Skip to content

Commit 64f3df6

Browse files
johnnyqjohnnyq
committed
Add Some Client Permission Checks to the new Global View and some tidying
1 parent ab3ffdf commit 64f3df6

13 files changed

Lines changed: 36 additions & 33 deletions

‎asset_details.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
$client_url = '';
1212
}
1313

14-
1514
if (isset($_GET['asset_id'])) {
1615
$asset_id = intval($_GET['asset_id']);
1716

@@ -25,7 +24,7 @@
2524
");
2625

2726
$row = mysqli_fetch_array($sql);
28-
$client_id = intval($row['asset_client_id']);
27+
$client_id = intval($row['client_id']);
2928
$client_name = nullable_htmlentities($row['client_name']);
3029
$asset_id = intval($row['asset_id']);
3130
$asset_type = nullable_htmlentities($row['asset_type']);

‎assets.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,13 @@
6666
SUM(CASE WHEN asset_type IN ('Firewall/Router', 'switch', 'access point') THEN 1 ELSE 0 END) AS network_count,
6767
SUM(CASE WHEN asset_type NOT IN ('laptop', 'desktop', 'server', 'virtual machine', 'Firewall/Router', 'switch', 'access point') THEN 1 ELSE 0 END) AS other_count
6868
FROM (
69-
SELECT assets.* FROM assets
69+
SELECT assets.* FROM assets
70+
LEFT JOIN clients ON client_id = asset_client_id
7071
LEFT JOIN contacts ON asset_contact_id = contact_id
7172
LEFT JOIN locations ON asset_location_id = location_id
7273
LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
7374
WHERE asset_$archive_query
75+
$access_permission_query
7476
$client_query
7577
) AS filtered_assets;
7678
"));
@@ -106,8 +108,10 @@
106108
WHERE asset_$archive_query
107109
AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%')
108110
AND ($type_query)
111+
$access_permission_query
109112
$location_query
110113
$client_query
114+
111115
ORDER BY $sort $order LIMIT $record_from, $record_to"
112116
);
113117

@@ -226,7 +230,7 @@
226230
<option value="" <?php if ($client == "") { echo "selected"; } ?>>- All Clients -</option>
227231

228232
<?php
229-
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
233+
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
230234
while ($row = mysqli_fetch_array($sql_clients_filter)) {
231235
$client_id = intval($row['client_id']);
232236
$client_name = nullable_htmlentities($row['client_name']);

‎certificates.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
LEFT JOIN clients ON client_id = certificate_client_id
2626
WHERE certificate_archived_at IS NULL
2727
AND (certificate_name LIKE '%$q%' OR certificate_domain LIKE '%$q%' OR certificate_issued_by LIKE '%$q%' OR client_name LIKE '%$q%')
28+
$access_permission_query
2829
$client_query
2930
ORDER BY $sort $order LIMIT $record_from, $record_to"
3031
);

‎check_login.php‎

Lines changed: 13 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -77,30 +77,22 @@
7777
// Set Currency Format
7878
$currency_format = numfmt_create($session_company_locale, NumberFormatter::CURRENCY);
7979

80+
// Get User Client Access Permissions
81+
$user_client_access_sql = "SELECT client_id FROM user_permissions WHERE user_id = $session_user_id";
82+
$user_client_access_result = mysqli_query($mysqli, $user_client_access_sql);
8083

81-
try {
82-
// Get User Client Access Permissions
83-
$user_client_access_sql = "SELECT client_id FROM user_permissions WHERE user_id = $session_user_id";
84-
$user_client_access_result = mysqli_query($mysqli, $user_client_access_sql);
85-
86-
$client_access_array = [];
87-
while ($row = mysqli_fetch_assoc($user_client_access_result)) {
88-
$client_access_array[] = $row['client_id'];
89-
}
90-
91-
$client_access_string = implode(',', $client_access_array);
84+
$client_access_array = [];
85+
while ($row = mysqli_fetch_assoc($user_client_access_result)) {
86+
$client_access_array[] = $row['client_id'];
87+
}
9288

93-
// Client access permission check
94-
// Default allow, if a list of allowed clients is set & the user isn't an admin, restrict them
95-
$access_permission_query = "";
96-
if ($client_access_string && !$session_is_admin) {
97-
$access_permission_query = "AND clients.client_id IN ($client_access_string)";
98-
}
89+
$client_access_string = implode(',', $client_access_array);
9990

100-
} catch (Exception $e) {
101-
// Handle exception
102-
error_log('MySQL error: ' . $e->getMessage());
103-
$access_permission_query = ""; // Ensure safe default if query fails
91+
// Client access permission check
92+
// Default allow, if a list of allowed clients is set & the user isn't an admin, restrict them
93+
$access_permission_query = "";
94+
if ($client_access_string && !$session_is_admin) {
95+
$access_permission_query = "AND clients.client_id IN ($client_access_string)";
10496
}
10597

10698
// Include the settings vars

‎contacts.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@
6565
WHERE contact_$archive_query
6666
$tag_query
6767
AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
68+
$access_permission_query
6869
$client_query
6970
$location_query
7071
GROUP BY contact_id
@@ -158,7 +159,7 @@
158159
<option value="" <?php if ($client == "") { echo "selected"; } ?>>- All Clients -</option>
159160

160161
<?php
161-
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
162+
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
162163
while ($row = mysqli_fetch_array($sql_clients_filter)) {
163164
$client_id = intval($row['client_id']);
164165
$client_name = nullable_htmlentities($row['client_name']);

‎credentials.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@
7474
$tag_query
7575
AND (l.login_name LIKE '%$q%' OR l.login_description LIKE '%$q%' OR l.login_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
7676
$location_query
77+
$access_permission_query
7778
$client_query
7879
GROUP BY l.login_id
7980
ORDER BY l.login_important DESC, $sort $order LIMIT $record_from, $record_to"
@@ -151,7 +152,7 @@
151152
<option value="" <?php if ($client == "") { echo "selected"; } ?>>- All Clients -</option>
152153

153154
<?php
154-
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
155+
$sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
155156
while ($row = mysqli_fetch_array($sql_clients_filter)) {
156157
$client_id = intval($row['client_id']);
157158
$client_name = nullable_htmlentities($row['client_name']);

‎domains.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,9 @@
3232
LEFT JOIN vendors AS dnshost ON domains.domain_dnshost = dnshost.vendor_id
3333
LEFT JOIN vendors AS mailhost ON domains.domain_mailhost = mailhost.vendor_id
3434
LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
35+
WHERE (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR dnshost.vendor_name LIKE '%$q%' OR mailhost.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
3536
AND domain_$archive_query
36-
AND (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR dnshost.vendor_name LIKE '%$q%' OR mailhost.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
37+
$access_permission_query
3738
$client_query
3839
ORDER BY $sort $order LIMIT $record_from, $record_to");
3940

@@ -43,7 +44,7 @@
4344

4445
<div class="card card-dark">
4546
<div class="card-header py-2">
46-
<h3 class="card-title mt-2"><i class="fa fa-fw fa-globe mr-2"></i>Domain Management</h3>
47+
<h3 class="card-title mt-2"><i class="fa fa-fw fa-globe mr-2"></i>Domains</h3>
4748
<div class="card-tools">
4849
<div class="btn-group">
4950
<button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addDomainModal"><i class="fas fa-plus mr-2"></i>New Domain</button>

‎global_search.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,8 @@
9393

9494
$sql_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM scheduled_tickets
9595
LEFT JOIN clients ON scheduled_ticket_client_id = client_id
96-
WHERE scheduled_ticket_subject LIKE '%$query%'
97-
OR scheduled_ticket_details LIKE '%$query%'
96+
WHERE (scheduled_ticket_subject LIKE '%$query%'
97+
OR scheduled_ticket_details LIKE '%$query%')
9898
$access_permission_query
9999
ORDER BY scheduled_ticket_id DESC LIMIT 5"
100100
);

‎includes/get_side_nav_counts.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
$num_active_clients = $row['num'];
77

88
// Active Ticket Count
9-
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4"));
9+
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 $access_permission_query"));
1010
$num_active_tickets = $row['num'];
1111

1212
// Recurring Ticket Count
13-
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('scheduled_ticket_id') AS num FROM scheduled_tickets"));
13+
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('scheduled_ticket_id') AS num FROM scheduled_tickets LEFT JOIN clients ON client_id = scheduled_ticket_client_id WHERE 1 = 1 $access_permission_query"));
1414
$num_recurring_tickets = $row['num'];
1515

1616
// Active Project Count

‎locations.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
WHERE location_$archive_query
4444
$tag_query
4545
AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
46+
$access_permission_query
4647
$client_query
4748
GROUP BY location_id
4849
ORDER BY location_primary DESC, $sort $order LIMIT $record_from, $record_to"

0 commit comments

Comments
 (0)