From 23f776efa35ceb041782e030b8afcb7818860cc0 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Fri, 20 Sep 2024 21:10:24 +0100 Subject: [PATCH] Permissions - clients and tickets Enforce new permissions model in clients and tickets --- client_add_modal.php | 1 + client_tickets.php | 6 ++-- clients.php | 26 +++++++------- inc_client_top_head.php | 25 +++++++------ post/client.php | 34 +++++++++++------- post/ticket.php | 80 ++++++++++++++++++++--------------------- ticket.php | 45 +++++++++++------------ ticket_edit_modal.php | 2 +- tickets.php | 8 +++-- 9 files changed, 121 insertions(+), 106 deletions(-) diff --git a/client_add_modal.php b/client_add_modal.php index db127307c..ffc8a3c12 100644 --- a/client_add_modal.php +++ b/client_add_modal.php @@ -8,6 +8,7 @@
+ diff --git a/client_tickets.php b/client_tickets.php index 04d0d60e9..2edc8f3b5 100644 --- a/client_tickets.php +++ b/client_tickets.php @@ -119,7 +119,7 @@ Number Subject Contact - + = 2) { ?> Billable Priority @@ -237,8 +237,8 @@ - - + + = 2) { ?>

Management

- + = 2) { ?>
@@ -134,13 +134,13 @@
- ">Clients - ">Leads + ">Clients + ">Leads
"> + class="btn btn-"> Archived
@@ -270,8 +270,8 @@ class="collapse mt-3 - Billing - Action + = 1) && $config_module_enable_accounting == 1) { ?> Billing + = 2) { ?> Action @@ -387,7 +387,7 @@ class="collapse mt-3
- Created: + Created:
@@ -425,8 +425,8 @@ class="collapse mt-3 - - + + = 1) && $config_module_enable_accounting == 1) { ?>
Balance @@ -443,8 +443,8 @@ class="collapse mt-3 - - + + = 2) { ?>
- + = 2) { ?>
- -
+ = 1 && $config_module_enable_accounting == 1) { ?> +
Billing
Hourly Rate @@ -141,8 +143,8 @@
- -
+ = 1 && $config_module_enable_ticketing == 1) { ?> +
Support
Open Tickets @@ -156,6 +158,7 @@
+
diff --git a/post/client.php b/post/client.php index 9349e0fa2..83ee15ced 100644 --- a/post/client.php +++ b/post/client.php @@ -6,10 +6,10 @@ if (isset($_POST['add_client'])) { - require_once 'post/client_model.php'; - + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_client', 2); - validateAdminRole(); + require_once 'post/client_model.php'; $location_phone = preg_replace("/[^0-9]/", '', $_POST['location_phone']); $address = sanitizeInput($_POST['address']); @@ -117,9 +117,9 @@ if (isset($_POST['edit_client'])) { - require_once 'post/client_model.php'; + enforceUserPermission('module_client', 2); - validateAdminRole(); + require_once 'post/client_model.php'; $client_id = intval($_POST['client_id']); @@ -153,7 +153,8 @@ if (isset($_GET['archive_client'])) { - validateAdminRole(); + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_client', 2); $client_id = intval($_GET['archive_client']); @@ -175,6 +176,8 @@ if (isset($_GET['undo_archive_client'])) { + enforceUserPermission('module_client', 2); + $client_id = intval($_GET['undo_archive_client']); // Get Client Name @@ -194,10 +197,8 @@ if (isset($_GET['delete_client'])) { - validateAdminRole(); - - // CSRF Check validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_client', 3); $client_id = intval($_GET['delete_client']); @@ -337,6 +338,8 @@ if (isset($_POST['export_clients_csv'])) { + enforceUserPermission('module_client', 1); + //get records from database $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 @@ -377,7 +380,7 @@ if (isset($_POST["import_clients_csv"])) { - validateTechRole(); + enforceUserPermission('module_client', 2); $file_name = $_FILES["file"]["tmp_name"]; $error = false; @@ -604,14 +607,21 @@ if (isset($_POST['export_client_pdf'])) { - validateAdminRole(); + // TODO: Enforce perms based on which individual boxes are ticked + enforceUserPermission('module_client', 3); + enforceUserPermission('module_support', 1); + enforceUserPermission('module_sales', 1); + enforceUserPermission('module_financial', 1); $client_id = intval($_POST['client_id']); $export_contacts = intval($_POST['export_contacts']); $export_locations = intval($_POST['export_locations']); $export_assets = intval($_POST['export_assets']); $export_software = intval($_POST['export_software']); - $export_logins = intval($_POST['export_logins']); + $export_logins = 0; + if (lookupUserPermission("module_credential") >= 1) { + $export_logins = intval($_POST['export_logins']); + } $export_networks = intval($_POST['export_networks']); $export_certificates = intval($_POST['export_certificates']); $export_domains = intval($_POST['export_domains']); diff --git a/post/ticket.php b/post/ticket.php index 9b799e7cf..35230b047 100644 --- a/post/ticket.php +++ b/post/ticket.php @@ -6,7 +6,7 @@ if (isset($_POST['add_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $client_id = intval($_POST['client']); $assigned_to = intval($_POST['assigned_to']); @@ -186,7 +186,7 @@ if (isset($_POST['edit_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $contact_id = intval($_POST['contact']); @@ -269,7 +269,7 @@ if (isset($_POST['edit_ticket_priority'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $priority = sanitizeInput($_POST['priority']); @@ -287,7 +287,7 @@ if (isset($_POST['edit_ticket_contact'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $contact_id = intval($_POST['contact']); @@ -360,7 +360,7 @@ if (isset($_POST['add_ticket_watcher'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $client_id = intval($_POST['client_id']); @@ -431,7 +431,7 @@ if (isset($_POST['edit_ticket_watchers'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $client_id = intval($_POST['client_id']); @@ -460,7 +460,7 @@ if (isset($_GET['delete_ticket_watcher'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $watcher_id = intval($_GET['delete_ticket_watcher']); @@ -474,7 +474,7 @@ if (isset($_POST['edit_ticket_asset'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $asset_id = intval($_POST['asset']); @@ -493,7 +493,7 @@ if (isset($_POST['edit_ticket_vendor'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $vendor_id = intval($_POST['vendor']); @@ -512,7 +512,7 @@ if (isset($_POST['edit_ticket_priority'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $priority = sanitizeInput($_POST['priority']); @@ -530,8 +530,7 @@ if (isset($_POST['assign_ticket'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); // POST variables $ticket_id = intval($_POST['ticket_id']); @@ -630,7 +629,7 @@ if (isset($_GET['delete_ticket'])) { - validateAdminRole(); + enforceUserPermission('module_support', 3); // CSRF Check validateCSRFToken($_GET['csrf_token']); @@ -668,8 +667,7 @@ if (isset($_POST['bulk_assign_ticket'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); // POST variables $assign_to = intval($_POST['assign_to']); @@ -769,8 +767,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); // POST variables $priority = sanitizeInput($_POST['bulk_priority']); @@ -809,8 +806,7 @@ if (isset($_POST['bulk_merge_tickets'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_count = count($_POST['ticket_ids']); // Get a ticket count $merge_into_ticket_number = intval($_POST['merge_into_ticket_number']); // Parent ticket *number* @@ -868,8 +864,7 @@ if (isset($_POST['bulk_resolve_tickets'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); // POST variables $details = mysqli_escape_string($mysqli, $_POST['bulk_details']); @@ -979,8 +974,7 @@ if (isset($_POST['bulk_ticket_reply'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); // POST variables $ticket_reply = mysqli_escape_string($mysqli, $_POST['bulk_reply_details']); @@ -1117,8 +1111,7 @@ // Currenly not UI Frontend for this if (isset($_POST['bulk_add_ticket_project'])) { - // Role check - validateTechRole(); + enforceUserPermission('module_support', 2); // POST variables $project_id = intval($_POST['project_id']); @@ -1161,7 +1154,7 @@ if (isset($_POST['add_ticket_reply'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']); @@ -1306,7 +1299,7 @@ if (isset($_POST['edit_ticket_reply'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_reply_id = intval($_POST['ticket_reply_id']); $ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']); @@ -1327,7 +1320,7 @@ if (isset($_GET['archive_ticket_reply'])) { - validateAdminRole(); + enforceUserPermission('module_support', 2); $ticket_reply_id = intval($_GET['archive_ticket_reply']); @@ -1344,7 +1337,7 @@ if (isset($_POST['merge_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); // Child ticket ID to be closed $merge_into_ticket_number = intval($_POST['merge_into_ticket_number']); // Parent ticket *number* @@ -1407,7 +1400,7 @@ if (isset($_POST['change_client_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $client_id = intval($_POST['new_client_id']); @@ -1429,7 +1422,7 @@ if (isset($_GET['resolve_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); // CSRF Check validateCSRFToken($_GET['csrf_token']); @@ -1521,7 +1514,7 @@ if (isset($_GET['close_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); // CSRF Check validateCSRFToken($_GET['csrf_token']); @@ -1612,7 +1605,7 @@ if (isset($_GET['reopen_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['reopen_ticket']); @@ -1627,6 +1620,9 @@ if (isset($_POST['add_invoice_from_ticket'])) { + enforceUserPermission('module_support', 2); + enforceUserPermission('module_sales', 2); + $invoice_id = intval($_POST['invoice_id']); $ticket_id = intval($_POST['ticket_id']); $date = sanitizeInput($_POST['date']); @@ -1727,7 +1723,7 @@ if (isset($_POST['export_client_tickets_csv'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $client_id = intval($_POST['client_id']); @@ -1776,7 +1772,7 @@ if (isset($_POST['add_recurring_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); require_once 'post/recurring_ticket_model.php'; @@ -1804,7 +1800,7 @@ if (isset($_POST['edit_recurring_ticket'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); require_once 'post/recurring_ticket_model.php'; @@ -1831,7 +1827,7 @@ if (isset($_GET['delete_recurring_ticket'])) { - validateAdminRole(); + enforceUserPermission('module_support', 3); $scheduled_ticket_id = intval($_GET['delete_recurring_ticket']); @@ -1855,7 +1851,8 @@ } if (isset($_POST['bulk_delete_scheduled_tickets']) || isset($_POST['bulk_delete_recurring_tickets'])) { - validateAdminRole(); + + enforceUserPermission('module_support', 3); validateCSRFToken($_POST['csrf_token']); $count = 0; // Default 0 @@ -1884,7 +1881,8 @@ if (isset($_POST['set_billable_status'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); + enforceUserPermission('module_sales', 2); $ticket_id = intval($_POST['ticket_id']); $billable_status = sanitizeInput($_POST['billable_status']); @@ -1916,7 +1914,7 @@ if (isset($_POST['edit_ticket_schedule'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $onsite = intval($_POST['onsite']); @@ -2094,7 +2092,7 @@ if (isset($_GET['cancel_ticket_schedule'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['cancel_ticket_schedule']); diff --git a/ticket.php b/ticket.php index db1b1a481..8785e4067 100644 --- a/ticket.php +++ b/ticket.php @@ -361,10 +361,11 @@
-
+ = 2) { ?> +
- + = 2) { ?> Invoice @@ -376,7 +377,6 @@ Reopen -   @@ -421,7 +421,7 @@ Change Client - +
Delete @@ -432,6 +432,7 @@
+
@@ -495,11 +496,11 @@ // Billable if ($config_module_enable_accounting) { ?> - + = 1) { ?>
Invoiced:
- + = 1) { ?>
Ticket is @@ -588,7 +589,7 @@
- + = 2 && empty($ticket_resolved_at) && empty($ticket_closed_at)) { ?>
@@ -747,20 +748,20 @@
- -
- - Edit - - + = 2) { ?> + +
+ + Edit +
Archive - -
+
+
@@ -870,7 +871,7 @@
- + = 2) { ?>
@@ -899,7 +900,7 @@ - + = 2) { ?> @@ -908,7 +909,7 @@
- + = 2) { ?>
= 2 && empty($ticket_closed_at)) { require_once "ticket_edit_modal.php"; require_once "ticket_assign_modal.php"; @@ -1149,7 +1150,7 @@ require_once "ticket_merge_modal.php"; } - if ($config_module_enable_accounting) { + if (lookupUserPermission("module_support") >= 2 && lookupUserPermission("module_sales") >= 2 && $config_module_enable_accounting) { require_once "ticket_edit_billable_modal.php"; require_once "ticket_invoice_add_modal.php"; } diff --git a/ticket_edit_modal.php b/ticket_edit_modal.php index 092819a1c..62f02cb61 100644 --- a/ticket_edit_modal.php +++ b/ticket_edit_modal.php @@ -98,7 +98,7 @@
- + = 2) { ?>
value="1" id="billableSwitch"> diff --git a/tickets.php b/tickets.php index 030df1833..88610a07d 100644 --- a/tickets.php +++ b/tickets.php @@ -154,7 +154,8 @@ Unassigned Tickets | - +
@@ -328,7 +330,7 @@ class="collapse - + = 2) { ?> Billable @@ -514,7 +516,7 @@ class="collapse - + = 2) { ?>