From fc594814762c058f1967d90ad2ea624a3ad8af57 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 9 Jul 2026 16:17:00 -0400
Subject: [PATCH] Enforce Client Access in client selectbox

---
 agent/modals/invoice/invoice_add.php | 2 +-
 agent/modals/quote/quote_add.php     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/agent/modals/invoice/invoice_add.php b/agent/modals/invoice/invoice_add.php
index 8c969352..deebd27c 100644
--- a/agent/modals/invoice/invoice_add.php
+++ b/agent/modals/invoice/invoice_add.php
@@ -42,7 +42,7 @@ ob_start();
                         <option value="">- Client -</option>
                         <?php
                         //select unarchived clients
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = nullable_htmlentities($row['client_name']);
diff --git a/agent/modals/quote/quote_add.php b/agent/modals/quote/quote_add.php
index 1eb3d72b..667eb911 100644
--- a/agent/modals/quote/quote_add.php
+++ b/agent/modals/quote/quote_add.php
@@ -43,7 +43,7 @@ ob_start();
                         <?php
 
                         //select unarchived clients
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = nullable_htmlentities($row['client_name']);