From 47a4fa78a8860a122716bbcf28abd89889cbda50 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 13 Nov 2024 17:22:07 -0500 Subject: [PATCH 001/148] Updated task post to use new logAction function, tidy and added more details to logging --- post/user/task.php | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/post/user/task.php b/post/user/task.php index f5026a6d..fed74e6a 100644 --- a/post/user/task.php +++ b/post/user/task.php @@ -6,7 +6,7 @@ if (isset($_POST['add_task'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); $task_name = sanitizeInput($_POST['name']); @@ -21,7 +21,7 @@ if (isset($_POST['add_task'])) { $task_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task', log_action = 'Create', log_description = '$session_name created task $task_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $task_id"); + logAction("Task", "Create", "$session_name created task $task_name", $client_id, $task_id); $_SESSION['alert_message'] = "You created Task $task_name"; @@ -30,7 +30,7 @@ if (isset($_POST['add_task'])) { if (isset($_POST['edit_task'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $task_id = intval($_POST['task_id']); $task_name = sanitizeInput($_POST['name']); @@ -50,9 +50,9 @@ if (isset($_POST['edit_task'])) { } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task', log_action = 'Edit', log_description = '$session_name edited task $task_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $task_id"); + logAction("Task", "Edit", "$session_name edited task $task_name", $client_id, $task_id); - $_SESSION['alert_message'] = "You edited Task $task_name"; + $_SESSION['alert_message'] = "Task $task_name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -60,7 +60,7 @@ if (isset($_POST['edit_task'])) { if (isset($_GET['delete_task'])) { - validateTechRole(); + enforceUserPermission('module_support', 3); // CSRF Check validateCSRFToken($_GET['csrf_token']); @@ -76,17 +76,17 @@ if (isset($_GET['delete_task'])) { mysqli_query($mysqli, "DELETE FROM tasks WHERE task_id = $task_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task', log_action = 'Delete', log_description = '$session_name deleted task $task_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $task_id"); + logAction("Task", "Delete", "$session_name deleted task $task_name", $client_id, $task_id); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "You Deleted Task $task_name"; + $_SESSION['alert_message'] = "Task $task_name deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['complete_task'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $task_id = intval($_GET['complete_task']); @@ -109,16 +109,16 @@ if (isset($_GET['complete_task'])) { $ticket_reply_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task', log_action = 'Edit', log_description = '$session_name completed task $task_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $task_id"); + logAction("Task", "Edit", "$session_name completed task $task_name", $client_id, $task_id); - $_SESSION['alert_message'] = "You completed Task $task_name Great Job!"; + $_SESSION['alert_message'] = "Task $task_name Completed"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['undo_complete_task'])) { - validateTechRole(); + enforceUserPermission('module_support', 2); $task_id = intval($_GET['undo_complete_task']); @@ -137,9 +137,10 @@ if (isset($_GET['undo_complete_task'])) { $ticket_reply_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task', log_action = 'Edit', log_description = '$session_name un-completed task $task_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $task_id"); + logAction("Task", "Edit", "$session_name marked task $task_name as incomplete", $client_id, $task_id); - $_SESSION['alert_message'] = "You marked Task $task_name as incomplete"; + $_SESSION['alert_message'] = "Task $task_name marked as incomplete"; header("Location: " . $_SERVER["HTTP_REFERER"]); -} \ No newline at end of file + +} From 93b5c6aab1735a6e025c3184a12f3d634cdc0137 Mon Sep 17 00:00:00 2001 From: ThaMunsta Date: Wed, 13 Nov 2024 17:25:58 -0500 Subject: [PATCH 002/148] Update guest_post.php fix hotlink on notification --- guest_post.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/guest_post.php b/guest_post.php index a1cffd80..410f63dd 100644 --- a/guest_post.php +++ b/guest_post.php @@ -118,7 +118,7 @@ if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) { mysqli_query($mysqli, "UPDATE tickets SET ticket_feedback = '$feedback' WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key'"); // Notify on bad feedback if ($feedback == "Bad") { - appNotify("Feedback", "Guest rated ticket ID $ticket_id as bad"); + appNotify("Feedback", "Guest rated ticket ID $ticket_id as bad", "ticket.php?ticket_id=$ticket_id"); } $_SESSION['alert_message'] = "Feedback recorded - thank you"; From 56361c7008592ce6532dd5ef73f7357a5d8d80d9 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 13 Nov 2024 17:48:24 -0500 Subject: [PATCH 003/148] Partially Updated ticket post to use new logAction function, added some ticket history updates, tidy and added more details to logging --- post/user/task.php | 1 + post/user/ticket.php | 40 +++++++++++++++++++++++++++++----------- 2 files changed, 30 insertions(+), 11 deletions(-) diff --git a/post/user/task.php b/post/user/task.php index fed74e6a..8f31cdd5 100644 --- a/post/user/task.php +++ b/post/user/task.php @@ -139,6 +139,7 @@ if (isset($_GET['undo_complete_task'])) { // Logging logAction("Task", "Edit", "$session_name marked task $task_name as incomplete", $client_id, $task_id); + $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "Task $task_name marked as incomplete"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/user/ticket.php b/post/user/ticket.php index 1137c4bd..a126d9d3 100644 --- a/post/user/ticket.php +++ b/post/user/ticket.php @@ -77,7 +77,7 @@ if (isset($_POST['add_ticket'])) { } // Add Watchers - if (!empty($_POST['watchers'])) { + if (isset($_POST['watchers'])) { foreach ($_POST['watchers'] as $watcher) { $watcher_email = sanitizeInput($watcher); mysqli_query($mysqli, "INSERT INTO ticket_watchers SET watcher_email = '$watcher_email', watcher_ticket_id = $ticket_id"); @@ -157,11 +157,11 @@ if (isset($_POST['add_ticket'])) { customAction('ticket_create', $ticket_id); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Create', log_description = '$session_name created ticket $config_ticket_prefix$ticket_number - $ticket_subject', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $ticket_id"); + logAction("Ticket", "Create", "$session_name created ticket $config_ticket_prefix$ticket_number - $ticket_subject", $client_id, $ticket_id); - $_SESSION['alert_message'] = "You created Ticket $ticket_subject $config_ticket_prefix$ticket_number"; + $_SESSION['alert_message'] = "Ticket $config_ticket_prefix$ticket_number created"; - header("Location: ticket.php?ticket_id=" . $ticket_id); + header("Location: ticket.php?ticket_id=$ticket_id"); } if (isset($_POST['edit_ticket'])) { @@ -183,6 +183,7 @@ if (isset($_POST['edit_ticket'])) { $project_id = intval($_POST['project']); $client_id = intval($_POST['client_id']); $ticket_number = sanitizeInput($_POST['ticket_number']); + $ticket_prefix = sanitizeInput($config_ticket_prefix); mysqli_query($mysqli, "UPDATE tickets SET ticket_category = $category, ticket_subject = '$subject', ticket_priority = '$priority', ticket_billable = $billable, ticket_details = '$details', ticket_vendor_ticket_number = '$vendor_ticket_number', ticket_contact_id = $contact_id, ticket_vendor_id = $vendor_id, ticket_location_id = $location_id, ticket_asset_id = $asset_id, ticket_project_id = $project_id WHERE ticket_id = $ticket_id"); @@ -193,7 +194,7 @@ if (isset($_POST['edit_ticket'])) { $sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_category, ticket_subject, ticket_details, ticket_priority, ticket_status_name, ticket_created_by, ticket_assigned_to, ticket_client_id FROM tickets LEFT JOIN clients ON ticket_client_id = client_id LEFT JOIN contacts ON ticket_contact_id = contact_id - LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id + LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id WHERE ticket_id = $ticket_id AND ticket_closed_at IS NULL"); $row = mysqli_fetch_array($sql); @@ -242,10 +243,10 @@ if (isset($_POST['edit_ticket'])) { // Custom action/notif handler customAction('ticket_update', $ticket_id); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Modify', log_description = '$session_name modified ticket $ticket_number - $subject', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $ticket_id"); + // Logging + logAction("Ticket", "Edit", "$session_name edited ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); - $_SESSION['alert_message'] = "Ticket $ticket_number updated"; + $_SESSION['alert_message'] = "Ticket $ticket_prefix$ticket_number updated"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -258,14 +259,31 @@ if (isset($_POST['edit_ticket_priority'])) { $priority = sanitizeInput($_POST['priority']); $client_id = intval($_POST['client_id']); + // Get ticket details + $sql = mysqli_query($mysqli, "SELECT + ticket_prefix, ticket_number ticket_priority, ticket_status_name, ticket_client_id + FROM tickets + LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id + WHERE ticket_id = $ticket_id" + ); + $row = mysqli_fetch_array($sql); + $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_number = intval($row['ticket_number']); + $original_priority = sanitizeInput($row['ticket_priority']); + $ticket_status = sanitizeInput($row['ticket_status_name']); + $client_id = intval($row['ticket_client_id']); + mysqli_query($mysqli, "UPDATE tickets SET ticket_priority = '$priority' WHERE ticket_id = $ticket_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Modify', log_description = '$session_name edited ticket priority', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $ticket_id"); + // Update Ticket History + mysqli_query($mysqli, "INSERT INTO ticket_history SET ticket_history_status = '$ticket_status', ticket_history_description = '$session_name changed priority from $original_priority to $priority', ticket_history_ticket_id = $ticket_id"); + + // Logging + logAction("Ticket", "Edit", "$session_name changed priority from $original_priority to $priority for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); customAction('ticket_update', $ticket_id); - $_SESSION['alert_message'] = "Ticket priority updated"; + $_SESSION['alert_message'] = "Priority updated $original_priority to $priority"; header("Location: " . $_SERVER["HTTP_REFERER"]); } From 52284231bb99e3862f41e5107742145d2bac6b68 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 13 Nov 2024 17:56:28 -0500 Subject: [PATCH 004/148] Remove Dup Edit Priority Logic from ticket post and fix priority from > to --- post/user/ticket.php | 27 ++------------------------- 1 file changed, 2 insertions(+), 25 deletions(-) diff --git a/post/user/ticket.php b/post/user/ticket.php index a126d9d3..fc2d6368 100644 --- a/post/user/ticket.php +++ b/post/user/ticket.php @@ -261,7 +261,7 @@ if (isset($_POST['edit_ticket_priority'])) { // Get ticket details $sql = mysqli_query($mysqli, "SELECT - ticket_prefix, ticket_number ticket_priority, ticket_status_name, ticket_client_id + ticket_prefix, ticket_number, ticket_priority, ticket_status_name, ticket_client_id FROM tickets LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id WHERE ticket_id = $ticket_id" @@ -283,7 +283,7 @@ if (isset($_POST['edit_ticket_priority'])) { customAction('ticket_update', $ticket_id); - $_SESSION['alert_message'] = "Priority updated $original_priority to $priority"; + $_SESSION['alert_message'] = "Priority updated from $original_priority to $priority"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -517,29 +517,6 @@ if (isset($_POST['edit_ticket_vendor'])) { header("Location: " . $_SERVER["HTTP_REFERER"]); } -if (isset($_POST['edit_ticket_priority'])) { - - enforceUserPermission('module_support', 2); - - $ticket_id = intval($_POST['ticket_id']); - $priority = sanitizeInput($_POST['priority']); - $client_id = intval($_POST['client_id']); - - mysqli_query($mysqli, "UPDATE tickets SET ticket_priority = '$priority' WHERE ticket_id = $ticket_id"); - - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Modify', log_description = '$session_name edited ticket priority', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $ticket_id"); - - // Custom action/notif handler - customAction('ticket_update', $ticket_id); - - $_SESSION['alert_message'] = "Ticket priority updated"; - - header("Location: " . $_SERVER["HTTP_REFERER"]); - - customAction('ticket_update', $ticket_id); -} - if (isset($_POST['assign_ticket'])) { enforceUserPermission('module_support', 2); From e4f618c1502a41f4fd5f20270c1d686716d0d364 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 13 Nov 2024 18:46:28 -0500 Subject: [PATCH 005/148] More work on Updating ticket post to use new logAction function, added more ticket history updates, tidy and added more details to logging, lots of logic changes need to happen here --- post/user/ticket.php | 42 +++++++++++++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 9 deletions(-) diff --git a/post/user/ticket.php b/post/user/ticket.php index fc2d6368..9ce150d9 100644 --- a/post/user/ticket.php +++ b/post/user/ticket.php @@ -298,18 +298,36 @@ if (isset($_POST['edit_ticket_contact'])) { $ticket_number = sanitizeInput($_POST['ticket_number']); $notify = intval($_POST['contact_notify']); + // Get Original contact, and ticket details + $sql = mysqli_query($mysqli, "SELECT + contact_name, contact_email, ticket_prefix, ticket_number, ticket_status_name, ticket_client_id + FROM tickets + LEFT JOIN contacts ON ticket_contact_id = contact_id + LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id + WHERE ticket_id = $ticket_id" + ); + $row = mysqli_fetch_array($sql); + $original_contact_name = sanitizeInput($row['contact_name']); + $original_contact_email = sanitizeInput($row['contact_email']); + $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_number = intval($row['ticket_number']); + $ticket_status = sanitizeInput($row['ticket_status_name']); + $client_id = intval($row['ticket_client_id']); + mysqli_query($mysqli, "UPDATE tickets SET ticket_contact_id = $contact_id WHERE ticket_id = $ticket_id"); // Notify new contact if selected if ($notify && !empty($config_smtp_host)) { - // Get contact/ticket details - $sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_category, ticket_subject, ticket_details, ticket_priority, ticket_status_name, ticket_url_key, ticket_created_by, ticket_assigned_to, ticket_client_id FROM tickets + // Get New contact/ticket details + $sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_category, ticket_subject, ticket_details, ticket_priority, ticket_status_name, ticket_url_key, ticket_created_by, ticket_assigned_to, ticket_client_id + FROM tickets LEFT JOIN clients ON ticket_client_id = client_id LEFT JOIN contacts ON ticket_contact_id = contact_id - LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id + LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id WHERE ticket_id = $ticket_id - AND ticket_closed_at IS NULL"); + AND ticket_closed_at IS NULL" + ); $row = mysqli_fetch_array($sql); $contact_name = sanitizeInput($row['contact_name']); @@ -332,6 +350,9 @@ if (isset($_POST['edit_ticket_contact'])) { $company_name = sanitizeInput($row['company_name']); $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); + $config_ticket_from_email = sanitizeInput($config_ticket_from_email); + $config_ticket_from_name = sanitizeInput($config_ticket_from_name); + // Email content $data = []; // Queue array @@ -357,10 +378,13 @@ if (isset($_POST['edit_ticket_contact'])) { // Custom action/notif handler customAction('ticket_update', $ticket_id); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Modify', log_description = '$session_name changed contact for ticket $ticket_number', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $ticket_id"); + // Update Ticket History + mysqli_query($mysqli, "INSERT INTO ticket_history SET ticket_history_status = '$ticket_status', ticket_history_description = '$session_name changed the contact from $original_contact_name to $contact_name', ticket_history_ticket_id = $ticket_id"); - $_SESSION['alert_message'] = "Ticket $ticket_number contact updated"; + // Logging + logAction("Ticket", "Edit", "$session_name changed the contact from $original_contact_name to $contact_name for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); + + $_SESSION['alert_message'] = "Contact changed from $original_contact_name to $contact_name"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -428,8 +452,8 @@ if (isset($_POST['add_ticket_watcher'])) { addToMailQueue($mysqli, $data); } - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Edit', log_description = '$session_name added watcher $watcher_email to ticket $ticket_number', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $ticket_id"); + // Logging + logAction("Ticket", "Edit", "$session_name added $watcher_email as a watcher for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); $_SESSION['alert_message'] = "You added $watcher_email as a watcher to Ticket $ticket_number"; From fc94d7179598d64f730bdab57af753b567134522 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Thu, 14 Nov 2024 08:08:52 +0000 Subject: [PATCH 006/148] Fix typo in ticket archived logging --- post/user/ticket.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/post/user/ticket.php b/post/user/ticket.php index 9ce150d9..2edb75f6 100644 --- a/post/user/ticket.php +++ b/post/user/ticket.php @@ -1490,7 +1490,7 @@ if (isset($_GET['archive_ticket_reply'])) { mysqli_query($mysqli, "UPDATE ticket_replies SET ticket_reply_archived_at = NOW() WHERE ticket_reply_id = $ticket_reply_id"); //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Reply', log_action = 'Archive', log_description = '$session_name arhived ticket reply', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_reply_id"); + mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Reply', log_action = 'Archive', log_description = '$session_name archived ticket reply', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_reply_id"); $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "Ticket reply archived"; From 9fe9d8e9ff4485bb81319b45f9f69527b68787ed Mon Sep 17 00:00:00 2001 From: wrongecho Date: Thu, 14 Nov 2024 08:44:08 +0000 Subject: [PATCH 007/148] Clarify notes on debug --- admin_debug.php | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/admin_debug.php b/admin_debug.php index fc6d659a..1e200bf5 100644 --- a/admin_debug.php +++ b/admin_debug.php @@ -1,4 +1,5 @@ close();

Debugging

    -
  • If you are experiencing a problem with ITFlow you may be directed to this page to gather server/app info.
    • -
  • When creating forum posts / support requests ensure you share the information under Server Info, ITFlow app and Database stats.
    • -
  • Caution: Be careful when sharing the full debug output - it contains your PHP session variables/cookies ("PHPSESSID") which could allow anyone to login to your ITFlow instance
    • -
  • Note: Sometimes you might need to gather PHP error logs as well
    • +
  • If you are experiencing a problem with ITFlow, this page should help you identify any configuration issues.
    • +
  • Note: You might also need to gather error logs
From 28a0343a972a6ca4796a59840f9388a8b0430fd5 Mon Sep 17 00:00:00 2001 From: wrongecho Date: Thu, 14 Nov 2024 11:23:28 +0000 Subject: [PATCH 008/148] Quote notifications - Send an internal email when quotes are accepted/declined - Clients are prompted to confirm accept/decline with confirm-link - Tidy --- admin_settings_quote.php | 10 ++++ database_updates.php | 12 +++-- database_version.php | 2 +- db.sql | 1 + get_settings.php | 1 + guest_footer.php | 3 ++ guest_post.php | 73 +++++++++++++++++++++++++++-- guest_view_quote.php | 6 +-- post/admin/admin_settings_quote.php | 6 ++- 9 files changed, 102 insertions(+), 12 deletions(-) diff --git a/admin_settings_quote.php b/admin_settings_quote.php index ea3c2763..9473c7fb 100644 --- a/admin_settings_quote.php +++ b/admin_settings_quote.php @@ -35,6 +35,16 @@ require_once "inc_all_admin.php"; +
+ +
+
+ +
+ +
+
+
diff --git a/database_updates.php b/database_updates.php index 4751fe7b..c9485e49 100644 --- a/database_updates.php +++ b/database_updates.php @@ -2232,10 +2232,16 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.6.5'"); } - // if (CURRENT_DATABASE_VERSION == '1.6.5') { - // // Insert queries here required to update to DB version 1.6.6 + if (CURRENT_DATABASE_VERSION == '1.6.5') { + mysqli_query($mysqli, "ALTER TABLE `settings` ADD `config_quote_notification_email` VARCHAR(200) DEFAULT NULL AFTER `config_quote_from_email`"); + + mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.6.6'"); + } + + // if (CURRENT_DATABASE_VERSION == '1.6.6') { + // // Insert queries here required to update to DB version 1.6.7 // // Then, update the database to the next sequential version - // mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.6.6'"); + // mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '1.6.7'"); // } } else { diff --git a/database_version.php b/database_version.php index 856c9189..d8b464c4 100644 --- a/database_version.php +++ b/database_version.php @@ -5,4 +5,4 @@ * It is used in conjunction with database_updates.php */ -DEFINE("LATEST_DATABASE_VERSION", "1.6.5"); +DEFINE("LATEST_DATABASE_VERSION", "1.6.6"); diff --git a/db.sql b/db.sql index 223a8662..b6706f94 100644 --- a/db.sql +++ b/db.sql @@ -1517,6 +1517,7 @@ CREATE TABLE `settings` ( `config_quote_footer` text DEFAULT NULL, `config_quote_from_name` varchar(200) DEFAULT NULL, `config_quote_from_email` varchar(200) DEFAULT NULL, + `config_quote_notification_email` varchar(200) DEFAULT NULL, `config_ticket_prefix` varchar(200) DEFAULT NULL, `config_ticket_next_number` int(11) DEFAULT NULL, `config_ticket_from_name` varchar(200) DEFAULT NULL, diff --git a/get_settings.php b/get_settings.php index 40f4cd35..b74f7a66 100644 --- a/get_settings.php +++ b/get_settings.php @@ -58,6 +58,7 @@ $config_quote_next_number = intval($row['config_quote_next_number']); $config_quote_footer = $row['config_quote_footer']; $config_quote_from_name = $row['config_quote_from_name']; $config_quote_from_email = $row['config_quote_from_email']; +$config_quote_notification_email = $row['config_quote_notification_email']; // Projects $config_project_prefix = $row['config_project_prefix']; diff --git a/guest_footer.php b/guest_footer.php index c11e4c88..c6e94e3c 100644 --- a/guest_footer.php +++ b/guest_footer.php @@ -7,6 +7,7 @@ + @@ -23,5 +24,7 @@ + + diff --git a/guest_post.php b/guest_post.php index 410f63dd..b2fd9ac7 100644 --- a/guest_post.php +++ b/guest_post.php @@ -23,11 +23,44 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) { mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Accepted' WHERE quote_id = $quote_id"); mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Accepted', history_description = 'Client accepted Quote!', history_quote_id = $quote_id"); + // Notification appNotify("Quote Accepted", "Quote $quote_prefix$quote_number has been accepted by $client_name", "quote.php?quote_id=$quote_id", $client_id); - - customAction('quote_accept', $quote_id); + + // Internal email notification + + $sql_company = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"); + $row = mysqli_fetch_array($sql_company); + $company_name = sanitizeInput($row['company_name']); + + $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); + $row = mysqli_fetch_array($sql_settings); + $config_smtp_host = $row['config_smtp_host']; + $config_smtp_port = intval($row['config_smtp_port']); + $config_smtp_encryption = $row['config_smtp_encryption']; + $config_smtp_username = $row['config_smtp_username']; + $config_smtp_password = $row['config_smtp_password']; + $config_quote_from_name = sanitizeInput($row['config_quote_from_name']); + $config_quote_from_email = sanitizeInput($row['config_quote_from_email']); + $config_quote_notification_email = sanitizeInput($row['config_quote_notification_email']); + $config_base_url = sanitizeInput($config_base_url); + + if (!empty($config_smtp_host) && !empty($config_quote_notification_email)) { + $subject = "Quote Accepted - $client_name - Quote $quote_prefix$quote_number"; + $body = "Hello,

This is a notification that a quote has been accepted in ITFlow.

Client: $client_name
Quote: $quote_prefix$quote_number

~
$company_name - Billing
$config_quote_from_email"; + + $data[] = [ + 'from' => $config_quote_from_email, + 'from_name' => $config_quote_from_name, + 'recipient' => $config_quote_notification_email, + 'subject' => $subject, + 'body' => $body, + ]; + + $mail = addToMailQueue($mysqli, $data); + } + $_SESSION['alert_message'] = "Quote Accepted"; header("Location: " . $_SERVER["HTTP_REFERER"]); } else { @@ -51,10 +84,44 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) { mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Declined' WHERE quote_id = $quote_id"); mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Declined', history_description = 'Client declined Quote!', history_quote_id = $quote_id"); + // Notification appNotify("Quote Declined", "Quote $quote_prefix$quote_number has been declined by $client_name", "quote.php?quote_id=$quote_id", $client_id); - customAction('quote_decline', $quote_id); + + // Internal email notification + + $sql_company = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"); + $row = mysqli_fetch_array($sql_company); + $company_name = sanitizeInput($row['company_name']); + + $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); + $row = mysqli_fetch_array($sql_settings); + $config_smtp_host = $row['config_smtp_host']; + $config_smtp_port = intval($row['config_smtp_port']); + $config_smtp_encryption = $row['config_smtp_encryption']; + $config_smtp_username = $row['config_smtp_username']; + $config_smtp_password = $row['config_smtp_password']; + $config_quote_from_name = sanitizeInput($row['config_quote_from_name']); + $config_quote_from_email = sanitizeInput($row['config_quote_from_email']); + $config_quote_notification_email = sanitizeInput($row['config_quote_notification_email']); + $config_base_url = sanitizeInput($config_base_url); + + if (!empty($config_smtp_host) && !empty($config_quote_notification_email)) { + $subject = "Quote Declined - $client_name - Quote $quote_prefix$quote_number"; + $body = "Hello,

This is a notification that a quote has been declined in ITFlow.

Client: $client_name
Quote: $quote_prefix$quote_number

~
$company_name - Billing
$config_quote_from_email"; + + $data[] = [ + 'from' => $config_quote_from_email, + 'from_name' => $config_quote_from_name, + 'recipient' => $config_quote_notification_email, + 'subject' => $subject, + 'body' => $body, + ]; + + $mail = addToMailQueue($mysqli, $data); + } + $_SESSION['alert_type'] = "danger"; $_SESSION['alert_message'] = "Quote Declined"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/guest_view_quote.php b/guest_view_quote.php index 2996c1bd..b909b79a 100644 --- a/guest_view_quote.php +++ b/guest_view_quote.php @@ -44,7 +44,6 @@ $quote_discount = floatval($row['quote_discount_amount']); $quote_amount = floatval($row['quote_amount']); $quote_currency_code = nullable_htmlentities($row['quote_currency_code']); $quote_note = nullable_htmlentities($row['quote_note']); -$category_id = intval($row['category_id']); $client_id = intval($row['client_id']); $client_name = nullable_htmlentities($row['client_name']); $client_name_escaped = sanitizeInput($row['client_name']); @@ -273,10 +272,10 @@ if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Vie strtotime("now")) { ?> - + Accept - + Decline @@ -712,7 +711,6 @@ if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Vie } - Date: Thu, 14 Nov 2024 11:51:39 +0000 Subject: [PATCH 009/148] Import CSV - Check file uploaded Check the file was uploaded when importing a CSV. Can probably convert this into a function at a later date. --- client_asset_import_modal.php | 2 +- client_contact_import_modal.php | 2 +- client_import_modal.php | 3 +-- client_location_import_modal.php | 2 +- client_login_import_modal.php | 2 +- post/user/asset.php | 10 ++++++++++ post/user/client.php | 13 ++++++++++--- post/user/contact.php | 10 +++++++++- post/user/credential.php | 10 +++++++++- post/user/location.php | 10 +++++++++- 10 files changed, 52 insertions(+), 12 deletions(-) diff --git a/client_asset_import_modal.php b/client_asset_import_modal.php index 583bf346..cc10bd7b 100644 --- a/client_asset_import_modal.php +++ b/client_asset_import_modal.php @@ -14,7 +14,7 @@

Format csv file with headings & data:
Name, Description, Type, Make, Model, Serial, OS, Assigned To, Location

- +
diff --git a/client_contact_import_modal.php b/client_contact_import_modal.php index a7c02bfd..bc567b60 100644 --- a/client_contact_import_modal.php +++ b/client_contact_import_modal.php @@ -13,7 +13,7 @@

Format csv file with headings & data:
Name, Title, Department, Email, Phone, Extension, Mobile, Location

- +
diff --git a/client_import_modal.php b/client_import_modal.php index eb447ebe..e6d9eacd 100644 --- a/client_import_modal.php +++ b/client_import_modal.php @@ -8,12 +8,11 @@
-

Format csv file with headings & data:
Client Name, Industry, Referral, Website, Location Name, Location Phone, Location Address, City, State, Postal Code, Country, Contact Name, Title, Contact Phone, Extension, Contact Mobile, Contact Email, Hourly Rate, Currency, Payment Terms, Tax ID, Abbreviation

- +
diff --git a/client_location_import_modal.php b/client_location_import_modal.php index 42cf942e..579d82b9 100644 --- a/client_location_import_modal.php +++ b/client_location_import_modal.php @@ -13,7 +13,7 @@

Format csv file with headings & data:
Name, Description, Address, City, State, Postal Code, Phone, Hours

- +
diff --git a/client_login_import_modal.php b/client_login_import_modal.php index edf7edc4..566ccdda 100644 --- a/client_login_import_modal.php +++ b/client_login_import_modal.php @@ -13,7 +13,7 @@

Format csv file with headings & data:
Name, Description, Username, Password, URL

- +
diff --git a/post/user/asset.php b/post/user/asset.php index 9a1885ba..b9ee2c4b 100644 --- a/post/user/asset.php +++ b/post/user/asset.php @@ -473,8 +473,18 @@ if (isset($_POST["import_client_assets_csv"])) { $client_id = intval($_POST['client_id']); $file_name = $_FILES["file"]["tmp_name"]; + $error = false; + if (!empty($_FILES["file"]["tmp_name"])) { + $file_name = $_FILES["file"]["tmp_name"]; + } else { + $_SESSION['alert_message'] = "Please select a file to upload."; + $_SESSION['alert_type'] = "error"; + header("Location: " . $_SERVER["HTTP_REFERER"]); + exit(); + } + //Check file is CSV $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); $allowed_file_extensions = array('csv'); diff --git a/post/user/client.php b/post/user/client.php index d497b25a..60f839ac 100644 --- a/post/user/client.php +++ b/post/user/client.php @@ -387,10 +387,17 @@ if (isset($_POST['export_clients_csv'])) { if (isset($_POST["import_clients_csv"])) { enforceUserPermission('module_client', 2); - - $file_name = $_FILES["file"]["tmp_name"]; $error = false; + if (!empty($_FILES["file"]["tmp_name"])) { + $file_name = $_FILES["file"]["tmp_name"]; + } else { + $_SESSION['alert_message'] = "Please select a file to upload."; + $_SESSION['alert_type'] = "error"; + header("Location: " . $_SERVER["HTTP_REFERER"]); + exit(); + } + //Check file is CSV $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); $allowed_file_extensions = array('csv'); @@ -589,7 +596,7 @@ if (isset($_POST["import_clients_csv"])) { if (isset($_GET['download_clients_csv_template'])) { $delimiter = ","; - $filename = strtoAZaz09($client_name) . "-Clients-Template.csv"; + $filename = "Clients-Template.csv"; //create a file pointer $f = fopen('php://memory', 'w'); diff --git a/post/user/contact.php b/post/user/contact.php index a537a842..d5fbe7fc 100644 --- a/post/user/contact.php +++ b/post/user/contact.php @@ -822,9 +822,17 @@ if (isset($_POST["import_client_contacts_csv"])) { enforceUserPermission('module_client', 2); $client_id = intval($_POST['client_id']); - $file_name = $_FILES["file"]["tmp_name"]; $error = false; + if (!empty($_FILES["file"]["tmp_name"])) { + $file_name = $_FILES["file"]["tmp_name"]; + } else { + $_SESSION['alert_message'] = "Please select a file to upload."; + $_SESSION['alert_type'] = "error"; + header("Location: " . $_SERVER["HTTP_REFERER"]); + exit(); + } + //Check file is CSV $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); $allowed_file_extensions = array('csv'); diff --git a/post/user/credential.php b/post/user/credential.php index 491b3b1a..cce38199 100644 --- a/post/user/credential.php +++ b/post/user/credential.php @@ -377,9 +377,17 @@ if (isset($_POST["import_client_logins_csv"])) { enforceUserPermission('module_credential', 2); $client_id = intval($_POST['client_id']); - $file_name = $_FILES["file"]["tmp_name"]; $error = false; + if (!empty($_FILES["file"]["tmp_name"])) { + $file_name = $_FILES["file"]["tmp_name"]; + } else { + $_SESSION['alert_message'] = "Please select a file to upload."; + $_SESSION['alert_type'] = "error"; + header("Location: " . $_SERVER["HTTP_REFERER"]); + exit(); + } + //Check file is CSV $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); $allowed_file_extensions = array('csv'); diff --git a/post/user/location.php b/post/user/location.php index 6cedd3ed..6df8c008 100644 --- a/post/user/location.php +++ b/post/user/location.php @@ -429,9 +429,17 @@ if(isset($_POST["import_client_locations_csv"])){ enforceUserPermission('module_client', 2); $client_id = intval($_POST['client_id']); - $file_name = $_FILES["file"]["tmp_name"]; $error = false; + if (!empty($_FILES["file"]["tmp_name"])) { + $file_name = $_FILES["file"]["tmp_name"]; + } else { + $_SESSION['alert_message'] = "Please select a file to upload."; + $_SESSION['alert_type'] = "error"; + header("Location: " . $_SERVER["HTTP_REFERER"]); + exit(); + } + //Check file is CSV $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); $allowed_file_extensions = array('csv'); From 22f54886e217ac2572616f045ac832db8dab436c Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 11:56:12 -0500 Subject: [PATCH 010/148] Fix: Broken Create Quote - regression in logging --- post/user/quote.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/post/user/quote.php b/post/user/quote.php index a925660b..d6b44c46 100644 --- a/post/user/quote.php +++ b/post/user/quote.php @@ -10,7 +10,7 @@ if (isset($_POST['add_quote'])) { require_once 'post/user/quote_model.php'; - $client = intval($_POST['client']); + $client_id = intval($_POST['client']); //Get the last Quote Number and add 1 for the new Quote number $quote_number = $config_quote_next_number; @@ -20,7 +20,7 @@ if (isset($_POST['add_quote'])) { //Generate a unique URL key for clients to access $quote_url_key = randomString(156); - mysqli_query($mysqli,"INSERT INTO quotes SET quote_prefix = '$config_quote_prefix', quote_number = $quote_number, quote_scope = '$scope', quote_date = '$date', quote_expire = '$expire', quote_currency_code = '$session_company_currency', quote_category_id = $category, quote_status = 'Draft', quote_url_key = '$quote_url_key', quote_client_id = $client"); + mysqli_query($mysqli,"INSERT INTO quotes SET quote_prefix = '$config_quote_prefix', quote_number = $quote_number, quote_scope = '$scope', quote_date = '$date', quote_expire = '$expire', quote_currency_code = '$session_company_currency', quote_category_id = $category, quote_status = 'Draft', quote_url_key = '$quote_url_key', quote_client_id = $client_id"); $quote_id = mysqli_insert_id($mysqli); From 5d8b9ac600c89295e8b6e5ebf6a2b8686cb234a1 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 12:51:26 -0500 Subject: [PATCH 011/148] Updated transfer post to use new logAction function, new role checking, tidy and added more details to logging --- post/user/transfer.php | 35 ++++++++++++++++++++++++++++------- 1 file changed, 28 insertions(+), 7 deletions(-) diff --git a/post/user/transfer.php b/post/user/transfer.php index 76c48423..0342a7cf 100644 --- a/post/user/transfer.php +++ b/post/user/transfer.php @@ -6,8 +6,19 @@ if (isset($_POST['add_transfer'])) { + enforceUserPermission('module_financial', 2); + require_once 'post/user/transfer_model.php'; + // Get Source Account Name for logging + $sql = mysqli_query($mysqli,"SELECT account_name FROM accounts WHERE account_id = $account_from"); + $row = mysqli_fetch_array($sql); + $source_account_name = sanitizeInput($row['account_name']); + + // Get Destination Account Name for logging + $sql = mysqli_query($mysqli,"SELECT account_name FROM accounts WHERE account_id = $account_to"); + $row = mysqli_fetch_array($sql); + $destination_account_name = sanitizeInput($row['account_name']); mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = $amount, expense_currency_code = '$session_company_currency', expense_vendor_id = 0, expense_category_id = 0, expense_account_id = $account_from"); $expense_id = mysqli_insert_id($mysqli); @@ -17,10 +28,12 @@ if (isset($_POST['add_transfer'])) { mysqli_query($mysqli,"INSERT INTO transfers SET transfer_expense_id = $expense_id, transfer_revenue_id = $revenue_id, transfer_method = '$transfer_method', transfer_notes = '$notes'"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Transfer', log_action = 'Create', log_description = '$date - $amount', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $transfer_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Transfer complete"; + // Logging + logAction("Account Transfer", "Create", "$session_name transferred $amount from account $source_account_name to $destination_account_name", 0 , $transfer_id); + + $_SESSION['alert_message'] = "Transferred $amount from $source_account_name to $destination_account_name"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -28,6 +41,8 @@ if (isset($_POST['add_transfer'])) { if (isset($_POST['edit_transfer'])) { + enforceUserPermission('module_financial', 2); + require_once 'post/user/transfer_model.php'; @@ -41,19 +56,22 @@ if (isset($_POST['edit_transfer'])) { mysqli_query($mysqli,"UPDATE transfers SET transfer_method = '$transfer_method', transfer_notes = '$notes' WHERE transfer_id = $transfer_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Transfer', log_action = 'Modifed', log_description = '$date - $amount', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Account Transfer", "Edit", "$session_name edited transfer", 0 , $transfer_id); - $_SESSION['alert_message'] = "Transfer modified"; + $_SESSION['alert_message'] = "Transfer edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['delete_transfer'])) { + + enforceUserPermission('module_financial', 3); + $transfer_id = intval($_GET['delete_transfer']); - //Query the transfer ID to get the Payment and Expense IDs, so we can delete those as well + // Query the transfer ID to get the Payment and Expense IDs, so we can delete those as well $row = mysqli_fetch_array(mysqli_query($mysqli,"SELECT * FROM transfers WHERE transfer_id = $transfer_id")); $expense_id = intval($row['transfer_expense_id']); $revenue_id = intval($row['transfer_revenue_id']); @@ -67,6 +85,9 @@ if (isset($_GET['delete_transfer'])) { //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Transfer', log_action = 'Delete', log_description = '$transfer_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Account Transfer", "Delete", "$session_name deleted transfer"); + $_SESSION['alert_message'] = "Transfer deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); From 2047a6d18ddf8e824df41a0f04fb4202036beff8 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 12:52:56 -0500 Subject: [PATCH 012/148] removed old logging line in transfer --- post/user/transfer.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/post/user/transfer.php b/post/user/transfer.php index 0342a7cf..e2c687fc 100644 --- a/post/user/transfer.php +++ b/post/user/transfer.php @@ -82,12 +82,10 @@ if (isset($_GET['delete_transfer'])) { mysqli_query($mysqli,"DELETE FROM transfers WHERE transfer_id = $transfer_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Transfer', log_action = 'Delete', log_description = '$transfer_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); - // Logging logAction("Account Transfer", "Delete", "$session_name deleted transfer"); + $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "Transfer deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); From 670390f1d37b35c9225d848020d49ec6c5cecfe4 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 13:16:23 -0500 Subject: [PATCH 013/148] Updated trip post to use new logAction function, tidy and added more details to logging --- post/user/trip.php | 43 ++++++++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/post/user/trip.php b/post/user/trip.php index 95f66e29..1bf6fcee 100644 --- a/post/user/trip.php +++ b/post/user/trip.php @@ -11,10 +11,10 @@ if (isset($_POST['add_trip'])) { mysqli_query($mysqli,"INSERT INTO trips SET trip_date = '$date', trip_source = '$source', trip_destination = '$destination', trip_miles = $miles, round_trip = $roundtrip, trip_purpose = '$purpose', trip_user_id = $user_id, trip_client_id = $client_id"); - //logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Trip', log_action = 'Create', log_description = '$session_name logged trip to $destination', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Trip", "Create", "$session_name logged trip from $source to $destination", $client_id , $trip_id); - $_SESSION['alert_message'] = "Trip added"; + $_SESSION['alert_message'] = "Trip from $source to $destination logged"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -24,15 +24,14 @@ if (isset($_POST['edit_trip'])) { require_once 'post/user/trip_model.php'; - $trip_id = intval($_POST['trip_id']); mysqli_query($mysqli,"UPDATE trips SET trip_date = '$date', trip_source = '$source', trip_destination = '$destination', trip_miles = $miles, trip_purpose = '$purpose', round_trip = $roundtrip, trip_user_id = $user_id, trip_client_id = $client_id WHERE trip_id = $trip_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Trip', log_action = 'Modify', log_description = '$date', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Trip", "Edit", "$session_name edited trip", $client_id , $trip_id); - $_SESSION['alert_message'] = "Trip modified"; + $_SESSION['alert_message'] = "Trip edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -41,16 +40,19 @@ if (isset($_POST['edit_trip'])) { if (isset($_GET['delete_trip'])) { $trip_id = intval($_GET['delete_trip']); - //Get Client ID + // Get Trip Info and Client ID for logging $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id")); $client_id = intval($row['trip_client_id']); + $trip_source = sanitizeInput($row['trip_source']); + $trip_destination = sanitizeInput($row['trip_destination']); mysqli_query($mysqli,"DELETE FROM trips WHERE trip_id = $trip_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Trip', log_action = 'Delete', log_description = '$trip_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Trip", "Delete", "$session_name deleted trip ($trip_source - $trip_destination)", $client_id); - $_SESSION['alert_message'] = "Trip deleted"; + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Trip ($trip_source - $trip_destination) deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -74,7 +76,9 @@ if (isset($_POST['export_trips_csv'])) { ORDER BY trip_date DESC" ); - if(mysqli_num_rows($sql) > 0){ + $count = mysqli_num_rows($sql); + + if ($count > 0) { $delimiter = ","; $filename = "$session_company_name-Trips-$file_name_date.csv"; @@ -100,6 +104,9 @@ if (isset($_POST['export_trips_csv'])) { //output all remaining data on a file pointer fpassthru($f); + + // Logging + logAction("Trip", "Export", "$session_name exported $count trip(s) to a CSV file"); } exit; @@ -112,12 +119,15 @@ if (isset($_POST['export_client_trips_csv'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_array($sql); - $client_name = $row['client_name']; + $client_name = sanitizeInput($row['client_name']); $sql = mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_client_id = $client_id ORDER BY trip_date ASC"); - if($sql->num_rows > 0){ + + $count = mysqli_num_rows($sql); + + if ($count > 0) { $delimiter = ","; - $filename = $client_name . "-Trips-" . date('Y-m-d') . ".csv"; + $filename = $row['client_name'] . "-Trips-" . date('Y-m-d') . ".csv"; //create a file pointer $f = fopen('php://memory', 'w'); @@ -141,6 +151,9 @@ if (isset($_POST['export_client_trips_csv'])) { //output all remaining data on a file pointer fpassthru($f); + + // Logging + logAction("Trip", "Export", "$session_name exported $count trip(s) to a CSV file for client $client_name", $client_id); } exit; From 8ffa90ae28ff923ee74b971c30e5c8297201260f Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 13:39:17 -0500 Subject: [PATCH 014/148] Updated vendor post to use new logAction function, tidy and added more details to logging --- post/user/transfer.php | 4 +- post/user/trip.php | 2 + post/user/vendor.php | 97 ++++++++++++++++++++++-------------------- 3 files changed, 56 insertions(+), 47 deletions(-) diff --git a/post/user/transfer.php b/post/user/transfer.php index e2c687fc..d7f415ad 100644 --- a/post/user/transfer.php +++ b/post/user/transfer.php @@ -31,7 +31,7 @@ if (isset($_POST['add_transfer'])) { $transfer_id = mysqli_insert_id($mysqli); // Logging - logAction("Account Transfer", "Create", "$session_name transferred $amount from account $source_account_name to $destination_account_name", 0 , $transfer_id); + logAction("Account Transfer", "Create", "$session_name transferred $amount from account $source_account_name to $destination_account_name", 0, $transfer_id); $_SESSION['alert_message'] = "Transferred $amount from $source_account_name to $destination_account_name"; @@ -57,7 +57,7 @@ if (isset($_POST['edit_transfer'])) { mysqli_query($mysqli,"UPDATE transfers SET transfer_method = '$transfer_method', transfer_notes = '$notes' WHERE transfer_id = $transfer_id"); // Logging - logAction("Account Transfer", "Edit", "$session_name edited transfer", 0 , $transfer_id); + logAction("Account Transfer", "Edit", "$session_name edited transfer", 0, $transfer_id); $_SESSION['alert_message'] = "Transfer edited"; diff --git a/post/user/trip.php b/post/user/trip.php index 1bf6fcee..cb562a02 100644 --- a/post/user/trip.php +++ b/post/user/trip.php @@ -38,6 +38,7 @@ if (isset($_POST['edit_trip'])) { } if (isset($_GET['delete_trip'])) { + $trip_id = intval($_GET['delete_trip']); // Get Trip Info and Client ID for logging @@ -59,6 +60,7 @@ if (isset($_GET['delete_trip'])) { } if (isset($_POST['export_trips_csv'])) { + $date_from = sanitizeInput($_POST['date_from']); $date_to = sanitizeInput($_POST['date_to']); if (!empty($date_from) && !empty($date_to)){ diff --git a/post/user/vendor.php b/post/user/vendor.php index 7fe8b0f4..3dff7002 100644 --- a/post/user/vendor.php +++ b/post/user/vendor.php @@ -34,9 +34,9 @@ if (isset($_POST['add_vendor_from_template'])) { $vendor_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Create', log_description = 'Vendor created from template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + logAction("Vendor", "Create", "$session_name created vendor $name using a template", $client_id, $vendor_id); - $_SESSION['alert_message'] = "Vendor created from template"; + $_SESSION['alert_message'] = "Vendor $name created from template"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -48,15 +48,14 @@ if (isset($_POST['add_vendor'])) { require_once 'post/user/vendor_model.php'; - $client_id = intval($_POST['client_id']); // Used if this vendor is under a contact otherwise its 0 for under company mysqli_query($mysqli,"INSERT INTO vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code', vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_client_id = $client_id"); $vendor_id = mysqli_insert_id($mysqli); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Create', log_description = '$session_name created vendor $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Vendor", "Create", "$session_name created vendor $name", $client_id, $vendor_id); $_SESSION['alert_message'] = "Vendor $name created"; @@ -67,16 +66,20 @@ if (isset($_POST['edit_vendor'])) { require_once 'post/user/vendor_model.php'; - $vendor_id = intval($_POST['vendor_id']); $vendor_template_id = intval($_POST['vendor_template_id']); + // Get Client ID + $sql_vendor = mysqli_query($mysqli,"SELECT vendor_client_id FROM vendors WHERE vendor_id = $vendor_id"); + $row = mysqli_fetch_array($sql_vendor); + $client_id = intval($row['vendor_client_id']); + mysqli_query($mysqli,"UPDATE vendors SET vendor_name = '$name', vendor_description = '$description', vendor_contact_name = '$contact_name', vendor_phone = '$phone', vendor_extension = '$extension', vendor_email = '$email', vendor_website = '$website', vendor_hours = '$hours', vendor_sla = '$sla', vendor_code = '$code',vendor_account_number = '$account_number', vendor_notes = '$notes', vendor_template_id = $vendor_template_id WHERE vendor_id = $vendor_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Modify', log_description = '$session_name modified vendor $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Vendor", "Edit", "$session_name edited vendor $name", $client_id, $vendor_id); - $_SESSION['alert_message'] = "Vendor $name modified"; + $_SESSION['alert_message'] = "Vendor $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -92,11 +95,11 @@ if (isset($_GET['archive_vendor'])) { mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Archive', log_description = '$session_name archived vendor $vendor_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "Vendor $vendor_name archived"; + $_SESSION['alert_message'] = "Vendor $vendor_name archived"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -113,8 +116,8 @@ if(isset($_GET['unarchive_vendor'])){ mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Unarchive', log_description = '$session_name restored credential $vendor_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $vendor_id"); + // Logging + logAction("Vendor", "Unarchive", "$session_name unarchived vendor $vendor_name", $client_id, $vendor_id); $_SESSION['alert_message'] = "Vendor $vendor_name restored"; @@ -147,6 +150,9 @@ if (isset($_GET['delete_vendor'])) { //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Delete', log_description = '$session_name deleted vendor $vendor_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id); + $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "Vendor $vendor_name deleted"; @@ -157,13 +163,13 @@ if (isset($_POST['bulk_archive_vendors'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - $count = 0; // Default 0 - $vendor_ids = $_POST['vendor_ids']; // Get array of IDs to be deleted + if (isset($vendor_ids)) { - if (!empty($vendor_ids)) { + // Get Selected Count + $count = count($_POST['vendor_ids']); // Cycle through array and archive each record - foreach ($vendor_ids as $vendor_id) { + foreach ($_POST['vendor_ids'] as $vendor_id) { $vendor_id = intval($vendor_id); @@ -176,15 +182,14 @@ if (isset($_POST['bulk_archive_vendors'])) { mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NOW() WHERE vendor_id = $vendor_id"); // Individual Contact logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Archive', log_description = '$session_name archived vendor $vendor_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $vendor_id"); - $count++; + logAction("Vendor", "Archive", "$session_name archived vendor $vendor_name", $client_id, $vendor_id); } // Bulk Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Vendor', log_action = 'Archive', log_description = '$session_name archived $count vendors', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + logAction("Vendor", "Bulk Archive", "$session_name archived $count vendor(s)"); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "Archived $count credential(s)"; + $_SESSION['alert_message'] = "Archived $count vendor(s)"; } @@ -195,13 +200,13 @@ if (isset($_POST['bulk_unarchive_vendors'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - $count = 0; // Default 0 - $vendor_ids = $_POST['vendor_ids']; // Get array of IDs + if (isset($vendor_ids)) { - if (!empty($vendor_ids)) { + // Get Selected Count + $count = count($_POST['vendor_ids']); - // Cycle through array and unarchive - foreach ($vendor_ids as $vendor_id) { + // Cycle through array and unarchive each record + foreach ($_POST['vendor_ids'] as $vendor_id) { $vendor_id = intval($vendor_id); @@ -214,16 +219,14 @@ if (isset($_POST['bulk_unarchive_vendors'])) { mysqli_query($mysqli,"UPDATE vendors SET vendor_archived_at = NULL WHERE vendor_id = $vendor_id"); // Individual logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Unarchive', log_description = '$session_name Unarchived vendor $vendors_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $vendor_id"); + logAction("Vendor", "Unarchive", "$session_name unarchived vendor $vendor_name", $client_id, $vendor_id); - - $count++; } // Bulk Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Vendor', log_action = 'Unarchive', log_description = '$session_name Unarchived $count vendors', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + logAction("Vendor", "Bulk Unarchive", "$session_name unarchived $count vendor(s)"); - $_SESSION['alert_message'] = "Unarchived $count vendor(s)"; + $_SESSION['alert_message'] = "Unarchived $count vendor(s)"; } @@ -234,13 +237,13 @@ if (isset($_POST['bulk_delete_vendors'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - $count = 0; // Default 0 - $vendor_ids = $_POST['vendor_ids']; // Get array of IDs to be deleted + if (isset($vendor_ids)) { - if (!empty($vendor_ids)) { + // Get Selected Count + $count = count($_POST['vendor_ids']); // Cycle through array and delete each record - foreach ($vendor_ids as $vendor_id) { + foreach ($_POST['vendor_ids'] as $vendor_id) { $vendor_id = intval($vendor_id); @@ -264,15 +267,16 @@ if (isset($_POST['bulk_delete_vendors'])) { mysqli_query($mysqli,"DELETE FROM vendor_logins WHERE vendor_id = $vendor_id"); mysqli_query($mysqli,"DELETE FROM service_vendors WHERE vendor_id = $vendor_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Vendor', log_action = 'Delete', log_description = '$session_name deleted vendor $vendor_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $vendor_id"); + // Logging + logAction("Vendor", "Delete", "$session_name deleted vendor $vendor_name", $client_id); - $count++; } - // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Vendor', log_action = 'Delete', log_description = '$session_name bulk deleted $count vendors', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); - - $_SESSION['alert_message'] = "Deleted $count vendor(s)"; + // Bulk Logging + logAction("Vendor", "Bulk Delete", "$session_name deleted $count vendor(s)"); + + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Deleted $count vendor(s)"; } @@ -289,7 +293,10 @@ if (isset($_POST['export_client_vendors_csv'])) { $client_name = $row['client_name']; $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_client_id = $client_id ORDER BY vendor_name ASC"); - if ($sql->num_rows > 0) { + + $count = mysqli_num_rows($sql); + + if ($count > 0) { $delimiter = ","; $filename = $client_name . "-Vendors-" . date('Y-m-d') . ".csv"; @@ -317,8 +324,8 @@ if (isset($_POST['export_client_vendors_csv'])) { fpassthru($f); } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor', log_action = 'Export', log_description = '$session_name exported vendors to CSV', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + // Logging + logAction("Vendor", "Export", "$session_name exported $count vendor(s) to a CSV file", $client_id); exit; } From ef651f52486296c1b0e2eb89d01ddbe225bd236d Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 16:07:35 -0500 Subject: [PATCH 015/148] Updated admin posts to use new logAction function, tidy and added more details to logging --- post/admin/admin_api.php | 40 +++++++++------ post/admin/admin_backup.php | 26 ++++++---- post/admin/admin_bulk_mail.php | 16 +++--- post/admin/admin_category.php | 54 ++++++++++++++------ post/admin/admin_custom_field.php | 25 +++++---- post/admin/admin_custom_link.php | 26 ++++++---- post/admin/admin_document_template.php | 7 +-- post/admin/admin_mail_queue.php | 37 ++++++++------ post/admin/admin_project_template.php | 27 ++++------ post/admin/admin_role.php | 13 +++-- post/admin/admin_settings_ai.php | 6 +-- post/admin/admin_settings_company.php | 6 +-- post/admin/admin_settings_default.php | 6 +-- post/admin/admin_settings_integration.php | 4 +- post/admin/admin_settings_invoice.php | 5 +- post/admin/admin_settings_localization.php | 4 +- post/admin/admin_settings_mail.php | 6 +-- post/admin/admin_settings_module.php | 4 +- post/admin/admin_settings_notification.php | 10 ++-- post/admin/admin_settings_online_payment.php | 4 +- post/admin/admin_settings_project.php | 4 +- post/admin/admin_settings_quote.php | 4 +- post/admin/admin_settings_security.php | 4 +- post/admin/admin_settings_telemetry.php | 4 +- post/admin/admin_settings_theme.php | 10 ++-- post/admin/admin_settings_ticket.php | 4 +- 26 files changed, 204 insertions(+), 152 deletions(-) diff --git a/post/admin/admin_api.php b/post/admin/admin_api.php index b5e0a54a..8817b62a 100644 --- a/post/admin/admin_api.php +++ b/post/admin/admin_api.php @@ -10,19 +10,19 @@ if (isset($_POST['add_api_key'])) { $name = sanitizeInput($_POST['name']); $expire = sanitizeInput($_POST['expire']); - $client = intval($_POST['client']); + $client_id = intval($_POST['client']); $secret = sanitizeInput($_POST['key']); // API Key // Credential decryption password $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT); $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password'])); - mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client"); + mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client_id"); $api_key_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API', log_action = 'Create', log_description = '$session_name created API Key $name set to expire on $expire', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client, log_user_id = $session_user_id, log_entity_id = $api_key_id"); + logAction("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id); $_SESSION['alert_message'] = "API Key $name created"; @@ -37,13 +37,14 @@ if (isset($_GET['delete_api_key'])) { $api_key_id = intval($_GET['delete_api_key']); // Get API Key Name - $row = mysqli_fetch_array(mysqli_query($mysqli,"SELECT * FROM api_keys WHERE api_key_id = $api_key_id")); - $name = sanitizeInput($row['api_key_name']); + $row = mysqli_fetch_array(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); + $api_key_name = sanitizeInput($row['api_key_name']); + $client_id = intval($row['api_key_client_id']); mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'API Key', log_action = 'Delete', log_description = '$session_name deleted API key $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $api_key_id"); + logAction("API Key", "Delete", "$session_name deleted API key $name", $client_id); $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "API Key $name deleted"; @@ -56,25 +57,32 @@ if (isset($_POST['bulk_delete_api_keys'])) { validateCSRFToken($_POST['csrf_token']); - $count = 0; // Default 0 - $api_key_ids = $_POST['api_key_ids']; // Get array of API key IDs to be deleted + if (isset($_POST['api_key_ids'])) { - if (!empty($api_key_ids)) { + $count = count($_POST['api_key_ids']); - // Cycle through array and delete each scheduled ticket - foreach ($api_key_ids as $api_key_id) { + // Cycle through array and delete each record + foreach ($_POST['api_key_ids'] as $api_key_id) { $api_key_id = intval($api_key_id); - mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API Key', log_action = 'Delete', log_description = '$session_name deleted API key (bulk)', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $api_key_id"); + + // Get API Key Name + $row = mysqli_fetch_array(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); + $api_key_name = sanitizeInput($row['api_key_name']); + $client_id = intval($row['api_key_client_id']); + + mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); + + // Logging + logAction("API Key", "Delete", "$session_name deleted API key $name", $client_id); - $count++; } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API Key', log_action = 'Delete', log_description = '$session_name bulk deleted $count keys', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("API Key", "Bulk Delete", "$session_name deleted $count API key(s)"); - $_SESSION['alert_message'] = "Deleted $count keys(s)"; + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Deleted $count API keys(s)"; } diff --git a/post/admin/admin_backup.php b/post/admin/admin_backup.php index 5ae7cfb4..8649e91d 100644 --- a/post/admin/admin_backup.php +++ b/post/admin/admin_backup.php @@ -79,8 +79,8 @@ if (isset($_GET['download_database'])) { exec('rm ' . $backup_file_name); } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Database', log_action = 'Download', log_description = '$session_name downloaded the database', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Database", "Download", "$session_name downloaded the database"); $_SESSION['alert_message'] = "Database downloaded"; } @@ -92,25 +92,29 @@ if (isset($_POST['backup_master_key'])) { $password = $_POST['password']; $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id"); - $userRow = mysqli_fetch_array($sql); + $row = mysqli_fetch_array($sql); - if (password_verify($password, $userRow['user_password'])) { - $site_encryption_master_key = decryptUserSpecificKey($userRow['user_specific_encryption_ciphertext'], $password); - - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Master Key', log_action = 'Download', log_description = '$session_name retrieved the master encryption key', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); - mysqli_query($mysqli,"INSERT INTO notifications SET notification_type = 'Settings', notification = '$session_name retrieved the master encryption key'"); + if (password_verify($password, $row['user_password'])) { + $site_encryption_master_key = decryptUserSpecificKey($row['user_specific_encryption_ciphertext'], $password); + + // Logging + logAction("Master Key", "Download", "$session_name retrieved the master encryption key"); + // App Notify + appNotify("Master Key", "$session_name retrieved the master encryption key"); echo "=============================="; echo "
Master encryption key:
"; echo "$site_encryption_master_key"; echo "
=============================="; + } else { - //Log the failure - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Master Key', log_action = 'Download', log_description = '$session_name attempted to retrieve the master encryption key (failure)', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Log the failure + logAction("Master Key", "Download", "$session_name attempted to retrieve the master encryption key but failed"); + $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "Incorrect password."; + header("Location: " . $_SERVER["HTTP_REFERER"]); } } diff --git a/post/admin/admin_bulk_mail.php b/post/admin/admin_bulk_mail.php index dc26b722..cdbf999f 100644 --- a/post/admin/admin_bulk_mail.php +++ b/post/admin/admin_bulk_mail.php @@ -6,7 +6,9 @@ if (isset($_POST['send_bulk_mail_now'])) { - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { + + $count = count($_POST['contact_ids']); $mail_from = sanitizeInput($_POST['mail_from']); $mail_from_name = sanitizeInput($_POST['mail_from_name']); @@ -36,15 +38,11 @@ if (isset($_POST['send_bulk_mail_now'])) { ]; } addToMailQueue($mysqli, $data); - - // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Bulk Mail', log_action = 'Send', log_description = '$session_name sent bulk email', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); - $_SESSION['alert_message'] = "You Sent Bulk Mail"; - - } else { - - $_SESSION['alert_message'] = "NO Bulk Mail SENT"; + // Logging + logAction("Bulk Mail", "Send", "$session_name sent $count messages via bulk mail"); + + $_SESSION['alert_message'] = "$count messages queued"; } diff --git a/post/admin/admin_category.php b/post/admin/admin_category.php index f89d37bf..c3a97fc2 100644 --- a/post/admin/admin_category.php +++ b/post/admin/admin_category.php @@ -10,10 +10,12 @@ if (isset($_POST['add_category'])) { mysqli_query($mysqli,"INSERT INTO categories SET category_name = '$name', category_type = '$type', category_color = '$color'"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Category', log_action = 'Create', log_description = '$name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $category_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Category added"; + // Logging + logAction("Category", "Create", "$session_name created category $type $name", 0, $category_id); + + $_SESSION['alert_message'] = "Category $type $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -27,53 +29,75 @@ if (isset($_POST['edit_category'])) { mysqli_query($mysqli,"UPDATE categories SET category_name = '$name', category_type = '$type', category_color = '$color' WHERE category_id = $category_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Category', log_action = 'Modify', log_description = '$name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Category", "Edit", "$session_name edited category $type $name", 0, $category_id); - $_SESSION['alert_message'] = "Category modified"; + $_SESSION['alert_message'] = "Category $type $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['archive_category'])) { + $category_id = intval($_GET['archive_category']); + // Get Category Name and Type for logging + $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); + $row = mysqli_fetch_array($sql); + $category_name = sanitizeInput($row['category_name']); + $category_type = sanitizeInput($row['category_type']); + mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NOW() WHERE category_id = $category_id"); - //logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Category', log_action = 'Archive', log_description = '$category_id'"); + // Logging + logAction("Category", "Archive", "$session_name archived category $type $name", 0, $category_id); - $_SESSION['alert_message'] = "Category Archived"; + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Category $type $name archived"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['unarchive_category'])) { + $category_id = intval($_GET['unarchive_category']); + // Get Category Name and Type for logging + $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); + $row = mysqli_fetch_array($sql); + $category_name = sanitizeInput($row['category_name']); + $category_type = sanitizeInput($row['category_type']); + mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NULL WHERE category_id = $category_id"); - //logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Category', log_action = 'Unarchive', log_description = '$category_id'"); + // Logging + logAction("Category", "Unarchive", "$session_name unarchived category $type $name", 0, $category_id); - $_SESSION['alert_message'] = "Category Unarchived"; + $_SESSION['alert_message'] = "Category $type $name unarchived"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['delete_category'])) { + $category_id = intval($_GET['delete_category']); + // Get Category Name and Type for logging + $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); + $row = mysqli_fetch_array($sql); + $category_name = sanitizeInput($row['category_name']); + $category_type = sanitizeInput($row['category_type']); + mysqli_query($mysqli,"DELETE FROM categories WHERE category_id = $category_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Category', log_action = 'Delete', log_description = '$category_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Category", "Delete", "$session_name deleted category $type $name"); - $_SESSION['alert_message'] = "Category deleted"; $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Category $type $name deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_custom_field.php b/post/admin/admin_custom_field.php index 00c1769d..85f2a739 100644 --- a/post/admin/admin_custom_field.php +++ b/post/admin/admin_custom_field.php @@ -12,10 +12,12 @@ if(isset($_POST['create_custom_field'])){ mysqli_query($mysqli,"INSERT INTO custom_fields SET custom_field_table = '$table', custom_field_label = '$label', custom_field_type = '$type'"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Custom Field', log_action = 'Create', log_description = '$label', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $custom_field_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Custom field created"; + // Logging + logAction("Custom Field", "Create", "$session_name created custom field $label", 0, $custom_field_id); + + $_SESSION['alert_message'] = "Custom field $label created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -29,10 +31,10 @@ if(isset($_POST['edit_custom_field'])){ mysqli_query($mysqli,"UPDATE custom_fields SET custom_field_label = '$label', custom_field_type = '$type' WHERE custom_field_id = $custom_field_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Custom Field', log_action = 'Edit', log_description = '$label', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Custom Field", "Edit", "$session_name edited custom field $label", 0, $custom_field_id); - $_SESSION['alert_message'] = "You edited the custom field"; + $_SESSION['alert_message'] = "Custom field $label edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -41,13 +43,18 @@ if(isset($_POST['edit_custom_field'])){ if(isset($_GET['delete_custom_field'])){ $custom_field_id = intval($_GET['delete_custom_field']); + // Get Custom Field Label for logging + $sql = mysqli_query($mysqli,"SELECT custom_field_label FROM custom_fields WHERE custom_field_id = $custom_field_id"); + $row = mysqli_fetch_array($sql); + $custom_field_label = sanitizeInput($row['custom_field_label']); + mysqli_query($mysqli,"DELETE FROM custom_fields WHERE custom_field_id = $custom_field_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Custom Fields', log_action = 'Delete', log_description = '$custom_field_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Custom Field", "Delete", "$session_name deleted custom field $label"); - $_SESSION['alert_message'] = "You deleted custom field"; $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Custom field $label deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_custom_link.php b/post/admin/admin_custom_link.php index 5a84be51..a49c2975 100644 --- a/post/admin/admin_custom_link.php +++ b/post/admin/admin_custom_link.php @@ -15,10 +15,12 @@ if (isset($_POST['add_custom_link'])) { mysqli_query($mysqli,"INSERT INTO custom_links SET custom_link_name = '$name', custom_link_uri = '$uri', custom_link_new_tab = $new_tab, custom_link_icon = '$icon', custom_link_order = $order, custom_link_location = $location"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Custom Link', log_action = 'Create', log_description = '$session_name created custom link $name --> $uri', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $custom_link_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Custom link successfully created!"; + // Logging + logAction("Custom Link", "Create", "$session_name created custom link $name -> $uri", 0, $custom_link_id); + + $_SESSION['alert_message'] = "Custom link $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -36,10 +38,10 @@ if (isset($_POST['edit_custom_link'])) { mysqli_query($mysqli,"UPDATE custom_links SET custom_link_name = '$name', custom_link_uri = '$uri', custom_link_new_tab = $new_tab, custom_link_icon = '$icon', custom_link_order = $order, custom_link_location = $location WHERE custom_link_id = $custom_link_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Custom Link', log_action = 'Modify', log_description = '$session_name edited the custom link $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Custom Link", "Edit", "$session_name edited custom link $name -> $uri", 0, $custom_link_id); - $_SESSION['alert_message'] = "Custom Link modified"; + $_SESSION['alert_message'] = "Custom Link $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -48,13 +50,19 @@ if (isset($_POST['edit_custom_link'])) { if (isset($_GET['delete_custom_link'])) { $custom_link_id = intval($_GET['delete_custom_link']); + // Get Custom Link name and uri for logging + $sql = mysqli_query($mysqli,"SELECT custom_link_name, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id"); + $row = mysqli_fetch_array($sql); + $custom_link_name = sanitizeInput($row['custom_link_name']); + $custom_link_uri = sanitizeInput($row['custom_link_uri']); + mysqli_query($mysqli,"DELETE FROM custom_links WHERE custom_link_id = $custom_link_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Custom Link', log_action = 'Delete', log_description = '$session_name deleted a custom link', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Custom Link", "Delete", "$session_name deleted custom link $custom_link_name -> $custom_link_uri"); - $_SESSION['alert_message'] = "Custom Link deleted!"; $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Custom Link $name deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_document_template.php b/post/admin/admin_document_template.php index cb2431ed..40cdd2e9 100644 --- a/post/admin/admin_document_template.php +++ b/post/admin/admin_document_template.php @@ -14,12 +14,13 @@ if (isset($_POST['add_document_template'])) { $content_raw = sanitizeInput($_POST['name'] . " " . str_replace("<", " <", $_POST['content'])); // Content Raw is used for FULL INDEX searching. Adding a space before HTML tags to allow spaces between newlines, bulletpoints, etc. for searching. - // Document add query - $add_document = mysqli_query($mysqli,"INSERT INTO documents SET document_name = '$name', document_description = '$description', document_content = '$content', document_content_raw = '$content_raw', document_template = 1, document_folder_id = 0, document_created_by = $session_user_id, document_client_id = 0"); + // Document create query + mysqli_query($mysqli,"INSERT INTO documents SET document_name = '$name', document_description = '$description', document_content = '$content', document_content_raw = '$content_raw', document_template = 1, document_folder_id = 0, document_created_by = $session_user_id, document_client_id = 0"); + $document_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Document Template', log_action = 'Create', log_description = '$session_name created document template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $document_id"); + logAction("Document Template", "Create", "$session_name created document template $name", $client_id, $document_id); $_SESSION['alert_message'] = "Document template $name created"; diff --git a/post/admin/admin_mail_queue.php b/post/admin/admin_mail_queue.php index b6210f64..f178dc5c 100644 --- a/post/admin/admin_mail_queue.php +++ b/post/admin/admin_mail_queue.php @@ -7,7 +7,7 @@ if (isset($_GET['send_failed_mail'])) { mysqli_query($mysqli,"UPDATE email_queue SET email_status = 0, email_attempts = 3 WHERE email_id = $email_id"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Email', log_action = 'Send', log_description = '$session_name attempted to force send email queue id: $email_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $email_id"); + logAction("Email", "Send", "$session_name attempted to force send email id: $email_id in the mail queue", 0, $email_id); $_SESSION['alert_message'] = "Email Force Sent, give it a minute to resend"; @@ -22,8 +22,9 @@ if (isset($_GET['cancel_mail'])) { mysqli_query($mysqli,"UPDATE email_queue SET email_status = 2, email_attempts = 99, email_failed_at = NOW() WHERE email_id = $email_id"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Email', log_action = 'Cancel', log_description = '$session_name canceled send email queue id: $email_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $email_id"); + logAction("Email", "Send", "$session_name canceled send email id: $email_id in the mail queue", 0, $email_id); + $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "Email cancelled and marked as failed."; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -34,24 +35,25 @@ if (isset($_POST['bulk_cancel_emails'])) { validateCSRFToken($_POST['csrf_token']); - $count = 0; // Default 0 - $email_ids = $_POST['email_ids']; // Get array of email IDs to be cancelled + if (isset($_POST['email_ids'])) { - if (!empty($email_ids)) { + $count = count($_POST['email_ids']); // Cycle through array and mark each email as failed - foreach ($email_ids as $email_id) { + foreach ($_POST['email_ids'] as $email_id) { $email_id = intval($email_id); mysqli_query($mysqli,"UPDATE email_queue SET email_status = 2, email_attempts = 99, email_failed_at = NOW() WHERE email_id = $email_id"); - $count++; + // Logging + logAction("Email", "Cancel", "$session_name cancelled email id: $email_id in the mail queue", 0, $email_id); + } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Email', log_action = 'Cancel', log_description = '$session_name bulk cancelled $count emails from the mail Queue', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Email", "Bulk Cancel", "$session_name cancelled $count email(s) in the mail queue"); - $_SESSION['alert_message'] = "Cancelled $count email(s)"; + $_SESSION['alert_message'] = "Cancelled $count email(s)"; } @@ -62,25 +64,26 @@ if (isset($_POST['bulk_delete_emails'])) { validateCSRFToken($_POST['csrf_token']); - $count = 0; // Default 0 - $email_ids = $_POST['email_ids']; // Get array of email IDs to be deleted + if (isset($_POST['email_ids'])) { - if (!empty($email_ids)) { + $count = count($_POST['email_ids']); // Cycle through array and delete each email - foreach ($email_ids as $email_id) { + foreach ($_POST['email_ids'] as $email_id) { $email_id = intval($email_id); mysqli_query($mysqli,"DELETE FROM email_queue WHERE email_id = $email_id"); - $count++; + // Logging + logAction("Email", "Delete", "$session_name deleted email id: $email_id from the mail queue"); + } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Email', log_action = 'Delete', log_description = '$session_name bulk deleted $count emails from the mail Queue', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Email", "Bulk Delete", "$session_name deleted $count email(s) from the mail queue"); - $_SESSION['alert_type'] = "danger"; - $_SESSION['alert_message'] = "Deleted $count email(s)"; + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Deleted $count email(s)"; } diff --git a/post/admin/admin_project_template.php b/post/admin/admin_project_template.php index f9bf373b..790828a7 100644 --- a/post/admin/admin_project_template.php +++ b/post/admin/admin_project_template.php @@ -2,7 +2,6 @@ if (isset($_POST['add_project_template'])) { - validateTechRole(); $name = sanitizeInput($_POST['name']); $description = sanitizeInput($_POST['description']); @@ -11,9 +10,9 @@ if (isset($_POST['add_project_template'])) { $project_template_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Project Template', log_action = 'Create', log_description = '$session_name created project template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $project_template_id"); + logAction("Project Template", "Create", "$session_name created project template $name", 0, $project_template_id); - $_SESSION['alert_message'] = "You created Project Template $name"; + $_SESSION['alert_message'] = "Project Template $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -21,7 +20,6 @@ if (isset($_POST['add_project_template'])) { if (isset($_POST['edit_project_template'])) { - validateTechRole(); $project_template_id = intval($_POST['project_template_id']); $name = sanitizeInput($_POST['name']); $description = sanitizeInput($_POST['description']); @@ -29,16 +27,15 @@ if (isset($_POST['edit_project_template'])) { mysqli_query($mysqli, "UPDATE project_templates SET project_template_name = '$name', project_template_description = '$description' WHERE project_template_id = $project_template_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Project Template', log_action = 'Edit', log_description = '$session_name edited Project template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $project_template_id"); + logAction("Project Template", "Edit", "$session_name edited project template $name", 0, $project_template_id); - $_SESSION['alert_message'] = "You edited Project Template $name"; + $_SESSION['alert_message'] = "Project Template $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_POST['edit_ticket_template_order'])) { - validateTechRole(); $ticket_template_id = intval($_POST['ticket_template_id']); $project_template_id = intval($_POST['project_template_id']); $order = intval($_POST['order']); @@ -50,7 +47,6 @@ if (isset($_POST['edit_ticket_template_order'])) { if (isset($_POST['add_ticket_template_to_project_template'])) { - validateTechRole(); $project_template_id = intval($_POST['project_template_id']); $ticket_template_id = intval($_POST['ticket_template_id']); $order = intval($_POST['order']); @@ -58,9 +54,9 @@ if (isset($_POST['add_ticket_template_to_project_template'])) { mysqli_query($mysqli, "INSERT INTO project_template_ticket_templates SET project_template_id = $project_template_id, ticket_template_id = $ticket_template_id, ticket_template_order = $order"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Project Template', log_action = 'Edit', log_description = '$session_name added a ticket template to project template', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $project_template_id"); + logAction("Project Template", "Edit", "$session_name added ticket template to project_template", 0, $project_template_id); - $_SESSION['alert_message'] = "You added a ticket template to the project template"; + $_SESSION['alert_message'] = "Ticket template added"; header("Location: " . $_SERVER["HTTP_REFERER"]); } @@ -74,17 +70,16 @@ if (isset($_POST['remove_ticket_template_from_project_template'])) { mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE project_template_id = $project_template_id AND ticket_template_id = $ticket_template_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Project Template', log_action = 'Edit', log_description = '$session_name removed a ticket template from a project template', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $project_template_id"); + logAction("Project Template", "Edit", "$session_name removed ticket template from project template", 0, $project_template_id); - $_SESSION['alert_message'] = "You removed ticket template from the project template"; + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Ticket template removed"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['delete_project_template'])) { - validateTechRole(); - $project_template_id = intval($_GET['delete_project_template']); // Get project template name @@ -98,10 +93,10 @@ if (isset($_GET['delete_project_template'])) { mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE project_template_id = $project_template_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Project Template', log_action = 'Delete', log_description = '$session_name deleted ticket template $project_template_name and its associated ticket templates and its tasks', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $project_template_id"); + logAction("Project Template", "Delete", "$session_name deleted project template $project_template_name and its associated ticket templates and tasks"); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "You Deleted Project Template $project_template_name and its associated ticket templates and tasks"; + $_SESSION['alert_message'] = "Project Template $project_template_name and its associated ticket templates and tasks deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin/admin_role.php b/post/admin/admin_role.php index 33e10985..54471a12 100644 --- a/post/admin/admin_role.php +++ b/post/admin/admin_role.php @@ -14,9 +14,12 @@ if (isset($_POST['add_role'])) { mysqli_query($mysqli, "INSERT INTO user_roles SET user_role_name = '$name', user_role_description = '$description', user_role_is_admin = $admin"); - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Role', log_action = 'Create', log_description = '$session_name created the $name role', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $user_role_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Role $name created"; + // Logging + logAction("User Role", "Create", "$session_name created user role $name", 0, $user_role_id); + + $_SESSION['alert_message'] = "User Role created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -31,6 +34,7 @@ if (isset($_POST['edit_role'])) { $name = sanitizeInput($_POST['role_name']); $description = sanitizeInput($_POST['role_description']); $admin = intval($_POST['role_is_admin']); + mysqli_query($mysqli, "UPDATE user_roles SET user_role_name = '$name', user_role_description = '$description', user_role_is_admin = $admin WHERE user_role_id = $role_id"); // Update role access levels @@ -48,9 +52,10 @@ if (isset($_POST['edit_role'])) { } - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Role', log_action = 'Modify', log_description = '$session_name updated the $name role', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("User Role", "Edit", "$session_name edited user role $name", 0, $role_id); - $_SESSION['alert_message'] = "Role $name updated"; + $_SESSION['alert_message'] = "User Role $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin/admin_settings_ai.php b/post/admin/admin_settings_ai.php index e11ae7d4..ad7dac98 100644 --- a/post/admin/admin_settings_ai.php +++ b/post/admin/admin_settings_ai.php @@ -16,10 +16,10 @@ if (isset($_POST['edit_ai_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_ai_enable = $ai_enable, config_ai_provider = '$provider', config_ai_model = '$model', config_ai_url = '$url', config_ai_api_key = '$api_key' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Edit', log_description = '$session_name edited AI settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited AI settings"); - $_SESSION['alert_message'] = "You updated the AI Settings"; + $_SESSION['alert_message'] = "AI Settings updated"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_settings_company.php b/post/admin/admin_settings_company.php index a1d3bcc7..6ec33b45 100644 --- a/post/admin/admin_settings_company.php +++ b/post/admin/admin_settings_company.php @@ -45,10 +45,10 @@ if (isset($_POST['edit_company'])) { mysqli_query($mysqli,"UPDATE companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Company', log_action = 'Modify', log_description = '$session_name modified company $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited company details"); - $_SESSION['alert_message'] = "Company $name updated"; + $_SESSION['alert_message'] = "Company $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_settings_default.php b/post/admin/admin_settings_default.php index d717a06a..ba4746d8 100644 --- a/post/admin/admin_settings_default.php +++ b/post/admin/admin_settings_default.php @@ -18,10 +18,10 @@ if (isset($_POST['edit_default_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_start_page = '$start_page', config_default_expense_account = $expense_account, config_default_payment_account = $payment_account, config_default_payment_method = '$payment_method', config_default_expense_payment_method = '$expense_payment_method', config_default_transfer_from_account = $transfer_from_account, config_default_transfer_to_account = $transfer_to_account, config_default_calendar = $calendar, config_default_net_terms = $net_terms, config_default_hourly_rate = $hourly_rate, config_phone_mask = $phone_mask WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified default settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited default settings"); - $_SESSION['alert_message'] = "Default settings updated"; + $_SESSION['alert_message'] = "Default settings edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin/admin_settings_integration.php b/post/admin/admin_settings_integration.php index 4d9f72ae..2a8fa844 100644 --- a/post/admin/admin_settings_integration.php +++ b/post/admin/admin_settings_integration.php @@ -9,8 +9,8 @@ if (isset($_POST['edit_integrations_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_azure_client_id = '$azure_client_id', config_azure_client_secret = '$azure_client_secret' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified integrations settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited integrations settings"); $_SESSION['alert_message'] = "Integrations Settings updated"; diff --git a/post/admin/admin_settings_invoice.php b/post/admin/admin_settings_invoice.php index 34501741..2cf4c690 100644 --- a/post/admin/admin_settings_invoice.php +++ b/post/admin/admin_settings_invoice.php @@ -16,11 +16,10 @@ if (isset($_POST['edit_invoice_settings'])) { $config_invoice_paid_notification_email = sanitizeInput($_POST['config_invoice_paid_notification_email']); } - mysqli_query($mysqli,"UPDATE settings SET config_invoice_prefix = '$config_invoice_prefix', config_invoice_next_number = $config_invoice_next_number, config_invoice_footer = '$config_invoice_footer', config_invoice_late_fee_enable = $config_invoice_late_fee_enable, config_invoice_late_fee_percent = $config_invoice_late_fee_percent, config_invoice_paid_notification_email = '$config_invoice_paid_notification_email', config_recurring_prefix = '$config_recurring_prefix', config_recurring_next_number = $config_recurring_next_number WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Edit', log_description = '$session_name edited invoice settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited invoice settings"); $_SESSION['alert_message'] = "Invoice Settings edited"; diff --git a/post/admin/admin_settings_localization.php b/post/admin/admin_settings_localization.php index bf918e77..7f4996a4 100644 --- a/post/admin/admin_settings_localization.php +++ b/post/admin/admin_settings_localization.php @@ -12,8 +12,8 @@ if (isset($_POST['edit_localization'])) { mysqli_query($mysqli,"UPDATE settings SET config_timezone = '$timezone' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Company', log_action = 'Edit', log_description = '$session_name edited company localization settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited localization settings"); $_SESSION['alert_message'] = "Company localization updated"; diff --git a/post/admin/admin_settings_mail.php b/post/admin/admin_settings_mail.php index d09bea38..800ddc6d 100644 --- a/post/admin/admin_settings_mail.php +++ b/post/admin/admin_settings_mail.php @@ -14,7 +14,7 @@ if (isset($_POST['edit_mail_smtp_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_smtp_host = '$config_smtp_host', config_smtp_port = $config_smtp_port, config_smtp_encryption = '$config_smtp_encryption', config_smtp_username = '$config_smtp_username', config_smtp_password = '$config_smtp_password' WHERE company_id = 1"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified SMTP mail settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Settings", "Edit", "$session_name edited SMTP mail settings"); $_SESSION['alert_message'] = "SMTP Mail Settings updated"; @@ -36,7 +36,7 @@ if (isset($_POST['edit_mail_imap_settings'])) { // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified IMAP mail settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Settings", "Edit", "$session_name edited IMAP mail settings"); $_SESSION['alert_message'] = "IMAP Mail Settings updated"; @@ -63,7 +63,7 @@ if (isset($_POST['edit_mail_from_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_mail_from_email = '$config_mail_from_email', config_mail_from_name = '$config_mail_from_name', config_invoice_from_email = '$config_invoice_from_email', config_invoice_from_name = '$config_invoice_from_name', config_quote_from_email = '$config_quote_from_email', config_quote_from_name = '$config_quote_from_name', config_ticket_from_email = '$config_ticket_from_email', config_ticket_from_name = '$config_ticket_from_name' WHERE company_id = 1"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified Mail From settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Settings", "Edit", "$session_name edited mail from settings"); $_SESSION['alert_message'] = "Mail From Settings updated"; diff --git a/post/admin/admin_settings_module.php b/post/admin/admin_settings_module.php index 4d231c0a..4df41c9a 100644 --- a/post/admin/admin_settings_module.php +++ b/post/admin/admin_settings_module.php @@ -17,8 +17,8 @@ if (isset($_POST['edit_module_settings'])) { mysqli_query($mysqli, "UPDATE settings SET config_whitelabel_enabled = 0, config_whitelabel_key = '' WHERE company_id = 1"); } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified module settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited module settings"); $_SESSION['alert_message'] = "Module Settings updated"; diff --git a/post/admin/admin_settings_notification.php b/post/admin/admin_settings_notification.php index ea833ae0..10e9e196 100644 --- a/post/admin/admin_settings_notification.php +++ b/post/admin/admin_settings_notification.php @@ -13,8 +13,8 @@ if (isset($_POST['edit_notification_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_send_invoice_reminders = $config_send_invoice_reminders, config_recurring_auto_send_invoice = $config_recurring_auto_send_invoice, config_enable_cron = $config_enable_cron, config_enable_alert_domain_expire = $config_enable_alert_domain_expire, config_ticket_client_general_notifications = $config_ticket_client_general_notifications WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified notification settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited notification settings"); $_SESSION['alert_message'] = "Notification Settings updated"; @@ -28,10 +28,10 @@ if (isset($_GET['generate_cron_key'])) { mysqli_query($mysqli,"UPDATE settings SET config_cron_key = '$key' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name regenerated cron key', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name regenerated the cron key"); - $_SESSION['alert_message'] = "Cron key regenerated!"; + $_SESSION['alert_message'] = "Cron key regenerated"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_settings_online_payment.php b/post/admin/admin_settings_online_payment.php index 9d1a72d1..06f1498a 100644 --- a/post/admin/admin_settings_online_payment.php +++ b/post/admin/admin_settings_online_payment.php @@ -15,8 +15,8 @@ if (isset($_POST['edit_online_payment_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_stripe_enable = $config_stripe_enable, config_stripe_publishable = '$config_stripe_publishable', config_stripe_secret = '$config_stripe_secret', config_stripe_account = $config_stripe_account, config_stripe_expense_vendor = $config_stripe_expense_vendor, config_stripe_expense_category = $config_stripe_expense_category, config_stripe_percentage_fee = $config_stripe_percentage_fee, config_stripe_flat_fee = $config_stripe_flat_fee WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified online payment settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited online payment settings"); $_SESSION['alert_message'] = "Online Payment Settings updated"; diff --git a/post/admin/admin_settings_project.php b/post/admin/admin_settings_project.php index a35d5d9d..f2b42fda 100644 --- a/post/admin/admin_settings_project.php +++ b/post/admin/admin_settings_project.php @@ -9,8 +9,8 @@ if (isset($_POST['edit_project_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_project_prefix = '$config_project_prefix', config_project_next_number = $config_project_next_number WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified project settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited project settings"); $_SESSION['alert_message'] = "Project Settings updated"; diff --git a/post/admin/admin_settings_quote.php b/post/admin/admin_settings_quote.php index f85de889..99df3d08 100644 --- a/post/admin/admin_settings_quote.php +++ b/post/admin/admin_settings_quote.php @@ -14,8 +14,8 @@ if (isset($_POST['edit_quote_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_quote_prefix = '$config_quote_prefix', config_quote_next_number = $config_quote_next_number, config_quote_footer = '$config_quote_footer', config_quote_notification_email = '$config_quote_notification_email' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified quote settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited Quote settings"); $_SESSION['alert_message'] = "Quote Settings updated"; diff --git a/post/admin/admin_settings_security.php b/post/admin/admin_settings_security.php index d18b14a5..e0b388ee 100644 --- a/post/admin/admin_settings_security.php +++ b/post/admin/admin_settings_security.php @@ -13,9 +13,9 @@ if (isset($_POST['edit_security_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_login_message = '$config_login_message', config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret', config_login_remember_me_expire = $config_login_remember_me_expire, config_log_retention = $config_log_retention WHERE company_id = 1"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified login key settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Settings", "Edit", "$session_name edited security settings"); - $_SESSION['alert_message'] = "Login key settings updated"; + $_SESSION['alert_message'] = "Security settings updated"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin/admin_settings_telemetry.php b/post/admin/admin_settings_telemetry.php index 9eb312c7..59fc0c5f 100644 --- a/post/admin/admin_settings_telemetry.php +++ b/post/admin/admin_settings_telemetry.php @@ -8,8 +8,8 @@ if (isset($_POST['edit_telemetry_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_telemetry = $config_telemetry WHERE company_id = 1"); - // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified telemetry settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited telemetry settings"); $_SESSION['alert_message'] = "Telemetry Settings updated"; diff --git a/post/admin/admin_settings_theme.php b/post/admin/admin_settings_theme.php index 461f4ce6..0f341353 100644 --- a/post/admin/admin_settings_theme.php +++ b/post/admin/admin_settings_theme.php @@ -8,8 +8,8 @@ if (isset($_POST['edit_theme_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_theme = '$theme' WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified theme settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited theme settings"); $_SESSION['alert_message'] = "Changed theme to $theme"; @@ -45,10 +45,10 @@ if (isset($_POST['edit_favicon_settings'])) { } } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name updated the favicon', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name changed the favicon"); - $_SESSION['alert_message'] = "You updated the favicon"; + $_SESSION['alert_message'] = "Favicon Updated"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_settings_ticket.php b/post/admin/admin_settings_ticket.php index 72492184..d59523d4 100644 --- a/post/admin/admin_settings_ticket.php +++ b/post/admin/admin_settings_ticket.php @@ -15,8 +15,8 @@ if (isset($_POST['edit_ticket_settings'])) { mysqli_query($mysqli,"UPDATE settings SET config_ticket_prefix = '$config_ticket_prefix', config_ticket_next_number = $config_ticket_next_number, config_ticket_email_parse = $config_ticket_email_parse, config_ticket_email_parse_unknown_senders = $config_ticket_email_parse_unknown_senders, config_ticket_autoclose_hours = $config_ticket_autoclose_hours, config_ticket_new_ticket_notification_email = '$config_ticket_new_ticket_notification_email', config_ticket_default_billable = $config_ticket_default_billable WHERE company_id = 1"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Modify', log_description = '$session_name modified ticket settings', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Settings", "Edit", "$session_name edited ticket settings"); $_SESSION['alert_message'] = "Ticket Settings updated"; From 5bdd5d1f796bb921023ebc6b78cddbe64c12dc73 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 17:20:52 -0500 Subject: [PATCH 016/148] Finished Updating admin / settings posts to use new logAction function, tidy and added more details to logging --- post/admin/admin_software_template.php | 14 +++++----- post/admin/admin_tag.php | 25 ++++++++++------- post/admin/admin_tax.php | 37 +++++++++++++++++--------- post/admin/admin_ticket_status.php | 12 ++++----- post/admin/admin_ticket_template.php | 28 +++++++++---------- post/admin/admin_user.php | 33 +++++++++++++---------- post/admin/admin_vendor_template.php | 10 +++---- post/admin_update.php | 8 +++--- 8 files changed, 95 insertions(+), 72 deletions(-) diff --git a/post/admin/admin_software_template.php b/post/admin/admin_software_template.php index f999e0e9..e0f9d019 100644 --- a/post/admin/admin_software_template.php +++ b/post/admin/admin_software_template.php @@ -17,10 +17,12 @@ if (isset($_POST['add_software_template'])) { mysqli_query($mysqli,"INSERT INTO software SET software_name = '$name', software_version = '$version', software_description = '$description', software_type = '$type', software_license_type = '$license_type', software_notes = '$notes', software_template = 1, software_client_id = 0"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Software Template', log_action = 'Create', log_description = '$session_user_name created software template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $software_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Software template created"; + // Logging + logAction("Software Template", "Create", "$session_name created software template $name", 0, $software_id); + + $_SESSION['alert_message'] = "Software template $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -38,10 +40,10 @@ if (isset($_POST['edit_software_template'])) { mysqli_query($mysqli,"UPDATE software SET software_name = '$name', software_version = '$version', software_description = '$description', software_type = '$type', software_license_type = '$license_type', software_notes = '$notes' WHERE software_id = $software_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Software Teplate', log_action = 'Modify', log_description = '$session_name modified software template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Software Template", "Edit", "$session_name edited software template $name", 0, $software_id); - $_SESSION['alert_message'] = "Software template updated"; + $_SESSION['alert_message'] = "Software template $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_tag.php b/post/admin/admin_tag.php index 387c24a2..bb3e8280 100644 --- a/post/admin/admin_tag.php +++ b/post/admin/admin_tag.php @@ -10,10 +10,12 @@ if (isset($_POST['add_tag'])) { mysqli_query($mysqli,"INSERT INTO tags SET tag_name = '$name', tag_type = $type, tag_color = '$color', tag_icon = '$icon'"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tag', log_action = 'Create', log_description = '$name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $tag_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Tag added"; + // Logging + logAction("Tag", "Create", "$session_name created tag $name", 0, $tag_id); + + $_SESSION['alert_message'] = "Tag $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -27,10 +29,10 @@ if (isset($_POST['edit_tag'])) { mysqli_query($mysqli,"UPDATE tags SET tag_name = '$name', tag_type = $type, tag_color = '$color', tag_icon = '$icon' WHERE tag_id = $tag_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tag', log_action = 'Modify', log_description = '$name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Tag", "Edit", "$session_name edited tag $name", 0, $tag_id); - $_SESSION['alert_message'] = "Tag modified"; + $_SESSION['alert_message'] = "Tag $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -39,14 +41,19 @@ if (isset($_POST['edit_tag'])) { if (isset($_GET['delete_tag'])) { $tag_id = intval($_GET['delete_tag']); + // Get Tag Name for logging + $sql = mysqli_query($mysqli,"SELECT tag_name FROM tags WHERE tag_id = $tag_id"); + $row = mysqli_fetch_array($sql); + $tag_name = sanitizeInput($row['tag_name']); + mysqli_query($mysqli,"DELETE FROM tags WHERE tag_id = $tag_id"); mysqli_query($mysqli,"DELETE FROM client_tags WHERE tag_id = $tag_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tag', log_action = 'Delete', log_description = '$tag_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Tag", "Delete", "$session_name deleted tag $tag_name"); - $_SESSION['alert_message'] = "Tag deleted"; $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Tag $tag_name deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_tax.php b/post/admin/admin_tax.php index 3254e4e8..76b39759 100644 --- a/post/admin/admin_tax.php +++ b/post/admin/admin_tax.php @@ -12,10 +12,12 @@ if (isset($_POST['add_tax'])) { mysqli_query($mysqli,"INSERT INTO taxes SET tax_name = '$name', tax_percent = $percent"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tax', log_action = 'Create', log_description = '$name - $percent', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + $tax_id = mysqli_insert_id($mysqli); - $_SESSION['alert_message'] = "Tax added"; + // Logging + logAction("Tax", "Create", "$session_name created tax $name - $percent%", 0, $tax_id); + + $_SESSION['alert_message'] = "Tax $name ($percent%) created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -30,10 +32,10 @@ if (isset($_POST['edit_tax'])) { mysqli_query($mysqli,"UPDATE taxes SET tax_name = '$name', tax_percent = $percent WHERE tax_id = $tax_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tax', log_action = 'Modify', log_description = '$name - $percent', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Tax", "Edit", "$session_name edited tax $name - $percent%", 0, $tax_id); - $_SESSION['alert_message'] = "Tax modified"; + $_SESSION['alert_message'] = "Tax $name ($percent%) edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -43,12 +45,18 @@ if (isset($_GET['archive_tax'])) { validateCSRFToken($_GET['csrf_token']); $tax_id = intval($_GET['archive_tax']); + // Get Tax Name for logging + $sql = mysqli_query($mysqli,"SELECT tax_name FROM taxs WHERE tax_id = $tax_id"); + $row = mysqli_fetch_array($sql); + $tax_name = sanitizeInput($row['tax_name']); + mysqli_query($mysqli,"UPDATE taxes SET tax_archived_at = NOW() WHERE tax_id = $tax_id"); - //logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tax', log_action = 'Archive', log_description = '$tax_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent'"); + // Logging + logAction("Tax", "Archive", "$session_name archived tax $tax_name", 0, $tax_id); - $_SESSION['alert_message'] = "Tax Archived"; + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Tax $tax_name Archived"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -57,13 +65,18 @@ if (isset($_GET['archive_tax'])) { if (isset($_GET['delete_tax'])) { $tax_id = intval($_GET['delete_tax']); + // Get Tax Name for logging + $sql = mysqli_query($mysqli,"SELECT tax_name FROM taxs WHERE tax_id = $tax_id"); + $row = mysqli_fetch_array($sql); + $tax_name = sanitizeInput($row['tax_name']); + mysqli_query($mysqli,"DELETE FROM taxes WHERE tax_id = $tax_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Tax', log_action = 'Delete', log_description = '$tax_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Tax", "Delete", "$session_name deleted tax $tax_name"); - $_SESSION['alert_message'] = "Tax deleted"; $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Tax $tax_name deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); diff --git a/post/admin/admin_ticket_status.php b/post/admin/admin_ticket_status.php index 150ade7c..79b600cd 100644 --- a/post/admin/admin_ticket_status.php +++ b/post/admin/admin_ticket_status.php @@ -10,9 +10,9 @@ if (isset($_POST['add_ticket_status'])) { $ticket_status_id = mysqli_insert_id($mysqli); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Status', log_action = 'Create', log_description = '$session_name created ticket status $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_status_id"); + logAction("Ticket Status", "Create", "$session_name created custom ticket status $name", 0, $ticket_status_id); - $_SESSION['alert_message'] = "You created Ticket Status $name"; + $_SESSION['alert_message'] = "Custom Ticket Status $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -28,9 +28,9 @@ if (isset($_POST['edit_ticket_status'])) { mysqli_query($mysqli, "UPDATE ticket_statuses SET ticket_status_name = '$name', ticket_status_color = '$color', ticket_status_active = $status WHERE ticket_status_id = $ticket_status_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Status', log_action = 'Edit', log_description = '$session_name edited ticket status $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_status_id"); + logAction("Ticket Status", "Edit", "$session_name edited custom ticket status $name", 0, $ticket_status_id); - $_SESSION['alert_message'] = "You edited Ticket Status $name"; + $_SESSION['alert_message'] = "Custom Ticket Status $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -48,10 +48,10 @@ if (isset($_GET['delete_ticket_status'])) { mysqli_query($mysqli, "DELETE FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Status', log_action = 'Delete', log_description = '$session_name deleted ticket_status $ticket_status_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_status_id"); + logAction("Ticket Status", "Delete", "$session_name deleted custom ticket status $ticket_status_name"); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "You Deleted Ticket Status $ticket_status_name"; + $_SESSION['alert_message'] = "Custom Ticket Status $ticket_status_name Deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin/admin_ticket_template.php b/post/admin/admin_ticket_template.php index 56f68a63..428b1d16 100644 --- a/post/admin/admin_ticket_template.php +++ b/post/admin/admin_ticket_template.php @@ -8,7 +8,6 @@ require_once 'post/user/task.php'; if (isset($_POST['add_ticket_template'])) { - validateTechRole(); $name = sanitizeInput($_POST['name']); $description = sanitizeInput($_POST['description']); $subject = sanitizeInput($_POST['subject']); @@ -24,9 +23,9 @@ if (isset($_POST['add_ticket_template'])) { } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Template', log_action = 'Create', log_description = '$session_name created ticket template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_template_id"); + logAction("Ticket Template", "Create", "$session_name created ticket template $name", 0, $ticket_template_id); - $_SESSION['alert_message'] = "You created Ticket Template $name"; + $_SESSION['alert_message'] = "Ticket Template $name created"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -34,7 +33,6 @@ if (isset($_POST['add_ticket_template'])) { if (isset($_POST['edit_ticket_template'])) { - validateTechRole(); $ticket_template_id = intval($_POST['ticket_template_id']); $name = sanitizeInput($_POST['name']); $description = sanitizeInput($_POST['description']); @@ -44,17 +42,15 @@ if (isset($_POST['edit_ticket_template'])) { mysqli_query($mysqli, "UPDATE ticket_templates SET ticket_template_name = '$name', ticket_template_description = '$description', ticket_template_subject = '$subject', ticket_template_details = '$details' WHERE ticket_template_id = $ticket_template_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Template', log_action = 'Edit', log_description = '$session_name edited ticket template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_template_id"); + logAction("Ticket Template", "Edit", "$session_name edited ticket template $name", 0, $ticket_template_id); - $_SESSION['alert_message'] = "You edited Ticket Template $name"; + $_SESSION['alert_message'] = "Ticket Template $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_GET['delete_ticket_template'])) { - validateTechRole(); - $ticket_template_id = intval($_GET['delete_ticket_template']); // Get ticket template name @@ -71,17 +67,16 @@ if (isset($_GET['delete_ticket_template'])) { mysqli_query($mysqli, "DELETE FROM project_template_ticket_templates WHERE ticket_template_id = $ticket_template_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket Template', log_action = 'Delete', log_description = '$session_name deleted ticket template $ticket_template_name and its tasks', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_template_id"); + logAction("Ticket Template", "Delete", "$session_name deleted ticket template $ticket_template_name"); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "You Deleted Ticket Template $ticket_template_name and its associated tasks"; + $_SESSION['alert_message'] = "Ticket Template $ticket_template_name and its associated tasks deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); } if (isset($_POST['add_ticket_template_task'])) { - validateTechRole(); $ticket_template_id = intval($_POST['ticket_template_id']); $task_name = sanitizeInput($_POST['task_name']); @@ -92,7 +87,10 @@ if (isset($_POST['add_ticket_template_task'])) { // Logging mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task Template', log_action = 'Create', log_description = '$session_name created task template $task_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $ticket_template_id"); - $_SESSION['alert_message'] = "You created Task Template $task_name"; + // Logging + logAction("Ticket Template", "Edit", "$session_name added task $task_name to ticket template", 0, $ticket_template_id); + + $_SESSION['alert_message'] = "Added Task $task_name"; header("Location: " . $_SERVER["HTTP_REFERER"]); @@ -100,8 +98,6 @@ if (isset($_POST['add_ticket_template_task'])) { if (isset($_GET['delete_task_template'])) { - validateTechRole(); - $task_template_id = intval($_GET['delete_task_template']); // Get task template name @@ -112,10 +108,10 @@ if (isset($_GET['delete_task_template'])) { mysqli_query($mysqli, "DELETE FROM task_templates WHERE task_template_id = $task_template_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Task Template', log_action = 'Delete', log_description = '$session_name deleted task template $task_template_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $task_template_id"); + logAction("Ticket Template", "Edit", "$session_name deleted task $task_template_name from ticket template"); $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "You Deleted Task Template $task_template_name"; + $_SESSION['alert_message'] = "Task $task_template_name deleted"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin/admin_user.php b/post/admin/admin_user.php index 93da74c9..974936ee 100644 --- a/post/admin/admin_user.php +++ b/post/admin/admin_user.php @@ -18,7 +18,7 @@ if (isset($_POST['add_user'])) { $user_id = mysqli_insert_id($mysqli); // Add Client Access Permissions if set - if (!empty($_POST['clients'])) { + if (isset($_POST['clients'])) { foreach($_POST['clients'] as $client_id) { $client_id = intval($client_id); mysqli_query($mysqli,"INSERT INTO user_permissions SET user_id = $user_id, client_id = $client_id"); @@ -92,7 +92,7 @@ if (isset($_POST['add_user'])) { } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Create', log_description = '$session_name created user $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); + logAction("User", "Create", "$session_name created user $name", 0, $user_id); $_SESSION['alert_message'] = "User $name created" . $extended_alert_description; @@ -111,7 +111,7 @@ if (isset($_POST['edit_user'])) { // Update Client Access mysqli_query($mysqli,"DELETE FROM user_permissions WHERE user_id = $user_id"); - if (!empty($_POST['clients'])) { + if (isset($_POST['clients'])) { foreach($_POST['clients'] as $client_id) { $client_id = intval($client_id); mysqli_query($mysqli,"INSERT INTO user_permissions SET user_id = $user_id, client_id = $client_id"); @@ -174,8 +174,8 @@ if (isset($_POST['edit_user'])) { //Update User Settings mysqli_query($mysqli, "UPDATE user_settings SET user_role = $role, user_config_force_mfa = $force_mfa WHERE user_id = $user_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name modified user $name $extended_log_description', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); + // Logging + logAction("User", "Edit", "$session_name edited user $name", 0, $user_id); $_SESSION['alert_message'] = "User $name updated" . $extended_alert_description; @@ -196,8 +196,8 @@ if (isset($_GET['activate_user'])) { mysqli_query($mysqli, "UPDATE users SET user_status = 1 WHERE user_id = $user_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name activated user $user_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); + // Logging + logAction("User", "Activate", "$session_name activated user $user_name", 0, $user_id); $_SESSION['alert_message'] = "User $user_name activated"; @@ -222,8 +222,8 @@ if (isset($_GET['disable_user'])) { mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = 0 WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL"); mysqli_query($mysqli, "UPDATE scheduled_tickets SET scheduled_ticket_assigned_to = 0 WHERE scheduled_ticket_assigned_to = $user_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name disabled user $user_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); + // Logging + logAction("User", "Disable", "$session_name disabled user $name", 0, $user_id); $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "User $user_name disabled"; @@ -244,8 +244,8 @@ if (isset($_GET['revoke_remember_me'])) { mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $user_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name revoked all remember me tokens for user $user_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); + // Logging + logAction("User", "Edit", "$session_name revoked all remember me tokens for user $user_name", 0, $user_id); $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "User $user_name remember me tokens revoked"; @@ -271,7 +271,7 @@ if (isset($_GET['archive_user'])) { mysqli_query($mysqli, "UPDATE users SET user_name = '$name (archived)', user_password = '$password', user_status = 0, user_specific_encryption_ciphertext = '', user_archived_at = NOW() WHERE user_id = $user_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Archive', log_description = '$session_name archived user $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id, log_entity_id = $user_id"); + logAction("User", "Archive", "$session_name archived user $name", 0, $user_id); $_SESSION['alert_type'] = "error"; $_SESSION['alert_message'] = "User $name archived"; @@ -285,7 +285,9 @@ if (isset($_POST['export_users_csv'])) { //get records from database $sql = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC"); - if ($sql->num_rows > 0) { + $count = mysqli_num_rows($sql); + + if ($count > 0) { $delimiter = ", "; $filename = $session_company_name . "-Users-" . date('Y-m-d') . ".csv"; @@ -329,6 +331,9 @@ if (isset($_POST['export_users_csv'])) { //output all remaining data on a file pointer fpassthru($f); + + // Logging + logAction("User", "Export", "$session_name exported $count user(s) to a CSV file"); } exit; @@ -370,7 +375,7 @@ if (isset($_POST['ir_reset_user_password'])) { } // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name reset ALL user passwords', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("User", "Edit", "$session_name reset ALL user passwords"); exit; // Stay on the plain text password page diff --git a/post/admin/admin_vendor_template.php b/post/admin/admin_vendor_template.php index c11a4448..9f8c8b5b 100644 --- a/post/admin/admin_vendor_template.php +++ b/post/admin/admin_vendor_template.php @@ -13,8 +13,8 @@ if (isset($_POST['add_vendor_template'])) { $vendor_id = mysqli_insert_id($mysqli); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor Template', log_action = 'Create', log_description = '$session_name created vendor template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Vendor Template", "Create", "$session_name created vendor template $name", 0, $vendor_id); $_SESSION['alert_message'] = "Vendor template $name created"; @@ -107,10 +107,10 @@ if (isset($_POST['edit_vendor_template'])) { mysqli_query($mysqli,"UPDATE vendors SET $sql WHERE vendor_template_id = $vendor_id"); } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Vendor Template', log_action = 'Modify', log_description = '$session_name modified vendor template $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id); - $_SESSION['alert_message'] = "Vendor template $name modified"; + $_SESSION['alert_message'] = "Vendor template $name edited"; header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/post/admin_update.php b/post/admin_update.php index 2e002c6f..41e1ac42 100644 --- a/post/admin_update.php +++ b/post/admin_update.php @@ -270,8 +270,8 @@ if (isset($_GET['update'])) { } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Update', log_description = '$session_name ran updates', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("App", "Update", "$session_name ran updates"); $_SESSION['alert_message'] = "Update successful"; @@ -291,8 +291,8 @@ if (isset($_GET['update_db'])) { // Perform upgrades, if required require_once ('database_updates.php'); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Settings', log_action = 'Update', log_description = '$session_name updated the database structure', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Database", "Update", "$session_name updated the database structure"); $_SESSION['alert_message'] = "Database structure update successful"; From 77aede8babc39b6e6ad1a93df0b60d611ca0b6ab Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 17:32:26 -0500 Subject: [PATCH 017/148] Updated the remaining posts except ticket to use new logAction function, tidy and added more details to logging --- post/logout.php | 5 ++++- post/misc.php | 16 +++++++--------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/post/logout.php b/post/logout.php index 3645d4f6..33c6e31b 100644 --- a/post/logout.php +++ b/post/logout.php @@ -5,7 +5,10 @@ */ if (isset($_GET['logout'])) { - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Logout', log_action = 'Success', log_description = '$session_name logged out', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + + // Logging + logAction("Logout", "Success", "$session_name logged out"); + mysqli_query($mysqli, "UPDATE users SET user_php_session = '' WHERE user_id = $session_user_id"); setcookie("PHPSESSID", '', time() - 3600, "/"); diff --git a/post/misc.php b/post/misc.php index 69b304ce..c5f21b3c 100644 --- a/post/misc.php +++ b/post/misc.php @@ -24,8 +24,8 @@ if (isset($_GET['dismiss_notification'])) { mysqli_query($mysqli,"UPDATE notifications SET notification_dismissed_at = NOW(), notification_dismissed_by = $session_user_id WHERE notification_id = $notification_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Notification', log_action = 'Dismiss', log_description = '$session_name dismissed notification', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Notification", "Dismiss", "$session_name dismissed notification"); $_SESSION['alert_message'] = "Notification Dismissed"; @@ -47,8 +47,8 @@ if (isset($_GET['dismiss_all_notifications'])) { } - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Notification', log_action = 'Dismiss', log_description = '$session_name dismissed $num_notifications notifications', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + // Logging + logAction("Notification", "Dismiss", "$session_name dismissed $num_notifications notifications"); $_SESSION['alert_message'] = "$num_notifications Notifications Dismissed"; @@ -59,8 +59,6 @@ if (isset($_GET['dismiss_all_notifications'])) { // Revoke sharing (sharing itself is done via ajax.php) if (isset($_GET['deactivate_shared_item'])) { - validateAdminRole(); - $item_id = intval($_GET['deactivate_shared_item']); // Get details of the shared link @@ -68,15 +66,15 @@ if (isset($_GET['deactivate_shared_item'])) { $row = mysqli_fetch_array($sql); $item_type = sanitizeInput($row['item_type']); $item_related_id = intval($row['item_related_id']); - $item_client_id = intval($row['item_client_id']); + $client_id = intval($row['item_client_id']); // Deactivate item id mysqli_query($mysqli, "DELETE FROM shared_items WHERE item_id = $item_id"); // Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Sharing', log_action = 'Delete', log_description = '$session_name deactivated shared $item_type link. Item ID: $item_related_id. Share ID $item_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $item_client_id, log_user_id = $session_user_id, log_entity_id = $item_id"); + logAction("Sharing", "Delete", "$session_name deactivated shared $item_type link Item ID: $item_related_id. Share ID $item_id", $client_id, $item_id); - $_SESSION['alert_message'] = "Link deactivated"; + $_SESSION['alert_message'] = "Share Link deactivated"; header("Location: " . $_SERVER["HTTP_REFERER"]); } From ba5e2b216b2602806132d648b1a19803116eff9f Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 17:42:01 -0500 Subject: [PATCH 018/148] Updated asset API to use new logAction function --- api/v1/assets/create.php | 6 +++--- api/v1/assets/delete.php | 4 ++-- api/v1/assets/update.php | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/api/v1/assets/create.php b/api/v1/assets/create.php index b8213805..4954e049 100644 --- a/api/v1/assets/create.php +++ b/api/v1/assets/create.php @@ -22,9 +22,9 @@ if (!empty($name) && !empty($client_id)) { // Add Primary Interface mysqli_query($mysqli,"INSERT INTO asset_interfaces SET interface_name = 'Primary', interface_mac = '$mac', interface_ip = '$ip', interface_port = 'eth0', interface_primary = 1, interface_network_id = $network, interface_asset_id = $insert_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Asset', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = '$client_id'"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created asset $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = '$client_id'"); + // Logging + logAction("Asset", "Create", "$name via API ($api_key_name)", $client_id, $insert_id); + logAction("API", "Success", "Created asset $name via API ($api_key_name)", $client_id); } } diff --git a/api/v1/assets/delete.php b/api/v1/assets/delete.php index 42479ef7..061e4bc4 100644 --- a/api/v1/assets/delete.php +++ b/api/v1/assets/delete.php @@ -24,8 +24,8 @@ if (!empty($asset_id)) { if ($delete_sql && !empty($asset_name)) { $delete_count = mysqli_affected_rows($mysqli); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Asset', log_action = 'Deleted', log_description = '$asset_name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Asset", "Delete", "$asset_name via API ($api_key_name)", $client_id); } } diff --git a/api/v1/assets/update.php b/api/v1/assets/update.php index 54ee6a94..86f59b57 100644 --- a/api/v1/assets/update.php +++ b/api/v1/assets/update.php @@ -28,9 +28,9 @@ if (!empty($asset_id)) { // Update Primary Interface mysqli_query($mysqli,"UPDATE asset_interfaces SET interface_mac = '$mac', interface_ip = '$ip', interface_network_id = $network WHERE interface_asset_id = $asset_id AND interface_primary = 1"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Asset', log_action = 'Updated', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Updated asset $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Asset", "Edit", "$name via API ($api_key_name)", $client_id); + logAction("API", "Success", "Edited asset $name via API ($api_key_name)", $client_id); } } From bfffec73638a6a069493224b26f9e440a9179a8c Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 17:55:35 -0500 Subject: [PATCH 019/148] Temp added vars session_ip and session_user_agent to validate_api_key so IP and User agent is logged with the new logAction function --- api/v1/validate_api_key.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index 3a4bef5e..f46e4bff 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -20,6 +20,10 @@ $_POST = json_decode(file_get_contents('php://input'), true); $ip = sanitizeInput(getIP()); $user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +// Temp Added this to work with the new logAction function +$session_ip = $ip; +$session_user_agent = $user_agent; + // Setup return array $return_arr = array(); From e9f023f0c7f43d0a1559e0a647358dd1ca2b1188 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 18:27:31 -0500 Subject: [PATCH 020/148] Updated all API functions to use the new logAction Function --- api/v1/clients/create.php | 7 ++++--- api/v1/contacts/create.php | 7 ++++--- api/v1/contacts/delete.php | 4 ++-- api/v1/contacts/update.php | 7 +++---- api/v1/credentials/create.php | 6 +++--- api/v1/credentials/update.php | 6 +++--- api/v1/documents/create.php | 7 +++---- api/v1/documents/update.php | 7 +++---- api/v1/tickets/create.php | 8 +++----- 9 files changed, 28 insertions(+), 31 deletions(-) diff --git a/api/v1/clients/create.php b/api/v1/clients/create.php index dcffd710..eafd7daa 100644 --- a/api/v1/clients/create.php +++ b/api/v1/clients/create.php @@ -20,9 +20,10 @@ if (!empty($name) && $client_id == 0) { // Check insert & get insert ID if ($insert_sql) { $insert_id = mysqli_insert_id($mysqli); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $insert_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created client $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $insert_id"); + + // Logging + logAction("Client", "Create", "$name via API ($api_key_name)", $insert_id); + logAction("API", "Success", "Created client $name via API ($api_key_name)", $insert_id); } } diff --git a/api/v1/contacts/create.php b/api/v1/contacts/create.php index 02301b21..45f3b78f 100644 --- a/api/v1/contacts/create.php +++ b/api/v1/contacts/create.php @@ -25,9 +25,10 @@ if (!empty($name) && !empty($email) && !empty($client_id)) { // Check insert & get insert ID if ($insert_sql) { $insert_id = mysqli_insert_id($mysqli); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Created', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created contact $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + + // Logging + logAction("Contact", "Create", "$name via API ($api_key_name)", $client_id, $insert_id); + logAction("API", "Success", "Created contact $name via API ($api_key_name)", $client_id); } } diff --git a/api/v1/contacts/delete.php b/api/v1/contacts/delete.php index 1729148d..62309277 100644 --- a/api/v1/contacts/delete.php +++ b/api/v1/contacts/delete.php @@ -21,8 +21,8 @@ if (!empty($contact_id)) { if ($delete_sql && !empty($contact_name)) { $delete_count = mysqli_affected_rows($mysqli); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Deleted', log_description = '$contact_name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Contact", "Delete", "$contact_name via API ($api_key_name)", $client_id); } } diff --git a/api/v1/contacts/update.php b/api/v1/contacts/update.php index 8e7e28e0..eb9e4c45 100644 --- a/api/v1/contacts/update.php +++ b/api/v1/contacts/update.php @@ -25,12 +25,11 @@ if (!empty($contact_id)) { if ($update_sql) { $update_count = mysqli_affected_rows($mysqli); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Updated', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Updated contact $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Contact", "Edit", "$name via API ($api_key_name)", $client_id, $contact_id); + logAction("API", "Success", "Edited contact $name via API ($api_key_name)", $client_id); } } // Output require_once '../update_output.php'; - diff --git a/api/v1/credentials/create.php b/api/v1/credentials/create.php index 66140df1..ba4c6e0e 100644 --- a/api/v1/credentials/create.php +++ b/api/v1/credentials/create.php @@ -19,9 +19,9 @@ if (!empty($api_key_decrypt_password) && !empty($name) && !(empty($password))) { if ($insert_sql) { $insert_id = mysqli_insert_id($mysqli); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Credential', log_action = 'Create', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created credential $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Credential", "Create", "$name via API ($api_key_name)", $client_id, $insert_id); + logAction("API", "Success", "Created credential $name via API ($api_key_name)", $client_id); } } diff --git a/api/v1/credentials/update.php b/api/v1/credentials/update.php index 489ef8b0..dfe59c45 100644 --- a/api/v1/credentials/update.php +++ b/api/v1/credentials/update.php @@ -27,9 +27,9 @@ if (!empty($_POST['api_key_decrypt_password']) && !empty($login_id)) { mysqli_query($mysqli, "UPDATE logins SET login_password_changed_at = NOW() WHERE login_id = $login_id LIMIT 1"); } - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Credential', log_action = 'Update', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Updated credential $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Credential", "Edit", "$name via API ($api_key_name)", $client_id, $login_id); + logAction("API", "Success", "Updated credential $name via API ($api_key_name)", $client_id); } } diff --git a/api/v1/documents/create.php b/api/v1/documents/create.php index 9b540885..82d9f7e5 100644 --- a/api/v1/documents/create.php +++ b/api/v1/documents/create.php @@ -22,13 +22,12 @@ if (!empty($name) && !(empty($content))) { // Update field document_parent to be the same id as document ID as this is the only version of the document. mysqli_query($mysqli,"UPDATE documents SET document_parent = $insert_id WHERE document_id = $insert_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Document', log_action = 'Create', log_description = '$name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created document $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Document", "Create", "$name via API ($api_key_name)", $client_id, $insert_id); + logAction("API", "Success", "Created document $name via API ($api_key_name)", $client_id); } } - // Output require_once '../create_output.php'; diff --git a/api/v1/documents/update.php b/api/v1/documents/update.php index ec007cb3..63bd9939 100644 --- a/api/v1/documents/update.php +++ b/api/v1/documents/update.php @@ -46,9 +46,9 @@ if (!empty($document_id)) { // Vendor documents mysqli_query($mysqli,"UPDATE vendor_documents SET document_id = $new_document_id WHERE document_id = $document_id"); - //Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Document', log_action = 'Modify', log_description = '$name via API ($api_key_name) previous version was kept', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Edited document $name via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + // Logging + logAction("Document", "Edit", "$name via API ($api_key_name) previous version kept", $client_id, $insert_id); + logAction("API", "Success", "Edited document $name via API ($api_key_name)", $client_id); // Override update count to 1 for API to report a success (as we inserted a document, not "updated" an existing row) $update_count = 1; @@ -56,6 +56,5 @@ if (!empty($document_id)) { } - // Output require_once '../update_output.php'; diff --git a/api/v1/tickets/create.php b/api/v1/tickets/create.php index 13da7242..5b6d117f 100644 --- a/api/v1/tickets/create.php +++ b/api/v1/tickets/create.php @@ -4,7 +4,6 @@ require_once '../validate_api_key.php'; require_once '../require_post_method.php'; - // Ticket-related settings require_once "../../../get_settings.php"; @@ -17,7 +16,6 @@ $company_phone = formatPhoneNumber($row['company_phone']); $ticket_row = false; // Creation, not an update require_once 'ticket_model.php'; - // Default $insert_id = false; @@ -41,13 +39,13 @@ if (!empty($subject) && !empty($client_id)) { // Check insert & get insert ID if ($insert_sql) { $insert_id = mysqli_insert_id($mysqli); + // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Ticket', log_action = 'Create', log_description = 'Created ticket $config_ticket_prefix$ticket_number $subject via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Success', log_description = 'Created ticket $config_ticket_prefix$ticket_number via API ($api_key_name)', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $client_id"); + logAction("Ticket", "Create", "Created ticket $config_ticket_prefix$ticket_number $subject via API ($api_key_name)", $client_id, $insert_id); + logAction("API", "Success", "Created ticket $config_ticket_prefix$ticket_number $subject via API ($api_key_name)", $client_id); } } // Output require_once '../create_output.php'; - From ed92592aa68d1278ddd9384de51d149916f4ca50 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Thu, 14 Nov 2024 19:13:56 -0500 Subject: [PATCH 021/148] Check to see if arrays are set before executing for each loops to prevent php errors --- post/user/asset.php | 10 +++++----- post/user/certificate.php | 2 +- post/user/client.php | 10 ++++++---- post/user/contact.php | 38 +++++++++++++++++++++----------------- post/user/credential.php | 10 +++++----- post/user/document.php | 4 ++-- post/user/domain.php | 6 +++--- post/user/expense.php | 8 ++++---- post/user/file.php | 4 ++-- post/user/location.php | 28 ++++++++++++++++------------ post/user/network.php | 2 +- post/user/product.php | 8 ++++---- post/user/project.php | 2 +- post/user/vendor.php | 6 +++--- 14 files changed, 74 insertions(+), 64 deletions(-) diff --git a/post/user/asset.php b/post/user/asset.php index b9ee2c4b..b7134e23 100644 --- a/post/user/asset.php +++ b/post/user/asset.php @@ -273,7 +273,7 @@ if (isset($_POST['bulk_assign_asset_location'])) { $client_id = intval($row['location_client_id']); // Assign Location to Selected Contacts - if ($_POST['asset_ids']) { + if (isset($_POST['asset_ids'])) { // Get Selected Contacts Count $asset_count = count($_POST['asset_ids']); @@ -318,7 +318,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) { $client_id = intval($row['contact_client_id']); // Assign Contact to Selected Assets - if ($_POST['asset_ids']) { + if (isset($_POST['asset_ids'])) { // Get Selected Contacts Count $asset_count = count($_POST['asset_ids']); @@ -357,7 +357,7 @@ if (isset($_POST['bulk_edit_asset_status'])) { $status = sanitizeInput($_POST['bulk_status']); // Assign Status to Selected Assets - if ($_POST['asset_ids']) { + if (isset($_POST['asset_ids'])) { // Get Count $asset_count = count($_POST['asset_ids']); @@ -394,7 +394,7 @@ if (isset($_POST['bulk_archive_assets'])) { validateCSRFToken($_POST['csrf_token']); - if ($_POST['asset_ids']) { + if (isset($_POST['asset_ids'])) { // Get Count $count = count($_POST['asset_ids']); @@ -433,7 +433,7 @@ if (isset($_POST['bulk_unarchive_assets'])) { validateCSRFToken($_POST['csrf_token']); - if ($_POST['asset_ids']) { + if (isset($_POST['asset_ids'])) { // Get Count $count = count($_POST['asset_ids']); diff --git a/post/user/certificate.php b/post/user/certificate.php index a9bf26dd..fc61918d 100644 --- a/post/user/certificate.php +++ b/post/user/certificate.php @@ -125,7 +125,7 @@ if (isset($_POST['bulk_delete_certificates'])) { enforceUserPermission('module_support', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['certificate_ids']) { + if (isset($_POST['certificate_ids'])) { // Get selected count $count = count($_POST['certificate_ids']); diff --git a/post/user/client.php b/post/user/client.php index 60f839ac..446d31ad 100644 --- a/post/user/client.php +++ b/post/user/client.php @@ -62,7 +62,7 @@ if (isset($_POST['add_client'])) { } // Add Tags - if ($_POST['tags']) { + if (isset($_POST['tags'])) { foreach ($_POST['tags'] as $tag) { $tag = intval($tag); mysqli_query($mysqli, "INSERT INTO client_tags SET client_id = $client_id, tag_id = $tag"); @@ -139,9 +139,11 @@ if (isset($_POST['edit_client'])) { mysqli_query($mysqli, "DELETE FROM client_tags WHERE client_id = $client_id"); // Add new tags - foreach($_POST['tags'] as $tag) { - $tag = intval($tag); - mysqli_query($mysqli, "INSERT INTO client_tags SET client_id = $client_id, tag_id = $tag"); + if(isset($_POST['tags'])) { + foreach($_POST['tags'] as $tag) { + $tag = intval($tag); + mysqli_query($mysqli, "INSERT INTO client_tags SET client_id = $client_id, tag_id = $tag"); + } } // Logging diff --git a/post/user/contact.php b/post/user/contact.php index d5fbe7fc..0068f449 100644 --- a/post/user/contact.php +++ b/post/user/contact.php @@ -32,7 +32,7 @@ if (isset($_POST['add_contact'])) { $contact_id = mysqli_insert_id($mysqli); // Add Tags - if ($_POST['tags']) { + if (isset($_POST['tags'])) { foreach($_POST['tags'] as $tag) { $tag = intval($tag); mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag"); @@ -144,9 +144,11 @@ if (isset($_POST['edit_contact'])) { mysqli_query($mysqli, "DELETE FROM contact_tags WHERE contact_id = $contact_id"); // Add new tags - foreach($_POST['tags'] as $tag) { - $tag = intval($tag); - mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag"); + if (isset($_POST['tags'])) { + foreach($_POST['tags'] as $tag) { + $tag = intval($tag); + mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag"); + } } // Update Primary contact in clients if primary contact is checked @@ -225,7 +227,7 @@ if (isset($_POST['bulk_assign_contact_location'])) { $client_id = intval($row['location_client_id']); // Assign Location to Selected Contacts - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $contact_count = count($_POST['contact_ids']); @@ -262,7 +264,7 @@ if (isset($_POST['bulk_edit_contact_phone'])) { $phone = preg_replace("/[^0-9]/", '', $_POST['bulk_phone']); // Assign Location to Selected Contacts - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $contact_count = count($_POST['contact_ids']); @@ -299,7 +301,7 @@ if (isset($_POST['bulk_edit_contact_department'])) { $department = sanitizeInput($_POST['bulk_department']); // Assign Location to Selected Contacts - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $contact_count = count($_POST['contact_ids']); @@ -339,7 +341,7 @@ if (isset($_POST['bulk_edit_contact_role'])) { $contact_technical = intval($_POST['bulk_contact_technical']); // Assign Location to Selected Contacts - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $contact_count = count($_POST['contact_ids']); @@ -377,7 +379,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) { enforceUserPermission('module_client', 2); // Assign Location to Selected Contacts - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $count = count($_POST['contact_ids']); @@ -397,12 +399,14 @@ if (isset($_POST['bulk_assign_contact_tags'])) { } // Add new tags - foreach($_POST['bulk_tags'] as $tag) { - $tag = intval($tag); + if (isset($_POST['bulk_tags'])) { + foreach($_POST['bulk_tags'] as $tag) { + $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag"); - if (mysqli_num_rows($sql) == 0) { - mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT * FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag"); + if (mysqli_num_rows($sql) == 0) { + mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag"); + } } } @@ -427,7 +431,7 @@ if (isset($_POST['bulk_archive_contacts'])) { //validateCSRFToken($_POST['csrf_token']); - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { $count = 0; // Default 0 @@ -477,7 +481,7 @@ if (isset($_POST['bulk_unarchive_contacts'])) { enforceUserPermission('module_client', 2); //validateCSRFToken($_POST['csrf_token']); - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $count = count($_POST['contact_ids']); @@ -521,7 +525,7 @@ if (isset($_POST['bulk_delete_contacts'])) { enforceUserPermission('module_client', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['contact_ids']) { + if (isset($_POST['contact_ids'])) { // Get Selected Contacts Count $count = count($_POST['contact_ids']); diff --git a/post/user/credential.php b/post/user/credential.php index cce38199..8290bf42 100644 --- a/post/user/credential.php +++ b/post/user/credential.php @@ -153,7 +153,7 @@ if (isset($_POST['bulk_assign_login_tags'])) { enforceUserPermission('module_credential', 2); // Assign tags to Selected Credentials - if ($_POST['login_ids']) { + if (isset($_POST['login_ids'])) { // Get Selected Credential Count $count = count($_POST['login_ids']); @@ -173,7 +173,7 @@ if (isset($_POST['bulk_assign_login_tags'])) { } // Add new tags - if(isset($_POST['bulk_tags'])) { + if (isset($_POST['bulk_tags'])) { foreach($_POST['bulk_tags'] as $tag) { $tag = intval($tag); @@ -204,7 +204,7 @@ if (isset($_POST['bulk_archive_logins'])) { enforceUserPermission('module_credential', 2); validateCSRFToken($_POST['csrf_token']); - if ($_POST['login_ids']) { + if (isset($_POST['login_ids'])) { // Get Selected Credential Count $count = count($_POST['login_ids']); @@ -243,7 +243,7 @@ if (isset($_POST['bulk_unarchive_logins'])) { validateCSRFToken($_POST['csrf_token']); - if ($_POST['login_ids']) { + if (isset($_POST['login_ids'])) { // Get Selected Credential Count $count = count($_POST['login_ids']); @@ -282,7 +282,7 @@ if (isset($_POST['bulk_delete_logins'])) { validateCSRFToken($_POST['csrf_token']); - if ($_POST['login_ids']) { + if (isset($_POST['login_ids'])) { // Get Selected Credential Count $count = count($_POST['login_ids']); diff --git a/post/user/document.php b/post/user/document.php index e3c0711a..7459a0ce 100644 --- a/post/user/document.php +++ b/post/user/document.php @@ -180,7 +180,7 @@ if (isset($_POST['bulk_move_document'])) { $client_id = intval($row['folder_client_id']); // Move Documents to Folder Loop - if ($_POST['document_ids']) { + if (isset($_POST['document_ids'])) { // Get Selected Count $count = count($_POST['document_ids']); @@ -701,7 +701,7 @@ if (isset($_POST['bulk_delete_documents'])) { validateCSRFToken($_POST['csrf_token']); - if ($_POST['document_ids']) { + if (isset($_POST['document_ids'])) { // Get selected document count $count = count($_POST['document_ids']); diff --git a/post/user/domain.php b/post/user/domain.php index 68f395ad..8dd6aa50 100644 --- a/post/user/domain.php +++ b/post/user/domain.php @@ -179,7 +179,7 @@ if (isset($_POST['bulk_archive_domains'])) { enforceUserPermission('module_support', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['domain_ids']) { + if (isset($_POST['domain_ids'])) { // Get Selected Count $count = count($_POST['domain_ids']); @@ -216,7 +216,7 @@ if (isset($_POST['bulk_unarchive_domains'])) { enforceUserPermission('module_support', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['domain_ids']) { + if (isset($_POST['domain_ids'])) { // Get Selected Count $count = count($_POST['domain_ids']); @@ -253,7 +253,7 @@ if (isset($_POST['bulk_delete_domains'])) { enforceUserPermission('module_support', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['domain_ids']) { + if (isset($_POST['domain_ids'])) { // Get Selected Count $count = count($_POST['domain_ids']); diff --git a/post/user/expense.php b/post/user/expense.php index cc5faed2..4f70f689 100644 --- a/post/user/expense.php +++ b/post/user/expense.php @@ -119,7 +119,7 @@ if (isset($_POST['bulk_edit_expense_category'])) { $category_name = sanitizeInput($row['category_name']); // Assign category to Selected Expenses - if ($_POST['expense_ids']) { + if (isset($_POST['expense_ids'])) { // Get Selected Count $count = count($_POST['expense_ids']); @@ -159,7 +159,7 @@ if (isset($_POST['bulk_edit_expense_account'])) { $account_name = sanitizeInput($row['account_name']); // Assign account to Selected Expenses - if ($_POST['expense_ids']) { + if (isset($_POST['expense_ids'])) { // Get Selected Contacts Count $count = count($_POST['expense_ids']); @@ -199,7 +199,7 @@ if (isset($_POST['bulk_edit_expense_client'])) { $client_name = sanitizeInput($row['client_name']); // Assign Client to Selected Expenses - if ($_POST['expense_ids']) { + if (isset($_POST['expense_ids'])) { // Get Selected Count $count = count($_POST['expense_ids']); @@ -229,7 +229,7 @@ if (isset($_POST['bulk_delete_expenses'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - if ($_POST['expense_ids']) { + if (isset($_POST['expense_ids'])) { // Get Selected Count $count = count($_POST['expense_ids']); diff --git a/post/user/file.php b/post/user/file.php index 17af1030..6a209160 100644 --- a/post/user/file.php +++ b/post/user/file.php @@ -176,7 +176,7 @@ if (isset($_POST['bulk_delete_files'])) { validateCSRFToken($_POST['csrf_token']); // Delete file loop - if ($_POST['file_ids']) { + if (isset($_POST['file_ids'])) { // Get selected file Count $file_count = count($_POST['file_ids']); @@ -224,7 +224,7 @@ if (isset($_POST['bulk_move_files'])) { $client_id = intval($row['folder_client_id']); // Check array for data - if ($_POST['file_ids']) { + if (isset($_POST['file_ids'])) { // Get Selected file Count $file_count = count($_POST['file_ids']); diff --git a/post/user/location.php b/post/user/location.php index 6df8c008..03baef26 100644 --- a/post/user/location.php +++ b/post/user/location.php @@ -95,9 +95,11 @@ if(isset($_POST['edit_location'])){ mysqli_query($mysqli, "DELETE FROM location_tags WHERE location_id = $location_id"); // Add new tags - foreach($_POST['tags'] as $tag) { - $tag = intval($tag); - mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag"); + if (isset($_POST['tags'])) { + foreach($_POST['tags'] as $tag) { + $tag = intval($tag); + mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag"); + } } //Check to see if a file is attached @@ -214,7 +216,7 @@ if (isset($_POST['bulk_assign_location_tags'])) { enforceUserPermission('module_client', 2); // Assign Tags to Selected - if ($_POST['location_ids']) { + if (isset($_POST['location_ids'])) { // Get Selected Count $count = count($_POST['location_ids']); @@ -234,12 +236,14 @@ if (isset($_POST['bulk_assign_location_tags'])) { } // Add new tags - foreach($_POST['bulk_tags'] as $tag) { - $tag = intval($tag); + if (isset($_POST['bulk_tags'])) { + foreach($_POST['bulk_tags'] as $tag) { + $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM location_tags WHERE location_id = $location_id AND tag_id = $tag"); - if (mysqli_num_rows($sql) == 0) { - mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT * FROM location_tags WHERE location_id = $location_id AND tag_id = $tag"); + if (mysqli_num_rows($sql) == 0) { + mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag"); + } } } @@ -262,7 +266,7 @@ if (isset($_POST['bulk_archive_locations'])) { enforceUserPermission('module_client', 2); validateCSRFToken($_POST['csrf_token']); - if ($_POST['location_ids']) { + if (isset($_POST['location_ids'])) { $count = 0; // Default 0 @@ -304,7 +308,7 @@ if (isset($_POST['bulk_unarchive_locations'])) { enforceUserPermission('module_client', 2); validateCSRFToken($_POST['csrf_token']); - if ($_POST['location_ids']) { + if (isset($_POST['location_ids'])) { // Get Selected Count $count = count($_POST['location_ids']); @@ -341,7 +345,7 @@ if (isset($_POST['bulk_delete_locations'])) { enforceUserPermission('module_client', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['location_ids']) { + if (isset($_POST['location_ids'])) { // Get Selected Count $count = count($_POST['location_ids']); diff --git a/post/user/network.php b/post/user/network.php index da2cfa09..f10c3b36 100644 --- a/post/user/network.php +++ b/post/user/network.php @@ -92,7 +92,7 @@ if (isset($_POST['bulk_delete_networks'])) { enforceUserPermission('module_support', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['network_ids']) { + if (isset($_POST['network_ids'])) { // Get Selected Count $count = count($_POST['network_ids']); diff --git a/post/user/product.php b/post/user/product.php index b63b20d2..a29506f4 100644 --- a/post/user/product.php +++ b/post/user/product.php @@ -123,7 +123,7 @@ if (isset($_POST['bulk_edit_product_category'])) { $category_name = sanitizeInput($row['category_name']); // Assign category to Selected Products - if ($_POST['product_ids']) { + if (isset($_POST['product_ids'])) { // Get Count $count = count($_POST['product_ids']); @@ -158,7 +158,7 @@ if (isset($_POST['bulk_archive_products'])) { validateCSRFToken($_POST['csrf_token']); - if ($_POST['product_ids']) { + if (isset($_POST['product_ids'])) { $count = count($_POST['product_ids']); @@ -193,7 +193,7 @@ if (isset($_POST['bulk_unarchive_products'])) { enforceUserPermission('module_sales', 2); validateCSRFToken($_POST['csrf_token']); - if ($_POST['product_ids']) { + if (isset($_POST['product_ids'])) { $count = count($_POST['product_ids']); @@ -228,7 +228,7 @@ if (isset($_POST['bulk_delete_products'])) { enforceUserPermission('module_sales', 3); validateCSRFToken($_POST['csrf_token']); - if ($_POST['product_ids']) { + if (isset($_POST['product_ids'])) { $count = count($_POST['product_ids']); diff --git a/post/user/project.php b/post/user/project.php index 13e6d1b1..96521dc5 100644 --- a/post/user/project.php +++ b/post/user/project.php @@ -199,7 +199,7 @@ if (isset($_POST['add_project_ticket'])) { $project_name = sanitizeInput($row['project_name']); // Add Tickets - if ($_POST['tickets']) { + if (isset($_POST['tickets'])) { // Get Selected Count $count = count($_POST['tickets']); diff --git a/post/user/vendor.php b/post/user/vendor.php index 3dff7002..bdcee359 100644 --- a/post/user/vendor.php +++ b/post/user/vendor.php @@ -163,7 +163,7 @@ if (isset($_POST['bulk_archive_vendors'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - if (isset($vendor_ids)) { + if (isset($_POST['vendor_ids'])) { // Get Selected Count $count = count($_POST['vendor_ids']); @@ -200,7 +200,7 @@ if (isset($_POST['bulk_unarchive_vendors'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - if (isset($vendor_ids)) { + if (isset($_POST['vendor_ids'])) { // Get Selected Count $count = count($_POST['vendor_ids']); @@ -237,7 +237,7 @@ if (isset($_POST['bulk_delete_vendors'])) { validateAdminRole(); validateCSRFToken($_POST['csrf_token']); - if (isset($vendor_ids)) { + if (isset($_POST['vendor_ids'])) { // Get Selected Count $count = count($_POST['vendor_ids']); From 577d97b471d931540a1e27dc4fb30cf0a8d96d10 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Fri, 15 Nov 2024 11:53:43 -0500 Subject: [PATCH 022/148] Updated ajax.php to use the new logAction function --- ajax.php | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/ajax.php b/ajax.php index fb699daf..7455d8bd 100644 --- a/ajax.php +++ b/ajax.php @@ -152,7 +152,7 @@ if (isset($_POST['client_set_notes'])) { mysqli_query($mysqli, "UPDATE clients SET client_notes = '$notes' WHERE client_id = $client_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client', log_action = 'Modify', log_description = '$session_name modified client notes', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id"); + logAction("Client", "Edit", "$session_name edited client notes", $client_id); } @@ -160,11 +160,19 @@ if (isset($_POST['contact_set_notes'])) { $contact_id = intval($_POST['contact_id']); $notes = sanitizeInput($_POST['notes']); + // Get Contact Details and Client ID for Logging + $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id + FROM contacts WHERE contact_id = $contact_id" + ); + $row = mysqli_fetch_array($sql); + $contact_name = sanitizeInput($row['contact_name']); + $client_id = intval($row['contact_client_id']); + // Update notes mysqli_query($mysqli, "UPDATE contacts SET contact_notes = '$notes' WHERE contact_id = $contact_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Contact', log_action = 'Modify', log_description = '$session_name modified contact notes', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Contact", "Edit", "$session_name edited contact notes for $contact_name", $client_id, $contact_id); } @@ -172,11 +180,19 @@ if (isset($_POST['asset_set_notes'])) { $asset_id = intval($_POST['asset_id']); $notes = sanitizeInput($_POST['notes']); + // Get Asset Details and Client ID for Logging + $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id + FROM assets WHERE asset_id = $asset_id" + ); + $row = mysqli_fetch_array($sql); + $asset_name = sanitizeInput($row['asset_name']); + $client_id = intval($row['asset_client_id']); + // Update notes mysqli_query($mysqli, "UPDATE assets SET asset_notes = '$notes' WHERE asset_id = $asset_id"); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Asset', log_action = 'Modify', log_description = '$session_name modified asset notes', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Asset", "Edit", "$session_name edited asset notes for $asset_name", $client_id, $asset_id); } @@ -331,7 +347,7 @@ if (isset($_GET['share_generate_link'])) { echo json_encode($url); // Logging - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'Create', log_description = '$session_name created shared link for $item_type - $item_name', log_client_id = $client_id, log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + logAction("Share", "Create", "$session_name created shared link for $item_type - $item_name", $client_id, $item_id); } @@ -484,7 +500,9 @@ if (isset($_GET['get_totp_token_via_id'])) { $recent_totp_view_logged_count = intval($check_recent_totp_view_logged_sql['recent_totp_view']); if ($recent_totp_view_logged_count == 0) { - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Login', log_action = 'View TOTP', log_description = '$session_name viewed login TOTP code for $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $login_id"); + // Logging + logAction("Credential", "View TOTP", "$session_name viewed credential TOTP code for $name", $client_id, $login_id); + } } From 412462a4c0d4583e4d2dd3e323608b3871fb763f Mon Sep 17 00:00:00 2001 From: johnnyq Date: Fri, 15 Nov 2024 12:21:55 -0500 Subject: [PATCH 023/148] More logAction function updates to client portal login amd cleaned up the client login portal for better presentation of vars --- guest_view_item.php | 5 +- portal/login.php | 218 ++++++++++++++++++++++++-------------------- 2 files changed, 122 insertions(+), 101 deletions(-) diff --git a/guest_view_item.php b/guest_view_item.php index 6070b2b9..230ec667 100644 --- a/guest_view_item.php +++ b/guest_view_item.php @@ -139,7 +139,8 @@ if ($item_type == "Document") { // Logging $name = mysqli_real_escape_string($mysqli, $doc_title); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Viewed shared $item_type $doc_title_escaped via link', log_client_id = $client_id, log_ip = '$ip', log_user_agent = '$user_agent'"); + logAction("Share", "View", "Viewed shared $item_type $doc_title_escaped via link", $client_id); + } elseif ($item_type == "File") { $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1"); @@ -254,7 +255,7 @@ if ($item_type == "Document") { // Logging $name = sanitizeInput($login_row['login_name']); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Sharing', log_action = 'View', log_description = 'Viewed shared $item_type $name via link', log_client_id = $client_id, log_ip = '$ip', log_user_agent = '$user_agent'"); + logAction("Share", "View", "Viewed shared $item_type $name via link", $client_id); } diff --git a/portal/login.php b/portal/login.php index 0aa9ce16..878ca6b4 100644 --- a/portal/login.php +++ b/portal/login.php @@ -31,8 +31,8 @@ if($config_client_portal_enable == 0) { exit(); } -$ip = sanitizeInput(getIP()); -$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$session_ip = sanitizeInput(getIP()); +$session_user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); $sql_settings = mysqli_query($mysqli, "SELECT config_azure_client_id, config_login_message FROM settings WHERE company_id = 1"); $settings = mysqli_fetch_array($sql_settings); @@ -50,34 +50,54 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login'])) { $password = $_POST['password']; if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { + header("HTTP/1.1 401 Unauthorized"); + $_SESSION['login_message'] = 'Invalid e-mail'; + } else { + $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_archived_at IS NULL AND user_type = 2 AND user_status = 1 LIMIT 1"); $row = mysqli_fetch_array($sql); - if ($row['user_auth_method'] == 'local') { + $client_id = intval($row['contact_client_id']); + $user_id = intval($row['user_id']); + $contact_id = intval($row['contact_id']); + $user_email = sanitizeInput($row['user_email']); + $user_auth_method = sanitizeInput($row['user_auth_method']); + + if ($user_auth_method == 'local') { if (password_verify($password, $row['user_password'])) { $_SESSION['client_logged_in'] = true; - $_SESSION['client_id'] = intval($row['contact_client_id']); - $_SESSION['user_id'] = intval($row['user_id']); - $_SESSION['contact_id'] = intval($row['contact_id']); + $_SESSION['client_id'] = $client_id; + $_SESSION['user_id'] = $user_id; + $_SESSION['contact_id'] = $contact_id; $_SESSION['login_method'] = "local"; header("Location: index.php"); - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client Login', log_action = 'Success', log_description = 'Client contact $row[contact_email] successfully logged in locally', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $row[contact_client_id], log_user_id = $row[user_id]"); + // Logging + logAction("Client Login", "Success", "Client contact $user_email successfully logged in locally", $client_id, $user_id); } else { - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client Login', log_action = 'Failed', log_description = 'Failed client portal login attempt using $email (incorrect password for contact ID $row[contact_id])', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $row[contact_client_id], log_user_id = $row[user_id]"); + + // Logging + logAction("Client Login", "Failed", "Failed client portal login attempt using $email (incorrect password for contact ID $contact_id)", $client_id, $user_id); + header("HTTP/1.1 401 Unauthorized"); $_SESSION['login_message'] = 'Incorrect username or password.'; + } } else { - mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client Login', log_action = 'Failed', log_description = 'Failed client portal login attempt using $email (invalid email/not allowed local auth)', log_ip = '$ip', log_user_agent = '$user_agent'"); + + // Logging + logAction("Client Login", "Failed", "Failed client portal login attempt using $email (invalid email/not allowed local auth)"); + header("HTTP/1.1 401 Unauthorized"); + $_SESSION['login_message'] = 'Incorrect username or password.'; + } } } @@ -85,120 +105,120 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['login'])) { ?> - - - - <?php echo $company_name; ?> | Client Portal Login + + + + <?php echo $company_name; ?> | Client Portal Login - - - + + + - - - - - - - - - - - - - - - - -