diff --git a/admin/post/ai_model.php b/admin/post/ai_model.php
index 127d1ccf..d975c8dc 100644
--- a/admin/post/ai_model.php
+++ b/admin/post/ai_model.php
@@ -19,7 +19,6 @@ if (isset($_POST['add_ai_model'])) {
$ai_model_id = mysqli_insert_id($mysqli);
- // Logging
logAction("AI Model", "Create", "$session_name created AI Model $model");
flash_alert("AI Model $model created");
@@ -39,7 +38,6 @@ if (isset($_POST['edit_ai_model'])) {
mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id");
- // Logging
logAction("AI Model", "Edit", "$session_name edited AI Model $model");
flash_alert("AI Model $model edited");
@@ -54,13 +52,10 @@ if (isset($_GET['delete_ai_model'])) {
$model_id = intval($_GET['delete_ai_model']);
- $sql = mysqli_query($mysqli,"SELECT ai_model_name FROM ai_models WHERE ai_model_id = $model_id");
- $row = mysqli_fetch_array($sql);
- $model_name = sanitizeInput($row['ai_model_name']);
+ $model_name = sanitizeInput(getFieldById('ai_models', $model_id, 'ai_model_name'));
mysqli_query($mysqli,"DELETE FROM ai_models WHERE ai_model_id = $model_id");
- // Logging
logAction("AI Model", "Delete", "$session_name deleted AI Model $model_name");
flash_alert("AI Model $model_name deleted", 'error');
diff --git a/admin/post/ai_provider.php b/admin/post/ai_provider.php
index 3a3692c7..3661da61 100644
--- a/admin/post/ai_provider.php
+++ b/admin/post/ai_provider.php
@@ -15,12 +15,10 @@ if (isset($_POST['add_ai_provider'])) {
$model = sanitizeInput($_POST['model']);
$api_key = sanitizeInput($_POST['api_key']);
-
mysqli_query($mysqli,"INSERT INTO ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key'");
$ai_provider_id = mysqli_insert_id($mysqli);
- // Logging
logAction("AI Provider", "Create", "$session_name created AI Provider $provider");
flash_alert("AI Model $provider created");
@@ -40,7 +38,6 @@ if (isset($_POST['edit_ai_provider'])) {
mysqli_query($mysqli,"UPDATE ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key' WHERE ai_provider_id = $provider_id");
- // Logging
logAction("AI Provider", "Edit", "$session_name edited AI Provider $provider");
flash_alert("AI Model $provider edited");
@@ -55,14 +52,11 @@ if (isset($_GET['delete_ai_provider'])) {
$provider_id = intval($_GET['delete_ai_provider']);
- $sql = mysqli_query($mysqli,"SELECT ai_provider_name FROM ai_providers WHERE ai_provider_id = $provider_id");
- $row = mysqli_fetch_array($sql);
- $provider_name = sanitizeInput($row['ai_provider_name']);
+ $provider_name = sanitizeInput(getFieldById('ai_providers', $provider_id, 'ai_provider_name'));
mysqli_query($mysqli,"DELETE FROM ai_providers WHERE ai_provider_id = $provider_id");
- // Logging
- logAction("AI Provider", "Delete", "$session_name deleted AI Provider $provider_name");
+ logAction("AI Provider", "Delete", "$session_name deleted AI Provider $provider_name", 'error');
flash_alert("AI Provider $provider_name deleted", 'error');
diff --git a/admin/post/api_keys.php b/admin/post/api_keys.php
index f1ffac30..d7c75186 100644
--- a/admin/post/api_keys.php
+++ b/admin/post/api_keys.php
@@ -23,7 +23,6 @@ if (isset($_POST['add_api_key'])) {
$api_key_id = mysqli_insert_id($mysqli);
- // Logging
logAction("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id);
flash_alert("API Key $name created");
@@ -45,7 +44,6 @@ if (isset($_GET['delete_api_key'])) {
mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id");
- // Logging
logAction("API Key", "Delete", "$session_name deleted API key $name", $client_id);
flash_alert("API Key $name deleted", 'error');
@@ -74,12 +72,10 @@ if (isset($_POST['bulk_delete_api_keys'])) {
mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id");
- // Logging
logAction("API Key", "Delete", "$session_name deleted API key $name", $client_id);
}
- // Logging
logAction("API Key", "Bulk Delete", "$session_name deleted $count API key(s)");
flash_alert("Deleted $count API keys(s)", 'error');
@@ -87,4 +83,5 @@ if (isset($_POST['bulk_delete_api_keys'])) {
}
redirect();
+
}
diff --git a/admin/post/backup.php b/admin/post/backup.php
index b4b36bd5..11f133cd 100644
--- a/admin/post/backup.php
+++ b/admin/post/backup.php
@@ -192,10 +192,8 @@ if (isset($_POST['backup_master_key'])) {
if (password_verify($password, $row['user_password'])) {
$site_encryption_master_key = decryptUserSpecificKey($row['user_specific_encryption_ciphertext'], $password);
- // Logging
logAction("Master Key", "Download", "$session_name retrieved the master encryption key");
- // App Notify
appNotify("Master Key", "$session_name retrieved the master encryption key");
echo "==============================";
@@ -204,7 +202,6 @@ if (isset($_POST['backup_master_key'])) {
echo "
==============================";
} else {
- // Log the failure
logAction("Master Key", "Download", "$session_name attempted to retrieve the master encryption key but failed");
flash_alert("Incorrect password.", 'error');
diff --git a/admin/post/category.php b/admin/post/category.php
index 470d579f..070744dc 100644
--- a/admin/post/category.php
+++ b/admin/post/category.php
@@ -14,7 +14,6 @@ if (isset($_POST['add_category'])) {
$category_id = mysqli_insert_id($mysqli);
- // Logging
logAction("Category", "Create", "$session_name created category $type $name", 0, $category_id);
flash_alert("Category $type $name created");
@@ -31,7 +30,6 @@ if (isset($_POST['edit_category'])) {
mysqli_query($mysqli,"UPDATE categories SET category_name = '$name', category_type = '$type', category_color = '$color' WHERE category_id = $category_id");
- // Logging
logAction("Category", "Edit", "$session_name edited category $type $name", 0, $category_id);
flash_alert("Category $type $name edited");
@@ -52,7 +50,6 @@ if (isset($_GET['archive_category'])) {
mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NOW() WHERE category_id = $category_id");
- // Logging
logAction("Category", "Archive", "$session_name archived category $category_type $category_name", 0, $category_id);
flash_alert("Category $category_type $category_name archived", 'error');
@@ -73,7 +70,6 @@ if (isset($_GET['unarchive_category'])) {
mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NULL WHERE category_id = $category_id");
- // Logging
logAction("Category", "Unarchive", "$session_name unarchived category $category_type $category_name", 0, $category_id);
flash_alert("Category $category_type $category_name unarchived");
@@ -94,7 +90,6 @@ if (isset($_GET['delete_category'])) {
mysqli_query($mysqli,"DELETE FROM categories WHERE category_id = $category_id");
- // Logging
logAction("Category", "Delete", "$session_name deleted category $category_type $category_name");
flash_alert("Category $category_type $category_name deleted", 'error');
diff --git a/admin/post/custom_field.php b/admin/post/custom_field.php
index 5751ce4d..4c4897d6 100644
--- a/admin/post/custom_field.php
+++ b/admin/post/custom_field.php
@@ -16,7 +16,6 @@ if(isset($_POST['create_custom_field'])){
$custom_field_id = mysqli_insert_id($mysqli);
- // Logging
logAction("Custom Field", "Create", "$session_name created custom field $label", 0, $custom_field_id);
flash_alert("Custom field $label created");
@@ -33,7 +32,6 @@ if(isset($_POST['edit_custom_field'])){
mysqli_query($mysqli,"UPDATE custom_fields SET custom_field_label = '$label', custom_field_type = '$type' WHERE custom_field_id = $custom_field_id");
- // Logging
logAction("Custom Field", "Edit", "$session_name edited custom field $label", 0, $custom_field_id);
flash_alert("Custom field $label edited");
@@ -43,19 +41,15 @@ if(isset($_POST['edit_custom_field'])){
}
if(isset($_GET['delete_custom_field'])){
+
$custom_field_id = intval($_GET['delete_custom_field']);
- // Get Custom Field Label for logging
- $sql = mysqli_query($mysqli,"SELECT custom_field_label FROM custom_fields WHERE custom_field_id = $custom_field_id");
- $row = mysqli_fetch_array($sql);
- $custom_field_label = sanitizeInput($row['custom_field_label']);
+ $label = sanitizeInput(getFieldById('custom_fields', $custom_field_id, 'custom_field_label'));
mysqli_query($mysqli,"DELETE FROM custom_fields WHERE custom_field_id = $custom_field_id");
- // Logging
logAction("Custom Field", "Delete", "$session_name deleted custom field $label");
- $_SESSION['alert_type'] = "error";
flash_alert("Custom field $label deleted", 'error');
redirect();
diff --git a/admin/post/custom_link.php b/admin/post/custom_link.php
index 26ec09d2..5ecf4710 100644
--- a/admin/post/custom_link.php
+++ b/admin/post/custom_link.php
@@ -19,7 +19,6 @@ if (isset($_POST['add_custom_link'])) {
$custom_link_id = mysqli_insert_id($mysqli);
- // Logging
logAction("Custom Link", "Create", "$session_name created custom link $name -> $uri", 0, $custom_link_id);
flash_alert("Custom link $name created");
@@ -40,7 +39,6 @@ if (isset($_POST['edit_custom_link'])) {
mysqli_query($mysqli,"UPDATE custom_links SET custom_link_name = '$name', custom_link_uri = '$uri', custom_link_new_tab = $new_tab, custom_link_icon = '$icon', custom_link_order = $order, custom_link_location = $location WHERE custom_link_id = $custom_link_id");
- // Logging
logAction("Custom Link", "Edit", "$session_name edited custom link $name -> $uri", 0, $custom_link_id);
flash_alert("Custom Link $name edited");
@@ -50,6 +48,7 @@ if (isset($_POST['edit_custom_link'])) {
}
if (isset($_GET['delete_custom_link'])) {
+
$custom_link_id = intval($_GET['delete_custom_link']);
// Get Custom Link name and uri for logging
@@ -60,7 +59,6 @@ if (isset($_GET['delete_custom_link'])) {
mysqli_query($mysqli,"DELETE FROM custom_links WHERE custom_link_id = $custom_link_id");
- // Logging
logAction("Custom Link", "Delete", "$session_name deleted custom link $custom_link_name -> $custom_link_uri");
flash_alert("Custom Link $name deleted", 'error');
diff --git a/admin/post/document_template.php b/admin/post/document_template.php
index b0bd8094..2dbbb3b9 100644
--- a/admin/post/document_template.php
+++ b/admin/post/document_template.php
@@ -10,12 +10,10 @@ if (isset($_POST['add_document_template'])) {
$description = sanitizeInput($_POST['description']);
$content = mysqli_real_escape_string($mysqli,$_POST['content']);
- // Document create query
mysqli_query($mysqli,"INSERT INTO document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$content', document_template_created_by = $session_user_id");
$document_template_id = mysqli_insert_id($mysqli);
- // Logging
logAction("Document Template", "Create", "$session_name created document template $name", 0, $document_template_id);
flash_alert("Document template $name created");
@@ -34,7 +32,6 @@ if (isset($_POST['edit_document_template'])) {
// Document edit query
mysqli_query($mysqli,"UPDATE document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$content', document_template_updated_by = $session_user_id WHERE document_template_id = $document_template_id");
- // Logging
logAction("Document Template", "Edit", "$session_name edited document template $name", 0, $document_template_id);
flash_alert("Document Template $name edited");
@@ -47,14 +44,10 @@ if (isset($_GET['delete_document_template'])) {
$document_template_id = intval($_GET['delete_document_template']);
- // Get Document Template Name for logging
- $sql = mysqli_query($mysqli,"SELECT document_template_name FROM document_templates WHERE document_template_id = $document_template_id");
- $row = mysqli_fetch_array($sql);
- $document_template_name = sanitizeInput($row['document_template_name']);
+ $document_template_name = sanitizeInput(getFieldById('document_templates', $document_template_id, 'document_template_name'));
mysqli_query($mysqli,"DELETE FROM document_templates WHERE document_template_id = $document_template_id");
- //Logging
logAction("Document Template", "Delete", "$session_name deleted document template $document_template_name");
flash_alert("Document Template $document_template_name deleted", 'error');
diff --git a/admin/post/identity_provider.php b/admin/post/identity_provider.php
index 8d444221..688facf8 100644
--- a/admin/post/identity_provider.php
+++ b/admin/post/identity_provider.php
@@ -11,7 +11,6 @@ if (isset($_POST['edit_identity_provider'])) {
mysqli_query($mysqli,"UPDATE settings SET config_azure_client_id = '$azure_client_id', config_azure_client_secret = '$azure_client_secret' WHERE company_id = 1");
- // Logging
logAction("Settings", "Edit", "$session_name edited identity provider settings");
flash_alert("Identity Provider Settings updated");
diff --git a/admin/post/mail_queue.php b/admin/post/mail_queue.php
index d7c89c24..3270fad1 100644
--- a/admin/post/mail_queue.php
+++ b/admin/post/mail_queue.php
@@ -8,7 +8,6 @@ if (isset($_GET['send_failed_mail'])) {
mysqli_query($mysqli,"UPDATE email_queue SET email_status = 0, email_attempts = 3 WHERE email_id = $email_id");
- // Logging
logAction("Email", "Send", "$session_name attempted to force send email id: $email_id in the mail queue", 0, $email_id);
flash_alert("Email Force Sent, give it a minute to resend");
@@ -23,7 +22,6 @@ if (isset($_GET['cancel_mail'])) {
mysqli_query($mysqli,"UPDATE email_queue SET email_status = 2, email_attempts = 99, email_failed_at = NOW() WHERE email_id = $email_id");
- // Logging
logAction("Email", "Send", "$session_name canceled send email id: $email_id in the mail queue", 0, $email_id);
flash_alert("Email cancelled and marked as failed.", 'error');
@@ -46,12 +44,10 @@ if (isset($_POST['bulk_cancel_emails'])) {
$email_id = intval($email_id);
mysqli_query($mysqli,"UPDATE email_queue SET email_status = 2, email_attempts = 99, email_failed_at = NOW() WHERE email_id = $email_id");
- // Logging
logAction("Email", "Cancel", "$session_name cancelled email id: $email_id in the mail queue", 0, $email_id);
}
- // Logging
logAction("Email", "Bulk Cancel", "$session_name cancelled $count email(s) in the mail queue");
flash_alert("Cancelled $count email(s)", 'error');
@@ -59,6 +55,7 @@ if (isset($_POST['bulk_cancel_emails'])) {
}
redirect();
+
}
if (isset($_POST['bulk_delete_emails'])) {
@@ -75,12 +72,10 @@ if (isset($_POST['bulk_delete_emails'])) {
$email_id = intval($email_id);
mysqli_query($mysqli,"DELETE FROM email_queue WHERE email_id = $email_id");
- // Logging
logAction("Email", "Delete", "$session_name deleted email id: $email_id from the mail queue");
}
- // Logging
logAction("Email", "Bulk Delete", "$session_name deleted $count email(s) from the mail queue");
flash_alert("Deleted $count email(s)", 'error');
@@ -88,4 +83,5 @@ if (isset($_POST['bulk_delete_emails'])) {
}
redirect();
+
}
diff --git a/admin/post/payment_method.php b/admin/post/payment_method.php
index 0df6e94c..3de1f4f7 100644
--- a/admin/post/payment_method.php
+++ b/admin/post/payment_method.php
@@ -15,7 +15,6 @@ if (isset($_POST['add_payment_method'])) {
mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$name', payment_method_description = '$description'");
- // Logging
logAction("Payment Method", "Create", "$session_name created Payment Method $name");
flash_alert("Payment Method $name created");
@@ -34,7 +33,6 @@ if (isset($_POST['edit_payment_method'])) {
mysqli_query($mysqli,"UPDATE payment_methods SET payment_method_name = '$name', payment_method_description = '$description' WHERE payment_method_id = $payment_method_id");
- // Logging
logAction("Payment Method", "Edit", "$session_name edited Payment Method $name");
flash_alert("Payment Method $name edited");
@@ -47,13 +45,10 @@ if (isset($_GET['delete_payment_method'])) {
$payment_method_id = intval($_GET['delete_payment_method']);
- $sql = mysqli_query($mysqli,"SELECT payment_method_name FROM payment_methods WHERE payment_method_id = $payment_method_id");
- $row = mysqli_fetch_array($sql);
- $payment_method_name = sanitizeInput($row['payment_method_name']);
+ $payment_method_name = sanitizeInput(getFieldById('payment_methods', $payment_method_is, 'payment_method_name'));
mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id");
- // Logging
logAction("Payment Method", "Delete", "$session_name deleted Payment Method $payment_method_name");
flash_alert("Payment Method $payment_method_name deleted", 'error');
diff --git a/admin/post/payment_provider.php b/admin/post/payment_provider.php
index e84499e7..603bccc1 100644
--- a/admin/post/payment_provider.php
+++ b/admin/post/payment_provider.php
@@ -52,7 +52,6 @@ if (isset($_POST['add_payment_provider'])) {
$provider_id = mysqli_insert_id($mysqli);
- // Logging
logAction("Payment Provider", "Create", "$session_name created AI Provider $provider");
flash_alert("Payment provider $provider created");
@@ -76,7 +75,6 @@ if (isset($_POST['edit_payment_provider'])) {
mysqli_query($mysqli,"UPDATE payment_providers SET payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_expense_percentage_fee = $percentage_fee, payment_provider_expense_flat_fee = $flat_fee WHERE payment_provider_id = $provider_id");
- // Logging
logAction("Payment Provider", "Edit", "$session_name edited Payment Provider $provider");
flash_alert("Payment Provider $provider edited");
@@ -89,13 +87,10 @@ if (isset($_GET['delete_payment_provider'])) {
$provider_id = intval($_GET['delete_payment_provider']);
- $sql = mysqli_query($mysqli,"SELECT payment_provider_name FROM payment_providers WHERE payment_provider_id = $provider_id");
- $row = mysqli_fetch_array($sql);
- $provider_name = sanitizeInput($row['payment_provider_name']);
+ $provider_name = sanitizeInput(getFieldById('provider_providers', $provider_id, 'provider_name'));
mysqli_query($mysqli,"DELETE FROM payment_providers WHERE payment_provider_id = $provider_id");
- // Logging
logAction("Payment Provider", "Delete", "$session_name deleted Payment Provider $provider_name");
flash_alert("Payment Provider $provider_name deleted", 'error');
diff --git a/admin/post/project_template.php b/admin/post/project_template.php
index b9ab35f9..747d78a1 100644
--- a/admin/post/project_template.php
+++ b/admin/post/project_template.php
@@ -11,7 +11,6 @@ if (isset($_POST['add_project_template'])) {
$project_template_id = mysqli_insert_id($mysqli);
- // Logging
logAction("Project Template", "Create", "$session_name created project template $name", 0, $project_template_id);
flash_alert("Project Template $name created");
@@ -28,12 +27,12 @@ if (isset($_POST['edit_project_template'])) {
mysqli_query($mysqli, "UPDATE project_templates SET project_template_name = '$name', project_template_description = '$description' WHERE project_template_id = $project_template_id");
- // Logging
logAction("Project Template", "Edit", "$session_name edited project template $name", 0, $project_template_id);
flash_alert("Project Template $name edited");
redirect();
+
}
if (isset($_POST['edit_ticket_template_order'])) {
@@ -45,6 +44,7 @@ if (isset($_POST['edit_ticket_template_order'])) {
mysqli_query($mysqli, "UPDATE project_template_ticket_templates SET ticket_template_order = $order WHERE ticket_template_id = $ticket_template_id AND project_template_id = $project_template_id");
redirect();
+
}
if (isset($_POST['add_ticket_template_to_project_template'])) {
@@ -55,12 +55,12 @@ if (isset($_POST['add_ticket_template_to_project_template'])) {
mysqli_query($mysqli, "INSERT INTO project_template_ticket_templates SET project_template_id = $project_template_id, ticket_template_id = $ticket_template_id, ticket_template_order = $order");
- // Logging
logAction("Project Template", "Edit", "$session_name added ticket template to project_template", 0, $project_template_id);
flash_alert("Ticket template added");
redirect();
+
}
if (isset($_POST['remove_ticket_template_from_project_template'])) {
@@ -71,32 +71,29 @@ if (isset($_POST['remove_ticket_template_from_project_template'])) {
mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE project_template_id = $project_template_id AND ticket_template_id = $ticket_template_id");
- // Logging
logAction("Project Template", "Edit", "$session_name removed ticket template from project template", 0, $project_template_id);
flash_alert("Ticket template removed", 'error');
redirect();
+
}
if (isset($_GET['delete_project_template'])) {
$project_template_id = intval($_GET['delete_project_template']);
- // Get project template name
- $sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id");
- $row = mysqli_fetch_array($sql);
- $project_template_name = sanitizeInput($row['project_template_name']);
+ $project_template_name = sanitizeInput(getFieldById('project_templates', $project_template_id, 'project_template_name'));
mysqli_query($mysqli, "DELETE FROM project_templates WHERE project_template_id = $project_template_id");
// Remove Associated Ticket Templates
mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE project_template_id = $project_template_id");
- // Logging
logAction("Project Template", "Delete", "$session_name deleted project template $project_template_name and its associated ticket templates and tasks");
flash_alert("Project Template $project_template_name and its associated ticket templates and tasks deleted", 'error');
redirect();
+
}
diff --git a/admin/post/roles.php b/admin/post/roles.php
index 48c74efe..928b10d6 100644
--- a/admin/post/roles.php
+++ b/admin/post/roles.php
@@ -18,7 +18,6 @@ if (isset($_POST['add_role'])) {
$role_id = mysqli_insert_id($mysqli);
- // Logging
logAction("User Role", "Create", "$session_name created user role $name", 0, $role_id);
flash_alert("User Role created");
@@ -31,7 +30,6 @@ if (isset($_POST['edit_role'])) {
validateCSRFToken($_POST['csrf_token']);
- // Update role metadata
$role_id = sanitizeInput($_POST['role_id']);
$name = sanitizeInput($_POST['role_name']);
$description = sanitizeInput($_POST['role_description']);
@@ -53,12 +51,12 @@ if (isset($_POST['edit_role'])) {
}
- // Logging
logAction("User Role", "Edit", "$session_name edited user role $name", 0, $role_id);
flash_alert("User Role $name edited");
redirect();
+
}
if (isset($_GET['archive_role'])) {
@@ -78,12 +76,12 @@ if (isset($_GET['archive_role'])) {
mysqli_query($mysqli, "UPDATE user_roles SET role_archived_at = NOW() WHERE role_id = $role_id");
- // Logging
- $role_details = mysqli_fetch_array(mysqli_query($mysqli, "SELECT role_name FROM user_roles WHERE role_id = $role_id LIMIT 1"));
- $role_name = sanitizeInput($role_details['role_name']);
+ $role_name = sanitizeInput(getFieldById('roles', $role_id, 'role_name'));
+
logAction("User Role", "Archive", "$session_name archived user role $role_name", 0, $role_id);
- flash_alert("User Role archived", 'error');
+ flash_alert("User Role $role_name archived", 'error');
redirect();
+
}
\ No newline at end of file
diff --git a/admin/post/settings_default.php b/admin/post/settings_default.php
index 2775e528..5edde815 100644
--- a/admin/post/settings_default.php
+++ b/admin/post/settings_default.php
@@ -24,4 +24,5 @@ if (isset($_POST['edit_default_settings'])) {
flash_alert("Default settings edited");
redirect();
+
}
diff --git a/admin/post/settings_mail.php b/admin/post/settings_mail.php
index e3c01668..dae79f25 100644
--- a/admin/post/settings_mail.php
+++ b/admin/post/settings_mail.php
@@ -112,9 +112,11 @@ if (isset($_POST['test_email_smtp'])) {
}
redirect();
+
}
if (isset($_POST['test_email_imap'])) {
+
validateCSRFToken($_POST['csrf_token']);
// Setup your IMAP connection parameters
@@ -136,4 +138,5 @@ if (isset($_POST['test_email_imap'])) {
}
redirect();
+
}
diff --git a/admin/post/settings_online_payment.php b/admin/post/settings_online_payment.php
index f14addf8..980f93e8 100644
--- a/admin/post/settings_online_payment.php
+++ b/admin/post/settings_online_payment.php
@@ -26,4 +26,5 @@ if (isset($_POST['edit_online_payment_settings'])) {
}
redirect();
+
}
diff --git a/admin/post/settings_online_payment_clients.php b/admin/post/settings_online_payment_clients.php
index 1da51c3f..a77a3b61 100644
--- a/admin/post/settings_online_payment_clients.php
+++ b/admin/post/settings_online_payment_clients.php
@@ -3,6 +3,7 @@
defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
if (isset($_GET['stripe_remove_pm'])) {
+
validateCSRFToken($_GET['csrf_token']);
if (!$config_stripe_enable) {
@@ -47,6 +48,7 @@ if (isset($_GET['stripe_remove_pm'])) {
}
if (isset($_GET['stripe_reset_customer'])) {
+
validateCSRFToken($_GET['csrf_token']);
$client_id = intval($_GET['client_id']);
diff --git a/admin/post/ticket_template.php b/admin/post/ticket_template.php
index a990bb48..eecd0d89 100644
--- a/admin/post/ticket_template.php
+++ b/admin/post/ticket_template.php
@@ -47,6 +47,7 @@ if (isset($_POST['edit_ticket_template'])) {
flash_alert("Ticket Template $name edited");
redirect();
+
}
if (isset($_GET['delete_ticket_template'])) {