ThaMunsta/itflow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

More enforcing user permissions

Browse Source
This commit is contained in:
wrongecho
2024-09-28 20:04:33 +01:00
parent e94aae7940
commit 654b590033
24 changed files with 136 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
post/quote.php
View File

@@ -6,6 +6,8 @@
if (isset($_POST['add_quote'])) {
enforceUserPermission('module_sales', 2);
require_once 'post/quote_model.php';
$client = intval($_POST['client']);
@@ -35,6 +37,8 @@ if (isset($_POST['add_quote'])) {
if (isset($_POST['add_quote_copy'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$client_id = intval($_POST['client']);
$date = sanitizeInput($_POST['date']);
@@ -90,6 +94,8 @@ if (isset($_POST['add_quote_copy'])) {
if (isset($_POST['add_quote_to_invoice'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$date = sanitizeInput($_POST['date']);
$client_net_terms = intval($_POST['client_net_terms']);
@@ -147,6 +153,8 @@ if (isset($_POST['add_quote_to_invoice'])) {
if (isset($_POST['add_quote_item'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$name = sanitizeInput($_POST['name']);
$description = sanitizeInput($_POST['description']);
@@ -196,6 +204,8 @@ if (isset($_POST['add_quote_item'])) {
if (isset($_POST['quote_note'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_POST['quote_id']);
$note = sanitizeInput($_POST['note']);
@@ -209,6 +219,8 @@ if (isset($_POST['quote_note'])) {
if (isset($_POST['edit_quote'])) {
enforceUserPermission('module_sales', 2);
require_once 'post/quote_model.php';
$quote_id = intval($_POST['quote_id']);
@@ -235,6 +247,9 @@ if (isset($_POST['edit_quote'])) {
}
if (isset($_GET['delete_quote'])) {
enforceUserPermission('module_sales', 3);
$quote_id = intval($_GET['delete_quote']);
mysqli_query($mysqli,"DELETE FROM quotes WHERE quote_id = $quote_id");
@@ -268,6 +283,9 @@ if (isset($_GET['delete_quote'])) {
}
if (isset($_GET['delete_quote_item'])) {
enforceUserPermission('module_sales', 2);
$item_id = intval($_GET['delete_quote_item']);
$sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id");
@@ -297,6 +315,8 @@ if (isset($_GET['delete_quote_item'])) {
if (isset($_GET['mark_quote_sent'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['mark_quote_sent']);
mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Sent' WHERE quote_id = $quote_id");
@@ -314,6 +334,8 @@ if (isset($_GET['mark_quote_sent'])) {
if (isset($_GET['accept_quote'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['accept_quote']);
mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Accepted' WHERE quote_id = $quote_id");
@@ -331,6 +353,8 @@ if (isset($_GET['accept_quote'])) {
if (isset($_GET['decline_quote'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['decline_quote']);
mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Declined' WHERE quote_id = $quote_id");
@@ -348,6 +372,8 @@ if (isset($_GET['decline_quote'])) {
if (isset($_GET['email_quote'])) {
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['email_quote']);
$sql = mysqli_query($mysqli,"SELECT * FROM quotes
@@ -422,6 +448,9 @@ if (isset($_GET['email_quote'])) {
}
if(isset($_POST['export_client_quotes_csv'])){
enforceUserPermission('module_sales');
$client_id = intval($_POST['client_id']);
//get records from database
@@ -464,6 +493,8 @@ if(isset($_POST['export_client_quotes_csv'])){
if (isset($_POST['update_quote_item_order'])) {
enforceUserPermission('module_sales', 2);
if ($_POST['update_quote_item_order'] == 'up') {
$item_id = intval($_POST['item_id']);
$item_quote_id = intval($_POST['item_quote_id']);
@@ -488,7 +519,6 @@ if (isset($_POST['update_quote_item_order'])) {
}
mysqli_query($mysqli,"UPDATE invoice_items SET item_order = $item_order WHERE item_quote_id = $item_quote_id AND item_order = $new_item_order");
mysqli_query($mysqli,"UPDATE invoice_items SET item_order = $new_item_order WHERE item_id = $item_id");