Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More enforcing user permissions #1072

Merged
merged 2 commits into from
Sep 29, 2024
Merged

More enforcing user permissions #1072

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
654b590
More enforcing user permissions
Sep 28, 2024
928d723
More enforcing user permissions
Sep 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion client_asset_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-details<?php echo $asset_id; ?>">

Expand Down
2 changes: 1 addition & 1 deletion client_asset_interface_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
<input type="hidden" name="interface_id" value="<?php echo $interface_id; ?>">

<div class="modal-body bg-white">
<div class="modal-body bg-white" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="form-group">
<label>Interface Name</label>
Expand Down
2 changes: 1 addition & 1 deletion client_certificate_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pillsEditDetails">

Expand Down
2 changes: 1 addition & 1 deletion client_domain_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-overview">

Expand Down
2 changes: 1 addition & 1 deletion client_location_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_client') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-details<?php echo $location_id; ?>">

Expand Down
2 changes: 1 addition & 1 deletion client_login_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_credential') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-details<?php echo $login_id; ?>">

Expand Down
34 changes: 18 additions & 16 deletions client_logins.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,8 @@
<div class="card-header py-2">
<h3 class="card-title mt-2"><i class="fa fa-fw fa-key mr-2"></i>Credentials</h3>
<div class="card-tools">
<div class="btn-group">
<?php if (lookupUserPermission("module_credential") >= 2) { ?>
<div class="btn-group">
<button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addLoginModal" <?php if (!isset($_COOKIE['user_encryption_session_key'])) { echo "disabled"; } ?>>
<i class="fas fa-plus mr-2"></i>New Credential
</button>
Expand All @@ -66,6 +67,7 @@
<?php } ?>
</div>
</div>
<?php } ?>
</div>
</div>
<div class="card-body">
Expand Down Expand Up @@ -296,23 +298,23 @@ class="btn btn-<?php if($archived == 1){ echo "primary"; } else { echo "default"
<a class="dropdown-item" href="#" data-toggle="modal" data-target="#shareModal" onclick="populateShareModal(<?php echo "$client_id, 'Login', $login_id"; ?>)">
<i class="fas fa-fw fa-share mr-2"></i>Share
</a>
<?php if ($session_user_role == 3) { ?>
<?php if (lookupUserPermission("module_credential") >= 2) { ?>
<?php if ($login_archived_at) { ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-info confirm-link" href="post.php?unarchive_login=<?php echo $login_id; ?>">
<i class="fas fa-fw fa-redo mr-2"></i>Unarchive
</a>
<?php if ($config_destructive_deletes_enable) { ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_login=<?php echo $login_id; ?>">
<i class="fas fa-fw fa-trash mr-2"></i>Delete
</a>
<?php } ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-info confirm-link" href="post.php?unarchive_login=<?php echo $login_id; ?>">
<i class="fas fa-fw fa-redo mr-2"></i>Unarchive
</a>
<?php if (lookupUserPermission("module_credential") >= 3) { ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_login=<?php echo $login_id; ?>">
<i class="fas fa-fw fa-trash mr-2"></i>Delete
<?php } ?>
</a>
<?php } else { ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-danger confirm-link" href="post.php?archive_login=<?php echo $login_id; ?>">
<i class="fas fa-fw fa-archive mr-2"></i>Archive
</a>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-danger confirm-link" href="post.php?archive_login=<?php echo $login_id; ?>">
<i class="fas fa-fw fa-archive mr-2"></i>Archive
</a>
<?php } ?>
<?php } ?>
</div>
Expand Down
2 changes: 1 addition & 1 deletion client_network_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pillsEditDetails">

Expand Down
2 changes: 1 addition & 1 deletion client_rack_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-rack-details<?php echo $rack_id; ?>">

Expand Down
2 changes: 1 addition & 1 deletion client_service_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-overview<?php echo $service_id ?>">

Expand Down
2 changes: 1 addition & 1 deletion client_software_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@

<hr>

<div class="tab-content">
<div class="tab-content" <?php if (lookupUserPermission('module_support') <= 1) { echo 'inert'; } ?>>

<div class="tab-pane fade show active" id="pills-details<?php echo $software_id; ?>">

Expand Down
2 changes: 1 addition & 1 deletion invoice_edit_modal.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="invoice_id" value="<?php echo $invoice_id; ?>">

<div class="modal-body bg-white">
<div class="modal-body bg-white" <?php if (lookupUserPermission('module_sales') <= 1) { echo 'inert'; } ?>>

<div class="form-group">
<label>Invoice Date <strong class="text-danger">*</strong></label>
Expand Down
4 changes: 2 additions & 2 deletions post/location.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@

validateTechRole();

require_once 'post/client_locations_model.php';
require_once 'post/location_model.php';


if(!file_exists("uploads/clients/$client_id")) {
Expand Down Expand Up @@ -67,7 +67,7 @@

validateTechRole();

require_once 'post/client_locations_model.php';
require_once 'post/location_model.php';


$location_id = intval($_POST['location_id']);
Expand Down
2 changes: 1 addition & 1 deletion post/client_locations_model.php → post/location_model.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,4 @@
$hours = sanitizeInput($_POST['hours']);
$notes = sanitizeInput($_POST['notes']);
$contact = intval($_POST['contact']);
$location_primary = intval($_POST['location_primary']);
$location_primary = intval($_POST['location_primary']);
31 changes: 18 additions & 13 deletions post/login.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,9 @@

if (isset($_POST['add_login'])) {

validateTechRole();

require_once 'post/client_logins_model.php';
enforceUserPermission('module_credential', 2);

require_once 'post/login_model.php';

mysqli_query($mysqli,"INSERT INTO logins SET login_name = '$name', login_description = '$description', login_uri = '$uri', login_uri_2 = '$uri_2', login_username = '$username', login_password = '$password', login_otp_secret = '$otp_secret', login_note = '$note', login_important = $important, login_contact_id = $contact_id, login_vendor_id = $vendor_id, login_asset_id = $asset_id, login_software_id = $software_id, login_client_id = $client_id");

Expand All @@ -26,10 +25,9 @@

if (isset($_POST['edit_login'])) {

validateTechRole();

require_once 'post/client_logins_model.php';
enforceUserPermission('module_credential', 2);

require_once 'post/login_model.php';

$login_id = intval($_POST['login_id']);

Expand All @@ -55,7 +53,7 @@

if(isset($_GET['archive_login'])){

validateTechRole();
enforceUserPermission('module_credential', 2);

$login_id = intval($_GET['archive_login']);

Expand All @@ -79,6 +77,8 @@

if(isset($_GET['unarchive_login'])){

enforceUserPermission('module_credential', 2);

$login_id = intval($_GET['unarchive_login']);

// Get Name and Client ID for logging and alert message
Expand All @@ -99,7 +99,7 @@

if (isset($_GET['delete_login'])) {

validateAdminRole();
enforceUserPermission('module_credential', 3);

$login_id = intval($_GET['delete_login']);

Expand Down Expand Up @@ -128,7 +128,8 @@
}

if (isset($_POST['bulk_archive_logins'])) {
validateAdminRole();

enforceUserPermission('module_credential', 2);
validateCSRFToken($_POST['csrf_token']);

$count = 0; // Default 0
Expand Down Expand Up @@ -166,7 +167,9 @@
}

if (isset($_POST['bulk_unarchive_logins'])) {
validateAdminRole();

enforceUserPermission('module_credential', 2);

validateCSRFToken($_POST['csrf_token']);

$count = 0; // Default 0
Expand Down Expand Up @@ -205,7 +208,9 @@
}

if (isset($_POST['bulk_delete_logins'])) {
validateAdminRole();

enforceUserPermission('module_credential', 3);

validateCSRFToken($_POST['csrf_token']);

$count = 0; // Default 0
Expand Down Expand Up @@ -250,7 +255,7 @@

if (isset($_POST['export_client_logins_csv'])) {

validateAdminRole();
enforceUserPermission('module_credential');

$client_id = intval($_POST['client_id']);

Expand Down Expand Up @@ -301,7 +306,7 @@

if (isset($_POST["import_client_logins_csv"])) {

validateTechRole();
enforceUserPermission('module_credential', 2);

$client_id = intval($_POST['client_id']);
$file_name = $_FILES["file"]["tmp_name"];
Expand Down
1 change: 1 addition & 0 deletions post/client_logins_model.php → post/login_model.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
<?php
// Model of reusable variables for client credentials/logins - not to be confused with the ITFLow login process
$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
Expand Down
27 changes: 3 additions & 24 deletions post/network.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,18 +8,7 @@

validateTechRole();

$client_id = intval($_POST['client_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$vlan = intval($_POST['vlan']);
$network = sanitizeInput($_POST['network']);
$subnet = sanitizeInput($_POST['subnet']);
$gateway = sanitizeInput($_POST['gateway']);
$primary_dns = sanitizeInput($_POST['primary_dns']);
$secondary_dns = sanitizeInput($_POST['secondary_dns']);
$dhcp_range = sanitizeInput($_POST['dhcp_range']);
$notes = sanitizeInput($_POST['notes']);
$location_id = intval($_POST['location']);
require_once 'post/login_model.php';

mysqli_query($mysqli,"INSERT INTO networks SET network_name = '$name', network_description = '$description', network_vlan = $vlan, network = '$network', network_subnet = '$subnet', network_gateway = '$gateway', network_primary_dns = '$primary_dns', network_secondary_dns = '$secondary_dns', network_dhcp_range = '$dhcp_range', network_notes = '$notes', network_location_id = $location_id, network_client_id = $client_id");

Expand All @@ -39,18 +28,8 @@
validateTechRole();

$network_id = intval($_POST['network_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$vlan = intval($_POST['vlan']);
$network = sanitizeInput($_POST['network']);
$subnet = sanitizeInput($_POST['subnet']);
$gateway = sanitizeInput($_POST['gateway']);
$primary_dns = sanitizeInput($_POST['primary_dns']);
$secondary_dns = sanitizeInput($_POST['secondary_dns']);
$dhcp_range = sanitizeInput($_POST['dhcp_range']);
$notes = sanitizeInput($_POST['notes']);
$location_id = intval($_POST['location']);
$client_id = intval($_POST['client_id']);

require_once 'post/login_model.php';

mysqli_query($mysqli,"UPDATE networks SET network_name = '$name', network_description = '$description', network_vlan = $vlan, network = '$network', network_subnet = '$subnet', network_gateway = '$gateway', network_primary_dns = '$primary_dns', network_secondary_dns = '$secondary_dns', network_dhcp_range = '$dhcp_range', network_notes = '$notes', network_location_id = $location_id WHERE network_id = $network_id");

Expand Down
13 changes: 13 additions & 0 deletions post/network_model.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
<?php
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
$vlan = intval($_POST['vlan']);
$network = sanitizeInput($_POST['network']);
$subnet = sanitizeInput($_POST['subnet']);
$gateway = sanitizeInput($_POST['gateway']);
$primary_dns = sanitizeInput($_POST['primary_dns']);
$secondary_dns = sanitizeInput($_POST['secondary_dns']);
$dhcp_range = sanitizeInput($_POST['dhcp_range']);
$notes = sanitizeInput($_POST['notes']);
$location_id = intval($_POST['location']);
$client_id = intval($_POST['client_id']);
Loading
Loading