From f14fa22222722b96ca07f0181c37b1fbd55f35ce Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Fri, 26 Jun 2026 12:05:11 -0400
Subject: [PATCH] USe enforceClientAccess and enforceUserPermissions on Client
 related edit / view modals as we do with credential edit modal

---
 agent/modals/asset/asset_copy.php             | 6 +++++-
 agent/modals/asset/asset_details.php          | 7 ++++++-
 agent/modals/asset/asset_edit.php             | 5 +++++
 agent/modals/certificate/certificate_edit.php | 6 +++++-
 agent/modals/contact/contact_details.php      | 7 ++++++-
 agent/modals/contact/contact_edit.php         | 7 ++++++-
 agent/modals/document/document_edit.php       | 6 +++++-
 agent/modals/domain/domain_edit.php           | 6 +++++-
 agent/modals/network/network_edit.php         | 5 +++++
 agent/modals/rack/rack_edit.php               | 7 ++++++-
 agent/modals/software/software_edit.php       | 4 ++++
 11 files changed, 58 insertions(+), 8 deletions(-)

diff --git a/agent/modals/asset/asset_copy.php b/agent/modals/asset/asset_copy.php
index 14adcc11..45c37ba5 100644
--- a/agent/modals/asset/asset_copy.php
+++ b/agent/modals/asset/asset_copy.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -41,8 +43,10 @@ $asset_contact_id = intval($row['asset_contact_id']);
 $asset_network_id = intval($row['interface_network_id']);
 $device_icon = getAssetIcon($asset_type);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/asset/asset_details.php b/agent/modals/asset/asset_details.php
index 2b7b2a8c..f3260038 100644
--- a/agent/modals/asset/asset_details.php
+++ b/agent/modals/asset/asset_details.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support');
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -218,9 +220,12 @@ if (isset($_GET['client_id'])) {
     $client_url = '';
 }
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-<?= $device_icon ?> mr-2"></i><strong><?= $asset_name ?></strong>
         <?php if ($asset_favorite) { ?><i class="fas fa-fw text-warning fa-star" title="Favorite"></i><?php } ?>
diff --git a/agent/modals/asset/asset_edit.php b/agent/modals/asset/asset_edit.php
index cf8af90c..477ac487 100644
--- a/agent/modals/asset/asset_edit.php
+++ b/agent/modals/asset/asset_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $asset_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM assets
@@ -59,7 +61,10 @@ while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
     $asset_tag_id_array[] = $asset_tag_tag_id;
 }
 
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/certificate/certificate_edit.php b/agent/modals/certificate/certificate_edit.php
index cfc6a307..3f8b8bee 100644
--- a/agent/modals/certificate/certificate_edit.php
+++ b/agent/modals/certificate/certificate_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $certificate_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = $certificate_id LIMIT 1");
@@ -20,8 +22,10 @@ $client_id = intval($row['certificate_client_id']);
 
 $history_sql = mysqli_query($mysqli, "SELECT * FROM certificate_history WHERE certificate_history_certificate_id = $certificate_id");
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/contact/contact_details.php b/agent/modals/contact/contact_details.php
index f618ccd3..491c46bd 100644
--- a/agent/modals/contact/contact_details.php
+++ b/agent/modals/contact/contact_details.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_client');
+
 $contact_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM contacts
@@ -184,9 +186,12 @@ elseif ($document_count) { $first_tab = "documents"; }
 elseif ($file_count) { $first_tab = "files"; }
 elseif ($note_count) { $first_tab = "notes"; }
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title">
         <div class="media">
diff --git a/agent/modals/contact/contact_edit.php b/agent/modals/contact/contact_edit.php
index d370ae67..a469080c 100644
--- a/agent/modals/contact/contact_edit.php
+++ b/agent/modals/contact/contact_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_client', 2);
+
 $contact_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM contacts
@@ -43,9 +45,12 @@ while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
     $contact_tag_id_array[] = $contact_tag_id;
 }
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class='fas fa-user-edit mr-2'></i>Editing Contact: <strong><?php echo $contact_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
diff --git a/agent/modals/document/document_edit.php b/agent/modals/document/document_edit.php
index 9154a99f..26a6e5e4 100644
--- a/agent/modals/document/document_edit.php
+++ b/agent/modals/document/document_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $document_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
@@ -14,8 +16,10 @@ $document_folder_id = intval($row['document_folder_id']);
 $document_client_visible = intval($row['document_client_visible']);
 $client_id = intval($row['document_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/domain/domain_edit.php b/agent/modals/domain/domain_edit.php
index c6079ea9..21eb4dc5 100644
--- a/agent/modals/domain/domain_edit.php
+++ b/agent/modals/domain/domain_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $domain_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = $domain_id LIMIT 1");
@@ -26,8 +28,10 @@ $client_id = intval($row['domain_client_id']);
 
 $history_sql = mysqli_query($mysqli, "SELECT * FROM domain_history WHERE domain_history_domain_id = $domain_id");
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/network/network_edit.php b/agent/modals/network/network_edit.php
index 950bcb43..a34e8023 100644
--- a/agent/modals/network/network_edit.php
+++ b/agent/modals/network/network_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $network_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $network_id LIMIT 1");
@@ -19,7 +21,10 @@ $network_notes = nullable_htmlentities($row['network_notes']);
 $network_location_id = intval($row['network_location_id']);
 $client_id = intval($row['network_client_id']);
 
+enforceClientAccess();
+
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">
diff --git a/agent/modals/rack/rack_edit.php b/agent/modals/rack/rack_edit.php
index 28d980ad..84d427a2 100644
--- a/agent/modals/rack/rack_edit.php
+++ b/agent/modals/rack/rack_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $rack_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM racks WHERE rack_id = $rack_id LIMIT 1");
@@ -20,9 +22,12 @@ $rack_location_id = nullable_htmlentities($row['rack_location_id']);
 $rack_created_at = nullable_htmlentities($row['rack_created_at']);
 $client_id = intval($row['rack_client_id']);
 
-// Generate the HTML form content using output buffering.
+enforceClientAccess();
+
 ob_start();
+
 ?>
+
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-server mr-2"></i>Editing rack: <strong><?php echo $rack_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
diff --git a/agent/modals/software/software_edit.php b/agent/modals/software/software_edit.php
index 384e1cef..9e5129d5 100644
--- a/agent/modals/software/software_edit.php
+++ b/agent/modals/software/software_edit.php
@@ -2,6 +2,8 @@
 
 require_once '../../../includes/modal_header.php';
 
+enforceUserPermission('module_support', 2);
+
 $software_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = $software_id LIMIT 1");
@@ -51,6 +53,8 @@ $license_types_array = array (
     'Usage-based'
 );
 
+enforceClientAccess();
+
 ob_start();
 
 ?>