diff --git a/api_key_add_modal.php b/api_key_add_modal.php index e07fc39a..23cefd42 100644 --- a/api_key_add_modal.php +++ b/api_key_add_modal.php @@ -5,7 +5,7 @@ $key = randomString(156);
-
New Key
+
New Key
@@ -74,7 +74,7 @@ $key = randomString(156);
- +
diff --git a/blank.php b/blank.php index a9909909..c7ea11e0 100644 --- a/blank.php +++ b/blank.php @@ -18,6 +18,17 @@
+
+'; +foreach ($timezones as $timezone) { + echo ''; +} +echo ''; + +?> +
diff --git a/client_contact_details.php b/client_contact_details.php index 65667410..d53d7a95 100644 --- a/client_contact_details.php +++ b/client_contact_details.php @@ -11,7 +11,6 @@ if (isset($_GET['contact_id'])) { "); $row = mysqli_fetch_array($sql); - $contact_id = $row['contact_id']; $contact_name = htmlentities($row['contact_name']); $contact_title = htmlentities($row['contact_title']); $contact_department =htmlentities($row['contact_department']); @@ -25,13 +24,13 @@ if (isset($_GET['contact_id'])) { $contact_important = intval($row['contact_important']); $contact_billing = intval($row['contact_billing']); $contact_technical = intval($row['contact_technical']); - $contact_created_at = $row['contact_created_at']; + $contact_created_at = htmlentities($row['contact_created_at']); if ($contact_id == $primary_contact) { $primary_contact_display = "Primary Contact"; } else { $primary_contact_display = false; } - $contact_location_id = $row['contact_location_id']; + $contact_location_id = intval($row['contact_location_id']); $location_name = htmlentities($row['location_name']); if (empty($location_name)) { $location_name_display = "-"; @@ -126,7 +125,7 @@ if (isset($_GET['contact_id'])) {
-
    +
    1. Home
      2. @@ -144,7 +143,7 @@ if (isset($_GET['contact_id'])) {
      ">
      -

      Assets

      +

      Assets

      @@ -165,7 +164,7 @@ if (isset($_GET['contact_id'])) {
      Interfaces - Edit - Copy + + Edit + + + Copy +
      - Archive - Delete + + Archive + + + Delete +
      @@ -259,7 +266,7 @@ if (isset($_GET['contact_id'])) {
      ">
      -

      Passwords

      +

      Passwords

      @@ -278,7 +285,7 @@ if (isset($_GET['contact_id'])) { Hover.."; } $login_note = htmlentities($row['login_note']); - $login_contact_id = $row['login_contact_id']; - $login_vendor_id = $row['login_vendor_id']; - $login_asset_id = $row['login_asset_id']; - $login_software_id = $row['login_software_id']; + $login_contact_id = intval($row['login_contact_id']); + $login_vendor_id = intval($row['login_vendor_id']); + $login_asset_id = intval($row['login_asset_id']); + $login_software_id = intval($row['login_software_id']); ?> @@ -326,11 +333,17 @@ if (isset($_GET['contact_id'])) {
      - Edit - )">Share + + Edit + + )"> + Share +
      - Delete + + Delete +
      @@ -353,7 +366,7 @@ if (isset($_GET['contact_id'])) {
      ">
      -

      Licenses

      +

      Licenses

      @@ -371,21 +384,21 @@ if (isset($_GET['contact_id'])) {
      - Edit + + Edit +
      - Delete + + Delete +
      @@ -444,7 +461,7 @@ if (isset($_GET['contact_id'])) {
      ">
      -

      Tickets

      +

      Tickets

      @@ -464,14 +481,14 @@ if (isset($_GET['contact_id'])) { Never

      "; @@ -481,7 +498,7 @@ if (isset($_GET['contact_id'])) { } else { $ticket_updated_at_display = $ticket_updated_at; } - $ticket_closed_at = $row['ticket_closed_at']; + $ticket_closed_at = htmlentities($row['ticket_closed_at']); if ($ticket_status == "Open") { $ticket_status_display = "$ticket_status"; @@ -500,7 +517,7 @@ if (isset($_GET['contact_id'])) { } else { $ticket_priority_display = "-"; } - $ticket_assigned_to = $row['ticket_assigned_to']; + $ticket_assigned_to = intval($row['ticket_assigned_to']); if (empty($ticket_assigned_to)) { if ($ticket_status == "Closed") { $ticket_assigned_to_display = "

      Not Assigned

      "; diff --git a/client_contact_import_modal.php b/client_contact_import_modal.php index 2928e725..a7c02bfd 100644 --- a/client_contact_import_modal.php +++ b/client_contact_import_modal.php @@ -16,10 +16,11 @@
      - +
      - + +
      diff --git a/client_document_add_from_template_modal.php b/client_document_add_from_template_modal.php index a6cc0771..7df8beae 100644 --- a/client_document_add_from_template_modal.php +++ b/client_document_add_from_template_modal.php @@ -2,7 +2,7 @@
      -
      New Document from Template
      +
      New Document from Template
      @@ -22,7 +22,7 @@ @@ -56,7 +56,7 @@ @@ -73,8 +73,8 @@
      - - + +
      diff --git a/client_document_add_modal.php b/client_document_add_modal.php index 9a7c84b4..efcf4202 100644 --- a/client_document_add_modal.php +++ b/client_document_add_modal.php @@ -2,7 +2,7 @@
      -
      New Document
      +
      New Document
      @@ -29,7 +29,7 @@ @@ -43,8 +43,8 @@
      - - + +
      diff --git a/client_document_details.php b/client_document_details.php index 699e11fd..254627bb 100644 --- a/client_document_details.php +++ b/client_document_details.php @@ -14,9 +14,9 @@ $row = mysqli_fetch_array($sql_document); $folder_name = htmlentities($row['folder_name']); $document_name = htmlentities($row['document_name']); $document_content = $row['document_content']; -$document_created_at = $row['document_created_at']; -$document_updated_at = $row['document_updated_at']; -$document_folder_id = $row['document_folder_id']; +$document_created_at = htmlentities($row['document_created_at']); +$document_updated_at = htmlentities($row['document_updated_at']); +$document_folder_id = intval($row['document_folder_id']); ?> @@ -35,10 +35,10 @@ $document_folder_id = $row['document_folder_id']; 0) { ?>
    2. - +
      3. -
      4. +
    @@ -55,16 +55,23 @@ $document_folder_id = $row['document_folder_id'];
    - - - + + +
    -
    Files
    -
    Passwords
    -
    Contacts
    -
    Assets
    -
    Software
    -
    Vendors
    +
    Files
    +
    Passwords
    +
    Contacts
    +
    Assets
    +
    Software
    +
    Vendors
    diff --git a/client_document_edit_modal.php b/client_document_edit_modal.php index ee2f134f..3abec2ba 100644 --- a/client_document_edit_modal.php +++ b/client_document_edit_modal.php @@ -2,7 +2,7 @@
    -
    Editing document:
    +
    Editing document:
    @@ -30,7 +30,7 @@ @@ -43,8 +43,8 @@
    - - + +
    diff --git a/client_document_folder_add_modal.php b/client_document_folder_add_modal.php index 4fe2fe79..4ffaaef5 100644 --- a/client_document_folder_add_modal.php +++ b/client_document_folder_add_modal.php @@ -2,7 +2,7 @@
    -
    New Folder
    +
    New Folder
    @@ -23,8 +23,8 @@
    - - + +
    diff --git a/client_document_folder_rename_modal.php b/client_document_folder_rename_modal.php index 7dca7993..0d7e9d36 100644 --- a/client_document_folder_rename_modal.php +++ b/client_document_folder_rename_modal.php @@ -2,7 +2,7 @@
    -
    Renaming folder:
    +
    Renaming folder:
    @@ -24,8 +24,8 @@
    - - + +
    diff --git a/client_document_template_add_modal.php b/client_document_template_add_modal.php index 01530fab..ab92636a 100644 --- a/client_document_template_add_modal.php +++ b/client_document_template_add_modal.php @@ -2,7 +2,7 @@
    -
    New Document Template
    +
    New Document Template
    @@ -22,8 +22,8 @@
    - - + +
    diff --git a/client_document_template_details.php b/client_document_template_details.php index 8a3ffedd..53d09c55 100644 --- a/client_document_template_details.php +++ b/client_document_template_details.php @@ -14,8 +14,8 @@ $row = mysqli_fetch_array($sql_document); $document_name = htmlentities($row['document_name']); $document_content = $row['document_content']; -$document_created_at = $row['document_created_at']; -$document_updated_at = $row['document_updated_at']; +$document_created_at = htmlentities($row['document_created_at']); +$document_updated_at = htmlentities($row['document_updated_at']); ?> @@ -35,18 +35,22 @@ $document_updated_at = $row['document_updated_at'];
  1. Templates
    2. -
    3. +
-

+

- - + +
diff --git a/client_document_template_edit_modal.php b/client_document_template_edit_modal.php index 7ffe9000..b5fd252c 100644 --- a/client_document_template_edit_modal.php +++ b/client_document_template_edit_modal.php @@ -2,7 +2,7 @@
-
Editing template:
+
Editing template:
@@ -21,8 +21,8 @@
- - + +
diff --git a/client_document_templates.php b/client_document_templates.php index b0765d9b..072d0f43 100644 --- a/client_document_templates.php +++ b/client_document_templates.php @@ -4,7 +4,7 @@ // Sort by if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "document_name"; } @@ -34,23 +34,23 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Document Templates

+

Document Templates

Documents
- +
- +
@@ -80,12 +80,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -101,10 +101,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Edit + + Edit +
- Delete + + Delete +
diff --git a/client_documents.php b/client_documents.php index 3e9dd824..0cbdc6cd 100644 --- a/client_documents.php +++ b/client_documents.php @@ -11,7 +11,7 @@ if (!empty($_GET['folder_id'])) { // Sort by if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "document_name"; } @@ -50,7 +50,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

- Documents + Documents

@@ -61,11 +61,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Folder + + Folder +
From Template
@@ -86,11 +88,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -117,7 +119,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); Rename
- Delete + Delete
@@ -136,10 +138,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
- +
@@ -169,12 +171,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -190,11 +192,17 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Edit - )">Share + + Edit + + )"> + Share +
- Delete + + Delete +
diff --git a/client_domain_add_modal.php b/client_domain_add_modal.php index c64c2ebc..329feb08 100644 --- a/client_domain_add_modal.php +++ b/client_domain_add_modal.php @@ -2,7 +2,7 @@
-
New Domain
+
New Domain
@@ -33,7 +33,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $vendor_id = $row['vendor_id']; + $vendor_id = intval($row['vendor_id']); $vendor_name = htmlentities($row['vendor_name']); ?> @@ -54,7 +54,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $vendor_id = $row['vendor_id']; + $vendor_id = intval($row['vendor_id']); $vendor_name = htmlentities($row['vendor_name']); ?> @@ -75,8 +75,8 @@
- - + +
diff --git a/client_domain_edit_modal.php b/client_domain_edit_modal.php index ce8aabfe..09a415f0 100644 --- a/client_domain_edit_modal.php +++ b/client_domain_edit_modal.php @@ -2,7 +2,7 @@
-
Editing domain:
+
Editing domain:
@@ -129,8 +129,8 @@
- - + +
diff --git a/client_domains.php b/client_domains.php index 9776097e..91bfc009 100644 --- a/client_domains.php +++ b/client_domains.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "domain_name"; } @@ -21,9 +21,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Domains

+

Domains

- +
@@ -34,7 +34,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -43,7 +43,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export + Export
@@ -65,7 +65,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- )" data-target="#editDomainModal">Edit + )" data-target="#editDomainModal"> + Edit +
- Delete + + Delete +
diff --git a/client_file_add_modal.php b/client_file_add_modal.php index 671ea4f3..5b5fa383 100644 --- a/client_file_add_modal.php +++ b/client_file_add_modal.php @@ -2,7 +2,7 @@
-
Upload File
+
Upload File
@@ -27,8 +27,8 @@
- - + +
diff --git a/client_file_view_modal.php b/client_file_view_modal.php index 9903700b..e8f16bc0 100644 --- a/client_file_view_modal.php +++ b/client_file_view_modal.php @@ -2,7 +2,7 @@
-
+
diff --git a/client_files.php b/client_files.php index 98ed549d..9493a667 100644 --- a/client_files.php +++ b/client_files.php @@ -12,7 +12,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
-

Files

+

Files

@@ -29,7 +29,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
-

Invoices

+

Invoices

- +
@@ -43,7 +43,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -52,7 +52,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export + Export
@@ -77,7 +77,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - + - +
@@ -137,13 +137,21 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Send + + Send +
- Edit - Copy + + Edit + + + Copy +
- Delete + + Delete +
diff --git a/client_location_add_modal.php b/client_location_add_modal.php index 19a151c6..40eaefe6 100644 --- a/client_location_add_modal.php +++ b/client_location_add_modal.php @@ -2,7 +2,7 @@
-
Creating location
+
Creating location
@@ -163,8 +163,8 @@
- - + +
diff --git a/client_location_edit_modal.php b/client_location_edit_modal.php index ac24da7b..1e4e2ded 100644 --- a/client_location_edit_modal.php +++ b/client_location_edit_modal.php @@ -2,7 +2,7 @@
-
Editing location:
+
Editing location:
@@ -117,7 +117,7 @@ $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE (contact_archived_at > '$location_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql_contacts)) { - $contact_id_select = $row['contact_id']; + $contact_id_select = intval($row['contact_id']); $contact_name_select = htmlentities($row['contact_name']); ?> @@ -172,8 +172,8 @@
- - + +
diff --git a/client_location_import_modal.php b/client_location_import_modal.php index 1de88f8c..1b499b03 100644 --- a/client_location_import_modal.php +++ b/client_location_import_modal.php @@ -2,7 +2,7 @@
-
Import Locations
+
Import Locations
@@ -16,10 +16,11 @@
- +
- + +
diff --git a/client_locations.php b/client_locations.php index 0b416245..8bca6f6a 100644 --- a/client_locations.php +++ b/client_locations.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -15,7 +15,7 @@ if (isset($_GET['q'])) { } if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "location_name"; } @@ -37,9 +37,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Locations

+

Locations

- +
@@ -49,7 +49,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -58,8 +58,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export - + Export +
@@ -81,7 +81,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); Primary Location

"; } else { @@ -126,11 +126,18 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Edit + + Edit +
- Archive - Delete + + Archive + +
+ + Delete +
diff --git a/client_login_add_modal.php b/client_login_add_modal.php index f9cb1e88..dc571a73 100644 --- a/client_login_add_modal.php +++ b/client_login_add_modal.php @@ -2,7 +2,7 @@
-
New Login
+
New Login
@@ -109,7 +109,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $contact_id = $row['contact_id']; + $contact_id = intval($row['contact_id']); $contact_name = htmlentities($row['contact_name']); ?> @@ -133,7 +133,7 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = $client_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql_vendors)) { - $vendor_id = $row['vendor_id']; + $vendor_id = intval($row['vendor_id']); $vendor_name = htmlentities($row['vendor_name']); ?> @@ -157,7 +157,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_client_id = $client_id ORDER BY asset_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $asset_id = $row['asset_id']; + $asset_id = intval($row['asset_id']); $asset_name = htmlentities($row['asset_name']); ?> @@ -181,7 +181,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = $client_id ORDER BY software_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $software_id = $row['software_id']; + $software_id = intval($row['software_id']); $software_name = htmlentities($row['software_name']); ?> @@ -206,8 +206,8 @@
- - + +
diff --git a/client_login_edit_modal.php b/client_login_edit_modal.php index c11623c0..6f53206c 100644 --- a/client_login_edit_modal.php +++ b/client_login_edit_modal.php @@ -2,7 +2,7 @@
-
Editing password:
+
Editing password:
@@ -117,7 +117,7 @@ $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql_contacts)) { - $contact_id_select = $row['contact_id']; + $contact_id_select = intval($row['contact_id']); $contact_name_select = htmlentities($row['contact_name']); ?> @@ -138,7 +138,7 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = $client_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql_vendors)) { - $vendor_id_select = $row['vendor_id']; + $vendor_id_select = intval($row['vendor_id']); $vendor_name_select = htmlentities($row['vendor_name']); ?> @@ -160,7 +160,7 @@ $sql_assets = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_client_id = $client_id ORDER BY asset_name ASC"); while ($row = mysqli_fetch_array($sql_assets)) { - $asset_id_select = $row['asset_id']; + $asset_id_select = intval($row['asset_id']); $asset_name_select = htmlentities($row['asset_name']); ?> @@ -182,7 +182,7 @@ $sql_software = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = $client_id ORDER BY software_name ASC"); while ($row = mysqli_fetch_array($sql_software)) { - $software_id_select = $row['software_id']; + $software_id_select = intval($row['software_id']); $software_name_select = htmlentities($row['software_name']); ?> @@ -205,8 +205,8 @@
- - + +
diff --git a/client_login_import_modal.php b/client_login_import_modal.php index b82a1c4e..a7aeb4c6 100644 --- a/client_login_import_modal.php +++ b/client_login_import_modal.php @@ -16,10 +16,11 @@
- +
- + +
diff --git a/client_logins.php b/client_logins.php index 8be4d70a..863ee58d 100644 --- a/client_logins.php +++ b/client_logins.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "login_name"; } @@ -25,9 +25,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Passwords

+

Passwords

- +
@@ -37,7 +37,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -46,8 +46,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export - + Export +
@@ -59,7 +59,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); "> Name - Username + Username Password OTP URI @@ -70,7 +70,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); Hover.."; } $login_note = htmlentities($row['login_note']); - $login_important = $row['login_important']; - $login_contact_id = $row['login_contact_id']; - $login_vendor_id = $row['login_vendor_id']; - $login_asset_id = $row['login_asset_id']; - $login_software_id = $row['login_software_id']; + $login_important = intval($row['login_important']); + $login_contact_id = intval($row['login_contact_id']); + $login_vendor_id = intval($row['login_vendor_id']); + $login_asset_id = intval($row['login_asset_id']); + $login_software_id = intval($row['login_software_id']); ?> @@ -119,11 +119,17 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Edit - )">Share + + Edit + + )"> + Share +
- Delete + + Delete +
diff --git a/client_logs.php b/client_logs.php index 75a76a62..af47940a 100644 --- a/client_logs.php +++ b/client_logs.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "log_id"; } @@ -31,7 +31,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Audit Logs

+

Audit Logs

@@ -41,7 +41,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -72,7 +72,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); diff --git a/client_network_add_modal.php b/client_network_add_modal.php index a2bba179..a2bfeb38 100644 --- a/client_network_add_modal.php +++ b/client_network_add_modal.php @@ -2,7 +2,7 @@
-
New Network
+
New Network
@@ -52,7 +52,7 @@
- +
@@ -73,7 +73,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $location_id = $row['location_id']; + $location_id = intval($row['location_id']); $location_name = htmlentities($row['location_name']); ?> @@ -87,8 +87,8 @@
- - + +
diff --git a/client_network_edit_modal.php b/client_network_edit_modal.php index b334cfca..b8dacdb6 100644 --- a/client_network_edit_modal.php +++ b/client_network_edit_modal.php @@ -2,7 +2,7 @@
-
Edit network:
+
Edit network:
@@ -53,7 +53,7 @@
- +
@@ -76,8 +76,8 @@
- - + +
diff --git a/client_networks.php b/client_networks.php index 7c7c7696..f7425a03 100644 --- a/client_networks.php +++ b/client_networks.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "network_name"; } @@ -25,9 +25,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Networks

+

Networks

- +
@@ -37,7 +37,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -70,7 +70,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - )" data-target="#editNetworkModal"> + )" + data-target="#editNetworkModal"> + + @@ -110,10 +113,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- )" data-target="#editNetworkModal">Edit + )" data-target="#editNetworkModal"> + Edit +
- Delete + + Delete +
diff --git a/client_overview.php b/client_overview.php index 7f8fdbed..66948278 100644 --- a/client_overview.php +++ b/client_overview.php @@ -60,7 +60,7 @@ $sql_domains_expiring = mysqli_query(

@@ -124,9 +124,9 @@ $sql_domains_expiring = mysqli_query(

@@ -159,9 +159,9 @@ $sql_domains_expiring = mysqli_query(

@@ -176,9 +176,9 @@ $sql_domains_expiring = mysqli_query(

@@ -195,9 +195,9 @@ $sql_domains_expiring = mysqli_query(

@@ -224,7 +224,7 @@ $sql_domains_expiring = mysqli_query(

-
Stale Tickets (14d)
+
Stale Tickets (14d)
@@ -233,11 +233,11 @@ $sql_domains_expiring = mysqli_query( diff --git a/client_payments.php b/client_payments.php index 761944bf..601bd2dd 100644 --- a/client_payments.php +++ b/client_payments.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "payment_date"; } @@ -32,7 +32,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Payments

+

Payments

@@ -41,7 +41,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -50,7 +50,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export + Export
@@ -75,14 +75,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - + - + diff --git a/client_quotes.php b/client_quotes.php index aa8334a9..b1cc0d40 100644 --- a/client_quotes.php +++ b/client_quotes.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "quote_number"; } @@ -32,9 +32,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Quotes

+

Quotes

- +
@@ -44,7 +44,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -53,7 +53,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export + Export
@@ -77,7 +77,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - + - + diff --git a/client_recurring_invoices.php b/client_recurring_invoices.php index fadeb453..5806daf5 100644 --- a/client_recurring_invoices.php +++ b/client_recurring_invoices.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "recurring_id"; } @@ -25,9 +25,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Recurring Invoices

+

Recurring Invoices

- +
@@ -37,7 +37,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -46,7 +46,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Export + Export
@@ -72,21 +72,21 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - + - ly - + ly + @@ -117,9 +117,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- Edit + + Edit +
- Delete + + Delete +
diff --git a/client_scheduled_tickets.php b/client_scheduled_tickets.php index 1ac573e2..a39ac95c 100644 --- a/client_scheduled_tickets.php +++ b/client_scheduled_tickets.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "scheduled_ticket_subject"; } @@ -28,7 +28,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
-

Scheduled Tickets

+

Scheduled Tickets

Tickets @@ -43,7 +43,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- +
@@ -71,18 +71,18 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - - + + +
@@ -91,11 +91,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
Edit + data-target="#editScheduledTicketModal" onclick="populateScheduledTicketEditModal()"> + Edit +
- Delete + + Delete +
diff --git a/client_service_add_modal.php b/client_service_add_modal.php index 3043c33f..118286d2 100644 --- a/client_service_add_modal.php +++ b/client_service_add_modal.php @@ -2,7 +2,7 @@
-
New Service
+
New Service
@@ -39,7 +39,7 @@
- +
@@ -49,7 +49,7 @@
- +
@@ -60,7 +60,7 @@
- +
@@ -84,7 +84,7 @@
- +
@@ -101,7 +101,7 @@ $contact_name"; } @@ -115,7 +115,7 @@ $vendor_name"; } @@ -129,7 +129,7 @@ $document_name"; } @@ -153,7 +153,7 @@ $asset_name"; } @@ -169,7 +169,7 @@ $login_name"; } @@ -190,7 +190,7 @@ $domain_name"; } @@ -206,7 +206,7 @@ $cert_name ($cert_domain)"; @@ -223,8 +223,8 @@
- - + +
diff --git a/client_service_edit_modal.php b/client_service_edit_modal.php index 97158655..8a2b76ed 100644 --- a/client_service_edit_modal.php +++ b/client_service_edit_modal.php @@ -2,7 +2,7 @@
-
Editing service:
+
Editing service:
@@ -40,7 +40,7 @@
- +
@@ -50,7 +50,7 @@
- +
@@ -61,7 +61,7 @@
- +
@@ -85,7 +85,7 @@
- +
@@ -105,10 +105,10 @@ // Get all contacts // NOTE: These are called $sql_all and $row_all for a reason - anything overwriting $sql or $row will break the current while loop we are in from client_services.php - $sql_all = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = '$client_id'"); + $sql_all = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id"); while ($row_all = mysqli_fetch_array($sql_all)) { - $contact_id = $row_all['contact_id']; + $contact_id = intval($row_all['contact_id']); $contact_name = htmlentities($row_all['contact_name']); if (in_array($contact_id, $selected_ids)) { @@ -130,7 +130,7 @@ $sql_all = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_template = 0 AND vendor_client_id = '$client_id'"); while ($row_all = mysqli_fetch_array($sql_all)) { - $vendor_id = $row_all['vendor_id']; + $vendor_id = intval($row_all['vendor_id']); $vendor_name = htmlentities($row_all['vendor_name']); if (in_array($vendor_id, $selected_ids)) { @@ -152,7 +152,7 @@ $sql_all = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_client_id = '$client_id'"); while ($row_all = mysqli_fetch_array($sql_all)) { - $document_id = $row_all['document_id']; + $document_id = intval($row_all['document_id']); $document_name = htmlentities($row_all['document_name']); if (in_array($document_id, $selected_ids)) { @@ -185,7 +185,7 @@ $sql_all = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_client_id = '$client_id'"); while ($row_all = mysqli_fetch_array($sql_all)) { - $asset_id = $row_all['asset_id']; + $asset_id = intval($row_all['asset_id']); $asset_name = htmlentities($row_all['asset_name']); if (in_array($asset_id, $selected_ids)) { @@ -209,7 +209,7 @@ $sql_all = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_client_id = '$client_id'"); while ($row_all = mysqli_fetch_array($sql_all)) { - $login_id = $row_all['login_id']; + $login_id = intval($row_all['login_id']); $login_name = htmlentities($row_all['login_name']); if (in_array($login_id, $selected_ids)) { @@ -238,7 +238,7 @@ $sql_all = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id = '$client_id'"); while ($row_all = mysqli_fetch_array($sql_all)) { - $domain_id = $row_all['domain_id']; + $domain_id = intval($row_all['domain_id']); $domain_name = htmlentities($row_all['domain_name']); if (in_array($domain_id, $selected_ids)) { @@ -262,7 +262,7 @@ $sql_all = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = '$client_id'"); while ($row_all = mysqli_fetch_array($sql_all)) { - $cert_id = $row_all['certificate_id']; + $cert_id = intval($row_all['certificate_id']); $cert_name = htmlentities($row_all['certificate_name']); if (in_array($cert_id, $selected_ids)) { @@ -284,8 +284,8 @@
- - + +
diff --git a/client_service_view_modal.php b/client_service_view_modal.php index 3136e04e..bedb5536 100644 --- a/client_service_view_modal.php +++ b/client_service_view_modal.php @@ -2,9 +2,9 @@
-
+
@@ -17,14 +17,14 @@ Description:
Backup Info:

-
Notes
+
Notes
0) { ?> -
Assets
+
Assets
    $row[asset_name] $ip"; @@ -57,7 +56,7 @@ // Get networks linked to assets - push name to array while ($row = mysqli_fetch_array($sql_assets)) { if (!empty($row['network_name'])) { - $network_data = "$row[network_name]:$row[network_vlan]"; + $network_data = htmlentities("$row[network_name]:$row[network_vlan]"); array_push($networks, $network_data); } } @@ -67,7 +66,7 @@ // Display if (!empty($networks)) { ?> -
    Networks
    +
    Networks
      -
      Locations
      +
      Locations
        0) { ?> -
        Domains
        +
        Domains
          0) { ?> -
          Certificates
          +
          Certificates
            0) { ?> -
            Vendors
            +
            Vendors
              0) { ?> -
              Contacts
              +
              Contacts
              @@ -207,7 +206,7 @@ 0 || mysqli_num_rows($sql_logins) > 0) { ?> -
              Logins
              +
              Logins
                -
                URLs
                +
                URLs
                  0) { ?> -
                  Documents
                  +
                  Documents
                  diff --git a/client_services.php b/client_services.php index 5e3022d5..009c46fa 100644 --- a/client_services.php +++ b/client_services.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "service_name"; } @@ -25,9 +25,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); ?>
                  -

                  Services

                  +

                  Services

                  - +
                  @@ -36,7 +36,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -52,7 +52,6 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); Category Updated Importance - Action @@ -60,15 +59,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Delete + + Delete +
                  @@ -117,7 +120,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); LEFT JOIN logins ON service_assets.asset_id = logins.login_asset_id LEFT JOIN networks ON assets.asset_network_id = networks.network_id LEFT JOIN locations ON assets.asset_location_id = locations.location_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); // Associated logins @@ -125,7 +128,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $mysqli, "SELECT * FROM service_logins LEFT JOIN logins ON service_logins.login_id = logins.login_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); // Associated Domains @@ -133,14 +136,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $mysqli, "SELECT * FROM service_domains LEFT JOIN domains ON service_domains.domain_id = domains.domain_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); // Associated Certificates $sql_certificates = mysqli_query( $mysqli, "SELECT * FROM service_certificates LEFT JOIN certificates ON service_certificates.certificate_id = certificates.certificate_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); // Associated URLs ---- REMOVED for now @@ -152,7 +155,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $mysqli, "SELECT * FROM service_vendors LEFT JOIN vendors ON service_vendors.vendor_id = vendors.vendor_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); // Associated Contacts @@ -160,7 +163,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $mysqli, "SELECT * FROM service_contacts LEFT JOIN contacts ON service_contacts.contact_id = contacts.contact_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); // Associated Documents @@ -168,7 +171,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $mysqli, "SELECT * FROM service_documents LEFT JOIN documents ON service_documents.document_id = documents.document_id - WHERE service_id = '$service_id'" + WHERE service_id = $service_id" ); require("client_service_edit_modal.php"); diff --git a/client_shared_items.php b/client_shared_items.php index a99a4c31..80dfbe71 100644 --- a/client_shared_items.php +++ b/client_shared_items.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -35,7 +35,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Shared Items (Links)

                  +

                  Shared Items (Links)

                  @@ -70,16 +70,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Deactivate + + Deactivate +
                  diff --git a/client_software.php b/client_software.php index 548bcffd..9b8b2244 100644 --- a/client_software.php +++ b/client_software.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "software_name"; } @@ -25,11 +25,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Licenses

                  +

                  Licenses

                  @@ -45,7 +45,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -54,7 +54,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Export + Export
                  @@ -77,19 +77,19 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Archive and
                  Remove Licenses                   + + Archive and
                  Remove Licenses
                  - Delete and
                  Remove Licenses                   + + Delete and
                  Remove Licenses
                  diff --git a/client_software_add_from_template_modal.php b/client_software_add_from_template_modal.php index 931c6f4a..e8fbe085 100644 --- a/client_software_add_from_template_modal.php +++ b/client_software_add_from_template_modal.php @@ -2,7 +2,7 @@
                  -
                  New License from Template
                  +
                  New License from Template
                  @@ -22,7 +22,7 @@ @@ -36,10 +36,8 @@
                  - - - - + +
                  diff --git a/client_software_add_modal.php b/client_software_add_modal.php index 4bff65cd..bcaf5d61 100644 --- a/client_software_add_modal.php +++ b/client_software_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New License
                  +
                  New License
                  @@ -41,7 +41,7 @@
                  - +
                  @@ -139,7 +139,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_client_id = $client_id ORDER BY asset_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $asset_id = $row['asset_id']; + $asset_id = intval($row['asset_id']); $asset_name = htmlentities($row['asset_name']); $asset_type = htmlentities($row['asset_type']); $contact_name = htmlentities($row['contact_name']); @@ -170,7 +170,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $contact_id = $row['contact_id']; + $contact_id = intval($row['contact_id']); $contact_name = htmlentities($row['contact_name']); $contact_email = htmlentities($row['contact_email']); @@ -225,8 +225,8 @@
                  - - + +
                  diff --git a/client_software_edit_modal.php b/client_software_edit_modal.php index d91b4db8..009ee50b 100644 --- a/client_software_edit_modal.php +++ b/client_software_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing license:
                  +
                  Editing license:
                  @@ -140,7 +140,7 @@ $sql_assets_select = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_client_id = $client_id ORDER BY asset_name ASC"); while ($row = mysqli_fetch_array($sql_assets_select)) { - $asset_id_select = $row['asset_id']; + $asset_id_select = intval($row['asset_id']); $asset_name_select = htmlentities($row['asset_name']); $asset_type_select = htmlentities($row['asset_type']); $contact_name_select = htmlentities($row['contact_name']); @@ -171,7 +171,7 @@ $sql_contacts_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql_contacts_select)) { - $contact_id_select = $row['contact_id']; + $contact_id_select = intval($row['contact_id']); $contact_name_select = htmlentities($row['contact_name']); $contact_email_select = htmlentities($row['contact_email']); @@ -226,8 +226,8 @@
                  - - + +
                  diff --git a/client_software_template_add_modal.php b/client_software_template_add_modal.php index 5421891e..e7fe7bcd 100644 --- a/client_software_template_add_modal.php +++ b/client_software_template_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New License Template
                  +
                  New License Template
                  @@ -65,8 +65,8 @@
                  - - + +
                  diff --git a/client_software_template_edit_modal.php b/client_software_template_edit_modal.php index 6017bb6b..1ed24642 100644 --- a/client_software_template_edit_modal.php +++ b/client_software_template_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing template:
                  +
                  Editing template:
                  @@ -64,8 +64,8 @@
                  - - + +
                  diff --git a/client_software_templates.php b/client_software_templates.php index 8e4ae421..f4911d09 100644 --- a/client_software_templates.php +++ b/client_software_templates.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if(!empty($_GET['sb'])){ - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "software_name"; } @@ -22,13 +22,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Licenses Templates

                  +

                  Licenses Templates

                  Licenses
                  - +
                  @@ -38,7 +38,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -66,15 +66,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -82,17 +82,21 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $software_version"; ?> - +
                  - Edit + + Edit +
                  - Delete + + Delete +
                  diff --git a/client_vendor_templates.php b/client_vendor_templates.php index dc6b727f..fd41fdc5 100644 --- a/client_vendor_templates.php +++ b/client_vendor_templates.php @@ -2,7 +2,7 @@ require_once("inc_all_client.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -14,7 +14,7 @@ if (isset($_GET['q'])) { } if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "vendor_name"; } @@ -36,7 +36,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

                  - Vendor Templates + Vendor Templates

                  @@ -44,7 +44,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  @@ -79,7 +79,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Delete + + Delete +
                  diff --git a/client_vendors.php b/client_vendors.php index a6452a1b..9a76178d 100644 --- a/client_vendors.php +++ b/client_vendors.php @@ -3,7 +3,7 @@ require_once("inc_all_client.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -15,7 +15,7 @@ if (isset($_GET['q'])) { } if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "vendor_name"; } @@ -37,12 +37,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

                  - Vendors + Vendors

                  @@ -58,7 +58,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -67,8 +67,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Export - Import + Export + Import
                  @@ -89,7 +89,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Delete + + Delete +
                  diff --git a/clients.php b/clients.php index bf33533c..a6439d7d 100644 --- a/clients.php +++ b/clients.php @@ -108,10 +108,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Clients

                  +

                  Clients

                  - +
                  diff --git a/companies.php b/companies.php index e957486f..9768a30d 100644 --- a/companies.php +++ b/companies.php @@ -2,7 +2,7 @@ require_once("inc_all_settings.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "company_name"; } @@ -23,9 +23,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Companies

                  +

                  Companies

                  - +
                  @@ -35,7 +35,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -58,7 +58,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Archive + + Archive +
                  - Delete + + Delete +
                  diff --git a/company_add_modal.php b/company_add_modal.php index 53f88a63..3aad3381 100644 --- a/company_add_modal.php +++ b/company_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Company
                  +
                  New Company
                  @@ -183,8 +183,8 @@
                  - - + +
                  diff --git a/company_edit_modal.php b/company_edit_modal.php index d4a492a5..40648f39 100644 --- a/company_edit_modal.php +++ b/company_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing company:
                  +
                  Editing company:
                  @@ -182,8 +182,8 @@
                  - - + +
                  diff --git a/cron.php b/cron.php index 79320439..f15dfe6f 100644 --- a/cron.php +++ b/cron.php @@ -16,7 +16,7 @@ while ($row = mysqli_fetch_array($sql_companies)) { $company_country = $row['company_country']; $company_locale = $row['company_locale']; $company_currency = $row['company_currency']; - $config_enable_cron = $row['config_enable_cron']; + $config_enable_cron = intval($row['config_enable_cron']); $config_invoice_overdue_reminders = $row['config_invoice_overdue_reminders']; $config_invoice_prefix = $row['config_invoice_prefix']; $config_invoice_from_email = $row['config_invoice_from_email']; @@ -24,25 +24,25 @@ while ($row = mysqli_fetch_array($sql_companies)) { $config_smtp_host = $row['config_smtp_host']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; - $config_smtp_port = $row['config_smtp_port']; + $config_smtp_port =intval($row['config_smtp_port']); $config_smtp_encryption = $row['config_smtp_encryption']; $config_mail_from_email = $row['config_mail_from_email']; $config_mail_from_name = $row['config_mail_from_name']; - $config_recurring_auto_send_invoice = $row['config_recurring_auto_send_invoice']; + $config_recurring_auto_send_invoice = intval($row['config_recurring_auto_send_invoice']); // Tickets $config_ticket_prefix = $row['config_ticket_prefix']; - $config_ticket_next_number = $row['config_ticket_next_number']; + $config_ticket_next_number = intval($row['config_ticket_next_number']); $config_ticket_from_name = $row['config_ticket_from_name']; $config_ticket_from_email = $row['config_ticket_from_email']; //Get Config for Telemetry $config_theme = $row['config_theme']; - $config_ticket_email_parse = $row['config_ticket_email_parse']; - $config_module_enable_itdoc = $row['config_module_enable_itdoc']; - $config_module_enable_ticketing = $row['config_module_enable_ticketing']; + $config_ticket_email_parse = intval($row['config_ticket_email_parse']); + $config_module_enable_itdoc = intval($row['config_module_enable_itdoc']); + $config_module_enable_ticketing = intval($row['config_module_enable_ticketing']); $config_module_enable_accounting = $row['config_module_enable_accounting']; - $config_telemetry = $row['config_telemetry']; + $config_telemetry = intval($row['config_telemetry']); // Set Currency Format $currency_format = numfmt_create($company_locale, NumberFormatter::CURRENCY); diff --git a/dashboard_financial.php b/dashboard_financial.php index 0001d8e2..24510afd 100644 --- a/dashboard_financial.php +++ b/dashboard_financial.php @@ -28,32 +28,32 @@ $largest_income_month = 0; //Get Total income $sql_total_payments_to_invoices = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments_to_invoices FROM payments WHERE YEAR(payment_date) = $year AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_payments_to_invoices); -$total_payments_to_invoices = $row['total_payments_to_invoices']; +$total_payments_to_invoices = floatval($row['total_payments_to_invoices']); //Do not grab transfer payment as these have a category_id of 0 $sql_total_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE YEAR(revenue_date) = $year AND revenue_category_id > 0 AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_revenues); -$total_revenues = $row['total_revenues']; +$total_revenues = floatval($row['total_revenues']); $total_income = $total_payments_to_invoices + $total_revenues; //Get Total expenses and do not grab transfer expenses as these have a vendor of 0 $sql_total_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_vendor_id > 0 AND YEAR(expense_date) = $year AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_expenses); -$total_expenses = $row['total_expenses']; +$total_expenses = floatval($row['total_expenses']); //Total up all the Invoices that are not draft or cancelled $sql_invoice_totals = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS invoice_totals FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Cancelled' AND YEAR(invoice_date) = $year AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_invoice_totals); -$invoice_totals = $row['invoice_totals']; +$invoice_totals = floatval($row['invoice_totals']); //Quaeries from Receivables $sql_total_payments_to_invoices_all_years = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments_to_invoices_all_years FROM payments WHERE company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_payments_to_invoices_all_years); -$total_payments_to_invoices_all_years = $row['total_payments_to_invoices_all_years']; +$total_payments_to_invoices_all_years = floatval($row['total_payments_to_invoices_all_years']); $sql_invoice_totals_all_years = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS invoice_totals_all_years FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Cancelled' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_invoice_totals_all_years); -$invoice_totals_all_years = $row['invoice_totals_all_years']; +$invoice_totals_all_years = floatval($row['invoice_totals_all_years']); $receivables = $invoice_totals_all_years - $total_payments_to_invoices_all_years; @@ -82,25 +82,25 @@ $sql_latest_expenses = mysqli_query( //Get Monthly Recurring Total $sql_recurring_monthly_total = mysqli_query($mysqli, "SELECT SUM(recurring_amount) AS recurring_monthly_total FROM recurring WHERE recurring_status = 1 AND recurring_frequency = 'month' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_recurring_monthly_total); -$recurring_monthly_total = $row['recurring_monthly_total']; +$recurring_monthly_total = floatval($row['recurring_monthly_total']); //Get Yearly Recurring Total $sql_recurring_yearly_total = mysqli_query($mysqli, "SELECT SUM(recurring_amount) AS recurring_yearly_total FROM recurring WHERE recurring_status = 1 AND recurring_frequency = 'year' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_recurring_yearly_total); -$recurring_yearly_total = $row['recurring_yearly_total']; +$recurring_yearly_total = floatval($row['recurring_yearly_total']); //Get Total Miles Driven $sql_miles_driven = mysqli_query($mysqli, "SELECT SUM(trip_miles) AS total_miles FROM trips WHERE YEAR(trip_date) = $year AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_miles_driven); -$total_miles = $row['total_miles']; +$total_miles = floatval($row['total_miles']); //Get Total Clients added $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS clients_added FROM clients WHERE YEAR(client_created_at) = $year AND company_id = $session_company_id")); -$clients_added = $row['clients_added']; +$clients_added = intval($row['clients_added']); //Get Total Vendors added $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('vendor_id') AS vendors_added FROM vendors WHERE YEAR(vendor_created_at) = $year AND vendor_client_id = 0 AND vendor_template = 0 AND company_id = $session_company_id")); -$vendors_added = $row['vendors_added']; +$vendors_added = intval($row['vendors_added']); ?> @@ -242,7 +242,7 @@ $vendors_added = $row['vendors_added'];
                  -

                  Cash Flow

                  +

                  Cash Flow

                  @@ -261,7 +261,7 @@ $vendors_added = $row['vendors_added'];
                  -

                  Income by Category

                  +

                  Income by Category

                  @@ -45,21 +45,21 @@ $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -85,7 +85,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = 0 AND vendor_template = 0 AND vendor_archived_at IS NULL AND company_id = $session_company_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $vendor_id = $row['vendor_id']; + $vendor_id = intval($row['vendor_id']); $vendor_name = htmlentities($row['vendor_name']); ?> @@ -120,7 +120,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $category_id = $row['category_id']; + $category_id = intval($row['category_id']); $category_name = htmlentities($row['category_name']); ?> @@ -156,8 +156,8 @@
                  - - + +
                  diff --git a/expense_copy_modal.php b/expense_copy_modal.php index 4f354fe2..5fb6ab0a 100644 --- a/expense_copy_modal.php +++ b/expense_copy_modal.php @@ -2,7 +2,7 @@
                  -
                  Copying expense
                  +
                  Copying expense
                  @@ -46,21 +46,21 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql_accounts)) { - $account_id_select = $row['account_id']; + $account_id_select = intval($row['account_id']); $account_name_select = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; ?> @@ -84,7 +84,7 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = 0 AND vendor_template = 0 AND company_id = $session_company_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql_vendors)) { - $vendor_id_select = $row['vendor_id']; + $vendor_id_select = intval($row['vendor_id']); $vendor_name_select = htmlentities($row['vendor_name']); ?> @@ -116,7 +116,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql_categories)) { - $category_id_select = $row['category_id']; + $category_id_select = intval($row['category_id']); $category_name_select = htmlentities($row['category_name']); ?> @@ -147,8 +147,8 @@
                  - - + +
                  diff --git a/expense_edit_modal.php b/expense_edit_modal.php index 7b98335e..affb6de9 100644 --- a/expense_edit_modal.php +++ b/expense_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing expense
                  +
                  Editing expense
                  @@ -48,21 +48,21 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$expense_created_at' OR account_archived_at IS NULL) AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql_accounts)) { - $account_id_select = $row['account_id']; + $account_id_select = intval($row['account_id']); $account_name_select = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -87,7 +87,7 @@ $sql_select = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = 0 AND vendor_template = 0 AND (vendor_archived_at > '$expense_created_at' OR vendor_archived_at IS NULL) AND company_id = $session_company_id ORDER BY vendor_name ASC"); while ($row = mysqli_fetch_array($sql_select)) { - $vendor_id_select = $row['vendor_id']; + $vendor_id_select = intval($row['vendor_id']); $vendor_name_select = htmlentities($row['vendor_name']); ?> @@ -122,7 +122,7 @@ $sql_select = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' AND (category_archived_at > '$expense_created_at' OR category_archived_at IS NULL) AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql_select)) { - $category_id_select = $row['category_id']; + $category_id_select = intval($row['category_id']); $category_name_select = htmlentities($row['category_name']); ?> @@ -161,8 +161,8 @@
                  - - + +
                  diff --git a/expense_export_modal.php b/expense_export_modal.php index 2ae62149..5b198b4c 100644 --- a/expense_export_modal.php +++ b/expense_export_modal.php @@ -2,7 +2,7 @@
                  -
                  Export Expenses to CSV
                  +
                  Export Expenses to CSV
                  @@ -32,8 +32,8 @@
                  - - + +
                  diff --git a/expense_refund_modal.php b/expense_refund_modal.php index a6464981..e09ee2a4 100644 --- a/expense_refund_modal.php +++ b/expense_refund_modal.php @@ -2,7 +2,7 @@
                  -
                  Refunding expense
                  +
                  Refunding expense
                  @@ -58,8 +58,8 @@
                  - - + +
                  diff --git a/expenses.php b/expenses.php index b4709185a..8992e73f 100644 --- a/expenses.php +++ b/expenses.php @@ -3,7 +3,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "expense_date"; } @@ -22,8 +22,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -74,9 +74,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Expenses

                  +

                  Expenses

                  - +
                  @@ -85,7 +85,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -94,7 +94,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -149,20 +149,20 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - +
                  @@ -187,15 +187,25 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - " download="">Download + " download=""> + Download +
                  - Edit -                   Copy + + Edit + + + Copy +
                  - Refund + + Refund +
                  - Delete + + Delete +
                  diff --git a/get_settings.php b/get_settings.php index ee13fa91..97871565 100644 --- a/get_settings.php +++ b/get_settings.php @@ -13,7 +13,7 @@ $config_azure_client_secret = $row['config_azure_client_secret']; // Mail $config_smtp_host = $row['config_smtp_host']; -$config_smtp_port = $row['config_smtp_port']; +$config_smtp_port = intval($row['config_smtp_port']); $config_smtp_encryption = $row['config_smtp_encryption']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; @@ -21,63 +21,63 @@ $config_mail_from_email = $row['config_mail_from_email']; $config_mail_from_name = $row['config_mail_from_name']; // Mail - IMAP $config_imap_host = $row['config_imap_host']; -$config_imap_port = $row['config_imap_port']; +$config_imap_port = intval($row['config_imap_port']); $config_imap_encryption = $row['config_imap_encryption']; // Defaults -$config_default_transfer_from_account = $row['config_default_transfer_from_account']; -$config_default_transfer_to_account = $row['config_default_transfer_to_account']; -$config_default_payment_account = $row['config_default_payment_account']; -$config_default_expense_account = $row['config_default_expense_account']; +$config_default_transfer_from_account = intval($row['config_default_transfer_from_account']); +$config_default_transfer_to_account = intval($row['config_default_transfer_to_account']); +$config_default_payment_account = intval($row['config_default_payment_account']); +$config_default_expense_account = intval($row['config_default_expense_account']); $config_default_payment_method = $row['config_default_payment_method']; $config_default_expense_payment_method = $row['config_default_expense_payment_method']; -$config_default_calendar = $row['config_default_calendar']; -$config_default_net_terms = $row['config_default_net_terms']; +$config_default_calendar = intval($row['config_default_calendar']); +$config_default_net_terms = intval($row['config_default_net_terms']); // Invoice $config_invoice_prefix = $row['config_invoice_prefix']; -$config_invoice_next_number = $row['config_invoice_next_number']; +$config_invoice_next_number = intval($row['config_invoice_next_number']); $config_invoice_footer = $row['config_invoice_footer']; $config_invoice_from_name = $row['config_invoice_from_name']; $config_invoice_from_email = $row['config_invoice_from_email']; // Recurring $config_recurring_prefix = $row['config_recurring_prefix']; -$config_recurring_next_number = $row['config_recurring_next_number']; +$config_recurring_next_number = intval($row['config_recurring_next_number']); // Quotes $config_quote_prefix = $row['config_quote_prefix']; -$config_quote_next_number = $row['config_quote_next_number']; +$config_quote_next_number = intval($row['config_quote_next_number']); $config_quote_footer = $row['config_quote_footer']; $config_quote_from_name = $row['config_quote_from_name']; $config_quote_from_email = $row['config_quote_from_email']; // Tickets $config_ticket_prefix = $row['config_ticket_prefix']; -$config_ticket_next_number = $row['config_ticket_next_number']; +$config_ticket_next_number = intval($row['config_ticket_next_number']); $config_ticket_from_name = $row['config_ticket_from_name']; $config_ticket_from_email = $row['config_ticket_from_email']; -$config_ticket_email_parse = $row['config_ticket_email_parse']; +$config_ticket_email_parse = intval($row['config_ticket_email_parse']); $config_ticket_client_general_notifications = $row['config_ticket_client_general_notifications']; // Alerts -$config_enable_cron = $row['config_enable_cron']; +$config_enable_cron = intval($row['config_enable_cron']); -$config_recurring_auto_send_invoice = $row['config_recurring_auto_send_invoice']; -$config_enable_alert_domain_expire = $row['config_enable_alert_domain_expire']; -$config_send_invoice_reminders = $row['config_send_invoice_reminders']; -$config_invoice_overdue_reminders = $row['config_invoice_overdue_reminders']; +$config_recurring_auto_send_invoice = intval($row['config_recurring_auto_send_invoice']); +$config_enable_alert_domain_expire = intval($row['config_enable_alert_domain_expire']); +$config_send_invoice_reminders = intval($row['config_send_invoice_reminders']); +$config_invoice_overdue_reminders = intval($row['config_invoice_overdue_reminders']); // Online Payment -$config_stripe_enable = $row['config_stripe_enable']; +$config_stripe_enable = intval($row['config_stripe_enable']); $config_stripe_publishable = $row['config_stripe_publishable']; $config_stripe_secret = $row['config_stripe_secret']; $config_stripe_account = $row['config_stripe_account']; // Modules -$config_module_enable_itdoc = $row['config_module_enable_itdoc']; -$config_module_enable_ticketing = $row['config_module_enable_ticketing']; -$config_module_enable_accounting = $row['config_module_enable_accounting']; +$config_module_enable_itdoc = intval($row['config_module_enable_itdoc']); +$config_module_enable_ticketing = intval($row['config_module_enable_ticketing']); +$config_module_enable_accounting = intval($row['config_module_enable_accounting']); // Currency $config_currency_format = "US_en"; @@ -316,13 +316,6 @@ $countries_array = array( "Zimbabwe" ); -$timezones_array = array( - 'US/Eastern', - 'US/Central', - 'US/Mountain', - 'US/Pacific' -); - $currencies_array = array( 'ALL' => 'Albania Lek', 'AFN' => 'Afghanistan Afghani', diff --git a/global_search.php b/global_search.php index 564aa7b7..922a5884 100644 --- a/global_search.php +++ b/global_search.php @@ -4,7 +4,7 @@ require_once("inc_all.php"); if (isset($_GET['query'])) { - $query = trim(strip_tags(mysqli_real_escape_string($mysqli, $_GET['query']))); + $query = sanitizeInput($_GET['query']); $phone_query = preg_replace("/[^0-9]/", '', $query); if (empty($phone_query)) { @@ -24,7 +24,7 @@ if (isset($_GET['query'])) { $q = htmlentities($_GET['query']); ?> -

                  Search all things

                  +

                  Search all things

                  @@ -35,7 +35,7 @@ if (isset($_GET['query'])) {
                  -
                  Clients
                  +
                  Clients
                  @@ -49,7 +49,7 @@ if (isset($_GET['query'])) {
                  -
                  Contacts
                  +
                  Contacts
                  @@ -94,14 +94,14 @@ if (isset($_GET['query'])) {
                  -
                  Vendors
                  +
                  Vendors
                  @@ -175,7 +175,7 @@ if (isset($_GET['query'])) {
                  -
                  Products
                  +
                  Products
                  @@ -214,7 +214,7 @@ if (isset($_GET['query'])) {
                  -
                  Documents
                  +
                  Documents
                  @@ -230,9 +230,9 @@ if (isset($_GET['query'])) { while ($row = mysqli_fetch_array($sql_documents)) { $document_name = htmlentities($row['document_name']); - $document_client_id = $row['document_client_id']; + $document_client_id = intval($row['document_client_id']); $document_client = htmlentities($row['client_name']); - $document_updated = $row['document_updated_at']; + $document_updated = htmlentities($row['document_updated_at']); ?> @@ -258,7 +258,7 @@ if (isset($_GET['query'])) {
                  -
                  Tickets
                  +
                  Tickets
                  @@ -274,9 +274,9 @@ if (isset($_GET['query'])) {
                  -
                  Logins
                  +
                  Logins
                  @@ -323,7 +323,7 @@ if (isset($_GET['query'])) { while ($row = mysqli_fetch_array($sql_logins)) { $login_name = htmlentities($row['login_name']); - $login_client_id = $row['login_client_id']; + $login_client_id = intval($row['login_client_id']); $login_username = htmlentities(decryptLoginEntry($row['login_username'])); $login_password = htmlentities(decryptLoginEntry($row['login_password'])); diff --git a/guest_ajax.php b/guest_ajax.php index 975a767c..7878780d 100644 --- a/guest_ajax.php +++ b/guest_ajax.php @@ -22,7 +22,7 @@ if (isset($_GET['stripe_create_pi'])) { $jsonStr = file_get_contents('php://input'); $jsonObj = json_decode($jsonStr, true); $invoice_id = intval($jsonObj['invoice_id']); - $url_key = mysqli_real_escape_string($mysqli, $jsonObj['url_key']); + $url_key = sanitizeInput($jsonObj['url_key']); // Query invoice details $invoice_sql = mysqli_query( @@ -43,16 +43,16 @@ if (isset($_GET['stripe_create_pi'])) { // Invoice exists - get details for payment $row = mysqli_fetch_array($invoice_sql); $invoice_prefix = htmlentities($row['invoice_prefix']); - $invoice_number = htmlentities($row['invoice_number']); + $invoice_number = intval($row['invoice_number']); $invoice_amount = floatval($row['invoice_amount']); $invoice_currency_code = htmlentities($row['invoice_currency_code']); - $client_id = $row['client_id']; + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); // Add up all the payments for the invoice and get the total amount paid to the invoice $sql_amount_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"); $row = mysqli_fetch_array($sql_amount_paid); - $amount_paid = $row['amount_paid']; + $amount_paid = floatval($row['amount_paid']); $balance_to_pay = $invoice_amount - $amount_paid; if (intval($balance_to_pay) == 0) { diff --git a/guest_download_file.php b/guest_download_file.php index 596555d5..6154d291 100644 --- a/guest_download_file.php +++ b/guest_download_file.php @@ -3,14 +3,14 @@ require_once("config.php"); require_once("functions.php"); -$ip = trim(strip_tags(mysqli_real_escape_string($mysqli, getIP()))); -$user_agent = strip_tags(mysqli_real_escape_string($mysqli, $_SERVER['HTTP_USER_AGENT'])); +$ip = sanitizeInput(getIP()); +$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); if (isset($_GET['id']) && isset($_GET['key'])) { $item_id = intval($_GET['id']); - $item_key = trim(strip_tags(mysqli_real_escape_string($mysqli, $_GET['key']))); + $item_key = sanitizeInput($_GET['key']); - $sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = '$item_id' AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); $row = mysqli_fetch_array($sql); // Check result @@ -28,8 +28,8 @@ if (isset($_GET['id']) && isset($_GET['key'])) { exit("Item cannot be viewed at this time."); } - $item_related_id = $row['item_related_id']; - $client_id = $row['item_client_id']; + $item_related_id = intval($row['item_related_id']); + $client_id = intval($row['item_client_id']); if (empty($row['item_views'])) { $item_views = 0; @@ -37,18 +37,18 @@ if (isset($_GET['id']) && isset($_GET['key'])) { $item_views = intval($row['item_views']); } - $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = '$item_related_id' AND file_client_id = '$client_id' LIMIT 1"); + $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1"); $file_row = mysqli_fetch_array($file_sql); if (mysqli_num_rows($file_sql) !== 1 || !$file_row) { exit("No file."); } - $file_name = strip_tags(mysqli_real_escape_string($mysqli, $file_row['file_name'])); - $file_ext = $file_row['file_ext']; - $file_reference_name = $file_row['file_reference_name']; - $client_id = $file_row['file_client_id']; - $company_id = $file_row['company_id']; + $file_name = sanitizeInput($file_row['file_name']); + $file_ext = sanitizeInput($file_row['file_ext']); + $file_reference_name = sanitizeInput($file_row['file_reference_name']); + $client_id = intval($file_row['file_client_id']); + $company_id = intval($file_row['company_id']); $file_path = "uploads/clients/$company_id/$client_id/$file_reference_name"; // Display file as download @@ -59,9 +59,9 @@ if (isset($_GET['id']) && isset($_GET['key'])) { // Update file view count $new_item_views = $item_views + 1; - mysqli_query($mysqli, "UPDATE shared_items SET item_views = '$new_item_views' WHERE item_id = '$item_id'"); + mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Downloaded shared file $file_name via link', log_client_id = '$client_id', log_created_at = NOW(), log_ip = '$ip', log_user_agent = '$user_agent', company_id = '1'"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Downloaded shared file $file_name via link', log_client_id = $client_id, log_ip = '$ip', log_user_agent = '$user_agent', company_id = 1"); } diff --git a/guest_header.php b/guest_header.php index 71b602a7..784108a6 100644 --- a/guest_header.php +++ b/guest_header.php @@ -5,10 +5,10 @@ require_once("functions.php"); session_start(); -$ip = trim(strip_tags(mysqli_real_escape_string($mysqli, getIP()))); -$ua = strip_tags(mysqli_real_escape_string($mysqli, $_SERVER['HTTP_USER_AGENT'])); -$os = strip_tags(mysqli_real_escape_string($mysqli, getOS($ua))); -$browser = strip_tags(mysqli_real_escape_string($mysqli, getWebBrowser($ua))); +$ip = sanitizeInput(getIP()); +$ua = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$os = sanitizeInput(getOS($ua)); +$browser = sanitizeInput(getWebBrowser($ua)); ?> @@ -52,7 +52,7 @@ $browser = strip_tags(mysqli_real_escape_string($mysqli, getWebBrowser($ua))); } ?>
                  - +
                  metadata->itflow_invoice_id); $pi_client_id = intval($pi_obj->metadata->itflow_client_id); $pi_amount_paid = floatval(($pi_obj->amount_received / 100)); - $pi_currency = strtoupper(mysqli_real_escape_string($mysqli, $pi_obj->currency)); + $pi_currency = strtoupper(sanitizeInput($pi_obj->currency)); $pi_livemode = $pi_obj->livemode; // Get/Check invoice (& client/primary contact) @@ -211,12 +211,12 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $row = mysqli_fetch_array($invoice_sql); $invoice_id = intval($row['invoice_id']); $invoice_prefix = htmlentities($row['invoice_prefix']); - $invoice_number = htmlentities($row['invoice_number']); + $invoice_number = intval($row['invoice_number']); $invoice_amount = floatval($row['invoice_amount']); $invoice_currency_code = htmlentities($row['invoice_currency_code']); $invoice_url_key = htmlentities($row['invoice_url_key']); $invoice_company_id = intval($row['company_id']); - $client_id = $row['client_id']; + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); $contact_name = $row['contact_name']; $contact_email = $row['contact_email']; @@ -244,11 +244,11 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent mysqli_query($mysqli, "UPDATE invoices SET invoice_status = 'Paid' WHERE invoice_id = $invoice_id AND company_id = $invoice_company_id"); // Add Payment to History - mysqli_query($mysqli, "INSERT INTO payments SET payment_date = '$pi_date', payment_amount = '$pi_amount_paid', payment_currency_code = '$pi_currency', payment_account_id = $config_stripe_account, payment_method = 'Stripe', payment_reference = 'Stripe - $pi_id', payment_invoice_id = $invoice_id, company_id = $invoice_company_id"); + mysqli_query($mysqli, "INSERT INTO payments SET payment_date = '$pi_date', payment_amount = $pi_amount_paid, payment_currency_code = '$pi_currency', payment_account_id = $config_stripe_account, payment_method = 'Stripe', payment_reference = 'Stripe - $pi_id', payment_invoice_id = $invoice_id, company_id = $invoice_company_id"); mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Paid', history_description = 'Payment added - $ip - $os - $browser', history_invoice_id = $invoice_id, company_id = $invoice_company_id"); // Notify - mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Invoice Paid', notification = 'Invoice $invoice_prefix$invoice_number has been paid - $ip - $os - $browser', notification_timestamp = NOW(), notification_client_id = $pi_client_id, company_id = $invoice_company_id"); + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Invoice Paid', notification = 'Invoice $invoice_prefix$invoice_number has been paid - $ip - $os - $browser', notification_client_id = $pi_client_id, company_id = $invoice_company_id"); // Logging $extended_log_desc = ''; @@ -262,7 +262,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $row = mysqli_fetch_array($sql_settings); $config_smtp_host = $row['config_smtp_host']; - $config_smtp_port = $row['config_smtp_port']; + $config_smtp_port = intval($row['config_smtp_port']); $config_smtp_encryption = $row['config_smtp_encryption']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; @@ -295,7 +295,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent } else { mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Sent', history_description = 'Email Receipt Failed!', history_invoice_id = $invoice_id, company_id = $invoice_company_id"); - mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Mail', notification = 'Failed to send email to $contact_email', notification_timestamp = NOW(), company_id = $invoice_company_id"); + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Mail', notification = 'Failed to send email to $contact_email', company_id = $invoice_company_id"); mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Mail', log_action = 'Error', log_description = 'Failed to send email to $contact_email regarding $subject. $mail', company_id = $invoice_company_id"); } } diff --git a/guest_post.php b/guest_post.php index a8c5ad62..46613506 100644 --- a/guest_post.php +++ b/guest_post.php @@ -9,7 +9,7 @@ if (isset($_GET['accept_quote'], $_GET['company_id'], $_GET['url_key'])) { $quote_id = intval($_GET['accept_quote']); $company_id = intval($_GET['company_id']); - $url_key = mysqli_real_escape_string($mysqli, $_GET['url_key']); + $url_key = sanitizeInput($_GET['url_key']); $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id AND quote_url_key = '$url_key' AND company_id = $company_id"); @@ -17,7 +17,7 @@ if (isset($_GET['accept_quote'], $_GET['company_id'], $_GET['url_key'])) { mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Accepted' WHERE quote_id = $quote_id"); - mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Accepted', history_description = 'Client accepted Quote!', history_created_at = NOW(), history_quote_id = $quote_id, company_id = $company_id"); + mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Accepted', history_description = 'Client accepted Quote!', history_quote_id = $quote_id, company_id = $company_id"); $_SESSION['alert_message'] = "Quote Accepted"; @@ -32,15 +32,15 @@ if (isset($_GET['decline_quote'], $_GET['company_id'], $_GET['url_key'])) { $quote_id = intval($_GET['decline_quote']); $company_id = intval($_GET['company_id']); - $url_key = mysqli_real_escape_string($mysqli, $_GET['url_key']); + $url_key = sanitizeInput($_GET['url_key']); - $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id AND quote_url_key = '$url_key' AND quote_url_key = '$url_key' AND company_id = $company_id"); + $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id AND quote_url_key = '$url_key' AND company_id = $company_id"); if (mysqli_num_rows($sql) == 1) { mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Declined' WHERE quote_id = $quote_id"); - mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Declined', history_description = 'Client declined Quote!', history_created_at = NOW(), history_quote_id = $quote_id, company_id = $company_id"); + mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Declined', history_description = 'Client declined Quote!', history_quote_id = $quote_id, company_id = $company_id"); $_SESSION['alert_type'] = "danger"; $_SESSION['alert_message'] = "Quote Declined"; diff --git a/guest_view_invoice.php b/guest_view_invoice.php index c5126dfb..f0617f58 100644 --- a/guest_view_invoice.php +++ b/guest_view_invoice.php @@ -8,7 +8,7 @@ if (!isset($_GET['invoice_id'], $_GET['url_key'])) { exit(); } -$url_key = mysqli_real_escape_string($mysqli, $_GET['url_key']); +$url_key = sanitizeInput($_GET['url_key']); $invoice_id = intval($_GET['invoice_id']); $sql = mysqli_query( @@ -31,17 +31,17 @@ if (mysqli_num_rows($sql) !== 1) { } $row = mysqli_fetch_array($sql); -$invoice_id = $row['invoice_id']; +$invoice_id = intval($row['invoice_id']); $invoice_prefix = htmlentities($row['invoice_prefix']); -$invoice_number = htmlentities($row['invoice_number']); +$invoice_number = intval($row['invoice_number']); $invoice_status = htmlentities($row['invoice_status']); -$invoice_date = $row['invoice_date']; -$invoice_due = $row['invoice_due']; +$invoice_date = htmlentities($row['invoice_date']); +$invoice_due = htmlentities($row['invoice_due']); $invoice_amount = floatval($row['invoice_amount']); $invoice_currency_code = htmlentities($row['invoice_currency_code']); $invoice_note = htmlentities($row['invoice_note']); -$invoice_category_id = $row['invoice_category_id']; -$client_id = $row['client_id']; +$invoice_category_id = intval($row['invoice_category_id']); +$client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); $location_address = htmlentities($row['location_address']); $location_city = htmlentities($row['location_city']); @@ -53,11 +53,11 @@ $contact_extension = htmlentities($row['contact_extension']); $contact_mobile = formatPhoneNumber($row['contact_mobile']); $client_website = htmlentities($row['client_website']); $client_currency_code = htmlentities($row['client_currency_code']); -$client_net_terms = htmlentities($row['client_net_terms']); +$client_net_terms = intval(($row['client_net_terms']); if ($client_net_terms == 0) { $client_net_terms = intval($row['config_default_net_terms']); } -$company_id = $row['company_id']; +$company_id = intval($row['company_id']); $company_name = htmlentities($row['company_name']); $company_address = htmlentities($row['company_address']); $company_city = htmlentities($row['company_city']); @@ -72,7 +72,7 @@ if (!empty($company_logo)) { } $company_locale = htmlentities($row['company_locale']); $config_invoice_footer = htmlentities($row['config_invoice_footer']); -$config_stripe_enable = $row['config_stripe_enable']; +$config_stripe_enable = intval($row['config_stripe_enable']); $config_stripe_publishable = $row['config_stripe_publishable']; $config_stripe_secret = $row['config_stripe_secret']; @@ -90,18 +90,18 @@ if ($invoice_status == 'Sent') { } //Mark viewed in history -mysqli_query($mysqli, "INSERT INTO history SET history_status = '$invoice_status', history_description = 'Invoice viewed - $ip - $os - $browser', history_created_at = NOW(), history_invoice_id = $invoice_id, company_id = $company_id"); +mysqli_query($mysqli, "INSERT INTO history SET history_status = '$invoice_status', history_description = 'Invoice viewed - $ip - $os - $browser', history_invoice_id = $invoice_id, company_id = $company_id"); if ($invoice_status !== 'Paid') { - $client_name_escaped = mysqli_real_escape_string($mysqli, $row['client_name']); - mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Invoice Viewed', notification = 'Invoice $invoice_prefix$invoice_number has been viewed by $client_name_escaped - $ip - $os - $browser', notification_timestamp = NOW(), notification_client_id = $client_id, company_id = $company_id"); + $client_name_escaped = sanitizeInput($row['client_name']); + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Invoice Viewed', notification = 'Invoice $invoice_prefix$invoice_number has been viewed by $client_name_escaped - $ip - $os - $browser', notification_client_id = $client_id, company_id = $company_id"); } $sql_payments = mysqli_query($mysqli, "SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC"); //Add up all the payments for the invoice and get the total amount paid to the invoice $sql_amount_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"); $row = mysqli_fetch_array($sql_amount_paid); -$amount_paid = $row['amount_paid']; +$amount_paid = floatval($row['amount_paid']); $balance = $invoice_amount - $amount_paid; @@ -122,12 +122,12 @@ $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE it
                  - Invoice History - Print - ');"> Download + Invoice History + Print + ');">Download - Pay Online + Pay Online
                  @@ -206,11 +206,11 @@ $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE it
                  , + text: , style: 'invoiceDateValue' }, ], @@ -383,7 +383,7 @@ $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE it style: 'invoiceDateTitle' }, { - text: , + text: , style: 'invoiceDateValue' }, ], @@ -716,7 +716,7 @@ if (mysqli_num_rows($sql) > 1) { ?>
                  - Previous Unpaid Invoices + Previous Unpaid Invoices
                  @@ -732,11 +732,11 @@ if (mysqli_num_rows($sql) > 1) { ?> 1) { ?>
                  - Current Invoices + Current Invoices
                  @@ -790,11 +790,11 @@ if (mysqli_num_rows($sql) > 1) { ?> 1) { ?>
                  - Previous Invoices Paid + Previous Invoices Paid
                  @@ -848,11 +848,11 @@ if (mysqli_num_rows($sql) > 1) { ?> 1) { ?> $sql_payments = mysqli_query($mysqli, "SELECT * FROM payments WHERE payment_invoice_id = $invoice_id ORDER BY payment_date DESC"); while ($row = mysqli_fetch_array($sql_payments)) { - $payment_id = $row['payment_id']; - $payment_date = $row['payment_date']; + $payment_id = intval($row['payment_id']); + $payment_date = htmlentities($row['payment_date']); $payment_amount = floatval($row['payment_amount']); $payment_currency_code = htmlentities($row['payment_currency_code']); $payment_method = htmlentities($row['payment_method']); diff --git a/guest_view_item.php b/guest_view_item.php index f259fb4b..9f85a12d 100644 --- a/guest_view_item.php +++ b/guest_view_item.php @@ -18,9 +18,9 @@ if (!isset($_GET['id']) || !isset($_GET['key'])) { } $item_id = intval($_GET['id']); -$item_key = trim(strip_tags(mysqli_real_escape_string($mysqli, $_GET['key']))); +$item_key = sanitizeInput($_GET['key']); -$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = '$item_id' AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); $row = mysqli_fetch_array($sql); // Check we got a result @@ -42,16 +42,16 @@ if ($row['item_active'] !== "1" || $row['item_views'] >= $row['item_view_limit'] echo "
                  You may only be able to view this information for a limited time! Be sure to copy/download what you need.
                  "; $item_type = htmlentities($row['item_type']); -$item_related_id = $row['item_related_id']; +$item_related_id = intval($row['item_related_id']); $item_encrypted_credential = htmlentities($row['item_encrypted_credential']); $item_note = htmlentities($row['item_note']); $item_views = intval($row['item_views']); -$item_created = $row['item_created_at']; -$item_expire = $row['item_expire_at']; -$client_id = $row['item_client_id']; +$item_created = htmlentities($row['item_created_at']); +$item_expire = htmlentities($row['item_expire_at']); +$client_id = intval($row['item_client_id']); if ($item_type == "Document") { - $doc_sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$item_related_id' AND document_client_id = '$client_id' LIMIT 1"); + $doc_sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $item_related_id AND document_client_id = $client_id LIMIT 1"); $doc_row = mysqli_fetch_array($doc_sql); if (mysqli_num_rows($doc_sql) !== 1 || !$doc_row) { @@ -73,14 +73,14 @@ if ($item_type == "Document") { // Update document view count $new_item_views = $item_views + 1; - mysqli_query($mysqli, "UPDATE shared_items SET item_views = '$new_item_views' WHERE item_id = '$item_id'"); + mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id"); // Logging $name = mysqli_real_escape_string($mysqli, $doc_title); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Viewed shared $item_type $name via link', log_client_id = '$client_id', log_created_at = NOW(), log_ip = '$ip', log_user_agent = '$user_agent', company_id = '1'"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Viewed shared $item_type $name via link', log_client_id = $client_id, log_ip = '$ip', log_user_agent = '$user_agent', company_id = 1"); } elseif ($item_type == "File") { - $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = '$item_related_id' AND file_client_id = '$client_id' LIMIT 1"); + $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1"); $file_row = mysqli_fetch_array($file_sql); if (mysqli_num_rows($file_sql) !== 1 || !$file_row) { @@ -101,7 +101,7 @@ if ($item_type == "Document") { } elseif ($item_type == "Login") { $encryption_key = $_GET['ek']; - $login_sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = '$item_related_id' AND login_client_id = '$client_id' LIMIT 1"); + $login_sql = mysqli_query($mysqli, "SELECT * FROM logins WHERE login_id = $item_related_id AND login_client_id = $client_id LIMIT 1"); $login_row = mysqli_fetch_array($login_sql); if (mysqli_num_rows($login_sql) !== 1 || !$login_row) { echo "
                  Error retrieving login.
                  "; @@ -138,11 +138,11 @@ if ($item_type == "Document") { // Update login view count $new_item_views = $item_views + 1; - mysqli_query($mysqli, "UPDATE shared_items SET item_views = '$new_item_views' WHERE item_id = '$item_id'"); + mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id"); // Logging - $name = mysqli_real_escape_string($mysqli, $login_name); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Viewed shared $item_type $name via link', log_client_id = '$client_id', log_created_at = NOW(), log_ip = '$ip', log_user_agent = '$user_agent', company_id = '1'"); + $name = sanitizeInput($login_row['login_name']); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Viewed shared $item_type $name via link', log_client_id = $client_id, log_ip = '$ip', log_user_agent = '$user_agent', company_id = 1"); } diff --git a/guest_view_quote.php b/guest_view_quote.php index ac3b05f9..50d2d835 100644 --- a/guest_view_quote.php +++ b/guest_view_quote.php @@ -9,7 +9,7 @@ if (!isset($_GET['quote_id'], $_GET['url_key'])) { } -$url_key = mysqli_real_escape_string($mysqli, $_GET['url_key']); +$url_key = sanitizeInput($_GET['url_key']); $quote_id = intval($_GET['quote_id']); $sql = mysqli_query( @@ -33,16 +33,16 @@ if (mysqli_num_rows($sql) !== 1) { $row = mysqli_fetch_array($sql); -$quote_id = $row['quote_id']; +$quote_id = intval($row['quote_id']); $quote_prefix = htmlentities($row['quote_prefix']); -$quote_number = htmlentities($row['quote_number']); +$quote_number = intval($row['quote_number']); $quote_status = htmlentities($row['quote_status']); -$quote_date = $row['quote_date']; +$quote_date = htmlentities($row['quote_date']); $quote_amount = floatval($row['quote_amount']); $quote_currency_code = htmlentities($row['quote_currency_code']); $quote_note = htmlentities($row['quote_note']); -$category_id = $row['category_id']; -$client_id = $row['client_id']; +$category_id = intval($row['category_id']); +$client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); $location_address = htmlentities($row['location_address']); $location_city = htmlentities($row['location_city']); @@ -54,11 +54,11 @@ $contact_extension = htmlentities($row['contact_extension']); $contact_mobile = formatPhoneNumber($row['contact_mobile']); $client_website = htmlentities($row['client_website']); $client_currency_code = htmlentities($row['client_currency_code']); -$client_net_terms = htmlentities($row['client_net_terms']); +$client_net_terms = intval($row['client_net_terms']); if ($client_net_terms == 0) { $client_net_terms = intval($row['config_default_net_terms']); } -$company_id = $row['company_id']; +$company_id = intval($row['company_id']); $company_name = htmlentities($row['company_name']); $company_address = htmlentities($row['company_address']); $company_city = htmlentities($row['company_city']); @@ -83,11 +83,11 @@ if ($quote_status == 'Sent') { } //Mark viewed in history -mysqli_query($mysqli, "INSERT INTO history SET history_status = '$quote_status', history_description = 'Quote viewed - $ip - $os - $browser', history_created_at = NOW(), history_quote_id = $quote_id, company_id = $company_id"); +mysqli_query($mysqli, "INSERT INTO history SET history_status = '$quote_status', history_description = 'Quote viewed - $ip - $os - $browser', history_quote_id = $quote_id, company_id = $company_id"); if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Viewed") { - $client_name_escaped = mysqli_escape_string($mysqli, $row['client_name']); - mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Quote Viewed', notification = 'Quote $quote_prefix$quote_number has been viewed by $client_name_escaped - $ip - $os - $browser', notification_timestamp = NOW(), notification_client_id = $client_id, company_id = $company_id"); + $client_name_escaped = sanitizeInput($row['client_name']); + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Quote Viewed', notification = 'Quote $quote_prefix$quote_number has been viewed by $client_name_escaped - $ip - $os - $browser', notification_client_id = $client_id, company_id = $company_id"); } ?> @@ -99,14 +99,20 @@ if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Vie - Accept - Decline + + Accept + + + Decline +
                  - Print - ');"> Download + Print + ');"> + Download +
                  @@ -182,7 +188,7 @@ if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Vie $total_tax = $sub_total = 0; // Default 0 while ($row = mysqli_fetch_array($sql_items)) { - $item_id = $row['item_id']; + $item_id = intval($row['item_id']); $item_name = htmlentities($row['item_name']); $item_description = htmlentities($row['item_description']); $item_quantity = floatval($row['item_quantity']); @@ -343,7 +349,7 @@ if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Vie style: 'invoiceDateTitle' }, { - text: , + text: , style: 'invoiceDateValue' }, ], diff --git a/inc_all_client.php b/inc_all_client.php index a3f3b753..14ed4912 100644 --- a/inc_all_client.php +++ b/inc_all_client.php @@ -31,29 +31,29 @@ if (isset($_GET['client_id'])) { $client_website = htmlentities($row['client_website']); $client_referral = htmlentities($row['client_referral']); $client_currency_code = htmlentities($row['client_currency_code']); - $client_net_terms = $row['client_net_terms']; + $client_net_terms = intval($row['client_net_terms']); if ($client_net_terms == 0) { $client_net_terms = $config_default_net_terms; } $client_notes = htmlentities($row['client_notes']); - $client_created_at = $row['client_created_at']; - $primary_contact = $row['primary_contact']; - $primary_location = $row['primary_location']; - $contact_id = $row['contact_id']; + $client_created_at = htmlentities($row['client_created_at']); + $primary_contact = intval($row['primary_contact']); + $primary_location = intval($row['primary_location']); + $contact_id = intval($row['contact_id']); $contact_name = htmlentities($row['contact_name']); $contact_title = htmlentities($row['contact_title']); $contact_email = htmlentities($row['contact_email']); - $contact_phone = $row['contact_phone']; - $contact_extension = $row['contact_extension']; - $contact_mobile = $row['contact_mobile']; - $location_id = $row['location_id']; + $contact_phone = formatPhoneNumber($row['contact_phone']); + $contact_extension = htmlentities($row['contact_extension']); + $contact_mobile = formatPhoneNumber($row['contact_mobile']); + $location_id = intval($row['location_id']); $location_name = htmlentities($row['location_name']); $location_address = htmlentities($row['location_address']); $location_city = htmlentities($row['location_city']); $location_state = htmlentities($row['location_state']); $location_zip = htmlentities($row['location_zip']); $location_country = htmlentities($row['location_country']); - $location_phone = $row['location_phone']; + $location_phone = formatPhoneNumber($row['location_phone']); //Client Tags @@ -62,7 +62,7 @@ if (isset($_GET['client_id'])) { $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_tags.client_id = $client_id"); while ($row = mysqli_fetch_array($sql_client_tags)) { - $client_tag_id = $row['tag_id']; + $client_tag_id = intval($row['tag_id']); $client_tag_name = htmlentities($row['tag_name']); $client_tag_color = htmlentities($row['tag_color']); $client_tag_icon = htmlentities($row['tag_icon']); @@ -79,12 +79,12 @@ if (isset($_GET['client_id'])) { $sql_invoice_amounts = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS invoice_amounts FROM invoices WHERE invoice_client_id = $client_id AND invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Cancelled'"); $row = mysqli_fetch_array($sql_invoice_amounts); - $invoice_amounts = $row['invoice_amounts']; + $invoice_amounts = floatval($row['invoice_amounts']); $sql_amount_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_client_id = $client_id"); $row = mysqli_fetch_array($sql_amount_paid); - $amount_paid = $row['amount_paid']; + $amount_paid = floatval($row['amount_paid']); $balance = $invoice_amounts - $amount_paid; @@ -92,13 +92,13 @@ if (isset($_GET['client_id'])) { $sql_recurring_monthly_total = mysqli_query($mysqli, "SELECT SUM(recurring_amount) AS recurring_monthly_total FROM recurring WHERE recurring_status = 1 AND recurring_frequency = 'month' AND recurring_client_id = $client_id AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_recurring_monthly_total); - $recurring_monthly_total = $row['recurring_monthly_total']; + $recurring_monthly_total = floatval($row['recurring_monthly_total']); //Get Yearly Recurring Total $sql_recurring_yearly_total = mysqli_query($mysqli, "SELECT SUM(recurring_amount) AS recurring_yearly_total FROM recurring WHERE recurring_status = 1 AND recurring_frequency = 'year' AND recurring_client_id = $client_id AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_recurring_yearly_total); - $recurring_yearly_total = $row['recurring_yearly_total'] / 12; + $recurring_yearly_total = floatval($row['recurring_yearly_total']) / 12; $recurring_monthly = $recurring_monthly_total + $recurring_yearly_total; @@ -197,7 +197,7 @@ if (isset($_GET['client_id'])) { AND domain_archived_at IS NULL AND company_id = $session_company_id" )); - $num_domains_expiring = $row['num']; + $num_domains_expiring = intval($row['num']); // Count Certificates Expiring within 30 Days $row = mysqli_fetch_assoc(mysqli_query( @@ -209,7 +209,7 @@ if (isset($_GET['client_id'])) { AND certificate_archived_at IS NULL AND company_id = $session_company_id" )); - $num_certs_expiring = $row['num']; + $num_certs_expiring = intval($row['num']); // Get Asset Warranties Expiring $sql_asset_warranties_expiring = mysqli_query( diff --git a/inc_client_top_head.php b/inc_client_top_head.php index b41cdd45..7688c60a 100644 --- a/inc_client_top_head.php +++ b/inc_client_top_head.php @@ -1,11 +1,3 @@ - -
                  @@ -89,14 +81,24 @@ $location_phone = formatPhoneNumber($location_phone);
                  - Export Data PDF
                  (without passwords)                   - Export Data PDF
                  (with passwords)                   + + Edit Client +
                  - Edit Client + + Export Data PDF
                  (without passwords) +                   + + Export Data PDF
                  (with passwords) +
                  - Archive Client + + Archive Client +
                  - Delete Client + + Delete Client +
                  diff --git a/invoice_add_modal.php b/invoice_add_modal.php index 298bedf0..9b2e356d 100644 --- a/invoice_add_modal.php +++ b/invoice_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Invoice
                  +
                  New Invoice
                  @@ -37,7 +37,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $client_id = $row['client_id']; + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); ?> @@ -63,7 +63,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $category_id = $row['category_id']; + $category_id = intval($row['category_id']); $category_name = htmlentities($row['category_name']); ?> diff --git a/invoice_copy_modal.php b/invoice_copy_modal.php index b877ccbc..4f6427cb 100644 --- a/invoice_copy_modal.php +++ b/invoice_copy_modal.php @@ -2,7 +2,7 @@
                  -
                  Copying invoice: -
                  +
                  Copying invoice: -
                  @@ -24,8 +24,8 @@
                  - - + +
                  diff --git a/invoice_edit_modal.php b/invoice_edit_modal.php index e56ca9be..fe9b42ba 100644 --- a/invoice_edit_modal.php +++ b/invoice_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing invoice: -
                  +
                  Editing invoice: -
                  @@ -44,7 +44,7 @@ $sql_income_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$invoice_created_at' OR category_archived_at IS NULL) AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql_income_category)) { - $category_id_select= $row['category_id']; + $category_id_select= intval($row['category_id']); $category_name_select = htmlentities($row['category_name']); ?> @@ -71,8 +71,8 @@
                  - - + +
                  diff --git a/invoice_note_modal.php b/invoice_note_modal.php index 23fb0677..3abf465c 100644 --- a/invoice_note_modal.php +++ b/invoice_note_modal.php @@ -2,7 +2,7 @@
                  -
                  Invoice Notes
                  +
                  Invoice Notes
                  @@ -16,7 +16,7 @@
                  - +
                  diff --git a/invoice_payment_add_modal.php b/invoice_payment_add_modal.php index 93523f11..6f97603c 100644 --- a/invoice_payment_add_modal.php +++ b/invoice_payment_add_modal.php @@ -2,7 +2,7 @@
                  -
                  : Make Payment
                  +
                  : Make Payment
                  @@ -56,21 +56,21 @@ $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); - $opening_balance = $row['opening_balance']; + $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $account_balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -132,8 +132,8 @@
                  - - + +
                  diff --git a/invoice_recurring_add_modal.php b/invoice_recurring_add_modal.php index 785941d8..ff79fd80 100644 --- a/invoice_recurring_add_modal.php +++ b/invoice_recurring_add_modal.php @@ -2,7 +2,7 @@
                  -
                  Make Recurring
                  +
                  Make Recurring
                  @@ -28,8 +28,8 @@
                  - - + +
                  diff --git a/invoices.php b/invoices.php index bc87370c..9aa00e0d 100644 --- a/invoices.php +++ b/invoices.php @@ -22,32 +22,32 @@ $overdue_count = $row['num']; $sql_total_draft = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft FROM invoices WHERE invoice_status = 'Draft' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_draft); -$total_draft = $row['total_draft']; +$total_draft = floatval($row['total_draft']); $sql_total_sent = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent FROM invoices WHERE invoice_status = 'Sent' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_sent); -$total_sent = $row['total_sent']; +$total_sent = floatval($row['total_sent']); $sql_total_viewed = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed FROM invoices WHERE invoice_status = 'Viewed' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_viewed); -$total_viewed = $row['total_viewed']; +$total_viewed = floatval($row['total_viewed']); $sql_total_cancelled = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled FROM invoices WHERE invoice_status = 'Cancelled' AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_cancelled); -$total_cancelled = $row['total_cancelled']; +$total_cancelled = floatval($row['total_cancelled']); $sql_total_partial = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoices.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_partial); -$total_partial = $row['total_partial']; +$total_partial = floatval($row['total_partial']); $total_partial_count = mysqli_num_rows($sql_total_partial); $sql_total_overdue_partial = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() AND invoices.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_overdue_partial); -$total_overdue_partial = $row['total_overdue_partial']; +$total_overdue_partial = floatval($row['total_overdue_partial']); $sql_total_overdue = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_due < CURDATE() AND invoices.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_total_overdue); -$total_overdue = $row['total_overdue']; +$total_overdue = floatval($row['total_overdue']); $real_overdue_amount = $total_overdue - $total_overdue_partial; @@ -196,7 +196,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Invoices

                  +

                  Invoices

                  @@ -325,14 +325,22 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit - Copy + + Edit + + + Copy +
                  - Send + + Send +
                  - Delete + + Delete +
                  diff --git a/item_edit_modal.php b/item_edit_modal.php index 7809cd54..197760cc 100644 --- a/item_edit_modal.php +++ b/item_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing Line Item:
                  +
                  Editing Line Item:
                  @@ -79,9 +79,9 @@ $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) AND company_id = $session_company_id ORDER BY tax_name ASC"); while ($row = mysqli_fetch_array($taxes_sql)) { - $tax_id_select = $row['tax_id']; + $tax_id_select = intval($row['tax_id']); $tax_name = htmlentities($row['tax_name']); - $tax_percent = $row['tax_percent']; + $tax_percent = floatval($row['tax_percent']); ?> diff --git a/login.php b/login.php index 1388f38c..fb48fda4 100644 --- a/login.php +++ b/login.php @@ -39,7 +39,7 @@ $company_logo = $row['company_logo']; // Mail $config_smtp_host = $row['config_smtp_host']; -$config_smtp_port = $row['config_smtp_port']; +$config_smtp_port = intval($row['config_smtp_port']); $config_smtp_encryption = $row['config_smtp_encryption']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; @@ -61,12 +61,12 @@ if (isset($_POST['login'])) { session_start(); // Passed login brute force check - $email = strip_tags(mysqli_real_escape_string($mysqli, $_POST['email'])); + $email = sanitizeInput($_POST['email']); $password = $_POST['password']; $current_code = 0; // Default value if (isset($_POST['current_code'])) { - $current_code = strip_tags(mysqli_real_escape_string($mysqli, $_POST['current_code'])); + $current_code = sanitizeInput($_POST['current_code']); } $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN user_settings on users.user_id = user_settings.user_id WHERE user_email = '$email' AND user_archived_at IS NULL AND user_status = 1")); @@ -88,10 +88,10 @@ if (isset($_POST['login'])) { // FULL LOGIN SUCCESS - 2FA not configured or was successful // Check this login isn't suspicious - $sql_ip_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS ip_previous_logins FROM logs WHERE log_type = 'Login' AND log_action = 'Success' AND log_ip = '$ip' AND log_user_id = '$user_id'")); + $sql_ip_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS ip_previous_logins FROM logs WHERE log_type = 'Login' AND log_action = 'Success' AND log_ip = '$ip' AND log_user_id = $user_id")); $ip_previous_logins = sanitizeInput($sql_ip_prev_logins['ip_previous_logins']); - $sql_ua_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS ua_previous_logins FROM logs WHERE log_type = 'Login' AND log_action = 'Success' AND log_user_agent = '$user_agent' AND log_user_id = '$user_id'")); + $sql_ua_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS ua_previous_logins FROM logs WHERE log_type = 'Login' AND log_action = 'Success' AND log_user_agent = '$user_agent' AND log_user_id = $user_id")); $ua_prev_logins = sanitizeInput($sql_ua_prev_logins['ua_previous_logins']); // Notify if both the user agent and IP are different @@ -127,7 +127,7 @@ if (isset($_POST['login'])) { // Session info $_SESSION['user_id'] = $user_id; $_SESSION['user_name'] = $user_name; - $_SESSION['user_role'] = $row['user_role']; + $_SESSION['user_role'] = intval($row['user_role']); $_SESSION['csrf_token'] = randomString(156); $_SESSION['logged'] = true; @@ -176,7 +176,7 @@ if (isset($_POST['login'])) { if ($current_code !== 0) { // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = '2FA Failed', log_description = '$user_name failed 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_user_id = $user_id"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = '2FA Failed', log_description = '$user_name failed 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_user_id = $user_id"); // Email the tech to advise their credentials may be compromised if (!empty($config_smtp_host)) { @@ -211,7 +211,7 @@ if (isset($_POST['login'])) { // Password incorrect or user doesn't exist - show generic error - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Failed', log_description = 'Failed login attempt using $email', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW()"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Failed', log_description = 'Failed login attempt using $email', log_ip = '$ip', log_user_agent = '$user_agent'"); $response = "
                  diff --git a/logs.php b/logs.php index 6dcc35a3..8f61377d 100644 --- a/logs.php +++ b/logs.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "log_id"; } @@ -22,8 +22,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -72,14 +72,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Audit Logs

                  +

                  Audit Logs

                  - +
                  @@ -108,13 +108,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  - +
                  @@ -140,7 +140,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $client_name"; } - $log_entity_id = $row['log_entity_id']; + $log_entity_id = intval($row['log_entity_id']); ?> diff --git a/notifications.php b/notifications.php index 79211e0d..3ef44c47 100644 --- a/notifications.php +++ b/notifications.php @@ -8,11 +8,11 @@ $sql = mysqli_query($mysqli, "SELECT * FROM notifications LEFT JOIN clients ON n
                  -

                  Notifications

                  +

                  Notifications

                  - 0) { ?> Dismiss All - Dismissed + 0) { ?>Dismiss All + Dismissed
                  @@ -33,12 +33,12 @@ $sql = mysqli_query($mysqli, "SELECT * FROM notifications LEFT JOIN clients ON n
                  - + diff --git a/notifications_dismissed.php b/notifications_dismissed.php index b689c2dd..c1f55c9a 100644 --- a/notifications_dismissed.php +++ b/notifications_dismissed.php @@ -3,7 +3,7 @@ require_once("inc_all.php"); //Column Filter if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "notification_timestamp"; } @@ -16,8 +16,8 @@ if (!isset($_GET['o'])) { //Date From and Date To Filter if (!empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } else { $dtf = "0000-00-00"; $dtt = "9999-00-00"; @@ -47,14 +47,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Dismissed Notications

                  +

                  Dismissed Notications

                  - +
                  @@ -98,14 +98,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Payments

                  +

                  Payments

                  @@ -81,7 +81,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -141,12 +141,12 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); diff --git a/portal/portal_functions.php b/portal/portal_functions.php index e703df75..334dcfbe 100644 --- a/portal/portal_functions.php +++ b/portal/portal_functions.php @@ -23,7 +23,7 @@ function verifyContactTicketAccess($requested_ticket_id, $expected_ticket_state) } // Verify the contact has access to the provided ticket ID - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$requested_ticket_id' AND $ticket_state_snippet AND ticket_client_id = '$session_client_id' LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $requested_ticket_id AND $ticket_state_snippet AND ticket_client_id = $session_client_id LIMIT 1"); $row = mysqli_fetch_array($sql); $ticket_id = $row['ticket_id']; diff --git a/portal/portal_post.php b/portal/portal_post.php index 656e9f00..2148e976 100644 --- a/portal/portal_post.php +++ b/portal/portal_post.php @@ -12,7 +12,7 @@ if (isset($_POST['add_ticket'])) { $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = $session_company_id"); $row = mysqli_fetch_array($sql_settings); $config_ticket_prefix = $row['config_ticket_prefix']; - $config_ticket_next_number = $row['config_ticket_next_number']; + $config_ticket_next_number = intval($row['config_ticket_next_number']); // HTML Purifier require_once("../plugins/htmlpurifier/HTMLPurifier.standalone.php"); @@ -22,14 +22,14 @@ if (isset($_POST['add_ticket'])) { $client_id = $session_client_id; $contact = $session_contact_id; - $subject = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['subject']))); + $subject = sanitizeInput($_POST['subject']); $details = trim(mysqli_real_escape_string($mysqli, $purifier->purify(html_entity_decode(nl2br($_POST['details']))))); // Ensure priority is low/med/high (as can be user defined) if ($_POST['priority'] !== "Low" && $_POST['priority'] !== "Medium" && $_POST['priority'] !== "High") { $priority = "Low"; } else { - $priority = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['priority']))); + $priority = sanitizeInput($_POST['priority']); } // Get the next Ticket Number and add 1 for the new ticket number @@ -37,11 +37,11 @@ if (isset($_POST['add_ticket'])) { $new_config_ticket_next_number = $config_ticket_next_number + 1; mysqli_query($mysqli, "UPDATE settings SET config_ticket_next_number = $new_config_ticket_next_number WHERE company_id = $session_company_id"); - mysqli_query($mysqli, "INSERT INTO tickets SET ticket_prefix = '$config_ticket_prefix', ticket_number = $ticket_number, ticket_subject = '$subject', ticket_details = '$details', ticket_priority = '$priority', ticket_status = 'Open', ticket_created_at = NOW(), ticket_created_by = '0', ticket_contact_id = $contact, ticket_client_id = $client_id, company_id = $session_company_id"); + mysqli_query($mysqli, "INSERT INTO tickets SET ticket_prefix = '$config_ticket_prefix', ticket_number = $ticket_number, ticket_subject = '$subject', ticket_details = '$details', ticket_priority = '$priority', ticket_status = 'Open', ticket_created_by = 0, ticket_contact_id = $contact, ticket_client_id = $client_id, company_id = $session_company_id"); $id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Create', log_description = 'Client contact $session_contact_name created ticket $subject', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), log_client_id = $client_id, company_id = $session_company_id"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Create', log_description = 'Client contact $session_contact_name created ticket $subject', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, company_id = $session_company_id"); header("Location: ticket.php?id=" . $id); @@ -71,10 +71,10 @@ if (isset($_POST['add_ticket_comment'])) { if (verifyContactTicketAccess($ticket_id, "Open")) { // Add the comment - mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$comment', ticket_reply_type = 'Client', ticket_reply_created_at = NOW(), ticket_reply_by = '$session_contact_id', ticket_reply_ticket_id = '$ticket_id', company_id = '$session_company_id'"); + mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$comment', ticket_reply_type = 'Client', ticket_reply_by = $session_contact_id, ticket_reply_ticket_id = $ticket_id, company_id = $session_company_id"); // Update Ticket Last Response Field & set ticket to open as client has replied - mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 'Open', ticket_updated_at = NOW() WHERE ticket_id = $ticket_id AND ticket_client_id = '$session_client_id' LIMIT 1"); + mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 'Open' WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id LIMIT 1"); // Redirect header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -87,17 +87,17 @@ if (isset($_POST['add_ticket_comment'])) { if (isset($_POST['add_ticket_feedback'])) { $ticket_id = intval($_POST['ticket_id']); - $feedback = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['add_ticket_feedback']))); + $feedback = sanitizeInput($_POST['add_ticket_feedback']); // Verify the contact has access to the provided ticket ID if (verifyContactTicketAccess($ticket_id, "Closed")) { // Add feedback - mysqli_query($mysqli, "UPDATE tickets SET ticket_feedback = '$feedback' WHERE ticket_id = '$ticket_id' AND ticket_client_id = '$session_client_id' LIMIT 1"); + mysqli_query($mysqli, "UPDATE tickets SET ticket_feedback = '$feedback' WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id LIMIT 1"); // Notify on bad feedback if ($feedback == "Bad") { - mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Feedback', notification = '$session_contact_name rated ticket ID $ticket_id as bad', notification_timestamp = NOW(), notification_client_id = '$session_client_id', company_id = '$session_company_id'"); + mysqli_query($mysqli, "INSERT INTO notifications SET notification_type = 'Feedback', notification = '$session_contact_name rated ticket ID $ticket_id as bad', notification_client_id = $session_client_id, company_id = $session_company_id"); } // Redirect @@ -117,13 +117,13 @@ if (isset($_GET['close_ticket'])) { if (verifyContactTicketAccess($ticket_id, "Open")) { // Close ticket - mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 'Closed', ticket_updated_at = NOW(), ticket_closed_at = NOW() WHERE ticket_id = $ticket_id AND ticket_client_id = '$session_client_id'"); + mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 'Closed', ticket_closed_at = NOW() WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id"); // Add reply - mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket closed by $session_contact_name.', ticket_reply_type = 'Client', ticket_reply_created_at = NOW(), ticket_reply_by = '$session_contact_id', ticket_reply_ticket_id = '$ticket_id', company_id = $session_company_id"); + mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket closed by $session_contact_name.', ticket_reply_type = 'Client', ticket_reply_by = $session_contact_id, ticket_reply_ticket_id = $ticket_id, company_id = $session_company_id"); //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Closed', log_description = '$ticket_id Closed by client', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), company_id = $session_company_id"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Closed', log_description = '$ticket_id Closed by client', log_ip = '$session_ip', log_user_agent = '$session_user_agent', company_id = $session_company_id"); header("Location: ticket.php?id=" . $ticket_id); } else { @@ -147,10 +147,10 @@ if (isset($_POST['edit_profile'])) { $new_password = $_POST['new_password']; if (!empty($new_password)) { $password_hash = password_hash($new_password, PASSWORD_DEFAULT); - mysqli_query($mysqli, "UPDATE contacts SET contact_password_hash = '$password_hash' WHERE contact_id = '$session_contact_id' AND contact_client_id = '$session_client_id'"); + mysqli_query($mysqli, "UPDATE contacts SET contact_password_hash = '$password_hash' WHERE contact_id = $session_contact_id AND contact_client_id = $session_client_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Modify', log_description = 'Client contact $session_contact_name modified their profile/password.', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), log_client_id = $session_client_id, company_id = $session_company_id"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Modify', log_description = 'Client contact $session_contact_name modified their profile/password.', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $session_client_id, company_id = $session_company_id"); } header('Location: index.php'); } \ No newline at end of file diff --git a/portal/profile.php b/portal/profile.php index 26ff7058..8ab65e3b 100644 --- a/portal/profile.php +++ b/portal/profile.php @@ -36,7 +36,7 @@ require_once('inc_portal.php');
                  - +
                  diff --git a/portal/ticket.php b/portal/ticket.php index 88d5ba29..7ad5ab6a 100644 --- a/portal/ticket.php +++ b/portal/ticket.php @@ -10,9 +10,9 @@ if (isset($_GET['id']) && intval($_GET['id'])) { $ticket_id = intval($_GET['id']); if ($session_contact_id == $session_client_primary_contact_id || $session_contact_is_technical_contact) { - $ticket_sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_client_id = '$session_client_id'"); + $ticket_sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id"); } else { - $ticket_sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_client_id = '$session_client_id' AND ticket_contact_id = '$session_contact_id'"); + $ticket_sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id AND ticket_contact_id = $session_contact_id"); } $ticket_row = mysqli_fetch_array($ticket_sql); @@ -20,7 +20,7 @@ if (isset($_GET['id']) && intval($_GET['id'])) { if ($ticket_row) { $ticket_prefix = htmlentities($ticket_row['ticket_prefix']); - $ticket_number = $ticket_row['ticket_number']; + $ticket_number = intval($ticket_row['ticket_number']); $ticket_status = htmlentities($ticket_row['ticket_status']); $ticket_priority = htmlentities($ticket_row['ticket_priority']); $ticket_subject = htmlentities($ticket_row['ticket_subject']); @@ -110,11 +110,11 @@ if (isset($_GET['id']) && intval($_GET['id'])) { $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type != 'Internal' ORDER BY ticket_reply_id DESC"); while ($row = mysqli_fetch_array($sql)) { - $ticket_reply_id = $row['ticket_reply_id']; + $ticket_reply_id = intval($row['ticket_reply_id']); $ticket_reply = $row['ticket_reply']; $ticket_reply_created_at = $row['ticket_reply_created_at']; $ticket_reply_updated_at = $row['ticket_reply_updated_at']; - $ticket_reply_by = $row['ticket_reply_by']; + $ticket_reply_by = intval($row['ticket_reply_by']); $ticket_reply_type = $row['ticket_reply_type']; if ($ticket_reply_type == "Client") { @@ -124,7 +124,7 @@ if (isset($_GET['id']) && intval($_GET['id'])) { $avatar_link = "../uploads/clients/$session_company_id/$session_client_id/$user_avatar"; } else { $ticket_reply_by_display = htmlentities($row['user_name']); - $user_id = $row['user_id']; + $user_id = intval($row['user_id']); $user_avatar = $row['user_avatar']; $user_initials = initials($row['user_name']); $avatar_link = "../uploads/users/$user_id/$user_avatar"; diff --git a/portal/ticket_view_all.php b/portal/ticket_view_all.php index 063c284a..9f001b35 100644 --- a/portal/ticket_view_all.php +++ b/portal/ticket_view_all.php @@ -27,7 +27,7 @@ if (!isset($_GET['status'])) { $ticket_status_snippet = "ticket_status LIKE '%'"; } -$all_tickets = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN contacts ON ticket_contact_id = contact_id WHERE $ticket_status_snippet AND ticket_client_id = '$session_client_id' ORDER BY ticket_id DESC"); +$all_tickets = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN contacts ON ticket_contact_id = contact_id WHERE $ticket_status_snippet AND ticket_client_id = $session_client_id ORDER BY ticket_id DESC"); ?>

                  All tickets

                  @@ -56,9 +56,9 @@ $all_tickets = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN contacts O @@ -81,9 +81,9 @@ $total_tickets = $row['total_tickets']; diff --git a/product_add_modal.php b/product_add_modal.php index 90998021..08b9998a 100644 --- a/product_add_modal.php +++ b/product_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Product
                  +
                  New Product
                  @@ -32,7 +32,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL AND company_id = $session_company_id"); while ($row = mysqli_fetch_array($sql)) { - $category_id = $row['category_id']; + $category_id = intval($row['category_id']); $category_name = htmlentities($row['category_name']); ?> @@ -73,9 +73,9 @@ $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL AND company_id = $session_company_id ORDER BY tax_name ASC"); while ($row = mysqli_fetch_array($taxes_sql)) { - $tax_id = $row['tax_id']; + $tax_id = intval($row['tax_id']); $tax_name = htmlentities($row['tax_name']); - $tax_percent = htmlentities($row['tax_percent']); + $tax_percent = floatval($row['tax_percent']); ?> @@ -96,8 +96,8 @@
                  - - + +
                  diff --git a/product_edit_modal.php b/product_edit_modal.php index 1ca9f0af..d5abcc86 100644 --- a/product_edit_modal.php +++ b/product_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing product:
                  +
                  Editing product:
                  @@ -32,7 +32,7 @@ $sql_select = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$product_created_at' OR category_archived_at IS NULL) AND company_id = $session_company_id"); while ($row = mysqli_fetch_array($sql_select)) { - $category_id_select = $row['category_id']; + $category_id_select = intval($row['category_id']); $category_name_select = htmlentities($row['category_name']); ?> @@ -72,9 +72,9 @@ $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$product_created_at' OR tax_archived_at IS NULL) AND company_id = $session_company_id ORDER BY tax_name ASC"); while ($row = mysqli_fetch_array($taxes_sql)) { - $tax_id_select = $row['tax_id']; + $tax_id_select = intval($row['tax_id']); $tax_name = htmlentities($row['tax_name']); - $tax_percent = htmlentities($row['tax_percent']); + $tax_percent = floatval($row['tax_percent']); ?> @@ -95,8 +95,8 @@
                  - - + +
                  diff --git a/products.php b/products.php index ce9d16bc..3d83c82c 100644 --- a/products.php +++ b/products.php @@ -2,7 +2,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "product_name"; } @@ -25,9 +25,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Products

                  +

                  Products

                  - +
                  @@ -36,7 +36,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -60,7 +60,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  @@ -87,9 +87,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Delete + + Delete +
                  diff --git a/quote.php b/quote.php index 948a9345..251d8321 100644 --- a/quote.php +++ b/quote.php @@ -24,7 +24,7 @@ if (isset($_GET['quote_id'])) { $row = mysqli_fetch_array($sql); $quote_id = intval($row['quote_id']); $quote_prefix = htmlentities($row['quote_prefix']); - $quote_number = htmlentities($row['quote_number']); + $quote_number = intval($row['quote_number']); $quote_scope = htmlentities($row['quote_scope']); $quote_status = htmlentities($row['quote_status']); $quote_date = htmlentities($row['quote_date']); @@ -278,9 +278,13 @@ if (isset($_GET['quote_id'])) {
                  - Edit + + Edit +
                  - Remove + + Remove +
                  @@ -558,7 +562,7 @@ require_once("footer.php"); style: 'invoiceDateTitle' }, { - text: , + text: , style: 'invoiceDateValue' }, ], diff --git a/quote_add_modal.php b/quote_add_modal.php index 470bd60d..6622866a 100644 --- a/quote_add_modal.php +++ b/quote_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Quote
                  +
                  New Quote
                  @@ -37,7 +37,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $session_company_id ORDER BY client_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $client_id = $row['client_id']; + $client_id = intval($row['client_id']); $client_name = htmlentities($row['client_name']); ?> @@ -61,7 +61,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $category_id = $row['category_id']; + $category_id = intval($row['category_id']); $category_name = htmlentities($row['category_name']); ?> @@ -87,7 +87,7 @@
                  - +
                  diff --git a/quote_copy_modal.php b/quote_copy_modal.php index cb439129..388c8218 100644 --- a/quote_copy_modal.php +++ b/quote_copy_modal.php @@ -2,7 +2,7 @@
                  -
                  Copying quote: -
                  +
                  Copying quote: -
                  diff --git a/quote_edit_modal.php b/quote_edit_modal.php index 125b76d9..63739453 100644 --- a/quote_edit_modal.php +++ b/quote_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing quote: -
                  +
                  Editing quote: -
                  @@ -34,7 +34,7 @@ $sql_income_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$quote_created_at' OR category_archived_at IS NULL) AND company_id = $session_company_id ORDER BY category_name ASC"); while ($row = mysqli_fetch_array($sql_income_category)) { - $category_id_select = $row['category_id']; + $category_id_select = intval($row['category_id']); $category_name_select = htmlentities($row['category_name']); ?> diff --git a/quote_note_modal.php b/quote_note_modal.php index 97c57356..f040ec0a 100644 --- a/quote_note_modal.php +++ b/quote_note_modal.php @@ -2,7 +2,7 @@
                  -
                  Quote Notes
                  +
                  Quote Notes
                  diff --git a/quote_to_invoice_modal.php b/quote_to_invoice_modal.php index 995f6297..e15d7ac1 100644 --- a/quote_to_invoice_modal.php +++ b/quote_to_invoice_modal.php @@ -2,7 +2,7 @@
                  -
                  Quote Invoice
                  +
                  Quote Invoice
                  diff --git a/quotes.php b/quotes.php index 398249ed..eaecadd5 100644 --- a/quotes.php +++ b/quotes.php @@ -144,7 +144,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); while ($row = mysqli_fetch_array($sql)) { $quote_id = intval($row['quote_id']); $quote_prefix = htmlentities($row['quote_prefix']); - $quote_number = htmlentities($row['quote_number']); + $quote_number = intval($row['quote_number']); $quote_scope = htmlentities($row['quote_scope']); if (empty($quote_scope)) { $quote_scope_display = "-"; diff --git a/recurring_invoice.php b/recurring_invoice.php index 1f93cf5b..83c04471 100644 --- a/recurring_invoice.php +++ b/recurring_invoice.php @@ -81,7 +81,7 @@ if (isset($_GET['recurring_id'])) {
                  1. - Recurring Invoices + Recurring Invoices
                  2. @@ -329,7 +329,7 @@ if (isset($_GET['recurring_id'])) {
                    - History + History
                    diff --git a/recurring_invoice_edit_modal.php b/recurring_invoice_edit_modal.php index ed833f85..82e09677 100644 --- a/recurring_invoice_edit_modal.php +++ b/recurring_invoice_edit_modal.php @@ -2,7 +2,7 @@
                    -
                    Editing Recur Invoice:
                    +
                    Editing Recur Invoice:
                    diff --git a/recurring_invoice_note_modal.php b/recurring_invoice_note_modal.php index 50c611bb..ff5fc739 100644 --- a/recurring_invoice_note_modal.php +++ b/recurring_invoice_note_modal.php @@ -2,7 +2,7 @@
                    -
                    Editing: Recurring Invoice Notes
                    +
                    Editing: Recurring Invoice Notes
                    diff --git a/report_expense_by_vendor.php b/report_expense_by_vendor.php index 82263d98..326e53c9 100644 --- a/report_expense_by_vendor.php +++ b/report_expense_by_vendor.php @@ -17,9 +17,9 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE company_id = $
                    -

                    Expense By Vendor

                    +

                    Expense By Vendor

                    - +
                    @@ -28,7 +28,7 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE company_id = $ @@ -50,7 +50,7 @@ $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE company_id = $
                  -

                  Expense Summary

                  +

                  Expense Summary

                  - +
                  @@ -62,7 +62,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category
                  @@ -75,7 +75,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category for ($month = 1; $month<=12; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_amount_for_month FROM expenses WHERE expense_category_id = $category_id AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month"); $row = mysqli_fetch_array($sql_expenses); - $expense_amount_for_month = $row['expense_amount_for_month']; + $expense_amount_for_month = floatval($row['expense_amount_for_month']); $total_expense_for_all_months = $expense_amount_for_month + $total_expense_for_all_months; @@ -96,7 +96,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category for ($month = 1; $month<=12; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_total_amount_for_month FROM expenses WHERE YEAR(expense_date) = $year AND MONTH(expense_date) = $month AND expense_vendor_id > 0 AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_expenses); - $expense_total_amount_for_month = $row['expense_total_amount_for_month']; + $expense_total_amount_for_month = floatval($row['expense_total_amount_for_month']); $total_expense_for_all_months = $expense_total_amount_for_month + $total_expense_for_all_months; @@ -145,7 +145,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category for ($month = 1; $month<=12; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_amount_for_month FROM expenses WHERE YEAR(expense_date) = $year AND MONTH(expense_date) = $month AND expense_vendor_id > 0 AND expenses.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_expenses); - $expenses_for_month = $row['expense_amount_for_month']; + $expenses_for_month = floatval($row['expense_amount_for_month']); if ($expenses_for_month > 0 && $expenses_for_month > $largest_expense_month) { $largest_expense_month = $expenses_for_month; diff --git a/report_income_by_client.php b/report_income_by_client.php index 0bc32e89..cd4686cb 100644 --- a/report_income_by_client.php +++ b/report_income_by_client.php @@ -17,9 +17,9 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $
                  -

                  Income By Client

                  +

                  Income By Client

                  - +
                  @@ -28,7 +28,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $ @@ -48,7 +48,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $
                  -

                  Income Summary

                  +

                  Income Summary

                  - +
                  @@ -28,7 +28,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category @@ -64,7 +64,7 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category
                  @@ -80,12 +80,12 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category //Payments to Invoices $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_category_id = $category_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month"); $row = mysqli_fetch_array($sql_payments); - $payment_amount_for_month = $row['payment_amount_for_month']; + $payment_amount_for_month = floatval($row['payment_amount_for_month']); //Revenues $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id = $category_id AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month"); $row = mysqli_fetch_array($sql_revenues); - $revenues_amount_for_month = $row['revenue_amount_for_month']; + $revenues_amount_for_month = floatval($row['revenue_amount_for_month']); $payment_amount_for_month = $payment_amount_for_month + $revenues_amount_for_month; $total_payment_for_all_months = $payment_amount_for_month + $total_payment_for_all_months; @@ -116,11 +116,11 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category for($month = 1; $month<=12; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_total_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month AND payments.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_payments); - $payment_total_amount_for_month = $row['payment_total_amount_for_month']; + $payment_total_amount_for_month = floatval($row['payment_total_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id > 0 AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month AND revenues.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_revenues); - $revenues_total_amount_for_month = $row['revenue_amount_for_month']; + $revenues_total_amount_for_month = floatval($row['revenue_amount_for_month']); $payment_total_amount_for_month = $payment_total_amount_for_month + $revenues_total_amount_for_month; @@ -173,11 +173,11 @@ $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category for ($month = 1; $month<=12; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month AND payments.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_payments); - $payments_for_month = $row['payment_amount_for_month']; + $payments_for_month = floatval($row['payment_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id > 0 AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_revenues); - $revenues_for_month = $row['revenue_amount_for_month']; + $revenues_for_month = floatval($row['revenue_amount_for_month']); $income_for_month = $payments_for_month + $revenues_for_month; diff --git a/report_profit_loss.php b/report_profit_loss.php index 1846a95a..2beebd82 100644 --- a/report_profit_loss.php +++ b/report_profit_loss.php @@ -21,9 +21,9 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE
                  -

                  Profit & Loss

                  +

                  Profit & Loss

                  - +
                  @@ -32,7 +32,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE @@ -61,7 +61,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE
                  @@ -75,11 +75,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 1; $month<=3; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_category_id = $category_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month"); $row = mysqli_fetch_array($sql_payments); - $payment_amount_for_month = $row['payment_amount_for_month']; + $payment_amount_for_month = floatval($row['payment_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id = $category_id AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month"); $row = mysqli_fetch_array($sql_revenues); - $revenue_amount_for_month = $row['revenue_amount_for_month']; + $revenue_amount_for_month = floatval($row['revenue_amount_for_month']); $payment_amount_for_month = $payment_amount_for_month + $revenue_amount_for_month; @@ -97,11 +97,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 4; $month<=6; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_category_id = $category_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month"); $row = mysqli_fetch_array($sql_payments); - $payment_amount_for_month = $row['payment_amount_for_month']; + $payment_amount_for_month = floatval($row['payment_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id = $category_id AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month"); $row = mysqli_fetch_array($sql_revenues); - $revenue_amount_for_month = $row['revenue_amount_for_month']; + $revenue_amount_for_month = floatval($row['revenue_amount_for_month']); $payment_amount_for_month = $payment_amount_for_month + $revenue_amount_for_month; @@ -119,11 +119,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 7; $month<=9; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_category_id = $category_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month"); $row = mysqli_fetch_array($sql_payments); - $payment_amount_for_month = $row['payment_amount_for_month']; + $payment_amount_for_month = floatval($row['payment_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id = $category_id AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month"); $row = mysqli_fetch_array($sql_revenues); - $revenue_amount_for_month = $row['revenue_amount_for_month']; + $revenue_amount_for_month = floatval($row['revenue_amount_for_month']); $payment_amount_for_month = $payment_amount_for_month + $revenue_amount_for_month; $payment_amount_for_quarter_three = $payment_amount_for_quarter_three + $payment_amount_for_month; @@ -140,11 +140,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 10; $month<=12; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_category_id = $category_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month"); $row = mysqli_fetch_array($sql_payments); - $payment_amount_for_month = $row['payment_amount_for_month']; + $payment_amount_for_month = floatval($row['payment_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_amount_for_month FROM revenues WHERE revenue_category_id = $category_id AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month"); $row = mysqli_fetch_array($sql_revenues); - $revenue_amount_for_month = $row['revenue_amount_for_month']; + $revenue_amount_for_month = floatval($row['revenue_amount_for_month']); $payment_amount_for_month = $payment_amount_for_month + $revenue_amount_for_month; $payment_amount_for_quarter_four = $payment_amount_for_quarter_four + $payment_amount_for_month; @@ -176,11 +176,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 1; $month<=3; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_total_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month AND payments.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_payments); - $payment_total_amount_for_month = $row['payment_total_amount_for_month']; + $payment_total_amount_for_month = floatval($row['payment_total_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_total_amount_for_month FROM revenues WHERE revenue_category_id > 0 AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month AND revenues.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_revenues); - $revenue_total_amount_for_month = $row['revenue_total_amount_for_month']; + $revenue_total_amount_for_month = floatval($row['revenue_total_amount_for_month']); $payment_total_amount_for_month = $payment_total_amount_for_month + $revenue_total_amount_for_month; @@ -198,11 +198,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 4; $month<=6; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_total_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month AND payments.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_payments); - $payment_total_amount_for_month = $row['payment_total_amount_for_month']; + $payment_total_amount_for_month = floatval($row['payment_total_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_total_amount_for_month FROM revenues WHERE revenue_category_id > 0 AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month AND revenues.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_revenues); - $revenue_total_amount_for_month = $row['revenue_total_amount_for_month']; + $revenue_total_amount_for_month = floatval($row['revenue_total_amount_for_month']); $payment_total_amount_for_month = $payment_total_amount_for_month + $revenue_total_amount_for_month; @@ -220,11 +220,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 7; $month<=9; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_total_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month AND payments.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_payments); - $payment_total_amount_for_month = $row['payment_total_amount_for_month']; + $payment_total_amount_for_month = floatval($row['payment_total_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_total_amount_for_month FROM revenues WHERE revenue_category_id > 0 AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month AND revenues.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_revenues); - $revenue_total_amount_for_month = $row['revenue_total_amount_for_month']; + $revenue_total_amount_for_month = floatval($row['revenue_total_amount_for_month']); $payment_total_amount_for_month = $payment_total_amount_for_month + $revenue_total_amount_for_month; @@ -242,11 +242,11 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 10; $month<=12; $month++) { $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS payment_total_amount_for_month FROM payments, invoices WHERE payment_invoice_id = invoice_id AND YEAR(payment_date) = $year AND MONTH(payment_date) = $month AND payments.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_payments); - $payment_total_amount_for_month = $row['payment_total_amount_for_month']; + $payment_total_amount_for_month = floatval($row['payment_total_amount_for_month']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS revenue_total_amount_for_month FROM revenues WHERE revenue_category_id > 0 AND YEAR(revenue_date) = $year AND MONTH(revenue_date) = $month AND revenues.company_id = $session_company_id"); $row = mysqli_fetch_array($sql_revenues); - $revenue_total_amount_for_month = $row['revenue_total_amount_for_month']; + $revenue_total_amount_for_month = floatval($row['revenue_total_amount_for_month']); $payment_total_amount_for_month = $payment_total_amount_for_month + $revenue_total_amount_for_month; @@ -268,7 +268,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE @@ -282,7 +282,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 1; $month<=3; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_amount_for_month FROM expenses WHERE expense_category_id = $category_id AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month"); $row = mysqli_fetch_array($sql_expenses); - $expense_amount_for_quarter_one = $expense_amount_for_quarter_one + $row['expense_amount_for_month']; + $expense_amount_for_quarter_one = $expense_amount_for_quarter_one + floatval($row['expense_amount_for_month']); } ?> @@ -296,7 +296,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 4; $month<=6; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_amount_for_month FROM expenses WHERE expense_category_id = $category_id AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month"); $row = mysqli_fetch_array($sql_expenses); - $expense_amount_for_quarter_two = $expense_amount_for_quarter_two + $row['expense_amount_for_month']; + $expense_amount_for_quarter_two = $expense_amount_for_quarter_two + floatval($row['expense_amount_for_month']); } ?> @@ -310,7 +310,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 7; $month<=9; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_amount_for_month FROM expenses WHERE expense_category_id = $category_id AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month"); $row = mysqli_fetch_array($sql_expenses); - $expense_amount_for_quarter_three = $expense_amount_for_quarter_three + $row['expense_amount_for_month']; + $expense_amount_for_quarter_three = $expense_amount_for_quarter_three + floatval($row['expense_amount_for_month']); } ?> @@ -324,7 +324,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 10; $month<=12; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_amount_for_month FROM expenses WHERE expense_category_id = $category_id AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month"); $row = mysqli_fetch_array($sql_expenses); - $expense_amount_for_quarter_four = $expense_amount_for_quarter_four + $row['expense_amount_for_month']; + $expense_amount_for_quarter_four = $expense_amount_for_quarter_four + floatval($row['expense_amount_for_month']); } $total_expenses_for_all_four_quarters = $expense_amount_for_quarter_one + $expense_amount_for_quarter_two + $expense_amount_for_quarter_three + $expense_amount_for_quarter_four; @@ -353,7 +353,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 1; $month<=3; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_total_amount_for_month FROM expenses WHERE expense_category_id > 0 AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month AND expense_vendor_id > 0 AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_expenses); - $expense_total_amount_for_quarter_one = $expense_total_amount_for_quarter_one + $row['expense_total_amount_for_month']; + $expense_total_amount_for_quarter_one = $expense_total_amount_for_quarter_one + floatval($row['expense_total_amount_for_month']); } ?> @@ -367,7 +367,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 4; $month<=6; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_total_amount_for_month FROM expenses WHERE expense_category_id > 0 AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month AND expense_vendor_id > 0 AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_expenses); - $expense_total_amount_for_quarter_two = $expense_total_amount_for_quarter_two + $row['expense_total_amount_for_month']; + $expense_total_amount_for_quarter_two = $expense_total_amount_for_quarter_two + floatval($row['expense_total_amount_for_month']); } ?> @@ -381,7 +381,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 7; $month<=9; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_total_amount_for_month FROM expenses WHERE expense_category_id > 0 AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month AND expense_vendor_id > 0 AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_expenses); - $expense_total_amount_for_quarter_three = $expense_total_amount_for_quarter_three + $row['expense_total_amount_for_month']; + $expense_total_amount_for_quarter_three = $expense_total_amount_for_quarter_three + floatval($row['expense_total_amount_for_month']); } ?> @@ -395,7 +395,7 @@ $sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE for($month = 10; $month<=12; $month++) { $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS expense_total_amount_for_month FROM expenses WHERE expense_category_id > 0 AND YEAR(expense_date) = $year AND MONTH(expense_date) = $month AND expense_vendor_id > 0 AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_expenses); - $expense_total_amount_for_quarter_four = $expense_total_amount_for_quarter_four + $row['expense_total_amount_for_month']; + $expense_total_amount_for_quarter_four = $expense_total_amount_for_quarter_four + floatval($row['expense_total_amount_for_month']); } $total_expenses_for_all_four_quarters = $expense_total_amount_for_quarter_one + $expense_total_amount_for_quarter_two + $expense_total_amount_for_quarter_three + $expense_total_amount_for_quarter_four; diff --git a/report_recurring_by_client.php b/report_recurring_by_client.php index 3a493a70..81168c45 100644 --- a/report_recurring_by_client.php +++ b/report_recurring_by_client.php @@ -9,9 +9,9 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $
                  -

                  Recurring Income By Client

                  +

                  Recurring Income By Client

                  - +
                  @@ -27,20 +27,20 @@ $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE company_id = $
                  -

                  Collected Tax Summary

                  +

                  Collected Tax Summary

                  - +
                  @@ -29,7 +29,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio @@ -54,7 +54,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio
                  @@ -78,7 +78,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_quarter_one = $tax_collected_quarter_one + $tax_collected_for_month; } @@ -104,7 +104,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_quarter_two = $tax_collected_quarter_two + $tax_collected_for_month; } @@ -130,7 +130,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_quarter_three = $tax_collected_quarter_three + $tax_collected_for_month; } @@ -156,7 +156,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_quarter_four = $tax_collected_quarter_four + $tax_collected_for_month; } @@ -194,7 +194,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_total_quarter_one = $tax_collected_total_quarter_one + $tax_collected_for_month; } @@ -219,7 +219,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_total_quarter_two = $tax_collected_total_quarter_two + $tax_collected_for_month; } @@ -244,7 +244,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_total_quarter_three = $tax_collected_total_quarter_three + $tax_collected_for_month; } @@ -269,7 +269,7 @@ $sql_tax = mysqli_query($mysqli, "SELECT * FROM taxes WHERE company_id = $sessio ); $row = mysqli_fetch_array($sql_tax_collected); - $tax_collected_for_month = $row['tax_collected_for_month']; + $tax_collected_for_month = floatval($row['tax_collected_for_month']); $tax_collected_total_quarter_four = $tax_collected_total_quarter_four + $tax_collected_for_month; } diff --git a/report_ticket_by_client.php b/report_ticket_by_client.php index a23e7bcf..cc40971d 100644 --- a/report_ticket_by_client.php +++ b/report_ticket_by_client.php @@ -55,9 +55,9 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients
                  -

                  Tickets By Client

                  +

                  Tickets By Client

                  - +
                  @@ -65,7 +65,7 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients @@ -84,21 +84,21 @@ $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients
                  0) { diff --git a/report_ticket_summary.php b/report_ticket_summary.php index 86406544..388d4d58 100644 --- a/report_ticket_summary.php +++ b/report_ticket_summary.php @@ -17,9 +17,9 @@ $sql_tickets = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE compan
                  -

                  Ticket Summary

                  +

                  Ticket Summary

                  - +
                  @@ -27,7 +27,7 @@ $sql_tickets = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE compan @@ -64,7 +64,7 @@ $sql_tickets = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE compan $sql_tickets = mysqli_query($mysqli, "SELECT COUNT(ticket_id) AS tickets_for_month FROM tickets WHERE YEAR(ticket_created_at) = $year AND MONTH(ticket_created_at) = $month"); $row = mysqli_fetch_array($sql_tickets); - $tickets_for_month = $row['tickets_for_month']; + $tickets_for_month = intval($row['tickets_for_month']); $total_tickets_for_all_months = $tickets_for_month + $total_tickets_for_all_months; ?> @@ -114,7 +114,7 @@ $sql_tickets = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE compan $sql_tickets = mysqli_query($mysqli, "SELECT COUNT(ticket_id) AS tickets_for_month FROM tickets WHERE YEAR(ticket_created_at) = $year AND MONTH(ticket_created_at) = $month"); $row = mysqli_fetch_array($sql_tickets); - $tickets_for_month = $row['tickets_for_month']; + $tickets_for_month = intval($row['tickets_for_month']); if ($tickets_for_month > 0 && $tickets_for_month > $largest_ticket_month) { $largest_ticket_month = $tickets_for_month; diff --git a/revenue_add_modal.php b/revenue_add_modal.php index 2eed4b84..91ecb3a5 100644 --- a/revenue_add_modal.php +++ b/revenue_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Revenue
                  +
                  New Revenue
                  diff --git a/revenue_edit_modal.php b/revenue_edit_modal.php index 47611e1a..3ef0b92c 100644 --- a/revenue_edit_modal.php +++ b/revenue_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Edit Revenue
                  +
                  Edit Revenue
                  diff --git a/revenues.php b/revenues.php index 8c72321d..31e4b207 100644 --- a/revenues.php +++ b/revenues.php @@ -72,7 +72,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Revenues

                  +

                  Revenues

                  diff --git a/scheduled_ticket_add_modal.php b/scheduled_ticket_add_modal.php index 6c4226b4..0be82a54 100644 --- a/scheduled_ticket_add_modal.php +++ b/scheduled_ticket_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Scheduled Ticket
                  +
                  New Scheduled Ticket
                  @@ -23,10 +23,10 @@ $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $contact_id = $row['contact_id']; + $contact_id = intval($row['contact_id']); $contact_name = htmlentities($row['contact_name']); ?> - + - + @@ -140,8 +140,8 @@
                  - - + +
                  diff --git a/scheduled_ticket_edit_modal.php b/scheduled_ticket_edit_modal.php index bb5c5c4a..ffcb87e8 100644 --- a/scheduled_ticket_edit_modal.php +++ b/scheduled_ticket_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  +
                  @@ -82,8 +82,8 @@
                  - - + +
                  diff --git a/scheduled_tickets.php b/scheduled_tickets.php index 9880ef2c..8fa8e9f7 100644 --- a/scheduled_tickets.php +++ b/scheduled_tickets.php @@ -2,7 +2,7 @@ require_once("inc_all.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "scheduled_ticket_subject"; } @@ -25,8 +25,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -
                  -

                  Scheduled Tickets

                  +
                  +

                  Scheduled Tickets

                  +
                  +
                  + +
                  +
                  @@ -36,7 +43,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -58,7 +65,6 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - @@ -66,21 +72,25 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - - - - + + + + + - + @@ -84,7 +84,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Revoke + + Revoke +
                  diff --git a/settings_backup.php b/settings_backup.php index 6b056eab..98702a57 100644 --- a/settings_backup.php +++ b/settings_backup.php @@ -3,16 +3,16 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Download Database

                  +

                  Download Database

                  -

                  Download                   +

                  Download
                  -

                  Backup Master Encryption Key

                  +

                  Backup Master Encryption Key

                  @@ -23,7 +23,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_defaults.php b/settings_defaults.php index 4c55e079..bd124aa2 100644 --- a/settings_defaults.php +++ b/settings_defaults.php @@ -4,7 +4,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Defaults

                  +

                  Defaults

                  @@ -21,7 +21,7 @@ require_once("inc_all_settings.php"); ?> $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); ?> @@ -42,7 +42,7 @@ require_once("inc_all_settings.php"); ?> $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); ?> @@ -63,7 +63,7 @@ require_once("inc_all_settings.php"); ?> $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); ?> @@ -84,7 +84,7 @@ require_once("inc_all_settings.php"); ?> $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); ?> @@ -145,7 +145,7 @@ require_once("inc_all_settings.php"); ?> $sql = mysqli_query($mysqli, "SELECT * FROM calendars WHERE company_id = $session_company_id ORDER BY calendar_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $calendar_id = $row['calendar_id']; + $calendar_id = intval($row['calendar_id']); $calendar_name = htmlentities($row['calendar_name']); ?> diff --git a/settings_integrations.php b/settings_integrations.php index 2a0ba7bd..5d2a9f01 100644 --- a/settings_integrations.php +++ b/settings_integrations.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Integration Settings

                  +

                  Integration Settings

                  @@ -31,7 +31,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_invoice.php b/settings_invoice.php index 15492e8a..0465a6de 100644 --- a/settings_invoice.php +++ b/settings_invoice.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Invoice Settings

                  +

                  Invoice Settings

                  @@ -26,7 +26,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  @@ -75,7 +75,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  @@ -83,7 +83,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_mail.php b/settings_mail.php index d5ce545f..7ceab626 100644 --- a/settings_mail.php +++ b/settings_mail.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Mail Settings

                  +

                  Mail Settings

                  @@ -24,7 +24,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  @@ -103,7 +103,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  @@ -123,7 +123,7 @@ require_once("inc_all_settings.php"); ?>
                  - + @@ -133,14 +133,14 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Test Email Sending

                  +

                  Test Email Sending

                  - +
                  @@ -153,12 +153,12 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Test Email Receiving

                  +

                  Test Email Receiving

                  - +
                  diff --git a/settings_modules.php b/settings_modules.php index 877df859..97af57db 100644 --- a/settings_modules.php +++ b/settings_modules.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Modules

                  +

                  Modules

                  @@ -31,7 +31,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_online_payment.php b/settings_online_payment.php index 27769362..789050ed 100644 --- a/settings_online_payment.php +++ b/settings_online_payment.php @@ -8,7 +8,7 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id =
                  -

                  Online Payment

                  +

                  Online Payment

                  @@ -46,14 +46,19 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id =
                  - +
                  - - - + + + @@ -64,7 +69,7 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE company_id =
                  - +
                  diff --git a/settings_quote.php b/settings_quote.php index ac93ea89..4bd4ff62 100644 --- a/settings_quote.php +++ b/settings_quote.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Quote Settings

                  +

                  Quote Settings

                  @@ -24,7 +24,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  @@ -55,7 +55,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_software_templates.php b/settings_software_templates.php index 0d388f86..7283e506 100644 --- a/settings_software_templates.php +++ b/settings_software_templates.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "software_name"; } @@ -26,9 +26,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  License Templates

                  +

                  License Templates

                  - +
                  @@ -38,7 +38,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -66,33 +66,37 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - + - + - + diff --git a/settings_tax_add_modal.php b/settings_tax_add_modal.php index 616ce00e..74526414 100644 --- a/settings_tax_add_modal.php +++ b/settings_tax_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Tax
                  +
                  New Tax
                  @@ -19,8 +19,8 @@
                  - - + +
                  diff --git a/settings_tax_edit_modal.php b/settings_tax_edit_modal.php index af0ccde2..077aa4d4 100644 --- a/settings_tax_edit_modal.php +++ b/settings_tax_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing tax:
                  +
                  Editing tax:
                  @@ -24,8 +24,8 @@
                  - - + +
                  diff --git a/settings_taxes.php b/settings_taxes.php index 770dba03..2ec3b74c 100644 --- a/settings_taxes.php +++ b/settings_taxes.php @@ -2,7 +2,7 @@ require_once("inc_all_settings.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "tax_name"; } @@ -24,9 +24,9 @@ $num_rows = mysqli_num_rows($sql);
                  -

                  Taxes

                  +

                  Taxes

                  - +
                  @@ -43,13 +43,13 @@ $num_rows = mysqli_num_rows($sql);
                  - + diff --git a/settings_telemetry.php b/settings_telemetry.php index 6567a20b..9578182b 100644 --- a/settings_telemetry.php +++ b/settings_telemetry.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Telemetry

                  +

                  Telemetry

                  @@ -33,9 +33,9 @@ require_once("inc_all_settings.php"); ?>
                  0) { ?> - + - +
                  diff --git a/settings_theme.php b/settings_theme.php index 4ecf0f11..16e5d75a 100644 --- a/settings_theme.php +++ b/settings_theme.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Theme

                  +

                  Theme

                  @@ -36,7 +36,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_ticket.php b/settings_ticket.php index df30ca9a..9d448c14 100644 --- a/settings_ticket.php +++ b/settings_ticket.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); ?>
                  -

                  Ticket Settings

                  +

                  Ticket Settings

                  @@ -24,7 +24,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  @@ -64,7 +64,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_update.php b/settings_update.php index b73edc2c..f2de58cf 100644 --- a/settings_update.php +++ b/settings_update.php @@ -20,7 +20,7 @@ $git_log = shell_exec("git log $repo_branch..origin/$repo_branch --pretty=format
                  -

                  Update

                  +

                  Update

                  diff --git a/settings_vendor_templates.php b/settings_vendor_templates.php index 61a45fef..44b56cad 100644 --- a/settings_vendor_templates.php +++ b/settings_vendor_templates.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -15,7 +15,7 @@ if (isset($_GET['q'])) { } if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "vendor_name"; } @@ -37,11 +37,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

                  - Vendor Templates + Vendor Templates

                  @@ -52,7 +52,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -76,7 +76,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - + diff --git a/trip_add_modal.php b/trip_add_modal.php index b2edb92b..732ab2b4 100644 --- a/trip_add_modal.php +++ b/trip_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Trip
                  +
                  New Trip
                  diff --git a/trip_copy_modal.php b/trip_copy_modal.php index 4b8a66d5..9352aee9 100644 --- a/trip_copy_modal.php +++ b/trip_copy_modal.php @@ -2,7 +2,7 @@
                  -
                  Copying Trip
                  +
                  Copying Trip
                  diff --git a/trip_export_modal.php b/trip_export_modal.php index d4501280..e33033aa 100644 --- a/trip_export_modal.php +++ b/trip_export_modal.php @@ -2,7 +2,7 @@
                  -
                  Export Trips to CSV
                  +
                  Export Trips to CSV
                  @@ -32,8 +32,8 @@
                  - - + +
                  diff --git a/trips.php b/trips.php index 3a747219..0599093c 100644 --- a/trips.php +++ b/trips.php @@ -157,7 +157,7 @@ $total_pages = ceil($total_found_rows / 10); $trip_purpose = htmlentities($row['trip_purpose']); $trip_source = htmlentities($row['trip_source']); $trip_destination = htmlentities($row['trip_destination']); - $trip_miles = htmlentities($row['trip_miles']); + $trip_miles = floatval($row['trip_miles']); $trip_user_id = intval($row['trip_user_id']); $round_trip = htmlentities($row['round_trip']); $client_id = intval($row['client_id']); @@ -205,7 +205,7 @@ $total_pages = ceil($total_found_rows / 10); Copy
                  - + Delete
                  diff --git a/user_add_modal.php b/user_add_modal.php index fe7a1421..cc892182 100644 --- a/user_add_modal.php +++ b/user_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New User
                  +
                  New User
                  @@ -102,8 +102,8 @@
                  - - + +
                  diff --git a/user_companies_modal.php b/user_companies_modal.php index 3fed68ed..f4d34594 100644 --- a/user_companies_modal.php +++ b/user_companies_modal.php @@ -2,7 +2,7 @@
                  -
                  Company access: +
                  Company access:
                  - - + +
                  diff --git a/user_edit_modal.php b/user_edit_modal.php index 2504fc34..9a81e39c 100644 --- a/user_edit_modal.php +++ b/user_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing user: +
                  Editing user:
                  - - + +
                  diff --git a/user_invite_modal.php b/user_invite_modal.php index d91597a0..e843d872 100644 --- a/user_invite_modal.php +++ b/user_invite_modal.php @@ -2,7 +2,7 @@
                  -
                  Invite User
                  +
                  Invite User
                  @@ -61,8 +61,8 @@
                  - - + +
                  diff --git a/user_profile.php b/user_profile.php index 03ea5692..b435ad40 100644 --- a/user_profile.php +++ b/user_profile.php @@ -15,7 +15,7 @@ $sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs
                  -

                  Your User Details

                  +

                  Your User Details

                  @@ -84,7 +84,7 @@ $sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs - + @@ -147,19 +147,19 @@ $sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs
                  -

                  Your Recent Sign ins

                  +

                  Your Recent Sign ins
                  Priority Frequency Next Run DateAction
                  )"> + )"> + +
                  @@ -89,11 +99,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  )">Edit + data-target="#editScheduledTicketModal" onclick="populateScheduledTicketEditModal()"> + Edit +
                  - Delete + + Delete +
                  @@ -110,5 +124,6 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Alerts

                  +

                  Alerts

                  @@ -45,7 +45,7 @@ require_once("inc_all_settings.php"); ?>
                  - +
                  diff --git a/settings_api.php b/settings_api.php index 7df9921b..0a9e258d 100644 --- a/settings_api.php +++ b/settings_api.php @@ -3,7 +3,7 @@ require_once("inc_all_settings.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "api_key_name"; } @@ -25,9 +25,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  API Keys

                  +

                  API Keys

                  - +
                  @@ -56,11 +56,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  $software_version"; ?>$software_version"; ?>
                  - Edit + + Edit +
                  - Delete + + Delete +
                  diff --git a/settings_tag_add_modal.php b/settings_tag_add_modal.php index 14422720..fa40bd0e 100644 --- a/settings_tag_add_modal.php +++ b/settings_tag_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Tag
                  +
                  New Tag
                  @@ -57,8 +57,8 @@
                  - - + +
                  diff --git a/settings_tag_edit_modal.php b/settings_tag_edit_modal.php index bdc56e2f..1b94b03d 100644 --- a/settings_tag_edit_modal.php +++ b/settings_tag_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing tag:
                  +
                  Editing tag:
                  @@ -63,8 +63,8 @@
                  - - + +
                  diff --git a/settings_tags.php b/settings_tags.php index 6f68bd86..3344a2b5 100644 --- a/settings_tags.php +++ b/settings_tags.php @@ -2,7 +2,7 @@ require_once("inc_all_settings.php"); if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "tag_name"; } @@ -43,9 +43,9 @@ if ($num_rows > 0) {
                  -

                  Tags

                  +

                  Tags

                  - +
                  @@ -54,7 +54,7 @@ if ($num_rows > 0) {
                  - +
                  @@ -80,7 +80,7 @@ if ($num_rows > 0) { 0) { ?>
                  "; ?> "; ?> @@ -97,9 +97,13 @@ if ($num_rows > 0) {
                  - Edit + + Edit +
                  - Delete + + Delete +
                  @@ -57,9 +57,13 @@ $num_rows = mysqli_num_rows($sql);
                  - Edit + + Edit +
                  - Archive + + Archive +
                  - - + + + @@ -144,10 +145,14 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Delete + + Delete +
                  diff --git a/setup.php b/setup.php index 87abee26..1629649e 100644 --- a/setup.php +++ b/setup.php @@ -846,8 +846,8 @@ if (isset($_POST['add_user'])) { exit; } - $name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name']))); - $email = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['email']))); + $name = sanitizeInput($_POST['name']); + $email = sanitizeInput($_POST['email']); $password = password_hash($_POST['password'], PASSWORD_DEFAULT); //Generate master encryption key @@ -856,7 +856,7 @@ if (isset($_POST['add_user'])) { //Generate user specific key $user_specific_encryption_ciphertext = setupFirstUserSpecificKey($_POST['password'], $site_encryption_master_key); - mysqli_query($mysqli,"INSERT INTO users SET user_name = '$name', user_email = '$email', user_password = '$password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext', user_created_at = NOW()"); + mysqli_query($mysqli,"INSERT INTO users SET user_name = '$name', user_email = '$email', user_password = '$password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext'"); $user_id = mysqli_insert_id($mysqli); @@ -919,21 +919,21 @@ if (isset($_POST['add_company_settings'])) { $sql = mysqli_query($mysqli,"SELECT user_id FROM users"); $row = mysqli_fetch_array($sql); - $user_id = $row['user_id']; + $user_id = intval($row['user_id']); - $name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name']))); - $country = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['country']))); - $address = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['address']))); - $city = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['city']))); - $state = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['state']))); - $zip = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['zip']))); + $name = sanitizeInput($_POST['name']); + $country = sanitizeInput($_POST['country']); + $address = sanitizeInput($_POST['address']); + $city = sanitizeInput($_POST['city']); + $state = sanitizeInput($_POST['state']); + $zip = sanitizeInput($_POST['zip']); $phone = preg_replace("/[^0-9]/", '',$_POST['phone']); - $email = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['email']))); - $website = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['website']))); - $locale = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['locale']))); - $currency_code = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['currency_code']))); + $email = sanitizeInput($_POST['email']); + $website = sanitizeInput($_POST['website']); + $locale = sanitizeInput($_POST['locale']); + $currency_code = sanitizeInput($_POST['currency_code']); - mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_locale = '$locale', company_currency = '$currency_code', company_created_at = NOW()"); + mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_locale = '$locale', company_currency = '$currency_code'"); $company_id = mysqli_insert_id($mysqli); @@ -992,25 +992,25 @@ if (isset($_POST['add_company_settings'])) { mysqli_query($mysqli,"INSERT INTO user_companies SET user_id = $user_id, company_id = $company_id"); $latest_database_version = LATEST_DATABASE_VERSION; - mysqli_query($mysqli,"INSERT INTO settings SET company_id = $company_id, config_current_database_version = '$latest_database_version', config_invoice_prefix = 'INV-', config_invoice_next_number = 1, config_recurring_prefix = 'REC-', config_recurring_next_number = 1, config_invoice_overdue_reminders = '1,3,7', config_quote_prefix = 'QUO-', config_quote_next_number = 1, config_recurring_auto_send_invoice = 1, config_default_net_terms = 30, config_send_invoice_reminders = 1, config_enable_cron = 0, config_ticket_next_number = 1, config_ticket_prefix = 'TCK-'"); + mysqli_query($mysqli,"INSERT INTO settings SET company_id = $company_id, config_current_database_version = '$latest_database_version', config_invoice_prefix = 'INV-', config_invoice_next_number = 1, config_recurring_prefix = 'REC-', config_recurring_next_number = 1, config_invoice_overdue_reminders = '1,3,7', config_quote_prefix = 'QUO-', config_quote_next_number = 1, config_default_net_terms = 30, config_ticket_next_number = 1, config_ticket_prefix = 'TCK-'"); //Create Some Data - mysqli_query($mysqli,"INSERT INTO accounts SET account_name = 'Cash', opening_balance = 0, account_currency_code = '$currency_code', account_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO accounts SET account_name = 'Cash', account_currency_code = '$currency_code', company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Office Supplies', category_type = 'Expense', category_color = 'blue', category_created_at = NOW(), company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Travel', category_type = 'Expense', category_color = 'red', category_created_at = NOW(), company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Advertising', category_type = 'Expense', category_color = 'green', category_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Office Supplies', category_type = 'Expense', category_color = 'blue', company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Travel', category_type = 'Expense', category_color = 'red', company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Advertising', category_type = 'Expense', category_color = 'green', company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Service', category_type = 'Income', category_color = 'blue', category_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Service', category_type = 'Income', category_color = 'blue', company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Friend', category_type = 'Referral', category_color = 'blue', category_created_at = NOW(), company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Search Engine', category_type = 'Referral', category_color = 'red', category_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Friend', category_type = 'Referral', category_color = 'blue', company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Search Engine', category_type = 'Referral', category_color = 'red', company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Cash', category_type = 'Payment Method', category_color = 'blue', category_created_at = NOW(), company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Check', category_type = 'Payment Method', category_color = 'red', category_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Cash', category_type = 'Payment Method', category_color = 'blue', company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Check', category_type = 'Payment Method', category_color = 'red', company_id = $company_id"); - mysqli_query($mysqli,"INSERT INTO calendars SET calendar_name = 'Default', calendar_color = 'blue', calendar_created_at = NOW(), company_id = $company_id"); + mysqli_query($mysqli,"INSERT INTO calendars SET calendar_name = 'Default', calendar_color = 'blue', company_id = $company_id"); $_SESSION['alert_message'] = "Company $name created!"; @@ -1023,7 +1023,7 @@ if (isset($_POST['add_telemetry'])) { if (isset($_POST['share_data']) && $_POST['share_data'] == 1) { - $comments = trim(strip_tags($_POST['comments'])); + $comments = sanitizeInput($_POST['comments']); $sql = mysqli_query($mysqli,"SELECT * FROM companies LIMIT 1"); $row = mysqli_fetch_array($sql); @@ -1175,7 +1175,7 @@ if (isset($_POST['add_telemetry'])) { if (!empty($_SESSION['alert_message'])) { ?>
                  - +
                  -
                  Setup Checks
                  +
                  Setup Checks
                  • Upload is readable and writeable
                  • PHP 7+ Installed
                  - +
                  @@ -1204,7 +1204,7 @@ if (isset($_POST['add_telemetry'])) {
                  -

                  Connect your Database

                  +

                  Connect your Database

                  @@ -1257,7 +1257,7 @@ if (isset($_POST['add_telemetry'])) {
                  - +
                  @@ -1267,7 +1267,7 @@ if (isset($_POST['add_telemetry'])) {
                  -

                  Create your first user

                  +

                  Create your first user

                  @@ -1312,7 +1312,7 @@ if (isset($_POST['add_telemetry'])) {
                  - +
                  @@ -1321,7 +1321,7 @@ if (isset($_POST['add_telemetry'])) {
                  -

                  Company Details

                  +

                  Company Details

                  @@ -1461,7 +1461,7 @@ if (isset($_POST['add_telemetry'])) {
                  - + @@ -1473,7 +1473,7 @@ if (isset($_POST['add_telemetry'])) {
                  -

                  Telemetry

                  +

                  Telemetry

                  @@ -1499,7 +1499,7 @@ if (isset($_POST['add_telemetry'])) {
                  - +
                  @@ -1510,7 +1510,7 @@ if (isset($_POST['add_telemetry'])) {
                  -

                  Welcome to ITFlow Setup

                  +

                  ITFlow Setup

                  Thank you for choosing to try ITFlow! Feel free to reach out on the forums if you have any questions.

                  @@ -1528,7 +1528,7 @@ if (isset($_POST['add_telemetry'])) { ?>
                  diff --git a/share_modal.php b/share_modal.php index 016b54a2..08b67ad5 100644 --- a/share_modal.php +++ b/share_modal.php @@ -42,7 +42,7 @@
                  -
                  Generate Share Link
                  +
                  Generate Share Link
                  @@ -87,8 +87,8 @@
                  - - + +
                  diff --git a/side_nav.php b/side_nav.php index cfef3f40..9d56730e 100644 --- a/side_nav.php +++ b/side_nav.php @@ -24,7 +24,7 @@ while ($row = mysqli_fetch_array($sql)) { - $company_id = $row['company_id']; + $company_id = intval($row['company_id']); $company_name = htmlentities($row['company_name']); ?> diff --git a/ticket.php b/ticket.php index c06d440b..3d8bdcfc 100644 --- a/ticket.php +++ b/ticket.php @@ -157,6 +157,11 @@ if (isset($_GET['ticket_id'])) { } $client_tags_display = implode(' ', $client_tag_name_display_array); + // Get the number of responses + $ticket_responses_sql = mysqli_query($mysqli, "SELECT COUNT(ticket_reply_id) AS ticket_responses FROM ticket_replies WHERE ticket_reply_ticket_id = $ticket_id"); + $row = mysqli_fetch_array($ticket_responses_sql); + $ticket_responses = intval($row['ticket_responses']); + // Get & format asset warranty expiry $date = date('Y-m-d H:i:s'); $dt_value = $asset_warranty_expire; //sample date @@ -208,7 +213,7 @@ if (isset($_GET['ticket_id'])) {
                  -

                  Ticket

                  +

                  Ticket

                  @@ -217,11 +222,17 @@ if (isset($_GET['ticket_id'])) {
                  - Edit - Merge + + Edit + + + Merge +
                  - Delete + + Delete +
                  @@ -236,7 +247,7 @@ if (isset($_GET['ticket_id'])) {
                  -

                  +

                  @@ -251,7 +262,7 @@ if (isset($_GET['ticket_id'])) {
                  - +
                  @@ -280,13 +291,13 @@ if (isset($_GET['ticket_id'])) {
                  - +
                  - +
                  @@ -297,6 +308,8 @@ if (isset($_GET['ticket_id'])) { +
                  Responses ()
                  +
                  - Edit + + Edit +
                  - Archive + + Archive +
                  @@ -605,10 +622,14 @@ if (isset($_GET['ticket_id'])) {
                  diff --git a/ticket_add_modal.php b/ticket_add_modal.php index 0a7ff3d1..a9265145 100644 --- a/ticket_add_modal.php +++ b/ticket_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Ticket
                  +
                  New Ticket
                  @@ -198,8 +198,8 @@
                  - - + +
                  diff --git a/ticket_merge_modal.php b/ticket_merge_modal.php index b05d29fc..c4025e0a 100644 --- a/ticket_merge_modal.php +++ b/ticket_merge_modal.php @@ -2,7 +2,7 @@
                  -
                  Merge & Close into another ticket
                  +
                  Merge & Close into another ticket
                  diff --git a/tickets.php b/tickets.php index 2a80c621..214af0b1 100644 --- a/tickets.php +++ b/tickets.php @@ -340,7 +340,7 @@ $user_active_assigned_tickets = intval($row['total_tickets_assigned']); while ($row = mysqli_fetch_array($sql)) { $ticket_id = intval($row['ticket_id']); $ticket_prefix = htmlentities($row['ticket_prefix']); - $ticket_number = htmlentities($row['ticket_number']); + $ticket_number = intval($row['ticket_number']); $ticket_subject = htmlentities($row['ticket_subject']); $ticket_details = htmlentities($row['ticket_details']); $ticket_priority = htmlentities($row['ticket_priority']); diff --git a/top_nav.php b/top_nav.php index 10096b3b..7886fddb 100644 --- a/top_nav.php +++ b/top_nav.php @@ -31,7 +31,13 @@ 0) { ?> @@ -64,7 +70,7 @@
                  See All Notifications
                  - Dismiss All Notifications + Dismiss All Notifications
                  @@ -112,8 +118,8 @@
                • - Profile - Sign out + Profile + Sign out
                  • diff --git a/transfer_add_modal.php b/transfer_add_modal.php index 1a533fac..9c3f9aaf 100644 --- a/transfer_add_modal.php +++ b/transfer_add_modal.php @@ -2,7 +2,7 @@
                  -
                  Transfering Funds
                  +
                  Transfering Funds
                  @@ -46,21 +46,21 @@ $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -84,21 +84,21 @@ $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql)) { - $account_id = $row['account_id']; + $account_id = intval($row['account_id']); $account_name = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -117,8 +117,8 @@
                  - - + +
                  diff --git a/transfer_edit_modal.php b/transfer_edit_modal.php index 5c219c4d..7cd09903 100644 --- a/transfer_edit_modal.php +++ b/transfer_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Modify Transfer
                  +
                  Edit Transfer
                  @@ -49,21 +49,21 @@ $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$transfer_created_at' OR account_archived_at IS NULL) AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql_accounts)) { - $account_id_select = $row['account_id']; + $account_id_select = intval($row['account_id']); $account_name_select = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id_select"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -87,21 +87,21 @@ $sql2 = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$transfer_created_at' OR account_archived_at IS NULL) AND company_id = $session_company_id ORDER BY account_name ASC"); while ($row = mysqli_fetch_array($sql2)) { - $account_id2 = $row['account_id']; + $account_id2 = intval($row['account_id']); $account_name = htmlentities($row['account_name']); $opening_balance = floatval($row['opening_balance']); $sql_payments = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_payments FROM payments WHERE payment_account_id = $account_id2"); $row = mysqli_fetch_array($sql_payments); - $total_payments = $row['total_payments']; + $total_payments = floatval($row['total_payments']); $sql_revenues = mysqli_query($mysqli, "SELECT SUM(revenue_amount) AS total_revenues FROM revenues WHERE revenue_account_id = $account_id2"); $row = mysqli_fetch_array($sql_revenues); - $total_revenues = $row['total_revenues']; + $total_revenues = floatval($row['total_revenues']); $sql_expenses = mysqli_query($mysqli, "SELECT SUM(expense_amount) AS total_expenses FROM expenses WHERE expense_account_id = $account_id2"); $row = mysqli_fetch_array($sql_expenses); - $total_expenses = $row['total_expenses']; + $total_expenses = floatval($row['total_expenses']); $balance = $opening_balance + $total_payments + $total_revenues - $total_expenses; @@ -123,8 +123,8 @@
                  - - + +
                  diff --git a/transfers.php b/transfers.php index 2a7501c5..bd6f5378 100644 --- a/transfers.php +++ b/transfers.php @@ -4,7 +4,7 @@ require_once("inc_all.php"); //Column Sortby Filter if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "transfer_date"; } @@ -23,8 +23,8 @@ if (empty($_GET['canned_date'])) { //Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); @@ -73,9 +73,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Transfers

                  +

                  Transfers

                  - +
                  @@ -84,7 +84,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -141,22 +141,22 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); @@ -164,16 +164,20 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Delete + + Delete +
                  @@ -180,7 +180,7 @@ $sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs
                  -

                  Your Recent Activity

                  +

                  Your Recent Activity

                  @@ -189,11 +189,11 @@ $sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs
                  -

                  Users

                  +

                  Users

                  @@ -41,7 +41,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -64,7 +64,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit + - Activate + + Activate + - Disable + + Disable +
                  - Company Access + + Company Access +
                  - Archive + + Archive +
                  diff --git a/vendor_add_from_template_modal.php b/vendor_add_from_template_modal.php index 0af4928c..5c274b1d 100644 --- a/vendor_add_from_template_modal.php +++ b/vendor_add_from_template_modal.php @@ -2,7 +2,7 @@
                  -
                  New Vendor from Template
                  +
                  New Vendor from Template
                  @@ -24,7 +24,7 @@ @@ -38,10 +38,8 @@
                  - - - - + +
                  diff --git a/vendor_add_modal.php b/vendor_add_modal.php index 53c16216..327e9fad 100644 --- a/vendor_add_modal.php +++ b/vendor_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Vendor
                  +
                  New Vendor
                  @@ -156,8 +156,8 @@
                  - - + +
                  diff --git a/vendor_edit_modal.php b/vendor_edit_modal.php index ce98f268..fc683040 100644 --- a/vendor_edit_modal.php +++ b/vendor_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing vendor:
                  +
                  Editing vendor:
                  @@ -175,8 +175,8 @@
                  - - + +
                  diff --git a/vendor_template_add_modal.php b/vendor_template_add_modal.php index 174d5574..f7b014ad 100644 --- a/vendor_template_add_modal.php +++ b/vendor_template_add_modal.php @@ -2,7 +2,7 @@
                  -
                  New Vendor Template
                  +
                  New Vendor Template
                  @@ -156,8 +156,8 @@
                  - - + +
                  diff --git a/vendor_template_edit_modal.php b/vendor_template_edit_modal.php index 6751a5e2..61fb4b86 100644 --- a/vendor_template_edit_modal.php +++ b/vendor_template_edit_modal.php @@ -2,7 +2,7 @@
                  -
                  Editing vendor template:
                  +
                  Editing vendor template:
                  @@ -161,8 +161,8 @@
                  - - + +
                  diff --git a/vendors.php b/vendors.php index df9eb1e2..c8039ac5 100644 --- a/vendors.php +++ b/vendors.php @@ -3,7 +3,7 @@ require_once("inc_all.php"); if (isset($_GET['q'])) { - $q = strip_tags(mysqli_real_escape_string($mysqli, $_GET['q'])); + $q = sanitizeInput($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -16,15 +16,15 @@ if (isset($_GET['q'])) { //Column Filter if (!empty($_GET['sb'])) { - $sb = strip_tags(mysqli_real_escape_string($mysqli, $_GET['sb'])); + $sb = sanitizeInput($_GET['sb']); } else { $sb = "vendor_name"; } //Date From and Date To Filter if (!empty($_GET['dtf'])) { - $dtf = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtf'])); - $dtt = strip_tags(mysqli_real_escape_string($mysqli, $_GET['dtt'])); + $dtf = sanitizeInput($_GET['dtf']); + $dtt = sanitizeInput($_GET['dtt']); } else { $dtf = "0000-00-00"; $dtt = "9999-00-00"; @@ -51,9 +51,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  -

                  Vendors

                  +

                  Vendors

                  - +
                  @@ -62,7 +62,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - +
                  @@ -102,7 +102,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  @@ -165,9 +165,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                  - Edit + + Edit +
                  - Archive + + Archive +
                  - - -
                  - - +                   + +
                  + +