Add permissions for every table (view, add, edit, and delete). Important change to increase security on the REST API and will be beneficial for more detailed control of permissions.

profiles/app_config.php

@@ -27,6 +27,6 @@
 		$apps[$x]['permissions'][2]['name'] = 'sip_profiles_edit';
 		$apps[$x]['permissions'][2]['groups'][] = 'superadmin';
 
-		$apps[$x]['permissions'][3]['name'] = 'sip_profiles_delete';
+		$apps[$x]['permissions'][3]['name'] = 'sip_profile_delete';
 		$apps[$x]['permissions'][3]['groups'][] = 'superadmin';
 ?>

profiles/v_profiles.php

@@ -151,7 +151,7 @@ if (strlen($save_msg) > 0) {
 			if (permission_exists('sip_profiles_edit')) {
 				echo "		  <td valign='middle'><a href='v_profile_edit.php?type=profile&f=".$file."' alt='edit'>$v_link_label_edit</a></td>\n";
 			}
-			if (permission_exists('sip_profiles_delete')) {
+			if (permission_exists('sip_profile_delete')) {
 				echo "		  <td><a href='v_profiles.php?type=profile&a=del&f=".$file."'  alt='delete' onclick=\"return confirm('Do you really want to delete this?')\">$v_link_label_delete</a></td>\n";
 			}
 			echo "		</tr>\n";

user_contacts/users.php

@@ -97,7 +97,7 @@ require_once "resources/paging.php";
 	echo th_order_by('user_company_name', 'Organization', $order_by, $order);
 	echo th_order_by('user_phone_1', 'Phone', $order_by, $order);
 	echo "<td align='right' width='42'>\n";
-	if (permission_exists('contacts_add')) {
+	if (permission_exists('contact_add')) {
 		echo "	<a href='user_edit.php' alt='add'>$v_link_label_add</a>\n";
 	}
 	echo "</td>\n";
@@ -119,7 +119,7 @@ require_once "resources/paging.php";
 			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['user_company_name']."&nbsp;</td>\n";
 			echo "	<td valign='top' class='".$row_style[$c]."'>".$row['user_phone_1']."&nbsp;</td>\n";
 			echo "	<td valign='top' align='right'>\n";
-			if (permission_exists('contacts_edit')) {
+			if (permission_exists('contact_edit')) {
 				echo "		<a href='user_edit.php?id=".$row['user_uuid']."' alt='edit'>$v_link_label_edit</a>\n";
 			}
 			if (permission_exists('contact_delete')) {
@@ -139,7 +139,7 @@ require_once "resources/paging.php";
 	echo "		<td width='33.3%' nowrap>&nbsp;</td>\n";
 	echo "		<td width='33.3%' align='center' nowrap>$paging_controls</td>\n";
 	echo "		<td width='33.3%' align='right'>\n";
-	if (permission_exists('contacts_add')) {
+	if (permission_exists('contact_add')) {
 		echo "			<a href='user_edit.php' alt='add'>$v_link_label_add</a>\n";
 	}
 	echo "		</td>\n";