From 654b5900330f301f2beab7a543ba52ab7ccec85e Mon Sep 17 00:00:00 2001 From: wrongecho Date: Sat, 28 Sep 2024 20:04:33 +0100 Subject: [PATCH 1/2] More enforcing user permissions --- client_asset_edit_modal.php | 2 +- client_asset_interface_edit_modal.php | 2 +- client_certificate_edit_modal.php | 2 +- client_domain_edit_modal.php | 2 +- client_location_edit_modal.php | 2 +- client_login_edit_modal.php | 2 +- client_logins.php | 34 ++++++++++--------- client_network_edit_modal.php | 2 +- client_rack_edit_modal.php | 2 +- client_service_edit_modal.php | 2 +- client_software_edit_modal.php | 2 +- invoice_edit_modal.php | 2 +- post/location.php | 4 +-- ...locations_model.php => location_model.php} | 0 post/login.php | 31 ++++++++++------- ...lient_logins_model.php => login_model.php} | 1 + post/network.php | 27 ++------------- post/network_model.php | 13 +++++++ post/quote.php | 32 ++++++++++++++++- quote.php | 32 ++++++++++------- quote_edit_modal.php | 2 +- quotes.php | 28 +++++++++------ recurring_ticket_edit_modal.php | 2 +- ticket_edit_modal.php | 2 +- 24 files changed, 136 insertions(+), 94 deletions(-) rename post/{client_locations_model.php => location_model.php} (100%) rename post/{client_logins_model.php => login_model.php} (84%) create mode 100644 post/network_model.php diff --git a/client_asset_edit_modal.php b/client_asset_edit_modal.php index 1d009d3a1..76645826f 100644 --- a/client_asset_edit_modal.php +++ b/client_asset_edit_modal.php @@ -37,7 +37,7 @@
-
+
>
diff --git a/client_asset_interface_edit_modal.php b/client_asset_interface_edit_modal.php index 301001a2d..62aef022b 100644 --- a/client_asset_interface_edit_modal.php +++ b/client_asset_interface_edit_modal.php @@ -12,7 +12,7 @@ -
+
>
diff --git a/client_certificate_edit_modal.php b/client_certificate_edit_modal.php index 19208e196..737ed6f9a 100644 --- a/client_certificate_edit_modal.php +++ b/client_certificate_edit_modal.php @@ -26,7 +26,7 @@
-
+
>
diff --git a/client_domain_edit_modal.php b/client_domain_edit_modal.php index e36f1c0e3..f7d27e989 100644 --- a/client_domain_edit_modal.php +++ b/client_domain_edit_modal.php @@ -26,7 +26,7 @@
-
+
>
diff --git a/client_location_edit_modal.php b/client_location_edit_modal.php index 7843c848a..24cd1591f 100644 --- a/client_location_edit_modal.php +++ b/client_location_edit_modal.php @@ -30,7 +30,7 @@
-
+
>
diff --git a/client_login_edit_modal.php b/client_login_edit_modal.php index fc935eb96..a89ac4cf9 100644 --- a/client_login_edit_modal.php +++ b/client_login_edit_modal.php @@ -26,7 +26,7 @@
-
+
>
diff --git a/client_logins.php b/client_logins.php index 012c90b1d..99d697bb2 100644 --- a/client_logins.php +++ b/client_logins.php @@ -49,7 +49,8 @@

Credentials

-
+ = 2) { ?> +
@@ -66,6 +67,7 @@
+
@@ -296,23 +298,23 @@ class="btn btn-)"> Share - + = 2) { ?> -
- - Unarchive - - -
- - Delete - - +
+ + Unarchive + + = 3) { ?> +
+ + Delete + + -
- - Archive - +
+ + Archive +
diff --git a/client_network_edit_modal.php b/client_network_edit_modal.php index 04b829f97..ad11d63fa 100644 --- a/client_network_edit_modal.php +++ b/client_network_edit_modal.php @@ -29,7 +29,7 @@
-
+
>
diff --git a/client_rack_edit_modal.php b/client_rack_edit_modal.php index 4f12eacc0..6b27e6895 100644 --- a/client_rack_edit_modal.php +++ b/client_rack_edit_modal.php @@ -26,7 +26,7 @@
-
+
>
diff --git a/client_service_edit_modal.php b/client_service_edit_modal.php index 5163845c7..c2fa6bd6f 100644 --- a/client_service_edit_modal.php +++ b/client_service_edit_modal.php @@ -28,7 +28,7 @@
-
+
>
diff --git a/client_software_edit_modal.php b/client_software_edit_modal.php index 96eb6617a..aeae4a392 100644 --- a/client_software_edit_modal.php +++ b/client_software_edit_modal.php @@ -32,7 +32,7 @@
-
+
>
diff --git a/invoice_edit_modal.php b/invoice_edit_modal.php index c69a28a44..ddf6a39ae 100644 --- a/invoice_edit_modal.php +++ b/invoice_edit_modal.php @@ -10,7 +10,7 @@
-
+
>
diff --git a/post/location.php b/post/location.php index 660133a4c..0b7cb3207 100644 --- a/post/location.php +++ b/post/location.php @@ -8,7 +8,7 @@ validateTechRole(); - require_once 'post/client_locations_model.php'; + require_once 'post/location_model.php'; if(!file_exists("uploads/clients/$client_id")) { @@ -67,7 +67,7 @@ validateTechRole(); - require_once 'post/client_locations_model.php'; + require_once 'post/location_model.php'; $location_id = intval($_POST['location_id']); diff --git a/post/client_locations_model.php b/post/location_model.php similarity index 100% rename from post/client_locations_model.php rename to post/location_model.php diff --git a/post/login.php b/post/login.php index 276b9d193..39e1da45d 100644 --- a/post/login.php +++ b/post/login.php @@ -6,10 +6,9 @@ if (isset($_POST['add_login'])) { - validateTechRole(); - - require_once 'post/client_logins_model.php'; + enforceUserPermission('module_credential', 2); + require_once 'post/login_model.php'; mysqli_query($mysqli,"INSERT INTO logins SET login_name = '$name', login_description = '$description', login_uri = '$uri', login_uri_2 = '$uri_2', login_username = '$username', login_password = '$password', login_otp_secret = '$otp_secret', login_note = '$note', login_important = $important, login_contact_id = $contact_id, login_vendor_id = $vendor_id, login_asset_id = $asset_id, login_software_id = $software_id, login_client_id = $client_id"); @@ -26,10 +25,9 @@ if (isset($_POST['edit_login'])) { - validateTechRole(); - - require_once 'post/client_logins_model.php'; + enforceUserPermission('module_credential', 2); + require_once 'post/login_model.php'; $login_id = intval($_POST['login_id']); @@ -55,7 +53,7 @@ if(isset($_GET['archive_login'])){ - validateTechRole(); + enforceUserPermission('module_credential', 2); $login_id = intval($_GET['archive_login']); @@ -79,6 +77,8 @@ if(isset($_GET['unarchive_login'])){ + enforceUserPermission('module_credential', 2); + $login_id = intval($_GET['unarchive_login']); // Get Name and Client ID for logging and alert message @@ -99,7 +99,7 @@ if (isset($_GET['delete_login'])) { - validateAdminRole(); + enforceUserPermission('module_credential', 3); $login_id = intval($_GET['delete_login']); @@ -128,7 +128,8 @@ } if (isset($_POST['bulk_archive_logins'])) { - validateAdminRole(); + + enforceUserPermission('module_credential', 2); validateCSRFToken($_POST['csrf_token']); $count = 0; // Default 0 @@ -166,7 +167,9 @@ } if (isset($_POST['bulk_unarchive_logins'])) { - validateAdminRole(); + + enforceUserPermission('module_credential', 2); + validateCSRFToken($_POST['csrf_token']); $count = 0; // Default 0 @@ -205,7 +208,9 @@ } if (isset($_POST['bulk_delete_logins'])) { - validateAdminRole(); + + enforceUserPermission('module_credential', 3); + validateCSRFToken($_POST['csrf_token']); $count = 0; // Default 0 @@ -250,7 +255,7 @@ if (isset($_POST['export_client_logins_csv'])) { - validateAdminRole(); + enforceUserPermission('module_credential'); $client_id = intval($_POST['client_id']); @@ -301,7 +306,7 @@ if (isset($_POST["import_client_logins_csv"])) { - validateTechRole(); + enforceUserPermission('module_credential', 2); $client_id = intval($_POST['client_id']); $file_name = $_FILES["file"]["tmp_name"]; diff --git a/post/client_logins_model.php b/post/login_model.php similarity index 84% rename from post/client_logins_model.php rename to post/login_model.php index 68731462d..1ef1f8c12 100644 --- a/post/client_logins_model.php +++ b/post/login_model.php @@ -1,4 +1,5 @@
- + = 2) { ?> @@ -160,9 +160,11 @@ Edit - - Copy - + = 2) { ?> + + Copy + +
Print @@ -178,10 +180,12 @@ "> Guest URL -
- - Delete - + = 3) { ?> +
+ + Delete + +
@@ -306,7 +310,7 @@ - + = 2) { ?>
+
@@ -200,19 +202,23 @@ Edit - - Copy - -
- - - Email + = 2) { ?> + + Copy -
+ +
+ + Email + + + = 3) { ?> +
+ + Delete + + - - Delete -
diff --git a/recurring_ticket_edit_modal.php b/recurring_ticket_edit_modal.php index 0811be8fa..923a42d2d 100644 --- a/recurring_ticket_edit_modal.php +++ b/recurring_ticket_edit_modal.php @@ -29,7 +29,7 @@ -
+
>
diff --git a/ticket_edit_modal.php b/ticket_edit_modal.php index 62f02cb61..12df899fc 100644 --- a/ticket_edit_modal.php +++ b/ticket_edit_modal.php @@ -38,7 +38,7 @@
-
+
>
From 928d723a7715b546c999abe1b3092f765c21eef5 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Sat, 28 Sep 2024 20:07:54 +0100 Subject: [PATCH 2/2] More enforcing user permissions --- post/location_model.php | 2 +- post/network_model.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/post/location_model.php b/post/location_model.php index 8c9cd80c6..ecfd7eaf2 100644 --- a/post/location_model.php +++ b/post/location_model.php @@ -11,4 +11,4 @@ $hours = sanitizeInput($_POST['hours']); $notes = sanitizeInput($_POST['notes']); $contact = intval($_POST['contact']); -$location_primary = intval($_POST['location_primary']); \ No newline at end of file +$location_primary = intval($_POST['location_primary']); diff --git a/post/network_model.php b/post/network_model.php index 673849d13..78839e11e 100644 --- a/post/network_model.php +++ b/post/network_model.php @@ -10,4 +10,4 @@ $dhcp_range = sanitizeInput($_POST['dhcp_range']); $notes = sanitizeInput($_POST['notes']); $location_id = intval($_POST['location']); -$client_id = intval($_POST['client_id']); \ No newline at end of file +$client_id = intval($_POST['client_id']);