input type="hidden" name="client_id" value="<?= $client_id ?>">
 
     <ul class="modal-header nav nav-pills nav-justified mb-3">
         <li class="nav-item">
diff --git a/agent/modals/client/client_export.php b/agent/modals/client/client_export.php
index b13ea0e7..26aa2757 100644
--- a/agent/modals/client/client_export.php
+++ b/agent/modals/client/client_export.php
@@ -13,6 +13,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <div class="modal-body">
     </div>
     <div class="modal-footer">
diff --git a/agent/modals/client/client_import.php b/agent/modals/client/client_import.php
index 487e97d5..51101a38 100644
--- a/agent/modals/client/client_import.php
+++ b/agent/modals/client/client_import.php
@@ -12,6 +12,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <div class="modal-body">
         <p><strong>Importing Multiple Contacts:</strong><br>When importing a client, only one contact (which will become the primary contact) and one location (which will become the primary location) can be added initially. To add additional contacts, you will need to click into each client, navigate to the Contacts section, and import multiple contacts individually for each client.</p>
         <p><strong>Format csv file with headings & data:</strong><br>Client Name, Industry, Referral, Website, Primary Location Name, Location Phone, Location Address, City, State, Postal Code, Country, Primary Contact Name, Title, Contact Phone, Extension, Contact Mobile, Contact Email, Hourly Rate, Currency, Payment Terms, Tax ID, Abbreviation</p>
diff --git a/agent/post/client.php b/agent/post/client.php
index 92ac31d7..c994ecc3 100644
--- a/agent/post/client.php
+++ b/agent/post/client.php
@@ -252,6 +252,8 @@ if (isset($_POST['add_client'])) {
 
 if (isset($_POST['edit_client'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     enforceUserPermission('module_client', 2);
 
     require_once 'client_model.php';
@@ -443,6 +445,8 @@ if (isset($_GET['delete_client'])) {
 
 if (isset($_POST['export_clients_csv'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     enforceUserPermission('module_client', 1);
 
     //get records from database
@@ -493,6 +497,8 @@ if (isset($_POST['export_clients_csv'])) {
 
 if (isset($_POST["import_clients_csv"])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     enforceUserPermission('module_client', 2);
     $error = false;
 
@@ -986,6 +992,10 @@ if (isset($_POST['bulk_assign_client_tags'])) {
 
 if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
+    enforceUserPermission('module_client', 1);
+
     $client_ids = array_map('intval', $_POST['client_ids']);
     $count = count($client_ids);
 
@@ -1141,6 +1151,8 @@ if (isset($_POST['bulk_unarchive_clients'])) {
 
 if (isset($_POST["export_client_pdf"])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     // Enforce permissions
     enforceUserPermission("module_client", 3);
     enforceUserPermission("module_support", 1);