diff --git a/admin/post/ai_model.php b/admin/post/ai_model.php index 127d1ccf..d975c8dc 100644 --- a/admin/post/ai_model.php +++ b/admin/post/ai_model.php @@ -19,7 +19,6 @@ if (isset($_POST['add_ai_model'])) { $ai_model_id = mysqli_insert_id($mysqli); - // Logging logAction("AI Model", "Create", "$session_name created AI Model $model"); flash_alert("AI Model $model created"); @@ -39,7 +38,6 @@ if (isset($_POST['edit_ai_model'])) { mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id"); - // Logging logAction("AI Model", "Edit", "$session_name edited AI Model $model"); flash_alert("AI Model $model edited"); @@ -54,13 +52,10 @@ if (isset($_GET['delete_ai_model'])) { $model_id = intval($_GET['delete_ai_model']); - $sql = mysqli_query($mysqli,"SELECT ai_model_name FROM ai_models WHERE ai_model_id = $model_id"); - $row = mysqli_fetch_array($sql); - $model_name = sanitizeInput($row['ai_model_name']); + $model_name = sanitizeInput(getFieldById('ai_models', $model_id, 'ai_model_name')); mysqli_query($mysqli,"DELETE FROM ai_models WHERE ai_model_id = $model_id"); - // Logging logAction("AI Model", "Delete", "$session_name deleted AI Model $model_name"); flash_alert("AI Model $model_name deleted", 'error'); diff --git a/admin/post/ai_provider.php b/admin/post/ai_provider.php index 3a3692c7..3661da61 100644 --- a/admin/post/ai_provider.php +++ b/admin/post/ai_provider.php @@ -15,12 +15,10 @@ if (isset($_POST['add_ai_provider'])) { $model = sanitizeInput($_POST['model']); $api_key = sanitizeInput($_POST['api_key']); - mysqli_query($mysqli,"INSERT INTO ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key'"); $ai_provider_id = mysqli_insert_id($mysqli); - // Logging logAction("AI Provider", "Create", "$session_name created AI Provider $provider"); flash_alert("AI Model $provider created"); @@ -40,7 +38,6 @@ if (isset($_POST['edit_ai_provider'])) { mysqli_query($mysqli,"UPDATE ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key' WHERE ai_provider_id = $provider_id"); - // Logging logAction("AI Provider", "Edit", "$session_name edited AI Provider $provider"); flash_alert("AI Model $provider edited"); @@ -55,14 +52,11 @@ if (isset($_GET['delete_ai_provider'])) { $provider_id = intval($_GET['delete_ai_provider']); - $sql = mysqli_query($mysqli,"SELECT ai_provider_name FROM ai_providers WHERE ai_provider_id = $provider_id"); - $row = mysqli_fetch_array($sql); - $provider_name = sanitizeInput($row['ai_provider_name']); + $provider_name = sanitizeInput(getFieldById('ai_providers', $provider_id, 'ai_provider_name')); mysqli_query($mysqli,"DELETE FROM ai_providers WHERE ai_provider_id = $provider_id"); - // Logging - logAction("AI Provider", "Delete", "$session_name deleted AI Provider $provider_name"); + logAction("AI Provider", "Delete", "$session_name deleted AI Provider $provider_name", 'error'); flash_alert("AI Provider $provider_name deleted", 'error'); diff --git a/admin/post/api_keys.php b/admin/post/api_keys.php index f1ffac30..d7c75186 100644 --- a/admin/post/api_keys.php +++ b/admin/post/api_keys.php @@ -23,7 +23,6 @@ if (isset($_POST['add_api_key'])) { $api_key_id = mysqli_insert_id($mysqli); - // Logging logAction("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id); flash_alert("API Key $name created"); @@ -45,7 +44,6 @@ if (isset($_GET['delete_api_key'])) { mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id"); - // Logging logAction("API Key", "Delete", "$session_name deleted API key $name", $client_id); flash_alert("API Key $name deleted", 'error'); @@ -74,12 +72,10 @@ if (isset($_POST['bulk_delete_api_keys'])) { mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); - // Logging logAction("API Key", "Delete", "$session_name deleted API key $name", $client_id); } - // Logging logAction("API Key", "Bulk Delete", "$session_name deleted $count API key(s)"); flash_alert("Deleted $count API keys(s)", 'error'); @@ -87,4 +83,5 @@ if (isset($_POST['bulk_delete_api_keys'])) { } redirect(); + } diff --git a/admin/post/backup.php b/admin/post/backup.php index b4b36bd5..11f133cd 100644 --- a/admin/post/backup.php +++ b/admin/post/backup.php @@ -192,10 +192,8 @@ if (isset($_POST['backup_master_key'])) { if (password_verify($password, $row['user_password'])) { $site_encryption_master_key = decryptUserSpecificKey($row['user_specific_encryption_ciphertext'], $password); - // Logging logAction("Master Key", "Download", "$session_name retrieved the master encryption key"); - // App Notify appNotify("Master Key", "$session_name retrieved the master encryption key"); echo "=============================="; @@ -204,7 +202,6 @@ if (isset($_POST['backup_master_key'])) { echo "
=============================="; } else { - // Log the failure logAction("Master Key", "Download", "$session_name attempted to retrieve the master encryption key but failed"); flash_alert("Incorrect password.", 'error'); diff --git a/admin/post/category.php b/admin/post/category.php index 470d579f..070744dc 100644 --- a/admin/post/category.php +++ b/admin/post/category.php @@ -14,7 +14,6 @@ if (isset($_POST['add_category'])) { $category_id = mysqli_insert_id($mysqli); - // Logging logAction("Category", "Create", "$session_name created category $type $name", 0, $category_id); flash_alert("Category $type $name created"); @@ -31,7 +30,6 @@ if (isset($_POST['edit_category'])) { mysqli_query($mysqli,"UPDATE categories SET category_name = '$name', category_type = '$type', category_color = '$color' WHERE category_id = $category_id"); - // Logging logAction("Category", "Edit", "$session_name edited category $type $name", 0, $category_id); flash_alert("Category $type $name edited"); @@ -52,7 +50,6 @@ if (isset($_GET['archive_category'])) { mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NOW() WHERE category_id = $category_id"); - // Logging logAction("Category", "Archive", "$session_name archived category $category_type $category_name", 0, $category_id); flash_alert("Category $category_type $category_name archived", 'error'); @@ -73,7 +70,6 @@ if (isset($_GET['unarchive_category'])) { mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NULL WHERE category_id = $category_id"); - // Logging logAction("Category", "Unarchive", "$session_name unarchived category $category_type $category_name", 0, $category_id); flash_alert("Category $category_type $category_name unarchived"); @@ -94,7 +90,6 @@ if (isset($_GET['delete_category'])) { mysqli_query($mysqli,"DELETE FROM categories WHERE category_id = $category_id"); - // Logging logAction("Category", "Delete", "$session_name deleted category $category_type $category_name"); flash_alert("Category $category_type $category_name deleted", 'error'); diff --git a/admin/post/custom_field.php b/admin/post/custom_field.php index 5751ce4d..4c4897d6 100644 --- a/admin/post/custom_field.php +++ b/admin/post/custom_field.php @@ -16,7 +16,6 @@ if(isset($_POST['create_custom_field'])){ $custom_field_id = mysqli_insert_id($mysqli); - // Logging logAction("Custom Field", "Create", "$session_name created custom field $label", 0, $custom_field_id); flash_alert("Custom field $label created"); @@ -33,7 +32,6 @@ if(isset($_POST['edit_custom_field'])){ mysqli_query($mysqli,"UPDATE custom_fields SET custom_field_label = '$label', custom_field_type = '$type' WHERE custom_field_id = $custom_field_id"); - // Logging logAction("Custom Field", "Edit", "$session_name edited custom field $label", 0, $custom_field_id); flash_alert("Custom field $label edited"); @@ -43,19 +41,15 @@ if(isset($_POST['edit_custom_field'])){ } if(isset($_GET['delete_custom_field'])){ + $custom_field_id = intval($_GET['delete_custom_field']); - // Get Custom Field Label for logging - $sql = mysqli_query($mysqli,"SELECT custom_field_label FROM custom_fields WHERE custom_field_id = $custom_field_id"); - $row = mysqli_fetch_array($sql); - $custom_field_label = sanitizeInput($row['custom_field_label']); + $label = sanitizeInput(getFieldById('custom_fields', $custom_field_id, 'custom_field_label')); mysqli_query($mysqli,"DELETE FROM custom_fields WHERE custom_field_id = $custom_field_id"); - // Logging logAction("Custom Field", "Delete", "$session_name deleted custom field $label"); - $_SESSION['alert_type'] = "error"; flash_alert("Custom field $label deleted", 'error'); redirect(); diff --git a/admin/post/custom_link.php b/admin/post/custom_link.php index 26ec09d2..5ecf4710 100644 --- a/admin/post/custom_link.php +++ b/admin/post/custom_link.php @@ -19,7 +19,6 @@ if (isset($_POST['add_custom_link'])) { $custom_link_id = mysqli_insert_id($mysqli); - // Logging logAction("Custom Link", "Create", "$session_name created custom link $name -> $uri", 0, $custom_link_id); flash_alert("Custom link $name created"); @@ -40,7 +39,6 @@ if (isset($_POST['edit_custom_link'])) { mysqli_query($mysqli,"UPDATE custom_links SET custom_link_name = '$name', custom_link_uri = '$uri', custom_link_new_tab = $new_tab, custom_link_icon = '$icon', custom_link_order = $order, custom_link_location = $location WHERE custom_link_id = $custom_link_id"); - // Logging logAction("Custom Link", "Edit", "$session_name edited custom link $name -> $uri", 0, $custom_link_id); flash_alert("Custom Link $name edited"); @@ -50,6 +48,7 @@ if (isset($_POST['edit_custom_link'])) { } if (isset($_GET['delete_custom_link'])) { + $custom_link_id = intval($_GET['delete_custom_link']); // Get Custom Link name and uri for logging @@ -60,7 +59,6 @@ if (isset($_GET['delete_custom_link'])) { mysqli_query($mysqli,"DELETE FROM custom_links WHERE custom_link_id = $custom_link_id"); - // Logging logAction("Custom Link", "Delete", "$session_name deleted custom link $custom_link_name -> $custom_link_uri"); flash_alert("Custom Link $name deleted", 'error'); diff --git a/admin/post/document_template.php b/admin/post/document_template.php index b0bd8094..2dbbb3b9 100644 --- a/admin/post/document_template.php +++ b/admin/post/document_template.php @@ -10,12 +10,10 @@ if (isset($_POST['add_document_template'])) { $description = sanitizeInput($_POST['description']); $content = mysqli_real_escape_string($mysqli,$_POST['content']); - // Document create query mysqli_query($mysqli,"INSERT INTO document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$content', document_template_created_by = $session_user_id"); $document_template_id = mysqli_insert_id($mysqli); - // Logging logAction("Document Template", "Create", "$session_name created document template $name", 0, $document_template_id); flash_alert("Document template $name created"); @@ -34,7 +32,6 @@ if (isset($_POST['edit_document_template'])) { // Document edit query mysqli_query($mysqli,"UPDATE document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$content', document_template_updated_by = $session_user_id WHERE document_template_id = $document_template_id"); - // Logging logAction("Document Template", "Edit", "$session_name edited document template $name", 0, $document_template_id); flash_alert("Document Template $name edited"); @@ -47,14 +44,10 @@ if (isset($_GET['delete_document_template'])) { $document_template_id = intval($_GET['delete_document_template']); - // Get Document Template Name for logging - $sql = mysqli_query($mysqli,"SELECT document_template_name FROM document_templates WHERE document_template_id = $document_template_id"); - $row = mysqli_fetch_array($sql); - $document_template_name = sanitizeInput($row['document_template_name']); + $document_template_name = sanitizeInput(getFieldById('document_templates', $document_template_id, 'document_template_name')); mysqli_query($mysqli,"DELETE FROM document_templates WHERE document_template_id = $document_template_id"); - //Logging logAction("Document Template", "Delete", "$session_name deleted document template $document_template_name"); flash_alert("Document Template $document_template_name deleted", 'error'); diff --git a/admin/post/identity_provider.php b/admin/post/identity_provider.php index 8d444221..688facf8 100644 --- a/admin/post/identity_provider.php +++ b/admin/post/identity_provider.php @@ -11,7 +11,6 @@ if (isset($_POST['edit_identity_provider'])) { mysqli_query($mysqli,"UPDATE settings SET config_azure_client_id = '$azure_client_id', config_azure_client_secret = '$azure_client_secret' WHERE company_id = 1"); - // Logging logAction("Settings", "Edit", "$session_name edited identity provider settings"); flash_alert("Identity Provider Settings updated"); diff --git a/admin/post/mail_queue.php b/admin/post/mail_queue.php index d7c89c24..3270fad1 100644 --- a/admin/post/mail_queue.php +++ b/admin/post/mail_queue.php @@ -8,7 +8,6 @@ if (isset($_GET['send_failed_mail'])) { mysqli_query($mysqli,"UPDATE email_queue SET email_status = 0, email_attempts = 3 WHERE email_id = $email_id"); - // Logging logAction("Email", "Send", "$session_name attempted to force send email id: $email_id in the mail queue", 0, $email_id); flash_alert("Email Force Sent, give it a minute to resend"); @@ -23,7 +22,6 @@ if (isset($_GET['cancel_mail'])) { mysqli_query($mysqli,"UPDATE email_queue SET email_status = 2, email_attempts = 99, email_failed_at = NOW() WHERE email_id = $email_id"); - // Logging logAction("Email", "Send", "$session_name canceled send email id: $email_id in the mail queue", 0, $email_id); flash_alert("Email cancelled and marked as failed.", 'error'); @@ -46,12 +44,10 @@ if (isset($_POST['bulk_cancel_emails'])) { $email_id = intval($email_id); mysqli_query($mysqli,"UPDATE email_queue SET email_status = 2, email_attempts = 99, email_failed_at = NOW() WHERE email_id = $email_id"); - // Logging logAction("Email", "Cancel", "$session_name cancelled email id: $email_id in the mail queue", 0, $email_id); } - // Logging logAction("Email", "Bulk Cancel", "$session_name cancelled $count email(s) in the mail queue"); flash_alert("Cancelled $count email(s)", 'error'); @@ -59,6 +55,7 @@ if (isset($_POST['bulk_cancel_emails'])) { } redirect(); + } if (isset($_POST['bulk_delete_emails'])) { @@ -75,12 +72,10 @@ if (isset($_POST['bulk_delete_emails'])) { $email_id = intval($email_id); mysqli_query($mysqli,"DELETE FROM email_queue WHERE email_id = $email_id"); - // Logging logAction("Email", "Delete", "$session_name deleted email id: $email_id from the mail queue"); } - // Logging logAction("Email", "Bulk Delete", "$session_name deleted $count email(s) from the mail queue"); flash_alert("Deleted $count email(s)", 'error'); @@ -88,4 +83,5 @@ if (isset($_POST['bulk_delete_emails'])) { } redirect(); + } diff --git a/admin/post/payment_method.php b/admin/post/payment_method.php index 0df6e94c..3de1f4f7 100644 --- a/admin/post/payment_method.php +++ b/admin/post/payment_method.php @@ -15,7 +15,6 @@ if (isset($_POST['add_payment_method'])) { mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$name', payment_method_description = '$description'"); - // Logging logAction("Payment Method", "Create", "$session_name created Payment Method $name"); flash_alert("Payment Method $name created"); @@ -34,7 +33,6 @@ if (isset($_POST['edit_payment_method'])) { mysqli_query($mysqli,"UPDATE payment_methods SET payment_method_name = '$name', payment_method_description = '$description' WHERE payment_method_id = $payment_method_id"); - // Logging logAction("Payment Method", "Edit", "$session_name edited Payment Method $name"); flash_alert("Payment Method $name edited"); @@ -47,13 +45,10 @@ if (isset($_GET['delete_payment_method'])) { $payment_method_id = intval($_GET['delete_payment_method']); - $sql = mysqli_query($mysqli,"SELECT payment_method_name FROM payment_methods WHERE payment_method_id = $payment_method_id"); - $row = mysqli_fetch_array($sql); - $payment_method_name = sanitizeInput($row['payment_method_name']); + $payment_method_name = sanitizeInput(getFieldById('payment_methods', $payment_method_is, 'payment_method_name')); mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id"); - // Logging logAction("Payment Method", "Delete", "$session_name deleted Payment Method $payment_method_name"); flash_alert("Payment Method $payment_method_name deleted", 'error'); diff --git a/admin/post/payment_provider.php b/admin/post/payment_provider.php index e84499e7..603bccc1 100644 --- a/admin/post/payment_provider.php +++ b/admin/post/payment_provider.php @@ -52,7 +52,6 @@ if (isset($_POST['add_payment_provider'])) { $provider_id = mysqli_insert_id($mysqli); - // Logging logAction("Payment Provider", "Create", "$session_name created AI Provider $provider"); flash_alert("Payment provider $provider created"); @@ -76,7 +75,6 @@ if (isset($_POST['edit_payment_provider'])) { mysqli_query($mysqli,"UPDATE payment_providers SET payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_expense_percentage_fee = $percentage_fee, payment_provider_expense_flat_fee = $flat_fee WHERE payment_provider_id = $provider_id"); - // Logging logAction("Payment Provider", "Edit", "$session_name edited Payment Provider $provider"); flash_alert("Payment Provider $provider edited"); @@ -89,13 +87,10 @@ if (isset($_GET['delete_payment_provider'])) { $provider_id = intval($_GET['delete_payment_provider']); - $sql = mysqli_query($mysqli,"SELECT payment_provider_name FROM payment_providers WHERE payment_provider_id = $provider_id"); - $row = mysqli_fetch_array($sql); - $provider_name = sanitizeInput($row['payment_provider_name']); + $provider_name = sanitizeInput(getFieldById('provider_providers', $provider_id, 'provider_name')); mysqli_query($mysqli,"DELETE FROM payment_providers WHERE payment_provider_id = $provider_id"); - // Logging logAction("Payment Provider", "Delete", "$session_name deleted Payment Provider $provider_name"); flash_alert("Payment Provider $provider_name deleted", 'error'); diff --git a/admin/post/project_template.php b/admin/post/project_template.php index b9ab35f9..747d78a1 100644 --- a/admin/post/project_template.php +++ b/admin/post/project_template.php @@ -11,7 +11,6 @@ if (isset($_POST['add_project_template'])) { $project_template_id = mysqli_insert_id($mysqli); - // Logging logAction("Project Template", "Create", "$session_name created project template $name", 0, $project_template_id); flash_alert("Project Template $name created"); @@ -28,12 +27,12 @@ if (isset($_POST['edit_project_template'])) { mysqli_query($mysqli, "UPDATE project_templates SET project_template_name = '$name', project_template_description = '$description' WHERE project_template_id = $project_template_id"); - // Logging logAction("Project Template", "Edit", "$session_name edited project template $name", 0, $project_template_id); flash_alert("Project Template $name edited"); redirect(); + } if (isset($_POST['edit_ticket_template_order'])) { @@ -45,6 +44,7 @@ if (isset($_POST['edit_ticket_template_order'])) { mysqli_query($mysqli, "UPDATE project_template_ticket_templates SET ticket_template_order = $order WHERE ticket_template_id = $ticket_template_id AND project_template_id = $project_template_id"); redirect(); + } if (isset($_POST['add_ticket_template_to_project_template'])) { @@ -55,12 +55,12 @@ if (isset($_POST['add_ticket_template_to_project_template'])) { mysqli_query($mysqli, "INSERT INTO project_template_ticket_templates SET project_template_id = $project_template_id, ticket_template_id = $ticket_template_id, ticket_template_order = $order"); - // Logging logAction("Project Template", "Edit", "$session_name added ticket template to project_template", 0, $project_template_id); flash_alert("Ticket template added"); redirect(); + } if (isset($_POST['remove_ticket_template_from_project_template'])) { @@ -71,32 +71,29 @@ if (isset($_POST['remove_ticket_template_from_project_template'])) { mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE project_template_id = $project_template_id AND ticket_template_id = $ticket_template_id"); - // Logging logAction("Project Template", "Edit", "$session_name removed ticket template from project template", 0, $project_template_id); flash_alert("Ticket template removed", 'error'); redirect(); + } if (isset($_GET['delete_project_template'])) { $project_template_id = intval($_GET['delete_project_template']); - // Get project template name - $sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id"); - $row = mysqli_fetch_array($sql); - $project_template_name = sanitizeInput($row['project_template_name']); + $project_template_name = sanitizeInput(getFieldById('project_templates', $project_template_id, 'project_template_name')); mysqli_query($mysqli, "DELETE FROM project_templates WHERE project_template_id = $project_template_id"); // Remove Associated Ticket Templates mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE project_template_id = $project_template_id"); - // Logging logAction("Project Template", "Delete", "$session_name deleted project template $project_template_name and its associated ticket templates and tasks"); flash_alert("Project Template $project_template_name and its associated ticket templates and tasks deleted", 'error'); redirect(); + } diff --git a/admin/post/roles.php b/admin/post/roles.php index 48c74efe..928b10d6 100644 --- a/admin/post/roles.php +++ b/admin/post/roles.php @@ -18,7 +18,6 @@ if (isset($_POST['add_role'])) { $role_id = mysqli_insert_id($mysqli); - // Logging logAction("User Role", "Create", "$session_name created user role $name", 0, $role_id); flash_alert("User Role created"); @@ -31,7 +30,6 @@ if (isset($_POST['edit_role'])) { validateCSRFToken($_POST['csrf_token']); - // Update role metadata $role_id = sanitizeInput($_POST['role_id']); $name = sanitizeInput($_POST['role_name']); $description = sanitizeInput($_POST['role_description']); @@ -53,12 +51,12 @@ if (isset($_POST['edit_role'])) { } - // Logging logAction("User Role", "Edit", "$session_name edited user role $name", 0, $role_id); flash_alert("User Role $name edited"); redirect(); + } if (isset($_GET['archive_role'])) { @@ -78,12 +76,12 @@ if (isset($_GET['archive_role'])) { mysqli_query($mysqli, "UPDATE user_roles SET role_archived_at = NOW() WHERE role_id = $role_id"); - // Logging - $role_details = mysqli_fetch_array(mysqli_query($mysqli, "SELECT role_name FROM user_roles WHERE role_id = $role_id LIMIT 1")); - $role_name = sanitizeInput($role_details['role_name']); + $role_name = sanitizeInput(getFieldById('roles', $role_id, 'role_name')); + logAction("User Role", "Archive", "$session_name archived user role $role_name", 0, $role_id); - flash_alert("User Role archived", 'error'); + flash_alert("User Role $role_name archived", 'error'); redirect(); + } \ No newline at end of file diff --git a/admin/post/settings_default.php b/admin/post/settings_default.php index 2775e528..5edde815 100644 --- a/admin/post/settings_default.php +++ b/admin/post/settings_default.php @@ -24,4 +24,5 @@ if (isset($_POST['edit_default_settings'])) { flash_alert("Default settings edited"); redirect(); + } diff --git a/admin/post/settings_mail.php b/admin/post/settings_mail.php index e3c01668..dae79f25 100644 --- a/admin/post/settings_mail.php +++ b/admin/post/settings_mail.php @@ -112,9 +112,11 @@ if (isset($_POST['test_email_smtp'])) { } redirect(); + } if (isset($_POST['test_email_imap'])) { + validateCSRFToken($_POST['csrf_token']); // Setup your IMAP connection parameters @@ -136,4 +138,5 @@ if (isset($_POST['test_email_imap'])) { } redirect(); + } diff --git a/admin/post/settings_online_payment.php b/admin/post/settings_online_payment.php index f14addf8..980f93e8 100644 --- a/admin/post/settings_online_payment.php +++ b/admin/post/settings_online_payment.php @@ -26,4 +26,5 @@ if (isset($_POST['edit_online_payment_settings'])) { } redirect(); + } diff --git a/admin/post/settings_online_payment_clients.php b/admin/post/settings_online_payment_clients.php index 1da51c3f..a77a3b61 100644 --- a/admin/post/settings_online_payment_clients.php +++ b/admin/post/settings_online_payment_clients.php @@ -3,6 +3,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); if (isset($_GET['stripe_remove_pm'])) { + validateCSRFToken($_GET['csrf_token']); if (!$config_stripe_enable) { @@ -47,6 +48,7 @@ if (isset($_GET['stripe_remove_pm'])) { } if (isset($_GET['stripe_reset_customer'])) { + validateCSRFToken($_GET['csrf_token']); $client_id = intval($_GET['client_id']); diff --git a/admin/post/ticket_template.php b/admin/post/ticket_template.php index a990bb48..eecd0d89 100644 --- a/admin/post/ticket_template.php +++ b/admin/post/ticket_template.php @@ -47,6 +47,7 @@ if (isset($_POST['edit_ticket_template'])) { flash_alert("Ticket Template $name edited"); redirect(); + } if (isset($_GET['delete_ticket_template'])) {