nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

code audit fixes: require_once, issue flow, role guards

Browse Source
This commit is contained in:
Thanakorn S
2026-05-23 17:06:08 +07:00
parent 54f3f11fd2
commit 5ca6b49fd0
191 changed files with 534 additions and 464 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/setting/api/engine/change_password.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PasswordManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PasswordManager.php';
$pm = new PasswordManager($pdo1, $include_url);
$pm->handleChange($user_id, $data);
app/setting/api/engine/company_setting.php
+1 -1
View File
@@ -1,6 +1,6 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/CompanySettingManager.php';
if (($data['action'] ?? '') === 'update') {
app/setting/api/engine/gl_maintenance.php
+1 -1
View File
@@ -1,6 +1,6 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/db_auth.php';
require_role($user_role, ['owner', 'admin']);
require_once '../../../assets/utils/classes_ac/EtlManager.php';
app/setting/api/engine/manage_company.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/CompanyProfileManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/CompanyProfileManager.php';
if ($user_role !== 'owner') { http_response_code(403); exit(json_encode(['success' => 0, 'message' => 'Only the owner can modify this setting.'])); }
app/setting/api/engine/manage_profile.php
+3 -3
View File
@@ -1,8 +1,8 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/FileUploader.php';
require '../../../assets/utils/classes/UserManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/FileUploader.php';
require_once '../../../assets/utils/classes/UserManager.php';
try {
$um = new UserManager($pdo1, $company_id, $user_id);
app/setting/api/engine/manage_smtp.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/SmtpManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/SmtpManager.php';
if ($user_role !== 'owner') { http_response_code(403); exit(json_encode(['success' => 0, 'message' => 'Only the owner can modify this setting.'])); }
app/setting/api/engine/manage_users.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/UserManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/UserManager.php';
if ($user_role !== 'owner') { http_response_code(403); exit(json_encode(['success' => 0, 'message' => 'Only the owner can modify this setting.'])); }
app/setting/api/engine/request_reset_otp.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
define('UNAUTHENTICATED_ROUTE', true);
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PasswordResetManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PasswordResetManager.php';
$prm = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
$prm->handleRequestOtp($user_id, $company_id);
app/setting/api/engine/reset_password_otp.php
+2 -2
View File
@@ -1,8 +1,8 @@
<?php
session_start();
define('UNAUTHENTICATED_ROUTE', true);
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/PasswordResetManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/PasswordResetManager.php';
$prm = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
$prm->handleConfirmReset($user_id, $data);
app/setting/api/engine/retrieve_company.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/CompanyProfileManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/CompanyProfileManager.php';
try {
$company_profile = new CompanyProfileManager($pdo1, $company_id);
app/setting/api/engine/retrieve_profile.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/UserManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/UserManager.php';
$um = new UserManager($pdo1, $company_id, $user_id);
app/setting/api/engine/retrieve_smtp.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/SmtpManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/SmtpManager.php';
try {
$smtp = new SmtpManager($pdo1, $company_id, $method, $pinkey, $iv);
app/setting/api/engine/retrieve_users.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/UserManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/UserManager.php';
$um = new UserManager($pdo1, $company_id, $user_id);
app/setting/api/engine/search_users.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/UserManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/UserManager.php';
$keyword = trim($data['keyword'] ?? '');
$um = new UserManager($pdo1, $company_id, $user_id);
app/setting/api/engine/switch_branch.php
+2 -2
View File
@@ -6,8 +6,8 @@
* action: 'update' → switch to the requested company_id
*/
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/UserManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/UserManager.php';
$action = $data['action'] ?? '';
$um = new UserManager($pdo1, $company_id, $user_id);
app/setting/api/engine/test_smtp.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/SmtpManager.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/SmtpManager.php';
if ($user_role !== 'owner') { http_response_code(403); exit(json_encode(['success' => 0, 'message' => 'Only the owner can modify this setting.'])); }