ajout app

SNIPE-IT/app/Console/Commands/CheckinLicensesFromAllUsers.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\License;
+use App\Models\LicenseSeat;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Model;
+
+class CheckinLicensesFromAllUsers extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:checkin-from-all {--license_id=} {--notify}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Checks in licenses from all users';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $license_id = $this->option('license_id');
+        $notify = $this->option('notify');
+
+        if (! $license_id) {
+            $this->error('ERROR: License ID is required.');
+
+            return false;
+        }
+
+        if (! $license = License::where('id', '=', $license_id)->first()) {
+            $this->error('Invalid license ID');
+
+            return false;
+        }
+
+        $this->info('Checking in ALL seats for '.$license->name);
+
+        $licenseSeats = LicenseSeat::where('license_id', '=', $license_id)
+            ->whereNotNull('assigned_to')
+            ->with('user')
+            ->get();
+
+        $this->info(' There are '.$licenseSeats->count().' seats checked out: ');
+
+        if (! $notify) {
+            $this->info('No mail will be sent.');
+        }
+
+        foreach ($licenseSeats as $seat) {
+            $this->info($seat->user->username.' has a license seat for '.$license->name);
+            $seat->assigned_to = null;
+
+            if ($seat->save()) {
+
+                // Override the email address so we don't notify on checkin
+                if (! $notify) {
+                    $seat->user->email = null;
+                }
+
+                // Log the checkin
+                $seat->logCheckin($seat->user, 'Checked in via cli tool');
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/CheckoutLicenseToAllUsers.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\License;
+use App\Models\LicenseSeat;
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Model;
+
+class CheckoutLicenseToAllUsers extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:checkout-to-all {--license_id=} {--notify}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Checks out licenses to all users';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $license_id = $this->option('license_id');
+        $notify = $this->option('notify');
+
+        if (! $license_id) {
+            $this->error('ERROR: License ID is required.');
+
+            return false;
+        }
+
+        if (! $license = License::where('id', '=', $license_id)->with('assignedusers')->first()) {
+            $this->error('Invalid license ID');
+
+            return false;
+        }
+
+        $users = User::whereNull('deleted_at')->where('autoassign_licenses', '=', 1)->with('licenses')->get();
+
+        if ($users->count() > $license->getAvailSeatsCountAttribute()) {
+            $this->info('You do not have enough free seats to complete this task, so we will check out as many as we can. ');
+        }
+
+        $this->info('Checking out '.$users->count().' of '.$license->getAvailSeatsCountAttribute().' seats for '.$license->name);
+
+        if (! $notify) {
+            $this->info('No mail will be sent.');
+        }
+
+        foreach ($users as $user) {
+
+            // Check to make sure this user doesn't already have this license checked out
+            // to them
+
+            if ($user->licenses->where('id', '=', $license_id)->count()) {
+                $this->info($user->username.' already has this license checked out to them. Skipping... ');
+                continue;
+            }
+
+            // If the license is valid, check that there is an available seat
+            if ($license->availCount()->count() < 1) {
+                $this->error('ERROR: No available seats');
+
+                return false;
+            }
+
+            $this->info($license->availCount()->count().' seats left');
+            // Get the seat ID
+            $licenseSeat = $license->freeSeat();
+
+            // Update the seat with checkout info,
+            $licenseSeat->assigned_to = $user->id;
+            if ($licenseSeat->save()) {
+
+                // Temporarily null the user's email address so we don't send mail if we're not supposed to
+                if (! $notify) {
+                    $user->email = null;
+                }
+
+                // Log the checkout
+                $licenseSeat->logCheckout('Checked out via cli tool', $user);
+                $this->info('License '.$license_id.' seat '.$licenseSeat->id.' checked out to '.$user->username);
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/CreateAdmin.php

@@ -0,0 +1,95 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use \App\Models\User;
+
+
+class CreateAdmin extends Command
+{
+
+    /** @mixin User **/
+    /**
+     * App\Console\CreateAdmin
+     * @property mixed $first_name
+     * @property string $last_name
+     * @property string $username
+     * @property string $email
+     * @property string $permissions
+     * @property string $password
+     * @property boolean $activated
+     * @property boolean $show_in_list
+     * @property boolean $autoassign_licenses
+     * @property \Illuminate\Support\Carbon|null $created_at
+     * @property mixed $created_by
+     */
+
+
+
+    protected $signature = 'snipeit:create-admin {--first_name=} {--last_name=}  {--email=}  {--username=}  {--password=} {show_in_list?} {autoassign_licenses?}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Create an admin user via command line.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+
+    public function handle()
+    {
+        $first_name = $this->option('first_name');
+        $last_name = $this->option('last_name');
+        $username = $this->option('username');
+        $email = $this->option('email');
+        $password = $this->option('password');
+        $show_in_list = $this->argument('show_in_list');
+        $autoassign_licenses = $this->argument('autoassign_licenses');
+
+
+
+        if (($first_name == '') || ($last_name == '') || ($username == '') || ($email == '') || ($password == '')) {
+            $this->info('ERROR: All fields are required.');
+        } else {
+            $user = new User;
+            $user->first_name = $first_name;
+            $user->last_name = $last_name;
+            $user->username = $username;
+            $user->email = $email;
+            $user->permissions = '{"admin":1,"user":1,"superuser":1,"reports.view":1, "licenses.keys":1}';
+            $user->password = bcrypt($password);
+            $user->activated = 1;
+
+            if ($show_in_list == 'false') {
+                $user->show_in_list = 0;
+            }
+
+            if ($autoassign_licenses == 'false') {
+                $user->autoassign_licenses = 0;
+            }
+
+            if ($user->save()) {
+                $this->info('New user created');
+                $user->groups()->attach(1);
+            } else {
+                $this->info('Admin user was not created');
+                $errors = $user->getErrors();
+
+                foreach ($errors->all() as $error) {
+                    $this->info('ERROR:'.$error);
+                }
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/DisableLDAP.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Setting;
+use Illuminate\Console\Command;
+
+class DisableLDAP extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:ldap-disable';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This is  a rescue command that can be used to turn off LDAP settings in the event that you managed to lock yourself out using bad LDAP settings.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if ($this->confirm("\n****************************************************\nThis will disable LDAP support. You will not be able \nto login with an account that does not exist \nlocally in the Snipe-IT local database. \n****************************************************\n\nDo you wish to continue? [y|N]")) {
+            $setting = Setting::getSettings();
+            $setting->ldap_enabled = 0;
+            if ($setting->save()) {
+                $this->info('LDAP has been set to disabled.');
+            } else {
+                $this->info('Unable to disable LDAP.');
+            }
+        } else {
+            $this->info('Canceled. No actions taken.');
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/FixDoubleEscape.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class FixDoubleEscape extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:unescape';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This should be run to fix some double-escaping issues from earlier versions of Snipe-IT.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $tables = [
+            \App\Models\Asset::class => ['name'],
+            \App\Models\License::class => ['name'],
+            \App\Models\Consumable::class => ['name'],
+            \App\Models\Accessory::class => ['name'],
+            \App\Models\Component::class => ['name'],
+            \App\Models\Company::class => ['name'],
+            \App\Models\Manufacturer::class => ['name'],
+            \App\Models\Supplier::class => ['name'],
+            \App\Models\Statuslabel::class => ['name'],
+            \App\Models\Depreciation::class => ['name'],
+            \App\Models\AssetModel::class => ['name'],
+            \App\Models\Group::class => ['name'],
+            \App\Models\Department::class => ['name'],
+            \App\Models\Location::class => ['name'],
+            \App\Models\User::class => ['first_name', 'last_name'],
+        ];
+
+        $count = [];
+
+        foreach ($tables as $classname => $fields) {
+            $count[$classname] = [];
+            $count[$classname]['classname'] = 0;
+
+            foreach ($fields as $field) {
+                $count[$classname]['classname']++;
+                $count[$classname][$field] = 0;
+
+                foreach ($classname::where("$field", 'LIKE', '%&%')->get() as $row) {
+                    $this->info('Updating '.$field.' for '.$classname);
+                    $row->{$field} = html_entity_decode($row->{$field}, ENT_QUOTES);
+                    $row->save();
+                    $count[$classname][$field]++;
+                }
+            }
+        }
+
+        $this->info('Update complete');
+    }
+}

SNIPE-IT/app/Console/Commands/FixMismatchedAssetsAndLogs.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Actionlog;
+use App\Models\Asset;
+use Illuminate\Console\Command;
+
+class FixMismatchedAssetsAndLogs extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:fix-assets-and-logs {--dryrun : Run the sync process but don\'t update the database}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This script attempts to check the log table and check that the assets.assigned_to matches the last checkout.';
+
+    /**
+     * Is dry-run?
+     *
+     * @var bool
+     */
+    private $dryrun = false;
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if ($this->option('dryrun')) {
+            $this->dryrun = true;
+        }
+
+        if ($this->dryrun) {
+            $this->info('This is a DRY RUN - no changes will be saved.');
+        }
+
+        $mismatch_count = 0;
+        $assets = Asset::whereNotNull('assigned_to')
+            ->where('assigned_type', '=', \App\Models\User::class)
+            ->orderBy('id', 'ASC')->get();
+        foreach ($assets as $asset) {
+
+            // get the last checkout of the asset
+            if ($checkout_log = Actionlog::where('target_type', '=', \App\Models\User::class)
+                ->where('action_type', '=', 'checkout')
+                ->where('item_id', '=', $asset->id)
+                ->orderBy('created_at', 'DESC')
+                ->first()) {
+
+                    // Now check for a subsequent checkin log - we want to ignore those
+                if (! $checkin_log = Actionlog::where('target_type', '=', \App\Models\User::class)
+                        ->where('action_type', '=', 'checkin from')
+                        ->where('item_id', '=', $asset->id)
+                        ->whereDate('created_at', '>', $checkout_log->created_at)
+                        ->orderBy('created_at', 'DESC')
+                        ->first()) {
+
+                        //print_r($asset);
+                    if ($checkout_log->target_id != $asset->assigned_to) {
+                        $this->error('Log ID: '.$checkout_log->id.' -- Asset ID '.$checkout_log->item_id.' SHOULD BE checked out to User '.$checkout_log->target_id.' but its assigned_to is '.$asset->assigned_to);
+
+                        if (! $this->dryrun) {
+                            $asset->assigned_to = $checkout_log->target_id;
+                            if ($asset->save()) {
+                                $this->info('Asset record updated.');
+                            } else {
+                                $this->error('Error updating asset: '.$asset->getErrors());
+                            }
+                        }
+                        $mismatch_count++;
+                    }
+                } else {
+                    //$this->info('Asset ID '.$asset->id.': There is a checkin '.$checkin_log->created_at.' after this checkout '.$checkout_log->created_at);
+                }
+            }
+        }
+        $this->info($mismatch_count.' mismatched assets.');
+    }
+}

SNIPE-IT/app/Console/Commands/GeneratePersonalAccessToken.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Helpers\Helper;
+use Illuminate\Console\Command;
+use App\Models\User;
+use Laravel\Passport\TokenRepository;
+use Illuminate\Contracts\Validation\Factory as ValidationFactory;
+use DB;
+
+class GeneratePersonalAccessToken extends Command
+{
+
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:make-api-key 
+                        {--user_id= : The ID of the user to create the token for.}
+                        {--name= : The name of the new API token}
+                        {--key-only : Only return the value of the API key}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This console command allows you to generate Personal API tokens to be used with the Snipe-IT JSON REST API on behalf of a user.';
+
+
+    /**
+     * The token repository implementation.
+     *
+     * @var \Laravel\Passport\TokenRepository
+     */
+    protected $tokenRepository;
+
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct(TokenRepository $tokenRepository, ValidationFactory $validation)
+    {
+        $this->validation = $validation;
+        $this->tokenRepository = $tokenRepository;
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return int
+     */
+    public function handle()
+    {
+
+        $accessTokenName = $this->option('name');
+        if ($accessTokenName=='') {
+            $accessTokenName = 'CLI Auth Token';
+        }
+
+        if ($this->option('user_id')=='') {
+            return $this->error('ERROR: user_id cannot be blank.');
+        }
+
+        if ($user = User::find($this->option('user_id'))) {
+
+            $createAccessToken = $user->createToken($accessTokenName)->accessToken;
+
+            if ($this->option('key-only')) {
+                $this->info($createAccessToken);
+
+            } else {
+
+                $this->warn('Your API Token has been created. Be sure to copy this token now, as it will not be accessible again.');
+
+                if ($token = DB::table('oauth_access_tokens')->where('user_id', '=', $user->id)->where('name','=',$accessTokenName)->orderBy('created_at', 'desc')->first()) {
+                    $this->info('API Token ID: '.$token->id);
+                }
+
+                $this->info('API Token User: '.$user->present()->fullName.' ('.$user->username.')');
+                $this->info('API Token Name: '.$accessTokenName);
+                $this->info('API Token: '.$createAccessToken);
+            }
+        } else {
+           return $this->error('ERROR: Invalid user. API key was not created.');
+        }
+
+
+
+
+    }
+}

SNIPE-IT/app/Console/Commands/ImportLocations.php

@@ -0,0 +1,150 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Location;
+use Illuminate\Console\Command;
+use League\Csv\Reader;
+
+class ImportLocations extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:import-locations {filename}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Import locations and their parents';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if (! ini_get('auto_detect_line_endings')) {
+            ini_set('auto_detect_line_endings', '1');
+        }
+
+        $filename = $this->argument('filename');
+        $csv = Reader::createFromPath(storage_path('private_uploads/imports/').$filename, 'r');
+        $this->info('Attempting to process: '.storage_path('private_uploads/imports/').$filename);
+        $csv->setHeaderOffset(0); //because we don't want to insert the header
+        $results = $csv->getRecords();
+
+        // Import parent location names first if they don't exist
+        foreach ($results as $parent_index => $parent_row) {
+            if (array_key_exists('Parent Name', $parent_row)) {
+                $parent_name = trim($parent_row['Parent Name']);
+                if (array_key_exists('Name', $parent_row)) {
+                    $this->info('- Parent: '.$parent_name.' in row as: '.trim($parent_row['Parent Name']));
+                }
+
+                // Save parent location name
+                // This creates a sort of name-stub that we'll update later on in this script
+                $parent_location = Location::firstOrCreate(['name' => $parent_name]);
+                if (array_key_exists('Name', $parent_row)) {
+                    $this->info('Parent for '.$parent_row['Name'].' is '.$parent_name.'. Attempting to save '.$parent_name.'.');
+                }
+
+                // Check if the record was updated or created.
+                // This is mostly for clearer debugging.
+                if ($parent_location->exists) {
+                    $this->info('- Parent location '.$parent_name.' already exists.');
+                } else {
+                    $this->info('- Parent location '.$parent_name.' was created.');
+                }
+            } else {
+                $this->info('- No Parent Name provided, so no parent location will be created.');
+            }
+        }
+
+        $this->info('----- Parents Created.... backfilling additional details... --------');
+        // Loop through ALL records and add/update them if there are additional fields
+        // besides name
+        foreach ($results as $index => $row) {
+            if (array_key_exists('Parent Name', $row)) {
+                $parent_name = trim($row['Parent Name']);
+            } else {
+                $parent_name = null;
+            }
+
+            // Set the location attributes to save
+            if (array_key_exists('Name', $row)) {
+                $location = Location::firstOrCreate(['name' => trim($row['Name'])]);
+                $location->name = trim($row['Name']);
+                $this->info('Checking location: '.$location->name);
+            } else {
+                $this->error('Location name is required and is missing from at least one row in this dataset. Check your CSV for extra trailing rows and try again.');
+
+                return false;
+            }
+            if (array_key_exists('Currency', $row)) {
+                $location->currency = trim($row['Currency']);
+            }
+            if (array_key_exists('Address 1', $row)) {
+                $location->address = trim($row['Address 1']);
+            }
+            if (array_key_exists('Address 2', $row)) {
+                $location->address2 = trim($row['Address 2']);
+            }
+            if (array_key_exists('City', $row)) {
+                $location->city = trim($row['City']);
+            }
+            if (array_key_exists('State', $row)) {
+                $location->state = trim($row['State']);
+            }
+            if (array_key_exists('Zip', $row)) {
+                $location->zip = trim($row['Zip']);
+            }
+            if (array_key_exists('Country', $row)) {
+                $location->country = trim($row['Country']);
+            }
+            if (array_key_exists('OU', $row)) {
+                $location->ldap_ou = trim($row['OU']);
+            }
+
+            // If a parent name is provided, we created it earlier in the script,
+            // so let's grab that ID
+            if ($parent_name) {
+                $this->info('-- Searching for Parent Name: '.$parent_name);
+                $parent = Location::where('name', '=', $parent_name)->first();
+                $location->parent_id = $parent->id;
+                $this->info('Parent: '.$parent_name.' - ID: '.$parent->id);
+            }
+
+            // Make sure the more advanced (non-name) fields pass validation
+            if (($location->isValid()) && ($location->save())) {
+
+                // Check if the record was updated or created.
+                // This is mostly for clearer debugging.
+                if ($location->exists) {
+                    $this->info('Location '.$location->name.' already exists. Updating...');
+                } else {
+                    $this->info('- Location '.$location->name.' was created. ');
+                }
+
+                // If there's a validation error, display that
+            } else {
+                $this->error('- Non-parent Location '.$location->name.' could not be created: '.$location->getErrors());
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/KillAllSessions.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class KillAllSessions extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:global-logout  {--force : Skip the danger prompt; assuming you enter "y"} ';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command will destroy all web sessions on disk and will force a re-login for all users.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+        if (!$this->option('force') && !$this->confirm("****************************************************\nTHIS WILL FORCE A LOGIN FOR ALL LOGGED IN USERS.\n\nAre you SURE you wish to continue? ")) {
+            return $this->error("Session loss not confirmed");
+        }
+
+        $session_files = glob(storage_path("framework/sessions/*"));
+
+        $count = 0;
+        foreach ($session_files as $file) {
+
+            if (is_file($file))
+                unlink($file);
+                $count++;
+        }
+        \DB::table('users')->update(['remember_token' => null]);
+
+        $this->info($count. ' sessions cleared!');
+
+    }
+}

SNIPE-IT/app/Console/Commands/LdapSync.php

@@ -0,0 +1,431 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Department;
+use App\Models\Group;
+use Illuminate\Console\Command;
+use App\Models\Setting;
+use App\Models\Ldap;
+use App\Models\User;
+use App\Models\Location;
+use Log;
+
+class LdapSync extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:ldap-sync {--location=} {--location_id=*} {--base_dn=} {--filter=} {--summary} {--json_summary}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Command line LDAP sync';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+        // If LDAP enabled isn't set to 1 (ldap_enabled!=1) then we should cut this short immediately without going any further
+        if (Setting::getSettings()->ldap_enabled!='1') {
+            $this->error('LDAP is not enabled. Aborting. See Settings > LDAP to enable it.');
+            exit();
+        }
+
+        ini_set('max_execution_time', env('LDAP_TIME_LIM', 600)); //600 seconds = 10 minutes
+        ini_set('memory_limit', env('LDAP_MEM_LIM', '500M'));
+        $ldap_result_username = Setting::getSettings()->ldap_username_field;
+        $ldap_result_last_name = Setting::getSettings()->ldap_lname_field;
+        $ldap_result_first_name = Setting::getSettings()->ldap_fname_field;
+        $ldap_result_active_flag = Setting::getSettings()->ldap_active_flag;
+        $ldap_result_emp_num = Setting::getSettings()->ldap_emp_num;
+        $ldap_result_email = Setting::getSettings()->ldap_email;
+        $ldap_result_phone = Setting::getSettings()->ldap_phone_field;
+        $ldap_result_jobtitle = Setting::getSettings()->ldap_jobtitle;
+        $ldap_result_country = Setting::getSettings()->ldap_country;
+        $ldap_result_location = Setting::getSettings()->ldap_location;
+        $ldap_result_dept = Setting::getSettings()->ldap_dept;
+        $ldap_result_manager = Setting::getSettings()->ldap_manager;
+        $ldap_default_group = Setting::getSettings()->ldap_default_group;
+        $search_base = Setting::getSettings()->ldap_base_dn;
+
+        try {
+            $ldapconn = Ldap::connectToLdap();
+            Ldap::bindAdminToLdap($ldapconn);
+        } catch (\Exception $e) {
+            if ($this->option('json_summary')) {
+                $json_summary = ['error' => true, 'error_message' => $e->getMessage(), 'summary' => []];
+                $this->info(json_encode($json_summary));
+            }
+            Log::info($e);
+
+            return [];
+        }
+
+        $summary = [];
+
+        try {
+
+            /**
+             * if a location ID has been specified, use that OU
+             */
+            if ( $this->option('location_id') ) {
+
+                foreach($this->option('location_id') as $location_id){
+                    $location_ou = Location::where('id', '=', $location_id)->value('ldap_ou');
+                    $search_base = $location_ou;
+                    Log::debug('Importing users from specified location OU: \"'.$search_base.'\".');
+                 }
+            }
+
+            /**
+             *  if a manual base DN has been specified, use that. Allow the Base DN to override
+             *  even if there's a location-based DN - if you picked it, you must have picked it for a reason.
+             */
+            if ($this->option('base_dn') != '') {
+                $search_base = $this->option('base_dn');
+                Log::debug('Importing users from specified base DN: \"'.$search_base.'\".');
+            }
+
+            /**
+             * If a filter has been specified, use that
+             */
+            if ($this->option('filter') != '') {
+                $results = Ldap::findLdapUsers($search_base, -1, $this->option('filter'));
+            } else {
+                $results = Ldap::findLdapUsers($search_base);
+            }
+            
+        } catch (\Exception $e) {
+            if ($this->option('json_summary')) {
+                $json_summary = ['error' => true, 'error_message' => $e->getMessage(), 'summary' => []];
+                $this->info(json_encode($json_summary));
+            }
+            Log::info($e);
+
+            return [];
+        }
+
+        /* Determine which location to assign users to by default. */
+        $location = null; // TODO - this would be better called "$default_location", which is more explicit about its purpose
+        if ($this->option('location') != '') {
+            if ($location = Location::where('name', '=', $this->option('location'))->first()) {
+                Log::debug('Location name ' . $this->option('location') . ' passed');
+                Log::debug('Importing to ' . $location->name . ' (' . $location->id . ')');
+            }
+
+        } elseif ($this->option('location_id')) {
+            foreach($this->option('location_id') as $location_id) {
+                if ($location = Location::where('id', '=', $location_id)->first()) {
+                    Log::debug('Location ID ' . $location_id . ' passed');
+                    Log::debug('Importing to ' . $location->name . ' (' . $location->id . ')');
+                }
+
+            }
+        }
+        if (! isset($location)) {
+            Log::debug('That location is invalid or a location was not provided, so no location will be assigned by default.');
+        }
+
+        /* Process locations with explicitly defined OUs, if doing a full import. */
+        if ($this->option('base_dn') == '' && $this->option('filter') == '') {
+            // Retrieve locations with a mapped OU, and sort them from the shallowest to deepest OU (see #3993)
+            $ldap_ou_locations = Location::where('ldap_ou', '!=', '')->get()->toArray();
+            $ldap_ou_lengths = [];
+
+            foreach ($ldap_ou_locations as $ou_loc) {
+                $ldap_ou_lengths[] = strlen($ou_loc['ldap_ou']);
+            }
+
+            array_multisort($ldap_ou_lengths, SORT_ASC, $ldap_ou_locations);
+
+            if (count($ldap_ou_locations) > 0) {
+                Log::debug('Some locations have special OUs set. Locations will be automatically set for users in those OUs.');
+            }
+
+            // Inject location information fields
+            for ($i = 0; $i < $results['count']; $i++) {
+                $results[$i]['ldap_location_override'] = false;
+                $results[$i]['location_id'] = 0;
+            }
+
+            // Grab subsets based on location-specific DNs, and overwrite location for these users.
+            foreach ($ldap_ou_locations as $ldap_loc) {
+                try {
+                    $location_users = Ldap::findLdapUsers($ldap_loc['ldap_ou']);
+                } catch (\Exception $e) { // TODO: this is stolen from line 77 or so above
+                    if ($this->option('json_summary')) {
+                        $json_summary = ['error' => true, 'error_message' => trans('admin/users/message.error.ldap_could_not_search').' Location: '.$ldap_loc['name'].' (ID: '.$ldap_loc['id'].') cannot connect to "'.$ldap_loc['ldap_ou'].'" - '.$e->getMessage(), 'summary' => []];
+                        $this->info(json_encode($json_summary));
+                    }
+                    Log::info($e);
+
+                    return [];
+                }
+                $usernames = [];
+                for ($i = 0; $i < $location_users['count']; $i++) {
+                    if (array_key_exists($ldap_result_username, $location_users[$i])) {
+                        $location_users[$i]['ldap_location_override'] = true;
+                        $location_users[$i]['location_id'] = $ldap_loc['id'];
+                        $usernames[] = $location_users[$i][$ldap_result_username][0];
+                    }
+                }
+
+                // Delete located users from the general group.
+                foreach ($results as $key => $generic_entry) {
+                    if ((is_array($generic_entry)) && (array_key_exists($ldap_result_username, $generic_entry))) {
+                        if (in_array($generic_entry[$ldap_result_username][0], $usernames)) {
+                            unset($results[$key]);
+                        }
+                    }
+                }
+
+                $global_count = $results['count'];
+                $results = array_merge($location_users, $results);
+                $results['count'] = $global_count;
+            }
+        }
+
+        $manager_cache = [];
+
+        if($ldap_default_group != null) {
+
+            $default = Group::find($ldap_default_group);
+            if (!$default) {
+                $ldap_default_group = null; // un-set the default group if that group doesn't exist
+            }
+
+        }
+
+
+        for ($i = 0; $i < $results['count']; $i++) {
+                $item = [];
+                $item['username'] = $results[$i][$ldap_result_username][0] ?? '';
+                $item['employee_number'] = $results[$i][$ldap_result_emp_num][0] ?? '';
+                $item['lastname'] = $results[$i][$ldap_result_last_name][0] ?? '';
+                $item['firstname'] = $results[$i][$ldap_result_first_name][0] ?? '';
+                $item['email'] = $results[$i][$ldap_result_email][0] ?? '';
+                $item['ldap_location_override'] = $results[$i]['ldap_location_override'] ?? '';
+                $item['location_id'] = $results[$i]['location_id'] ?? '';
+                $item['telephone'] = $results[$i][$ldap_result_phone][0] ?? '';
+                $item['jobtitle'] = $results[$i][$ldap_result_jobtitle][0] ?? '';
+                $item['country'] = $results[$i][$ldap_result_country][0] ?? '';
+                $item['department'] = $results[$i][$ldap_result_dept][0] ?? '';
+                $item['manager'] = $results[$i][$ldap_result_manager][0] ?? '';
+                $item['location'] = $results[$i][$ldap_result_location][0] ?? '';
+
+                // ONLY if you are using the "ldap_location" option *AND* you have an actual result
+                if ($ldap_result_location && $item['location']) {
+                        $location = Location::firstOrCreate([
+                                'name' => $item['location'],
+                        ]);
+                }
+                $department = Department::firstOrCreate([
+                    'name' => $item['department'],
+                ]);
+
+                $user = User::where('username', $item['username'])->first();
+                if ($user) {
+                    // Updating an existing user.
+                    $item['createorupdate'] = 'updated';
+                } else {
+                    // Creating a new user.
+                    $user = new User;
+                    $user->password = $user->noPassword();
+                    $user->activated = 1; // newly created users can log in by default, unless AD's UAC is in use, or an active flag is set (below)
+                    $item['createorupdate'] = 'created';
+                }
+
+            //If a sync option is not filled in on the LDAP settings don't populate the user field
+            if($ldap_result_username  != null){
+                $user->username = $item['username'];
+            }
+            if($ldap_result_last_name != null){
+                $user->last_name = $item['lastname'];
+            }
+            if($ldap_result_first_name != null){
+                $user->first_name = $item['firstname'];
+            }
+            if($ldap_result_emp_num  != null){
+                $user->employee_num = e($item['employee_number']);
+            }
+            if($ldap_result_email != null){
+                $user->email = $item['email'];
+            }
+            if($ldap_result_phone != null){
+                $user->phone = $item['telephone'];
+            }
+            if($ldap_result_jobtitle != null){
+                $user->jobtitle = $item['jobtitle'];
+            }
+            if($ldap_result_country != null){
+                $user->country = $item['country'];
+            }
+            if($ldap_result_dept  != null){
+                $user->department_id = $department->id;
+            }
+            if($ldap_result_location != null){
+                $user->location_id = $location ? $location->id : null;
+            }
+
+            if($ldap_result_manager != null){
+                if($item['manager'] != null) {
+                    // Check Cache first
+                    if (isset($manager_cache[$item['manager']])) {
+                        // found in cache; use that and avoid extra lookups
+                        $user->manager_id = $manager_cache[$item['manager']];
+                    } else {
+                        // Get the LDAP Manager
+                        try {
+                            $ldap_manager = Ldap::findLdapUsers($item['manager'], -1, $this->option('filter'));
+                        } catch (\Exception $e) {
+                            \Log::warning("Manager lookup caused an exception: " . $e->getMessage() . ". Falling back to direct username lookup");
+                            // Hail-mary for Okta manager 'shortnames' - will only work if
+                            // Okta configuration is using full email-address-style usernames
+                            $ldap_manager = [
+                                "count" => 1,
+                                0 => [
+                                    $ldap_result_username => [$item['manager']]
+                                ]
+                            ];
+                        }
+
+                        if ($ldap_manager["count"] > 0) {
+
+                            // Get the Manager's username
+                            // PHP LDAP returns every LDAP attribute as an array, and 90% of the time it's an array of just one item. But, hey, it's an array.
+                            $ldapManagerUsername = $ldap_manager[0][$ldap_result_username][0];
+
+                            // Get User from Manager username.
+                            $ldap_manager = User::where('username', $ldapManagerUsername)->first();
+
+                            if ($ldap_manager && isset($ldap_manager->id)) {
+                                // Link user to manager id.
+                                $user->manager_id = $ldap_manager->id;
+                            }
+                        }
+                        $manager_cache[$item['manager']] = $ldap_manager && isset($ldap_manager->id)  ? $ldap_manager->id : null; // Store results in cache, even if 'failed'
+
+                    }
+                }
+            }
+
+                // Sync activated state for Active Directory.
+                if ( !empty($ldap_result_active_flag)) { // IF we have an 'active' flag set....
+                    // ....then *most* things that are truthy will activate the user. Anything falsey will deactivate them.
+                    // (Specifically, we don't handle a value of '0.0' correctly)
+                    $raw_value = @$results[$i][$ldap_result_active_flag][0];
+                    $filter_var = filter_var($raw_value, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);
+                    $boolean_cast = (bool)$raw_value;
+
+                    $user->activated = $filter_var ?? $boolean_cast; // if filter_var() was true or false, use that. If it's null, use the $boolean_cast
+
+                } elseif (array_key_exists('useraccountcontrol', $results[$i]) ) {
+                    // ....otherwise, (ie if no 'active' LDAP flag is defined), IF the UAC setting exists,
+                    // ....then use the UAC setting on the account to determine can-log-in vs. cannot-log-in
+
+
+                   /* The following is _probably_ the correct logic, but we can't use it because
+                       some users may have been dependent upon the previous behavior, and this
+                       could cause additional access to be available to users they don't want
+                       to allow to log in.
+
+                    $useraccountcontrol = $results[$i]['useraccountcontrol'][0];
+                    if(
+                        // based on MS docs at: https://support.microsoft.com/en-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties
+                        ($useraccountcontrol & 0x200) && // is a NORMAL_ACCOUNT
+                        !($useraccountcontrol & 0x02) && // *and* _not_ ACCOUNTDISABLE
+                        !($useraccountcontrol & 0x10)    // *and* _not_ LOCKOUT
+                    ) {
+                        $user->activated = 1;
+                    } else {
+                        $user->activated = 0;
+                    } */
+                    $enabled_accounts = [
+                    '512',    //     0x200 NORMAL_ACCOUNT
+                    '544',    //     0x220 NORMAL_ACCOUNT, PASSWD_NOTREQD
+                    '66048',  //   0x10200 NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
+                    '66080',  //   0x10220 NORMAL_ACCOUNT, PASSWD_NOTREQD, DONT_EXPIRE_PASSWORD
+                    '262656', //   0x40200 NORMAL_ACCOUNT, SMARTCARD_REQUIRED
+                    '262688', //   0x40220 NORMAL_ACCOUNT, PASSWD_NOTREQD, SMARTCARD_REQUIRED
+                    '328192', //   0x50200 NORMAL_ACCOUNT, SMARTCARD_REQUIRED, DONT_EXPIRE_PASSWORD
+                    '328224', //   0x50220 NORMAL_ACCOUNT, PASSWD_NOT_REQD, SMARTCARD_REQUIRED, DONT_EXPIRE_PASSWORD
+                    '4194816',//  0x400200 NORMAL_ACCOUNT, DONT_REQ_PREAUTH
+                    '4260352', // 0x410200 NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH
+                    '1049088', // 0x100200 NORMAL_ACCOUNT, NOT_DELEGATED
+                    '1114624', // 0x110200 NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, NOT_DELEGATED,
+                  ];
+                    $user->activated = (in_array($results[$i]['useraccountcontrol'][0], $enabled_accounts)) ? 1 : 0;
+
+                // If we're not using AD, and there isn't an activated flag set, activate all users
+                } /* implied 'else' here - leave the $user->activated flag alone. Newly-created accounts will be active.
+                already-existing accounts will be however the administrator has set them */
+
+
+                if ($item['ldap_location_override'] == true) {
+                    $user->location_id = $item['location_id'];
+                } elseif ((isset($location)) && (! empty($location))) {
+                    if ((is_array($location)) && (array_key_exists('id', $location))) {
+                        $user->location_id = $location['id'];
+                    } elseif (is_object($location)) {
+                        $user->location_id = $location->id;
+                    }
+                }
+                $location = null;
+                $user->ldap_import = 1;
+
+                $errors = '';
+
+                if ($user->save()) {
+                    $item['note'] = $item['createorupdate'];
+                    $item['status'] = 'success';
+                    if ( $item['createorupdate'] === 'created' && $ldap_default_group) {
+                         $user->groups()->attach($ldap_default_group);
+                    }
+
+                } else {
+                    foreach ($user->getErrors()->getMessages() as $key => $err) {
+                        $errors .= $err[0];
+                    }
+                    $item['note'] = $errors;
+                    $item['status'] = 'error';
+                }
+
+                array_push($summary, $item);
+        }
+
+        if ($this->option('summary')) {
+            for ($x = 0; $x < count($summary); $x++) {
+                if ($summary[$x]['status'] == 'error') {
+                    $this->error('ERROR: '.$summary[$x]['firstname'].' '.$summary[$x]['lastname'].' (username:  '.$summary[$x]['username'].') was not imported: '.$summary[$x]['note']);
+                } else {
+                    $this->info('User '.$summary[$x]['firstname'].' '.$summary[$x]['lastname'].' (username:  '.$summary[$x]['username'].') was '.strtoupper($summary[$x]['createorupdate']).'.');
+                }
+            }
+        } elseif ($this->option('json_summary')) {
+            $json_summary = ['error' => false, 'error_message' => '', 'summary' => $summary]; // hardcoding the error to false and the error_message to blank seems a bit weird
+            $this->info(json_encode($json_summary));
+        } else {
+            return $summary;
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/LdapTroubleshooter.php

@@ -0,0 +1,517 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use App\Models\Setting;
+use Exception;
+use Crypt;
+
+/**
+ * Check if a given ip is in a network
+ * @param  string $ip    IP to check in IPV4 format eg. 127.0.0.1
+ * @param  string $range IP/CIDR netmask eg. 127.0.0.0/24, also 127.0.0.1 is accepted and /32 assumed
+ * @return boolean true if the ip is in this range / false if not.
+ */
+function ip_in_range( $ip, $range ) {
+	if ( strpos( $range, '/' ) == false ) {
+		$range .= '/32';
+	}
+	// $range is in IP/CIDR format eg 127.0.0.1/24
+	list( $range, $netmask ) = explode( '/', $range, 2 );
+	$range_decimal = ip2long( $range );
+	$ip_decimal = ip2long( $ip );
+	$wildcard_decimal = pow( 2, ( 32 - $netmask ) ) - 1;
+	$netmask_decimal = ~ $wildcard_decimal;
+	return ( ( $ip_decimal & $netmask_decimal ) == ( $range_decimal & $netmask_decimal ) );
+}
+// NOTE - this function was shamelessly stolen from this gist: https://gist.github.com/tott/7684443
+
+/**
+ * Ensure LDAP filters are parentheses-wrapped
+ */
+function parenthesized_filter($filter)
+{
+    if(substr($filter,0,1) == "(" ) {
+        return $filter;
+    } else {
+        return "(".$filter.")";
+    }
+
+}
+
+class LdapTroubleshooter extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'ldap:troubleshoot
+                            {--ldap-search : Output an ldapsearch command-line for testing your LDAP config}
+                            {--force : Skip the interactive yes/no prompt for confirmation}
+                            {--debug : Include debugging output (verbose)}
+                            {--trace : Include extremely verbose LDAP trace output}
+                            {--timeout=15 : Timeout for LDAP Bind operations}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Runs a series of non-destructive LDAP commands to help try and determine correct LDAP settings for your environment.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Output something *only* if debug is enabled
+     * 
+     * @return void
+     */
+    public function debugout($string)
+    {
+        if($this->option('debug')) {
+            $this->line($string);
+        }
+    }
+
+    /**
+     * Clean the results from ldap_get_entries into something useful
+     * @param array $array
+     * @return array
+     */
+    public function ldap_results_cleaner ($array) {
+        $cleaned = [];
+        for($i = 0; $i < $array['count']; $i++) {
+            $row = $array[$i];
+            $clean_row = [];
+            foreach($row AS $key => $val ) {
+                $this->debugout("Key is: ".$key);
+                if($key == "count" || is_int($key) || $key == "dn") {
+                    $this->debugout(" and we're gonna skip it\n");
+                    continue;
+                }
+                $this->debugout(" And that seems fine.\n");
+                if(array_key_exists('count',$val)) {
+                    if($val['count'] == 1) {
+                        $clean_row[$key] = $val[0];
+                    } else {
+                        unset($val['count']); //these counts are annoying
+                        $elements = [];
+                        foreach($val as $entry) {
+                            if(isset($ldap_constants[$entry])) {
+                                $elements[] = $ldap_constants[$entry];
+                            } else {
+                                $elements[] = $entry;
+                            }
+                        }
+                        $clean_row[$key] = $elements;
+                    }
+                } else {
+                    $clean_row[$key] = $val;
+                }
+            }
+            $cleaned[$i] = $clean_row;
+        }
+        return $cleaned;
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if($this->option('trace')) {
+    	    ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
+        }
+
+        $settings = Setting::getSettings();
+        $this->settings = $settings;
+        if($this->option('ldap-search')) {
+            if(!$this->option('force')) {
+                $confirmation = $this->confirm('WARNING: This command will display your LDAP password on your terminal. Are you sure this is ok?');
+                if(!$confirmation) {
+                    $this->error('ABORTING');
+                    exit(-1);
+                }
+            }
+            $output = [];
+            if($settings->ldap_server_cert_ignore) {
+                $this->line("# Ignoring server certificate validity");
+                $output[] = "LDAPTLS_REQCERT=never";
+            }
+            if($settings->ldap_client_tls_cert && $settings->ldap_client_tls_key) {
+                $this->line("# Adding LDAP Client Certificate and Key");
+                $output[] = "LDAPTLS_CERT=storage/ldap_client_tls.cert";
+                $output[] = "LDAPTLS_KEY=storage/ldap_client_tls.key";
+            }
+            $output[] = "ldapsearch";
+            $output[] = "-H ".$settings->ldap_server;
+            $output[] = "-x";
+            $output[] = "-b ".escapeshellarg($settings->ldap_basedn);
+            $output[] = "-D ".escapeshellarg($settings->ldap_uname);
+            $output[] = "-w ".escapeshellarg(\Crypt::Decrypt($settings->ldap_pword));
+            $output[] = escapeshellarg(parenthesized_filter($settings->ldap_filter));
+            if($settings->ldap_tls) {
+                $this->line("# adding STARTTLS option");
+                $output[] = "-Z";
+            }
+            $output[] = "-v";
+            $this->line("\n");
+            $this->line(implode(" \\\n",$output));
+            exit(0);
+        }
+        if(!$this->option('force')) {
+            $confirmation = $this->confirm('WARNING: This command will make several attempts to connect to your LDAP server. Are you sure this is ok?');
+            if(!$confirmation) {
+                $this->error('ABORTING');
+                exit(-1);
+            }
+        }
+        //$this->line(print_r($settings,true));
+        $this->info("STAGE 1: Checking settings");
+        if(!$settings->ldap_enabled) {
+            $this->error("WARNING: Snipe-IT's LDAP setting is not turned on. (That may be OK if you're still trying to figure out settings)");
+        }
+
+        $ldap_conn = false;
+        try {
+            $ldap_conn = ldap_connect($settings->ldap_server);
+        } catch (Exception $e) {
+            $this->error("WARNING: Exception caught when executing 'ldap_connect()' - ".$e->getMessage().". We will try to guess.");
+        }
+
+        if(!$ldap_conn) {
+            $this->error("WARNING: LDAP Server setting of: ".$settings->ldap_server." cannot be parsed. We will try to guess.");
+            //exit(-1);
+        }
+        //since we never use $ldap_conn again, we don't have to ldap_unbind() it (it's not even connected, tbh - that only happens at bind-time)
+
+        $parsed = parse_url($settings->ldap_server);
+
+        if(@$parsed['scheme'] != 'ldap' && @$parsed['scheme'] != 'ldaps') {
+            $this->error("WARNING: LDAP URL Scheme of '".@$parsed['scheme']."' is probably incorrect; should usually be ldap or ldaps");
+        }
+
+        if(!@$parsed['host']) {
+            $this->error("ERROR: Cannot determine hostname or IP from ldap URL: ".$settings->ldap_server.". ABORTING.");
+            exit(-1);
+        } else {
+            $this->info("Determined LDAP hostname to be: ".$parsed['host']);
+        }
+
+        $this->info("Performing DNS lookup of: ".$parsed['host']);
+        $ips = dns_get_record($parsed['host']);
+        $raw_ips = [];
+
+        //$this->info("Host IP is: ".print_r($ips,true));
+
+        if(!$ips || count($ips) == 0) {
+            $this->error("ERROR: DNS lookup of host: ".$parsed['host']." has failed. ABORTING.");
+            exit(-1);
+        }
+        $this->debugout("IP's? ".print_r($ips,true));
+        foreach($ips as $ip) {
+            if(!isset($ip['ip'])) {
+                continue;
+            }
+            $raw_ips[]=$ip['ip'];
+            if($ip['ip'] == "127.0.0.1") {
+                $this->error("WARNING: Using the localhost IP as the LDAP server. This is usually wrong");
+            }
+            if(ip_in_range($ip['ip'],'10.0.0.0/8') || ip_in_range($ip['ip'],'192.168.0.0/16') || ip_in_range($ip['ip'], '172.16.0.0/12')) {
+                $this->error("WARNING: Using an RFC1918 Private address for LDAP server. This may be correct, but it can be a problem if your Snipe-IT instance is not hosted on your private network");
+            }
+        }
+
+        $this->info("STAGE 2: Checking basic network connectivity");
+        $ports = [389,636];
+        if(@$parsed['port'] && !in_array($parsed['port'],$ports)) {
+            $ports[] = $parsed['port'];
+        }
+
+        $open_ports=[];
+        foreach($ports as $port ) {
+            $errno = 0;
+            $errstr = '';
+            $timeout = 30.0;
+            $result = '';
+            $this->info("Attempting to connect to port: ".$port." - may take up to $timeout seconds");
+            try {
+                $result = fsockopen($parsed['host'], $port, $errno, $errstr, 30.0);
+            } catch(Exception $e) {
+                $this->error("Exception: ".$e->getMessage());
+            }
+            if($result) {
+                $this->info("Success!");
+                $open_ports[] = $port;
+            } else {
+                $this->error("WARNING: Cannot connect to port: $port - $errstr ($errno)");
+            }
+        }
+
+        if(count($open_ports) == 0) {
+            $this->error("ERROR - no open ports. ABORTING.");
+            exit(-1);
+        }
+
+        $this->info("STAGE 3: Determine encryption algorithm, if any");
+
+        $ldap_urls = [];
+        $pretty_ldap_urls = [];
+        foreach($open_ports as $port) {
+            $this->line("Trying TLS first for port $port");
+            $ldap_url = "ldaps://".$parsed['host'].":$port";
+            if($this->test_anonymous_bind($ldap_url)) {
+                $this->info("Anonymous bind succesful to $ldap_url!");
+                $ldap_urls[] = [ $ldap_url, true, false ];
+                $pretty_ldap_urls[] = [ $ldap_url, "YES", "no" ];
+                continue; // TODO - lots of copypasta in these if(test_anonymous_bind()) routines...
+            } else {
+                $this->error("WARNING: Failed to bind to $ldap_url - trying without certificate checks.");
+            }
+
+            if($this->test_anonymous_bind($ldap_url, false)) {
+                $this->info("Anonymous bind succesful to $ldap_url with certifcate-checks disabled");
+                $ldap_urls[] = [ $ldap_url, false, false ]; 
+                $pretty_ldap_urls[] = [ $ldap_url, "no", "no" ]; 
+                continue;
+            } else {
+                $this->error("WARNING: Failed to bind to $ldap_url with certificate checks disabled. Trying unencrypted with STARTTLS");
+            }
+
+            $ldap_url = "ldap://".$parsed['host'].":$port";
+            if($this->test_anonymous_bind($ldap_url, true, true)) {
+                $this->info("Plain connection to $ldap_url with STARTTLS succesful!");
+                $ldap_urls[] = [ $ldap_url, true, true ];
+                $pretty_ldap_urls[] = [ $ldap_url, "YES", "YES" ];
+                continue;
+            } else {
+                $this->error("WARNING: Failed to bind to $ldap_url with STARTTLS enabled. Trying without STARTTLS");
+            }
+
+            if($this->test_anonymous_bind($ldap_url)) {
+                $this->info("Plain connection to $ldap_url succesful!");
+                $ldap_urls[] = [ $ldap_url, true, false ];
+                $pretty_ldap_urls[] = [ $ldap_url, "YES", "no" ];
+                continue;
+            } else {
+                $this->error("WARNING: Failed to bind to $ldap_url. Giving up on port $port");
+            }
+        }
+
+        $this->debugout(print_r($ldap_urls,true));
+
+        if(count($ldap_urls) > 0 ) {
+            $this->info("Found working LDAP URL's: ");
+            foreach($ldap_urls as $ldap_url) { // TODO maybe do this as a $this->table() instead?
+                $this->info("LDAP URL: ".$ldap_url[0]);
+                $this->info($ldap_url[0]. ($ldap_url[1] ? " certificate checks enabled" : " certificate checks disabled"). ($ldap_url[2] ? " STARTTLS Enabled ": " STARTTLS Disabled"));
+            }
+            $this->table(["URL", "Cert Checks Enabled?", "STARTTLS Enabled?"],$pretty_ldap_urls);
+        } else {
+            $this->error("ERROR - no valid LDAP URL's available - ABORTING");
+            exit(1);
+        }
+
+        $this->info("STAGE 4: Test Administrative Bind for LDAP Sync");
+        foreach($ldap_urls AS $ldap_url) {
+            $this->test_authed_bind($ldap_url[0], $ldap_url[1], $ldap_url[2], $settings->ldap_uname, Crypt::decrypt($settings->ldap_pword));
+        }
+
+        $this->info("STAGE 5: Test BaseDN");
+        //grab all LDAP_ constants and fill up a reversed array mapping from weird LDAP dotted-strings to (Constant Name)
+        $all_defined_constants = get_defined_constants();
+        $ldap_constants = [];
+        foreach($all_defined_constants AS $key => $val) {
+            if(starts_with($key,"LDAP_") && is_string($val)) {
+                $ldap_constants[$val] = $key; // INVERT the meaning here!
+            }
+        }
+        $this->debugout("LDAP constants are: ".print_r($ldap_constants,true));
+
+        foreach($ldap_urls AS $ldap_url) {
+            if($this->test_informational_bind($ldap_url[0],$ldap_url[1],$ldap_url[2],$settings->ldap_uname,Crypt::decrypt($settings->ldap_pword),$settings)) {
+                $this->info("Success getting informational bind!");
+            } else {
+                $this->error("Unable to get information from bind.");
+            }
+        }
+
+        $this->info("STAGE 6: Test LDAP Login to Snipe-IT");
+        foreach($ldap_urls AS $ldap_url) {
+            $this->info("Starting auth to ".$ldap_url[0]);
+            while(true) {
+                $with_tls = $ldap_url[1] ? "with": "without";
+                $with_startssl = $ldap_url[2] ? "using": "not using";
+                if(!$this->confirm('Do you wish to try to authenticate to this directory: '.$ldap_url[0]." $with_tls TLS and $with_startssl STARTSSL?")) {
+                    break;
+                }
+                $username = $this->ask("Username");
+                $password = $this->secret("Password");
+                $this->test_authed_bind($ldap_url[0], $ldap_url[1], $ldap_url[2], $username, $password); // FIXME - should do some other stuff here, maybe with the concatenating or something? maybe? and/or should put up some results?
+            }
+        }
+
+        $this->info("LDAP TROUBLESHOOTING COMPLETE!");
+    }
+
+    public function connect_to_ldap($ldap_url, $check_cert, $start_tls) 
+    {
+        $lconn = ldap_connect($ldap_url);
+        ldap_set_option($lconn, LDAP_OPT_PROTOCOL_VERSION, 3); // should we 'test' different protocol versions here? Does anyone even use anything other than LDAPv3?
+                                                             // no - it's formally deprecated: https://tools.ietf.org/html/rfc3494
+        if(!$check_cert) {
+            putenv('LDAPTLS_REQCERT=never'); // This is horrible; is this *really* the only way to do it?
+        } else {
+            putenv('LDAPTLS_REQCERT'); // have to very explicitly and manually *UN* set the env var here to ensure it works
+        }
+        if($this->settings->ldap_client_tls_cert && $this->settings->ldap_client_tls_key) {
+            // client-side TLS certificate support for LDAP (Google Secure LDAP)
+            putenv('LDAPTLS_CERT=storage/ldap_client_tls.cert');
+            putenv('LDAPTLS_KEY=storage/ldap_client_tls.key');
+        }
+        if($start_tls) {
+            if(!ldap_start_tls($lconn)) {
+                $this->error("WARNING: Unable to start TLS");
+                return false;
+            }
+        }
+        if(!$lconn) {
+            $this->error("WARNING: Failed to generate connection string - using: ".$ldap_url);
+            return false;
+        }
+        $net = ldap_set_option($lconn, LDAP_OPT_NETWORK_TIMEOUT, $this->option('timeout'));
+        $time = ldap_set_option($lconn, LDAP_OPT_TIMELIMIT, $this->option('timeout'));
+        if(!$net || !$time) {
+            $this->error("Unable to set timeouts!");
+        }
+        return $lconn;
+    }
+
+    public function test_anonymous_bind($ldap_url, $check_cert = true, $start_tls = false)
+    {
+        return $this->timed_boolean_execute(function () use ($ldap_url, $check_cert , $start_tls) {
+            try {
+                $lconn = $this->connect_to_ldap($ldap_url, $check_cert, $start_tls);
+                $this->info("gonna try to bind now, this can take a while if we mess it up");
+                $bind_results = ldap_bind($lconn);
+                $this->info("Bind results are: ".$bind_results." which translate into boolean: ".(bool)$bind_results);
+                return (bool)$bind_results;
+            } catch (Exception $e) {
+                $this->error("WARNING: Exception caught during bind - ".$e->getMessage());
+                return false;
+            }
+        });
+    }
+
+    public function test_authed_bind($ldap_url, $check_cert, $start_tls, $username, $password) 
+    {
+        return $this->timed_boolean_execute(function () use ($ldap_url, $check_cert, $start_tls, $username, $password) {
+            try {
+                $lconn = $this->connect_to_ldap($ldap_url, $check_cert, $start_tls);
+                $bind_results = ldap_bind($lconn, $username, $password);
+                if(!$bind_results) {
+                    $this->error("WARNING: Failed to bind to $ldap_url as $username");
+                    return false;
+                } else {
+                    $this->info("SUCCESS - Able to bind to $ldap_url as $username");
+                    return (bool)$lconn;
+                }
+            } catch (Exception $e) {
+                $this->error("WARNING: Exception caught during Authed bind to $username - ".$e->getMessage());
+                return false;
+            }
+        });
+    }
+
+    public function test_informational_bind($ldap_url, $check_cert, $start_tls, $username, $password,$settings)
+    {
+        return $this->timed_boolean_execute(function () use ($ldap_url, $check_cert, $start_tls, $username, $password, $settings) {
+            try { // TODO - copypasta'ed from test_authed_bind
+                $conn = $this->connect_to_ldap($ldap_url, $check_cert, $start_tls);
+                $bind_results = ldap_bind($conn, $username, $password);
+                if(!$bind_results) {
+                    $this->error("WARNING: Failed to bind to $ldap_url as $username");
+                    return false;
+                }
+                $this->info("SUCCESS - Able to bind to $ldap_url as $username");
+                $result = ldap_read($conn, '', '(objectClass=*)'/* , ['supportedControl']*/);
+                $results = ldap_get_entries($conn, $result);
+                $cleaned_results = $this->ldap_results_cleaner($results);
+                $this->line(print_r($cleaned_results,true));
+                //okay, great - now how do we display those results? I have no idea.
+                // I don't see why this throws an Exception for Google LDAP, but I guess we ought to try and catch it?
+                $this->comment("I guess we're trying to do the ldap search here, but sometimes it takes too long?");
+                $this->debugout("Base DN is: ".$settings->ldap_basedn." and filter is: ".parenthesized_filter($settings->ldap_filter));
+                $search_results = ldap_search($conn, $settings->ldap_basedn, parenthesized_filter($settings->ldap_filter));
+                $this->info("Printing first 10 results: ");
+                for($i=0;$i<10;$i++) {
+                    $this->info($search_results[$i]);
+                }
+            } catch (\Exception $e) {
+                $this->error("WARNING: Exception caught during Authed bind to $username - ".$e->getMessage());
+                return false;
+            }
+        });
+    }
+
+    /***********************************************
+     * 
+     * This function executes $function - which is expected to be some kind of executable function - 
+     * with a timeout set. It respects the timeout by forking execution and setting a strict timer
+     * for which to get back a SIGUSR1 or SIGUSR2 signal from the forked process.
+     * 
+     ***********************************************/
+    private function timed_boolean_execute($function)
+    {
+        if(!(function_exists('pcntl_sigtimedwait') && function_exists('posix_getpid') && function_exists('pcntl_fork') && function_exists('posix_kill') && function_exists('pcntl_wifsignaled'))) {
+            // POSIX functions needed for forking aren't present, just run the function inline (ignoring timeout)
+            $this->info('WARNING: Unable to execute POSIX fork() commands, timeout may not be respected');
+            return $function();
+        } else {
+            $parent_pid = posix_getpid();
+            $pid = pcntl_fork();
+            switch($pid) {
+                case 0:
+                    //we're the 'child'
+                    if($function()) {
+                        //SUCCESS = SIGUSR1
+                        posix_kill($parent_pid, SIGUSR1);
+                    } else {
+                        //FAILURE = SIGUSR2
+                        posix_kill($parent_pid, SIGUSR2);
+                    }
+                    exit();
+                    break; //yes I know we don't need it.
+                case -1:
+                    //couldn't fork
+                    $this->error("COULD NOT FORK - assuming failure");
+                    return false;
+                    break; //I still know that we don't need it
+                default:
+                    //we remain the 'parent', $pid is the PID of the forked process.
+                    $siginfo = [];
+                    $exit_status = pcntl_sigtimedwait ([SIGUSR1, SIGUSR2], $siginfo, $this->option('timeout'));
+                    if ($exit_status == SIGUSR1) {
+                        return true;
+                    } else {
+                        posix_kill($pid, SIGKILL); //make sure we don't have processes hanging around that might try and send signals during later executions, confusing us
+                        return false;
+                    }
+                    break; //Yeah I get it already, shush.
+            }
+        }
+
+    }
+}

SNIPE-IT/app/Console/Commands/MergeUsersByUsername.php

@@ -0,0 +1,115 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\User;
+use Carbon\Carbon;
+use Illuminate\Console\Command;
+
+class MergeUsersByUsername extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:merge-users';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command allows you to merge the history of users. It looks for users without an email address as their username and merges them into the version that does have an email username.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        // Get the list of users who have an email address as their username
+        $users = User::where('username', 'LIKE', '%@%')->whereNull('deleted_at')->get();
+        $this->info($users->count().' total non-deleted users whose usernames contain a @ symbol.');
+
+
+        foreach ($users as $user) {
+            $parts = explode('@', trim($user->username));
+            $this->info('Checking against username '.trim($parts[0]).'.');
+
+
+            $bad_users = User::where('username', '=', trim($parts[0]))
+                ->whereNull('deleted_at')
+                ->with('assets', 'manager', 'userlog', 'licenses', 'consumables', 'accessories', 'managedLocations')
+                ->get();
+
+
+
+            foreach ($bad_users as $bad_user) {
+                $this->info($bad_user->username.' ('.$bad_user->id.')  will be merged into '.$user->username.'  ('.$user->id.') ');
+
+                // Walk the list of assets
+                foreach ($bad_user->assets as $asset) {
+                    $this->info('Updating asset '.$asset->asset_tag.' '.$asset->id.' to user '.$user->id);
+                    $asset->assigned_to = $user->id;
+                    if (! $asset->save()) {
+                        $this->error('Could not update assigned_to field on asset '.$asset->asset_tag.' '.$asset->id.' to user '.$user->id);
+                        $this->error('Error saving: '.$asset->getErrors());
+                    }
+                }
+
+                // Walk the list of licenses
+                foreach ($bad_user->licenses as $license) {
+                    $this->info('Updating license '.$license->name.' '.$license->id.' to user '.$user->id);
+                    $bad_user->licenses()->updateExistingPivot($license->id, ['assigned_to' => $user->id]);
+                }
+
+                // Walk the list of consumables
+                foreach ($bad_user->consumables as $consumable) {
+                    $this->info('Updating consumable '.$consumable->id.' to user '.$user->id);
+                    $bad_user->consumables()->updateExistingPivot($consumable->id, ['assigned_to' => $user->id]);
+                }
+
+                // Walk the list of accessories
+                foreach ($bad_user->accessories as $accessory) {
+                    $this->info('Updating accessory '.$accessory->id.' to user '.$user->id);
+                    $bad_user->accessories()->updateExistingPivot($accessory->id, ['assigned_to' => $user->id]);
+                }
+
+                // Walk the list of logs
+                foreach ($bad_user->userlog as $log) {
+                    $this->info('Updating action log record '.$log->id.' to user '.$user->id);
+                    $log->target_id = $user->id;
+                    $log->save();
+                }
+
+                // Update any manager IDs
+                $this->info('Updating managed user records to user '.$user->id);
+                User::where('manager_id', '=', $bad_user->id)->update(['manager_id' => $user->id]);
+
+                // Update location manager IDs
+                foreach ($bad_user->managedLocations as $managedLocation) {
+                    $this->info('Updating managed location record '.$managedLocation->name.' to manager '.$user->id);
+                    $managedLocation->manager_id = $user->id;
+                    $managedLocation->save();
+                }
+
+                // Mark the user as deleted
+                $this->info('Marking the user as deleted');
+                $bad_user->deleted_at = Carbon::now()->timestamp;
+                $bad_user->save();
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/MoveUploadsToNewDisk.php

@@ -0,0 +1,167 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Storage;
+
+class MoveUploadsToNewDisk extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:move-uploads {delete_local?}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This will move your locally uploaded files to whatever your current disk is.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if (config('filesystems.default') == 'local') {
+            $this->error('Your current disk is set to local so we cannot proceed.');
+            $this->warn("Please configure your .env settings for S3. \nChange your PUBLIC_FILESYSTEM_DISK value to 's3_public' and your PRIVATE_FILESYSTEM_DISK to s3_private.");
+
+            return false;
+        }
+        $delete_local = $this->argument('delete_local');
+
+        $public_uploads['accessories'] = glob('public/uploads/accessories'."/*.*");
+        $public_uploads['assets'] = glob('public/uploads/assets'."/*.*");
+        $public_uploads['avatars'] = glob('public/uploads/avatars'."/*.*");
+        $public_uploads['categories'] = glob('public/uploads/categories'."/*.*");
+        $public_uploads['companies'] = glob('public/uploads/companies'."/*.*");
+        $public_uploads['components'] = glob('public/uploads/components'."/*.*");
+        $public_uploads['consumables'] = glob('public/uploads/consumables'."/*.*");
+        $public_uploads['departments'] = glob('public/uploads/departments'."/*.*");
+        $public_uploads['locations'] = glob('public/uploads/locations'."/*.*");
+        $public_uploads['manufacturers'] = glob('public/uploads/manufacturers'."/*.*");
+        $public_uploads['suppliers'] = glob('public/uploads/suppliers'."/*.*");
+        $public_uploads['assetmodels'] = glob('public/uploads/models'."/*.*");
+
+
+        // iterate files
+        foreach ($public_uploads as $public_type => $public_upload) {
+            $type_count = 0;
+            $this->info('- There are ' . count($public_upload) . ' PUBLIC ' . $public_type . ' files.');
+
+            for ($i = 0; $i < count($public_upload); $i++) {
+                $type_count++;
+                $filename = basename($public_upload[$i]);
+
+                try  {
+                    Storage::disk('public')->put('uploads/'.$public_type.'/'.$filename, file_get_contents($public_upload[$i]));
+                    $new_url = Storage::disk('public')->url('uploads/'.$public_type.'/'.$filename, $filename);
+                    $this->info($type_count.'. PUBLIC: '.$filename.' was copied to '.$new_url);
+                } catch (\Exception $e) {
+                    \Log::debug($e);
+                    $this->error($e);
+                }
+            }
+        }
+
+        $logos = glob("public/uploads/setting*.*");
+        $this->info("- There are ".count($logos).' files that might be logos.');
+        $type_count = 0;
+
+        foreach ($logos as $logo) {
+            $this->info($logo);
+            $type_count++;
+            $filename = basename($logo);
+            Storage::disk('public')->put('uploads/' . $filename, file_get_contents($logo));
+            $this->info($type_count . '. LOGO: ' . $filename . ' was copied to ' . env('PUBLIC_AWS_URL') . '/uploads/' . $filename);
+        }
+
+        $private_uploads['assets'] = glob('storage/private_uploads/assets'."/*.*");
+        $private_uploads['signatures'] = glob('storage/private_uploads/signatures'."/*.*");
+        $private_uploads['audits'] = glob('storage/private_uploads/audits'."/*.*");
+        $private_uploads['assetmodels'] = glob('storage/private_uploads/assetmodels'."/*.*");
+        $private_uploads['imports'] = glob('storage/private_uploads/imports'."/*.*");
+        $private_uploads['licenses'] = glob('storage/private_uploads/licenses'."/*.*");
+        $private_uploads['users'] = glob('storage/private_uploads/users'."/*.*");
+        $private_uploads['backups'] = glob('storage/private_uploads/backups'."/*.*");
+        
+
+        foreach ($private_uploads as $private_type => $private_upload) {
+            {
+                $this->info('- There are ' . count($private_upload) . ' PRIVATE ' . $private_type . ' files.');
+
+                $type_count = 0;
+                for ($x = 0; $x < count($private_upload); $x++) {
+                    $type_count++;
+                    $filename = basename($private_upload[$x]);
+
+                    try {
+                        Storage::put($private_type . '/' . $filename, file_get_contents($private_upload[$i]));
+                        $new_url = Storage::url($private_type . '/' . $filename, $filename);
+                        $this->info($type_count . '. PRIVATE: ' . $filename . ' was copied to ' . $new_url);
+                    } catch (\Exception $e) {
+                        \Log::debug($e);
+                        $this->error($e);
+                    }
+                }
+            }
+
+
+            if ($delete_local == 'true') {
+                $public_delete_count = 0;
+                $private_delete_count = 0;
+
+                $this->info("\n\n");
+                $this->error('!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!');
+                $this->warn("\nTHIS WILL DELETE ALL OF YOUR LOCAL UPLOADED FILES. \n\nThis cannot be undone, so you should take a backup of your system before you proceed.\n");
+                $this->error('!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!');
+
+                if ($this->confirm('Do you wish to continue?')) {
+                    foreach ($public_uploads as $public_type => $public_upload) {
+                        for ($i = 0; $i < count($public_upload); $i++) {
+                            $filename = $public_upload[$i];
+                            try {
+                                unlink($filename);
+                                $public_delete_count++;
+                            } catch (\Exception $e) {
+                                \Log::debug($e);
+                                $this->error($e);
+                            }
+                        }
+                    }
+
+                    foreach ($private_uploads as $private_type => $private_upload) {
+                        for ($i = 0; $i < count($private_upload); $i++) {
+                            $filename = $private_upload[$i];
+                            try {
+                                unlink($filename);
+                                $private_delete_count++;
+                            } catch (\Exception $e) {
+                                \Log::debug($e);
+                                $this->error($e);
+                            }
+                        }
+                    }
+
+                    $this->info($public_delete_count . ' PUBLIC local files and ' . $private_delete_count . ' PRIVATE local files were deleted from your filesystem.');
+                }
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/NormalizeUserNames.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use App\Models\User;
+
+class NormalizeUserNames extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:normalize-names';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Normalizes weirdly formatted names as first-letter upercased';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return int
+     */
+    public function handle()
+    {
+
+        $users = User::get();
+            $this->info($users->count() . ' users');
+
+            foreach ($users as $user) {
+                $user->first_name = ucwords(strtolower($user->first_name));
+                $user->last_name = ucwords(strtolower($user->last_name));
+                $user->email = strtolower($user->email);
+                $user->save();
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/ObjectImportCommand.php

@@ -0,0 +1,159 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputOption;
+
+ini_set('max_execution_time', env('IMPORT_TIME_LIMIT', 600)); //600 seconds = 10 minutes
+ini_set('memory_limit', env('IMPORT_MEMORY_LIMIT', '500M'));
+
+/**
+ * Class ObjectImportCommand
+ */
+class ObjectImportCommand extends Command
+{
+    /**
+     * The console command name.
+     *
+     * @var string
+     */
+    protected $name = 'snipeit:import';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Import Items from CSV';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    private $bar;
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $filename = $this->argument('filename');
+        $class = title_case($this->option('item-type'));
+        $classString = "App\\Importer\\{$class}Importer";
+        $importer = new $classString($filename);
+        $importer->setCallbacks([$this, 'log'], [$this, 'progress'], [$this, 'errorCallback'])
+                 ->setUserId($this->option('user_id'))
+                 ->setUpdating($this->option('update'))
+                 ->setShouldNotify($this->option('send-welcome'))
+                 ->setUsernameFormat($this->option('username_format'));
+
+        // This $logFile/useFiles() bit is currently broken, so commenting it out for now
+        // $logFile = $this->option('logfile');
+        // \Log::useFiles($logFile);
+        $this->comment('======= Importing Items from '.$filename.' =========');
+        $importer->import();
+
+        $this->bar = null;
+
+        if (! empty($this->errors)) {
+            $this->comment('The following Errors were encountered.');
+            foreach ($this->errors as $asset => $error) {
+                $this->comment('Error: Item: '.$asset.' failed validation: '.json_encode($error));
+            }
+        } else {
+            $this->comment('All Items imported successfully!');
+        }
+        $this->comment('');
+    }
+
+    public function errorCallback($item, $field, $errorString)
+    {
+        $this->errors[$item->name][$field] = $errorString;
+    }
+
+    public function progress($count)
+    {
+        if (! $this->bar) {
+            $this->bar = $this->output->createProgressBar($count);
+        }
+        static $index = 0;
+        $index++;
+        if ($index < $count) {
+            $this->bar->advance();
+        } else {
+            $this->bar->finish();
+        }
+    }
+
+    // Tracks the current item for error messages
+    private $updating;
+    // An array of errors encountered while parsing
+    private $errors;
+
+    /**
+     * Log a message to file, configurable by the --log-file parameter.
+     * If a warning message is passed, we'll spit it to the console as well.
+     *
+     * @author Daniel Melzter
+     * @since 3.0
+     * @param string $string
+     * @param string $level
+     */
+    public function log($string, $level = 'info')
+    {
+        if ($level === 'warning') {
+            \Log::warning($string);
+            $this->comment($string);
+        } else {
+            \Log::Info($string);
+            if ($this->option('verbose')) {
+                $this->comment($string);
+            }
+        }
+    }
+
+    /**
+     * Get the console command arguments.
+     *
+     * @author Daniel Melzter
+     * @since 3.0
+     * @return array
+     */
+    protected function getArguments()
+    {
+        return [
+            ['filename', InputArgument::REQUIRED, 'File for the CSV import.'],
+        ];
+    }
+
+    /**
+     * Get the console command options.
+     *
+     * @author Daniel Melzter
+     * @since 3.0
+     * @return array
+     */
+    protected function getOptions()
+    {
+        return [
+        ['email_format', null, InputOption::VALUE_REQUIRED, 'The format of the email addresses that should be generated. Options are firstname.lastname, firstname, filastname', null],
+        ['username_format', null, InputOption::VALUE_REQUIRED, 'The format of the username that should be generated. Options are firstname.lastname, firstname, filastname, email', null],
+        ['logfile', null, InputOption::VALUE_REQUIRED, 'The path to log output to.  storage/logs/importer.log by default', storage_path('logs/importer.log')],
+        ['item-type', null, InputOption::VALUE_REQUIRED, 'Item Type To import.  Valid Options are Asset, Consumable, Accessory, License, or User', 'Asset'],
+        ['web-importer', null, InputOption::VALUE_NONE, 'Internal: packages output for use with the web importer'],
+        ['user_id', null, InputOption::VALUE_REQUIRED, 'ID of user creating items', 1],
+        ['update', null, InputOption::VALUE_NONE, 'If a matching item is found, update item information'],
+        ['send-welcome', null, InputOption::VALUE_NONE, 'Whether to send a welcome email to any new users that are created.'],
+        ];
+    }
+}

SNIPE-IT/app/Console/Commands/PaveIt.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\CustomField;
+use Schema;
+use DB;
+use Illuminate\Console\Command;
+
+class PaveIt extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:pave  {--force : Skip the interactive yes/no prompt for confirmation}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Clear the database tables, leaving all migrations, table structure, and the first user in place. (It is primarily a quick tool for developers.) If you want to destroy all tables as well, use php artisan db:wipe.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+        if (!$this->option('force')) {
+            $confirmation = $this->confirm("\n****************************************************\nTHIS WILL DELETE ALL OF THE DATA IN YOUR DATABASE. \nThere is NO undo. This WILL destroy ALL of your data, \nINCLUDING ANY non-Snipe-IT tables you have in this database. \n****************************************************\n\nDo you wish to continue? No backsies! ");
+            if (!$confirmation) {
+                $this->error('ABORTING');
+                exit(-1);
+            }
+        }
+
+        // List all the tables in the database so we don't have to worry about missing some as the app grows
+        $tables = DB::connection()->getDoctrineSchemaManager()->listTableNames();
+
+        $except_tables = [
+            'oauth_access_tokens',
+            'oauth_clients',
+            'oauth_personal_access_clients',
+            'migrations',
+            'settings',
+            'users',
+        ];
+
+        // We only need to find out what these are so we can nuke these columns on the assets table.
+        $custom_fields = CustomField::get();
+        foreach ($custom_fields as $custom_field) {
+            $this->info('DROP the '.$custom_field->db_column.' column from assets as well.');
+
+            if (\Schema::hasColumn('assets', $custom_field->db_column)) {
+                \Schema::table('assets', function ($table) use ($custom_field) {
+                    $table->dropColumn($custom_field->db_column);
+                });
+            }
+        }
+
+        foreach ($tables as $table) {
+            if (in_array($table, $except_tables)) {
+                $this->info($table. ' is SKIPPED.');
+            } else {
+                \DB::statement('truncate '.$table);
+                $this->info($table. ' is TRUNCATED.');
+            }
+        }
+
+        // Leave in the demo oauth keys so we don't have to reset them every day in the demos
+        \DB::statement('delete from oauth_clients WHERE id > 2');
+        \DB::statement('delete from oauth_access_tokens WHERE id > 2');
+    
+    }
+}

SNIPE-IT/app/Console/Commands/Purge.php

@@ -0,0 +1,168 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Accessory;
+use App\Models\Asset;
+use App\Models\AssetModel;
+use App\Models\Category;
+use App\Models\Component;
+use App\Models\Consumable;
+use App\Models\License;
+use App\Models\Location;
+use App\Models\Manufacturer;
+use App\Models\Statuslabel;
+use App\Models\Supplier;
+use App\Models\User;
+use Illuminate\Console\Command;
+
+class Purge extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:purge {--force=false}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Purge all soft-deleted deleted records in the database. This will rewrite history for items that have been edited, or checked in or out. It will also rewrite history for users associated with deleted items.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $force = $this->option('force');
+        if (($this->confirm("\n****************************************************\nTHIS WILL PURGE ALL SOFT-DELETED ITEMS IN YOUR SYSTEM. \nThere is NO undo. This WILL permanently destroy \nALL of your deleted data. \n****************************************************\n\nDo you wish to continue? No backsies! [y|N]")) || $force == 'true') {
+
+            /**
+             * Delete assets
+             */
+            $assets = Asset::whereNotNull('deleted_at')->withTrashed()->get();
+            $assetcount = $assets->count();
+            $this->info($assets->count().' assets purged.');
+            $asset_assoc = 0;
+            $asset_maintenances = 0;
+
+            foreach ($assets as $asset) {
+                $this->info('- Asset "'.$asset->present()->name().'" deleted.');
+                $asset_assoc += $asset->assetlog()->count();
+                $asset->assetlog()->forceDelete();
+                $asset_maintenances += $asset->assetmaintenances()->count();
+                $asset->assetmaintenances()->forceDelete();
+                $asset->forceDelete();
+            }
+
+            $this->info($asset_assoc.' corresponding log records purged.');
+            $this->info($asset_maintenances.' corresponding maintenance records purged.');
+
+            $locations = Location::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($locations->count().' locations purged.');
+            foreach ($locations as $location) {
+                $this->info('- Location "'.$location->name.'" deleted.');
+                $location->forceDelete();
+            }
+
+            $accessories = Accessory::whereNotNull('deleted_at')->withTrashed()->get();
+            $accessory_assoc = 0;
+            $this->info($accessories->count().' accessories purged.');
+            foreach ($accessories as $accessory) {
+                $this->info('- Accessory "'.$accessory->name.'" deleted.');
+                $accessory_assoc += $accessory->assetlog()->count();
+                $accessory->assetlog()->forceDelete();
+                $accessory->forceDelete();
+            }
+            $this->info($accessory_assoc.' corresponding log records purged.');
+
+            $consumables = Consumable::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($consumables->count().' consumables purged.');
+            foreach ($consumables as $consumable) {
+                $this->info('- Consumable "'.$consumable->name.'" deleted.');
+                $consumable->assetlog()->forceDelete();
+                $consumable->forceDelete();
+            }
+
+            $components = Component::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($components->count().' components purged.');
+            foreach ($components as $component) {
+                $this->info('- Component "'.$component->name.'" deleted.');
+                $component->assetlog()->forceDelete();
+                $component->forceDelete();
+            }
+
+            $licenses = License::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($licenses->count().' licenses purged.');
+            foreach ($licenses as $license) {
+                $this->info('- License "'.$license->name.'" deleted.');
+                $license->assetlog()->forceDelete();
+                $license->licenseseats()->forceDelete();
+                $license->forceDelete();
+            }
+
+            $models = AssetModel::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($models->count().' asset models purged.');
+            foreach ($models as $model) {
+                $this->info('- Asset Model "'.$model->name.'" deleted.');
+                $model->forceDelete();
+            }
+
+            $categories = Category::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($categories->count().' categories purged.');
+            foreach ($categories as $category) {
+                $this->info('- Category "'.$category->name.'" deleted.');
+                $category->forceDelete();
+            }
+
+            $suppliers = Supplier::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($suppliers->count().' suppliers purged.');
+            foreach ($suppliers as $supplier) {
+                $this->info('- Supplier "'.$supplier->name.'" deleted.');
+                $supplier->forceDelete();
+            }
+
+            $users = User::whereNotNull('deleted_at')->where('show_in_list', '!=', '0')->withTrashed()->get();
+            $this->info($users->count().' users purged.');
+            $user_assoc = 0;
+            foreach ($users as $user) {
+                $this->info('- User "'.$user->username.'" deleted.');
+                $user_assoc += $user->userlog()->count();
+                $user->userlog()->forceDelete();
+                $user->forceDelete();
+            }
+            $this->info($user_assoc.' corresponding user log records purged.');
+
+            $manufacturers = Manufacturer::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($manufacturers->count().' manufacturers purged.');
+            foreach ($manufacturers as $manufacturer) {
+                $this->info('- Manufacturer "'.$manufacturer->name.'" deleted.');
+                $manufacturer->forceDelete();
+            }
+
+            $status_labels = Statuslabel::whereNotNull('deleted_at')->withTrashed()->get();
+            $this->info($status_labels->count().' status labels purged.');
+            foreach ($status_labels as $status_label) {
+                $this->info('- Status Label "'.$status_label->name.'" deleted.');
+                $status_label->forceDelete();
+            }
+        } else {
+            $this->info('Action canceled. Nothing was purged.');
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/PurgeLoginAttempts.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class PurgeLoginAttempts extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:purge-logins';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Clears the login_attempts table';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if ($this->confirm("\n****************************************************\nTHIS WILL DELETE ALL OF THE YOUR LOGIN ATTEMPT RECORDS. \nThere is NO undo! \n****************************************************\n\nDo you wish to continue? No backsies! [y|N]")) {
+            \DB::statement('delete from login_attempts');
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/ReEncodeCustomFieldNames.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\CustomField;
+use Illuminate\Console\Command;
+
+class ReEncodeCustomFieldNames extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:regenerate-fieldnames';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This utility will regenerate the column names for custom fields. It should typically only be needed when a PHP upgrade changed the behavior of the unicode conversion between versions.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * All three of these things must match for the custom fields system to work as expected:
+     *
+     * - what the system thinks the output of $field->convertUnicodeDbSlug() is
+     * - the actual db_column name in the customfields table
+     * - the physical column name that was created on the assets table
+     *
+     * For some people who upgraded their version of PHP, the unicode converter now behaves
+     * differently in than it did when their custom fields were first created, specifically as it
+     * relates to handling slashes, ampersands, etc. This can result in the field names no longer
+     * matching up, as an older version of the PHP extension simply dropped slashes, etc, while the
+     * newer version of the PHP extension will convert them to underscores.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if ($this->confirm('This will regenerate all of the custom field database fieldnames in your database. THIS WILL CHANGE YOUR SCHEMA AND SHOULD NOT BE DONE WITHOUT MAKING A BACKUP FIRST. Do you wish to continue?')) {
+
+            /** Get all of the custom fields */
+            $fields = CustomField::get();
+
+            $asset_columns = \DB::getSchemaBuilder()->getColumnListing('assets');
+            $custom_field_columns = [];
+
+            /** Loop through the columns on the assets table */
+            foreach ($asset_columns as $asset_column) {
+
+                /** Add ones that start with _snipeit_ to an array for handling */
+                if (strpos($asset_column, '_snipeit_') === 0) {
+
+                    /**
+                     * Get the ID of the custom field based on the fieldname.
+                     * For example, in _snipeit_mac_address_1, we grab the 1 because we know
+                     * that's the ID of the custom field that created the column.
+                     * Then use that ID as the array key for use comparing the actual assets field name
+                     * and the db_column value from the custom fields table.
+                     */
+                    $last_part = substr(strrchr($asset_column, '_snipeit_'), 1);
+                    $custom_field_columns[$last_part] = $asset_column;
+
+                }
+            }
+
+            foreach ($fields as $field) {
+                $this->info($field->name.' ('.$field->id.') column should be '.$field->convertUnicodeDbSlug());
+
+                /** The assets table has the column it should have, all is well */
+                if ($field->db_column == $field->convertUnicodeDbSlug() && \Schema::hasColumn('assets', $field->convertUnicodeDbSlug())) {
+                    $this->info('-- ✓ This field exists on the assets table and the value for db_column matches in the custom_fields table.');
+
+                /**
+                 * There is a mismatch between the fieldname on the assets table and
+                 * what $field->convertUnicodeDbSlug() is *now* expecting.
+                 */
+                } else {
+
+                    if ($field->db_column != $field->convertUnicodeDbSlug()) {
+                        $this->error('-- ✘ Field mismatch: '.$field->name.' value should be '.$field->convertUnicodeDbSlug().' but is '.$field->db_column.' in the custom_fields table');
+
+                    } else {
+                        $this->error('-- ✘ Field mismatch: '.$field->name.' column should be '.$field->convertUnicodeDbSlug().' but is '.$custom_field_columns[$field->id].' on the assets table.');
+
+                    }
+
+
+                    /** Make sure the custom_field_columns array has the ID */
+                    if (array_key_exists($field->id, $custom_field_columns)) {
+
+                        /**
+                         * Update the asset schema to the corrected fieldname that will be recognized by the
+                         *  system elsewhere that we use $field->convertUnicodeDbSlug()
+                         */
+                        $this->info('-- ✓ Updating field from '.$field->db_column.' to '.$field->convertUnicodeDbSlug().' in the assets table');
+                        \Schema::table('assets', function ($table) use ($custom_field_columns, $field) {
+                            $table->renameColumn($custom_field_columns[$field->id], $field->convertUnicodeDbSlug());
+                        });
+
+                        $this->info('-- ✓ Updating field from '.$field->db_column.' to '.$field->convertUnicodeDbSlug().' in the custom fields table');
+
+                        $field->db_column = $field->convertUnicodeDbSlug();
+                        $field->save();
+
+
+                    } else {
+                        $this->warn('-- ✘ WARNING: There is no field on the assets table ending in  '.$field->id.'. This may require more in-depth investigation and may mean the schema was altered manually.');
+                    }
+                }
+
+                /** Update the db_column property in the custom fields table, just in case it doesn't match the other
+                 * things.
+                 */
+                $field->db_column = $field->convertUnicodeDbSlug();
+                $field->save();
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/RecryptFromMcrypt.php

@@ -0,0 +1,157 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\LegacyEncrypter\McryptEncrypter;
+use App\Models\Asset;
+use App\Models\CustomField;
+use App\Models\Setting;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Storage;
+
+class RecryptFromMcrypt extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:legacy-recrypt 
+                {--force : Force a re-crypt of encrypted data from MCRYPT.}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command allows upgrading users to de-encrypt their deprecated mcrypt encrypted fields and re-encrypt them using the current OpenSSL encryption.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+        // Check and see if they have a legacy app key listed in their .env
+        // If not, we can try to use the current APP_KEY if looks like it's old
+        $legacy_key = env('LEGACY_APP_KEY');
+        $key_parts = explode(':', $legacy_key);
+        $legacy_cipher = env('LEGACY_CIPHER', 'rijndael-256');
+        $errors = [];
+
+        if (! $legacy_key) {
+            $this->error('ERROR: You do not have a LEGACY_APP_KEY set in your .env file. Please locate your old APP_KEY and ADD a line to your .env file like: LEGACY_APP_KEY=YOUR_OLD_APP_KEY');
+
+            return false;
+        }
+
+        // Do some basic legacy app key length checks
+        if (strlen($legacy_key) == 32) {
+            $legacy_length_check = true;
+        } elseif (array_key_exists('1', $key_parts) && (strlen($key_parts[1]) == 44)) {
+            $legacy_key = base64_decode($key_parts[1], true);
+            $legacy_length_check = true;
+        } else {
+            $legacy_length_check = false;
+        }
+
+        // Check that the app key is 32 characters
+        if ($legacy_length_check === true) {
+            $this->comment('INFO: Your LEGACY_APP_KEY looks correct. Okay to continue.');
+        } else {
+            $this->error('ERROR: Your LEGACY_APP_KEY is not the correct length (32 characters or base64 followed by 44 characters for later versions). Please locate your old APP_KEY and use that as your LEGACY_APP_KEY in your .env file to continue.');
+
+            return false;
+        }
+
+        $this->error('================================!!!! WARNING !!!!================================');
+        $this->error('================================!!!! WARNING !!!!================================');
+        $this->comment("This tool will attempt to decrypt your old Snipe-IT (mcrypt, now deprecated) encrypted data and re-encrypt it using OpenSSL. \n\nYou should only continue if you have backed up any and all old APP_KEYs and have backed up your data.");
+
+        $force = ($this->option('force')) ? true : false;
+
+        if ($force || ($this->confirm('Are you SURE you wish to continue?'))) {
+            $backup_file = 'backups/env-backups/'.'app_key-'.date('Y-m-d-gis');
+
+            try {
+                Storage::disk('local')->put($backup_file, 'APP_KEY: '.config('app.key'));
+                Storage::disk('local')->append($backup_file, 'LEGACY_APP_KEY: '.$legacy_key);
+            } catch (\Exception $e) {
+                $this->info('WARNING: Could not backup app keys');
+            }
+
+            if ($legacy_cipher) {
+                $mcrypter = new McryptEncrypter($legacy_key, $legacy_cipher);
+            } else {
+                $mcrypter = new McryptEncrypter($legacy_key);
+            }
+            $settings = Setting::getSettings();
+
+            if ($settings->ldap_pword == '') {
+                $this->comment('INFO: No LDAP password found. Skipping... ');
+            } else {
+                $decrypted_ldap_pword = $mcrypter->decrypt($settings->ldap_pword);
+                $settings->ldap_pword = \Crypt::encrypt($decrypted_ldap_pword);
+                $settings->save();
+            }
+            /** @var CustomField[] $custom_fields */
+            $custom_fields = CustomField::where('field_encrypted', '=', 1)->get();
+            $this->comment('INFO: Retrieving encrypted custom fields...');
+
+            $query = Asset::withTrashed();
+
+            foreach ($custom_fields as $custom_field) {
+                $this->comment('FIELD TO RECRYPT:  '.$custom_field->name.' ('.$custom_field->db_column.')');
+                $query->orWhereNotNull($custom_field->db_column);
+            }
+
+            // Get all assets with a value in any of the fields that were encrypted
+            /** @var Asset[] $assets */
+            $assets = $query->get();
+
+            $bar = $this->output->createProgressBar(count($assets));
+
+            foreach ($assets as $asset) {
+                foreach ($custom_fields as $encrypted_field) {
+                    $columnName = $encrypted_field->db_column;
+
+                    // Make sure the value isn't null
+                    if ($asset->{$columnName} != '') {
+                        // Try to decrypt the payload using the legacy app key
+                        try {
+                            $decrypted_field = $mcrypter->decrypt($asset->{$columnName});
+                            $asset->{$columnName} = \Crypt::encrypt($decrypted_field);
+                            $this->comment($decrypted_field);
+                        } catch (\Exception $e) {
+                            $errors[] = ' - ERROR: Could not decrypt field ['.$encrypted_field->name.']: '.$e->getMessage();
+                        }
+                    }
+                }
+                $asset->save();
+                $bar->advance();
+            }
+
+            $bar->finish();
+
+            if (count($errors) > 0) {
+                $this->comment("\n\n");
+                $this->error("The decrypter encountered some errors: \n");
+                foreach ($errors as $error) {
+                    $this->error($error);
+                }
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/RegenerateAssetTags.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\Setting;
+use Artisan;
+use Illuminate\Console\Command;
+
+class RegenerateAssetTags extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:regenerate-tags {--start=} {--output= : info|warn|error|all} ';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This utility will regenerate all asset tags. THIS IS DATA-DESTRUCTIVE AND SHOULD BE USED WITH CAUTION. ';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if ($this->confirm('This will regenerate all of the asset tags within your system. This action is data-destructive and should be used with caution. Do you wish to continue?')) {
+            $output['info'] = [];
+            $output['warn'] = [];
+            $output['error'] = [];
+            $settings = Setting::getSettings();
+
+            $start_tag = ($this->option('start')) ? $this->option('start') : (($settings->next_auto_tag_base) ? Setting::getSettings()->next_auto_tag_base : 1);
+
+            $this->info('Starting at '.$start_tag);
+
+            $total_assets = Asset::orderBy('id', 'asc')->get();
+            $bar = $this->output->createProgressBar(count($total_assets));
+
+            try {
+                Artisan::call('backup:run');
+            } catch (\Exception $e) {
+                $output['error'][] = $e;
+            }
+
+            foreach ($total_assets as $asset) {
+
+                $output['info'][] = 'Asset tag:'.$asset->asset_tag;
+                $asset->asset_tag = $settings->auto_increment_prefix.$settings->auto_increment_prefix.$start_tag;
+
+                if ($settings->zerofill_count > 0) {
+                    $asset->asset_tag = $settings->auto_increment_prefix.Asset::zerofill($start_tag, $settings->zerofill_count);
+                }
+
+                $output['info'][] = 'New Asset tag:'.$asset->asset_tag;
+
+                // Use forceSave here to override model level validation
+                $asset->forceSave();
+                $start_tag++;
+                if ($bar) {
+                    $bar->advance();
+                }
+            }
+
+            $settings->next_auto_tag_base = Asset::zerofill($start_tag, $settings->zerofill_count);
+            $settings->save();
+
+            $bar->finish();
+            $this->info("\n");
+
+            if (($this->option('output') == 'all') || ($this->option('output') == 'info')) {
+                foreach ($output['info'] as $key => $output_text) {
+                    $this->info($output_text);
+                }
+            }
+            if (($this->option('output') == 'all') || ($this->option('output') == 'warn')) {
+                foreach ($output['warn'] as $key => $output_text) {
+                    $this->warn($output_text);
+                }
+            }
+            if (($this->option('output') == 'all') || ($this->option('output') == 'error')) {
+                foreach ($output['error'] as $key => $output_text) {
+                    $this->error($output_text);
+                }
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/ResetDemoSettings.php

@@ -0,0 +1,90 @@
+<?php
+
+namespace App\Console\Commands;
+
+
+use App\Models\Setting;
+use App\Models\User;
+use Illuminate\Console\Command;
+
+class ResetDemoSettings extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:demo-settings';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This will reset the Snipe-IT demo settings back to default. ';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+        $this->info('Resetting the demo settings.');
+        $settings = Setting::first();
+        $settings->per_page = 20;
+        $settings->site_name = 'Snipe-IT Asset Management Demo';
+        $settings->auto_increment_assets = 1;
+        $settings->logo = 'snipe-logo.png';
+        $settings->alert_email = 'service@snipe-it.io';
+        $settings->login_note = 'Use `admin` / `password` to login to the demo.';
+        $settings->header_color = null;
+        $settings->barcode_type = 'QRCODE';
+        $settings->default_currency = 'USD';
+        $settings->brand = 2;
+        $settings->ldap_enabled = 0;
+        $settings->full_multiple_companies_support = 0;
+        $settings->alt_barcode = 'C128';
+        $settings->skin = '';
+        $settings->email_domain = 'snipeitapp.com';
+        $settings->email_format = 'filastname';
+        $settings->username_format = 'filastname';
+        $settings->date_display_format = 'D M d, Y';
+        $settings->time_display_format = 'g:iA';
+        $settings->thumbnail_max_h = '30';
+        $settings->locale = 'en-US';
+        $settings->version_footer = 'on';
+        $settings->support_footer = null;
+        $settings->saml_enabled = '0';
+        $settings->saml_sp_x509cert = null;
+        $settings->saml_idp_metadata = null;
+        $settings->saml_attr_mapping_username = null;
+        $settings->saml_forcelogin = '0';
+        $settings->saml_slo = null;
+        $settings->saml_custom_settings = null;
+
+
+        $settings->save();
+
+        if ($user = User::where('username', '=', 'admin')->first()) {
+            $user->locale = 'en-US';
+            $user->save();
+        }
+
+        \Storage::disk('public')->put('snipe-logo.png', file_get_contents(public_path('img/demo/snipe-logo.png')));
+        \Storage::disk('public')->put('snipe-logo-lg.png', file_get_contents(public_path('img/demo/snipe-logo-lg.png')));
+
+    }
+
+}

SNIPE-IT/app/Console/Commands/RestoreDeletedUsers.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Actionlog;
+use App\Models\Asset;
+use App\Models\License;
+use App\Models\User;
+use Artisan;
+use DB;
+use Illuminate\Console\Command;
+
+class RestoreDeletedUsers extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:restore-users {--start_date=} {--end_date=}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Restore users, and any associated assets and license checkouts.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $start_date = $this->option('start_date');
+        $end_date = $this->option('end_date');
+        $asset_totals = 0;
+        $license_totals = 0;
+        $user_count = 0;
+
+        if (($start_date == '') || ($end_date == '')) {
+            $this->info('ERROR: All fields are required.');
+
+            return false;
+        }
+
+        $users = User::whereBetween('deleted_at', [$start_date, $end_date])->withTrashed()->get();
+        $this->info('There are '.$users->count().' users deleted between '.$start_date.' and '.$end_date);
+        $this->warn('Making a backup!');
+        Artisan::call('backup:run');
+
+        foreach ($users as $user) {
+            $user_count++;
+            $user_logs = Actionlog::where('target_id', $user->id)->where('target_type', User::class)
+                ->where('action_type', 'checkout')->with('item')->get();
+
+            $this->info($user_count.'. '.$user->username.' ('.$user->id.') was deleted at '.$user->deleted_at.' and has '.$user_logs->count().' checkouts associated.');
+
+            foreach ($user_logs as $user_log) {
+                $this->info('  * '.$user_log->item_type.': '.$user_log->item->name.' - item_id: '.$user_log->item_id);
+
+                if ($user_log->item_type == Asset::class) {
+                    $asset_totals++;
+
+                    DB::table('assets')
+                        ->where('id', $user_log->item_id)
+                        ->update(['assigned_to' => $user->id, 'assigned_type'=> User::class]);
+
+                    $this->info('      ** Asset '.$user_log->item->id.' ('.$user_log->item->asset_tag.') restored to user '.$user->id.'');
+                } elseif ($user_log->item_type == License::class) {
+                    $license_totals++;
+
+                    $avail_seat = DB::table('license_seats')->where('license_id', '=', $user_log->item->id)
+                        ->whereNull('assigned_to')->whereNull('asset_id')->whereBetween('updated_at', [$start_date, $end_date])->first();
+                    if ($avail_seat) {
+                        $this->info('      ** Allocating seat '.$avail_seat->id.' for this License');
+
+                        DB::table('license_seats')
+                            ->where('id', $avail_seat->id)
+                            ->update(['assigned_to' => $user->id]);
+                    } else {
+                        $this->warn('ERROR: No available seats for '.$user_log->item->name);
+                    }
+                }
+            }
+
+            $this->warn('Restoring user '.$user->username.'!');
+            $user->restore();
+        }
+
+        $this->info($asset_totals.' assets affected');
+        $this->info($license_totals.' licenses affected');
+    }
+}

SNIPE-IT/app/Console/Commands/RestoreFromBackup.php

@@ -0,0 +1,489 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use ZipArchive;
+
+class SQLStreamer {
+    private $input;
+    private $output;
+    // embed the prefix here?
+    public ?string $prefix;
+
+    private bool $reading_beginning_of_line = true;
+
+    public static $buffer_size = 1024 * 1024;  // use a 1MB buffer, ought to work fine for most cases?
+
+    public array $tablenames = [];
+    private bool $should_guess = false;
+    private bool $statement_is_permitted = false;
+
+    public function __construct($input, $output, string $prefix = null)
+    {
+        $this->input = $input;
+        $this->output = $output;
+        $this->prefix = $prefix;
+    }
+
+    public function parse_sql(string $line): string {
+        // take into account the 'start of line or not' setting as an instance variable?
+        // 'continuation' lines for a permitted statement are PERMITTED.
+        if($this->statement_is_permitted && $line[0] === ' ') {
+            return $line;
+        }
+
+        $table_regex = '`?([a-zA-Z0-9_]+)`?';
+        $allowed_statements = [
+            "/^(DROP TABLE (?:IF EXISTS )?)`$table_regex(.*)$/" => false,
+            "/^(CREATE TABLE )$table_regex(.*)$/" => true, //sets up 'continuation'
+            "/^(LOCK TABLES )$table_regex(.*)$/" => false,
+            "/^(INSERT INTO )$table_regex(.*)$/" => false,
+            "/^UNLOCK TABLES/" => false,
+            // "/^\\) ENGINE=InnoDB AUTO_INCREMENT=16 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;/" => false, // FIXME not sure what to do here?
+            "/^\\)[a-zA-Z0-9_= ]*;$/" => false
+            // ^^^^^^ that bit should *exit* the 'perimitted' black
+        ];
+
+        foreach($allowed_statements as $statement => $statechange) {
+//            $this->info("Checking regex: $statement...\n");
+            $matches = [];
+            if (preg_match($statement,$line,$matches)) {
+                $this->statement_is_permitted = $statechange;
+                // matches are: 1 => first part of the statement, 2 => tablename, 3 => rest of statement
+                // (with of course 0 being "the whole match")
+                if (@$matches[2]) {
+//                    print "Found a tablename! It's: ".$matches[2]."\n";
+                    if ($this->should_guess) {
+                        @$this->tablenames[$matches[2]] += 1;
+                        continue; //oh? FIXME
+                    } else {
+                        $cleaned_tablename = \DB::getTablePrefix().preg_replace('/^'.$this->prefix.'/','',$matches[2]);
+                        $line = preg_replace($statement,'$1`'.$cleaned_tablename.'`$3' , $line);
+                    }
+                } else {
+                    // no explicit tablename in this one, leave the line alone
+                }
+                //how do we *replace* the tablename?
+//                print "RETURNING LINE: $line";
+                return $line;
+            }
+        }
+        // all that is not allowed is denied.
+        return "";
+    }
+
+    //this is used in exactly *TWO* places, and in both cases should return a prefix I think?
+    // first - if you do the --sanitize-only one (which is mostly for testing/development)
+    // next - when you run *without* a guessed prefix, this is run first to figure out the prefix
+    // I think we have to *duplicate* the call to be able to run it again?
+    public static function guess_prefix($input):string
+    {
+        $parser = new self($input, null);
+        $parser->should_guess = true;
+        $parser->line_aware_piping(); // <----- THIS is doing the heavy lifting!
+
+        $check_tables = ['settings' => null, 'migrations' => null /* 'assets' => null */]; //TODO - move to statics?
+        //can't use 'users' because the 'accessories_users' table?
+        // can't use 'assets' because 'ver1_components_assets'
+        foreach($check_tables as $check_table => $_ignore) {
+            foreach ($parser->tablenames as $tablename => $_count) {
+//                print "Comparing $tablename to $check_table\n";
+                if (str_ends_with($tablename,$check_table)) {
+//                    print "Found one!\n";
+                    $check_tables[$check_table] = substr($tablename,0,-strlen($check_table));
+                }
+            }
+        }
+        $guessed_prefix = null;
+        foreach ($check_tables as $clean_table => $prefix_guess) {
+            if(is_null($prefix_guess)) {
+                print("Couldn't find table $clean_table\n");
+                die();
+            }
+            if(is_null($guessed_prefix)) {
+                $guessed_prefix = $prefix_guess;
+            } else {
+                if ($guessed_prefix != $prefix_guess) {
+                    print("Prefix mismatch! Had guessed $guessed_prefix but got $prefix_guess\n");
+                    die();
+                }
+            }
+        }
+
+        return $guessed_prefix;
+
+    }
+
+    public function line_aware_piping(): int
+    {
+        $bytes_read = 0;
+        if (! $this->input) {
+            throw new \Exception("No Input available for line_aware_piping");
+        }
+
+        while (($buffer = fgets($this->input, SQLStreamer::$buffer_size)) !== false) {
+            $bytes_read += strlen($buffer);
+            if ($this->reading_beginning_of_line) {
+                // \Log::debug("Buffer is: '$buffer'");
+                $cleaned_buffer = $this->parse_sql($buffer);
+                if ($this->output) {
+                    $bytes_written = fwrite($this->output, $cleaned_buffer);
+
+                    if ($bytes_written === false) {
+                        throw new \Exception("Unable to write to pipe");
+                    }
+                }
+            }
+            // if we got a newline at the end of this, then the _next_ read is the beginning of a line
+            if($buffer[strlen($buffer)-1] === "\n") {
+                $this->reading_beginning_of_line = true;
+            } else {
+                $this->reading_beginning_of_line = false;
+            }
+
+        }
+        return $bytes_read;
+
+    }
+}
+
+
+
+class RestoreFromBackup extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    // FIXME - , stripping prefixes and nonstandard SQL statements. Without --prefix, guess and return the correct prefix to strip
+    protected $signature = 'snipeit:restore 
+                                            {--force : Skip the danger prompt; assuming you enter "y"} 
+                                            {filename : The zip file to be migrated}
+                                            {--no-progress : Don\'t show a progress bar}
+                                            {--sanitize-guess-prefix : Guess and output the table-prefix needed to "sanitize" the SQL}
+                                            {--sanitize-with-prefix= : "Sanitize" the SQL, using the passed-in table prefix (can be learned from --sanitize-guess-prefix). Pass as just \'--sanitize-with-prefix=\' to use no prefix}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Restore from a previously created Snipe-IT backup file';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $dir = getcwd();
+        if( $dir != base_path() ) { // usually only the case when running via webserver, not via command-line
+            \Log::debug("Current working directory is: $dir, changing directory to: ".base_path());
+            chdir(base_path()); // TODO - is this *safe* to change on a running script?!
+        }
+        //
+        $filename = $this->argument('filename');
+
+        if (! $filename) {
+            return $this->error('Missing required filename');
+        }
+
+        if (! $this->option('force') && ! $this->option('sanitize-guess-prefix') && ! $this->confirm('Are you sure you wish to restore from the given backup file? This can lead to MASSIVE DATA LOSS!')) {
+            return $this->error('Data loss not confirmed');
+        }
+
+        if (config('database.default') != 'mysql') {
+            return $this->error('DB_CONNECTION must be MySQL in order to perform a restore. Detected: '.config('database.default'));
+        }
+
+        $za = new ZipArchive();
+
+        $errcode = $za->open($filename/* , ZipArchive::RDONLY */); // that constant only exists in PHP 7.4 and higher
+        if ($errcode !== true) {
+            $errors = [
+                ZipArchive::ER_EXISTS => 'File already exists.',
+                ZipArchive::ER_INCONS => 'Zip archive inconsistent.',
+                ZipArchive::ER_INVAL => 'Invalid argument.',
+                ZipArchive::ER_MEMORY => 'Malloc failure.',
+                ZipArchive::ER_NOENT => 'No such file ('.$filename.') in directory '.$dir.'.',
+                ZipArchive::ER_NOZIP => 'Not a zip archive.',
+                ZipArchive::ER_OPEN => "Can't open file.",
+                ZipArchive::ER_READ => 'Read error.',
+                ZipArchive::ER_SEEK => 'Seek error.',
+            ];
+
+            return $this->error('Could not access file: '.$filename.' - '.array_key_exists($errcode, $errors) ? $errors[$errcode] : " Unknown reason: $errcode");
+        }
+
+
+        $private_dirs = [
+            'storage/private_uploads/accessories',
+            'storage/private_uploads/assetmodels',
+            'storage/private_uploads/assets', // these are asset _files_, not the pictures.
+            'storage/private_uploads/audits',
+            'storage/private_uploads/components',
+            'storage/private_uploads/consumables',
+            'storage/private_uploads/eula-pdfs',
+            'storage/private_uploads/imports',
+            'storage/private_uploads/licenses',
+            'storage/private_uploads/signatures',
+            'storage/private_uploads/users',
+        ];
+        $private_files = [
+            'storage/oauth-private.key',
+            'storage/oauth-public.key',
+        ];
+        $public_dirs = [
+            'public/uploads/accessories',
+            'public/uploads/assets', // these are asset _pictures_, not asset files
+            'public/uploads/avatars',
+            //'public/uploads/barcodes', // we don't want this, let the barcodes be regenerated
+            'public/uploads/categories',
+            'public/uploads/companies',
+            'public/uploads/components',
+            'public/uploads/consumables',
+            'public/uploads/departments',
+            'public/uploads/locations',
+            'public/uploads/manufacturers',
+            'public/uploads/models',
+            'public/uploads/suppliers',
+        ];
+
+        $public_files = [
+            'public/uploads/logo.*',
+            'public/uploads/setting-email_logo*',
+            'public/uploads/setting-label_logo*',
+            'public/uploads/setting-logo*',
+            'public/uploads/favicon.*',
+            'public/uploads/favicon-uploaded.*',
+        ];
+
+        $all_files = $private_dirs + $public_dirs;
+
+        $sqlfiles = [];
+        $sqlfile_indices = [];
+
+        $interesting_files = [];
+        $boring_files = [];
+
+        for ($i = 0; $i < $za->numFiles; $i++) {
+            $stat_results = $za->statIndex($i);
+            // echo "index: $i\n";
+            // print_r($stat_results);
+
+            $raw_path = $stat_results['name'];
+            if (strpos($raw_path, '\\') !== false) { //found a backslash, swap it to forward-slash
+                $raw_path = strtr($raw_path, '\\', '/');
+                //print "Translating file: ".$stat_results['name']." to: ".$raw_path."\n";
+            }
+
+            // skip macOS resource fork files (?!?!?!)
+            if (strpos($raw_path, '__MACOSX') !== false && strpos($raw_path, '._') !== false) {
+                //print "SKIPPING macOS Resource fork file: $raw_path\n";
+                $boring_files[] = $raw_path;
+                continue;
+            }
+            if (@pathinfo($raw_path, PATHINFO_EXTENSION) == 'sql') {
+                \Log::debug("Found a sql file!");
+                $sqlfiles[] = $raw_path;
+                $sqlfile_indices[] = $i;
+                continue;
+            }
+
+            foreach (array_merge($private_dirs, $public_dirs) as $dir) {
+                $last_pos = strrpos($raw_path, $dir . '/');
+                if ($last_pos !== false) {
+                    //print("INTERESTING - last_pos is $last_pos when searching $raw_path for $dir - last_pos+strlen(\$dir) is: ".($last_pos+strlen($dir))." and strlen(\$rawpath) is: ".strlen($raw_path)."\n");
+                    //print("We would copy $raw_path to $dir.\n"); //FIXME append to a path?
+                    $interesting_files[$raw_path] = ['dest' => $dir, 'index' => $i];
+                    continue 2;
+                    if ($last_pos + strlen($dir) + 1 == strlen($raw_path)) {
+                        // we don't care about that; we just want files with the appropriate prefix
+                        //print("FOUND THE EXACT DIRECTORY: $dir AT: $raw_path!!!\n");
+                    }
+                }
+            }
+            $good_extensions = ['png', 'gif', 'jpg', 'svg', 'jpeg', 'doc', 'docx', 'pdf', 'txt',
+                'zip', 'rar', 'xls', 'xlsx', 'lic', 'xml', 'rtf', 'webp', 'key', 'ico',];
+            foreach (array_merge($private_files, $public_files) as $file) {
+                $has_wildcard = (strpos($file, '*') !== false);
+                if ($has_wildcard) {
+                    $file = substr($file, 0, -1); //trim last character (which should be the wildcard)
+                }
+                $last_pos = strrpos($raw_path, $file); // no trailing slash!
+                if ($last_pos !== false) {
+                    $extension = strtolower(pathinfo($raw_path, PATHINFO_EXTENSION));
+                    if (!in_array($extension, $good_extensions)) {
+                        $this->warn('Potentially unsafe file ' . $raw_path . ' is being skipped');
+                        $boring_files[] = $raw_path;
+                        continue 2;
+                    }
+                    //print("INTERESTING - last_pos is $last_pos when searching $raw_path for $file - last_pos+strlen(\$file) is: ".($last_pos+strlen($file))." and strlen(\$rawpath) is: ".strlen($raw_path)."\n");
+                    //no wildcards found in $file, process 'normally'
+                    if ($last_pos + strlen($file) == strlen($raw_path) || $has_wildcard) { //again, no trailing slash. or this is a wildcard and we just take it.
+                        // print("FOUND THE EXACT FILE: $file AT: $raw_path!!!\n"); //we *do* care about this, though.
+                        $interesting_files[$raw_path] = ['dest' => dirname($file), 'index' => $i];
+                        continue 2;
+                    }
+                }
+            }
+            $boring_files[] = $raw_path; //if we've gotten to here and haven't continue'ed our way into the next iteration, we don't want this file
+        } // end of pre-processing the ZIP file for-loop
+        // print_r($interesting_files);exit(-1);
+
+        if (count($sqlfiles) != 1) {
+            return $this->error('There should be exactly *one* sql backup file found, found: '.(count($sqlfiles) == 0 ? 'None' : implode(', ', $sqlfiles)));
+        }
+
+        if (strpos($sqlfiles[0], 'db-dumps') === false) {
+            //return $this->error("SQL backup file is missing 'db-dumps' component of full pathname: ".$sqlfiles[0]);
+            //older Snipe-IT installs don't have the db-dumps subdirectory component
+        }
+
+        $sql_stat = $za->statIndex($sqlfile_indices[0]);
+        //$this->info("SQL Stat is: ".print_r($sql_stat,true));
+        $sql_contents = $za->getStream($sql_stat['name']); // maybe copy *THIS* thing?
+
+        // OKAY, now that we *found* the sql file if we're doing just the guess-prefix thing, we can do that *HERE* I think?
+        if ($this->option('sanitize-guess-prefix')) {
+            $prefix = SQLStreamer::guess_prefix($sql_contents);
+            $this->line($prefix);
+            return $this->info("Re-run this command with '--sanitize-with-prefix=".$prefix."' to see an attempt to sanitze your SQL.");
+        }
+
+        //how to invoke the restore?
+        $pipes = [];
+
+        $env_vars = getenv();
+        $env_vars['MYSQL_PWD'] = config('database.connections.mysql.password');
+        // TODO notes: we are stealing the dump_binary_path (which *probably* also has your copy of the mysql binary in it. But it might not, so we might need to extend this)
+        //             we unilaterally prepend a slash to the `mysql` command. This might mean your path could look like /blah/blah/blah//mysql - which should be fine. But maybe in some environments it isn't?
+        $mysql_binary = config('database.connections.mysql.dump.dump_binary_path').\DIRECTORY_SEPARATOR.'mysql'.(\DIRECTORY_SEPARATOR == '\\' ? ".exe" : "");
+        if( ! file_exists($mysql_binary) ) {
+            return $this->error("mysql tool at: '$mysql_binary' does not exist, cannot restore. Please edit DB_DUMP_PATH in your .env to point to a directory that contains the mysqldump and mysql binary");
+        }
+        $proc_results = proc_open("$mysql_binary -h ".escapeshellarg(config('database.connections.mysql.host')).' -u '.escapeshellarg(config('database.connections.mysql.username')).' '.escapeshellarg(config('database.connections.mysql.database')), // yanked -p since we pass via ENV
+                                  [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
+                                  $pipes,
+                                  null,
+                                  $env_vars); // this is not super-duper awesome-secure, but definitely more secure than showing it on the CLI, or dropping temporary files with passwords in them.
+        if ($proc_results === false) {
+            return $this->error('Unable to invoke mysql via CLI');
+        }
+
+        // I'm not sure about these?
+        stream_set_blocking($pipes[1], false); // use non-blocking reads for stdout
+        stream_set_blocking($pipes[2], false); // use non-blocking reads for stderr
+
+        // $this->info("Stdout says? ".fgets($pipes[1])); //FIXME: I think we might need to set non-blocking mode to use this properly?
+        // $this->info("Stderr says? ".fgets($pipes[2])); //FIXME: ditto, same.
+        // should we read stdout?
+        // fwrite($pipes[0],config("database.connections.mysql.password")."\n"); //this doesn't work :(
+
+        //$sql_contents = fopen($sqlfiles[0], "r"); //NOPE! This isn't a real file yet, silly-billy!
+
+        // FIXME - this feels like it wants to go somewhere else?
+        // and it doesn't seem 'right' - if you can't get a stream to the .sql file,
+        // why do we care what's happening with pipes and stdout and stderr?!
+        if ($sql_contents === false) {
+            $stdout = fgets($pipes[1]);
+            $this->info($stdout);
+            $stderr = fgets($pipes[2]);
+            $this->info($stderr);
+
+            return false;
+        }
+
+        try {
+            if ( $this->option('sanitize-with-prefix') === null) {
+                // "Legacy" direct-piping
+                $bytes_read = 0;
+                while (($buffer = fgets($sql_contents, SQLStreamer::$buffer_size)) !== false) {
+                    $bytes_read += strlen($buffer);
+                    // \Log::debug("Buffer is: '$buffer'");
+                    $bytes_written = fwrite($pipes[0], $buffer);
+
+                    if ($bytes_written === false) {
+                        throw new Exception("Unable to write to pipe");
+                    }
+                }
+            } else {
+                $sql_importer = new SQLStreamer($sql_contents, $pipes[0], $this->option('sanitize-with-prefix'));
+                $bytes_read = $sql_importer->line_aware_piping();
+            }
+        } catch (\Exception $e) {
+            \Log::error("Error during restore!!!! ".$e->getMessage());
+            // FIXME - put these back and/or put them in the right places?!
+            $err_out = fgets($pipes[1]);
+            $err_err = fgets($pipes[2]);
+            \Log::error("Error OUTPUT: ".$err_out);
+            $this->info($err_out);
+            \Log::error("Error ERROR : ".$err_err);
+            $this->error($err_err);
+            throw $e;
+        }
+        if (!feof($sql_contents) || $bytes_read == 0) {
+            return $this->error("Not at end of file for sql file, or zero bytes read. aborting!");
+        }
+    
+        fclose($pipes[0]);
+        fclose($sql_contents);
+        
+        $this->line(stream_get_contents($pipes[1]));
+        fclose($pipes[1]);
+
+        $this->error(stream_get_contents($pipes[2]));
+        fclose($pipes[2]);
+
+        //wait, have to do fclose() on all pipes first?
+        $close_results = proc_close($proc_results);
+        if ($close_results != 0) {
+            return $this->error('There may have been a problem with the database import: Error number '.$close_results);
+        }
+
+        //and now copy the files over too (right?)
+        //FIXME - we don't prune the filesystem space yet!!!!
+        if ($this->option('no-progress')) {
+            $bar = null;
+        } else {
+            $bar = $this->output->createProgressBar(count($interesting_files));
+        }
+        foreach ($interesting_files as $pretty_file_name => $file_details) {
+            $ugly_file_name = $za->statIndex($file_details['index'])['name'];
+            $fp = $za->getStream($ugly_file_name);
+            //$this->info("Weird problem, here are file details? ".print_r($file_details,true));
+            $migrated_file = fopen($file_details['dest'].'/'.basename($pretty_file_name), 'w');
+            while (($buffer = fgets($fp, SQLStreamer::$buffer_size)) !== false) {
+                fwrite($migrated_file, $buffer);
+            }
+            fclose($migrated_file);
+            fclose($fp);
+            //$this->info("Wrote $ugly_file_name to $pretty_file_name");
+            if ($bar) {
+                $bar->advance();
+            }
+        }
+        if ($bar) {
+            $bar->finish();
+            $this->line('');
+        } else {
+            $this->info(count($interesting_files).' files were succesfully transferred');
+        }
+        foreach ($boring_files as $boring_file) {
+            $this->warn($boring_file.' was skipped.');
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/RotateAppKey.php

@@ -0,0 +1,157 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\CustomField;
+use App\Models\Setting;
+use Artisan;
+use Illuminate\Console\Command;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Encryption\Encrypter;
+
+class RotateAppKey extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:rotate-key
+                            {previous_key? : The previous key to rotate from} 
+                            {--emergency : Emergency mode - rotate from .env APP_KEY to newly-generated one, modifying .env} 
+                            {--force : Skip interactive confirmation}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Rotates APP_KEY to a new value, optionally taking the previous key as an argument';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        //make sure they specify only exactly one of --emergency, or a filename. Not neither, and not both.
+        if ( (!$this->option('emergency') && !$this->argument('previous_key')) || ( $this->option('emergency') && $this->argument('previous_key'))) {
+            $this->error("Specify only one of --emergency, or an app key value, in order to rotate keys");
+            return 1;
+        }
+        if ( $this->option('emergency') ) {
+            $msg = "\n****************************************************\nTHIS WILL MODIFY YOUR APP_KEY AND DE-CRYPT YOUR ENCRYPTED CUSTOM FIELDS AND \nRE-ENCRYPT THEM WITH A NEWLY GENERATED KEY. \n\nThere is NO undo. \n\nMake SURE you have a database backup and a backup of your .env generated BEFORE running this command. \n\nIf you do not save the newly generated APP_KEY to your .env in this process, \nyour encrypted data will no longer be decryptable. \n\nAre you SURE you wish to continue, and have confirmed you have a database backup and an .env backup? ";
+        } else {
+            $msg = "\n****************************************************\nTHIS WILL DE-CRYPT YOUR ENCRYPTED CUSTOM FIELDS AND RE-ENCRYPT THEM WITH YOUR\nAPP_KEY.\n\nThere is NO undo. \n\nMake SURE you have a database backup BEFORE running this command. \n\nAre you SURE you wish to continue, and have confirmed you have a database backup? ";
+        }
+        if ($this->option('force') || $this->confirm($msg)) {
+
+            // Get the existing app_key and ciphers
+            // We put them in a variable since we clear the cache partway through here.
+            if ($this->option('emergency')) {
+                $old_app_key = config('app.key');
+                $cipher = config('app.cipher');
+
+                // Generate a new one
+                Artisan::call('key:generate', ['--show' => true]);
+                $new_app_key = trim(Artisan::output());
+
+                // Clear the config cache
+                Artisan::call('config:clear');
+
+                // Write the new app key to the .env file
+                $this->writeNewEnvironmentFileWith($new_app_key);
+            } elseif ($this->argument('previous_key')) {
+                $old_app_key = $this->argument('previous_key');
+                $cipher = config('app.cipher'); // just a guess?
+                $new_app_key = config('app.key');
+            }
+
+            $this->warn('Your app cipher is: ' . $cipher);
+            $this->warn('Your old APP_KEY is: ' . $old_app_key);
+            $this->warn('Your new APP_KEY is: ' . $new_app_key);
+
+            // Manually create an old encrypter instance using the old app key
+            // and also create a new encrypter instance so we can re-crypt the field
+            // using the newly generated app key
+            $oldEncrypter = new Encrypter(base64_decode(substr($old_app_key, 7)), $cipher);
+            $newEncrypter = new Encrypter(base64_decode(substr($new_app_key, 7)), $cipher);
+
+            $fields = CustomField::where('field_encrypted', '1')->get();
+
+            foreach ($fields as $field) {
+                $assets = Asset::whereNotNull($field->db_column)->get();
+
+                foreach ($assets as $asset) {
+                    try {
+                        $asset->{$field->db_column} = $oldEncrypter->decrypt($asset->{$field->db_column});
+                        $this->line('DECRYPTED: ' . $field->db_column);
+                    } catch (DecryptException $e) {
+                        $this->line('Could not decrypt '. $field->db_column.' using "old key" - skipping...');
+                        continue;
+                    } catch (\Exception $e) {
+                        $this->error("Error decrypting ".$field->db_column.", reason: ".$e->getMessage().". Aborting key rotation");
+                        throw $e;
+                    }
+                    $asset->{$field->db_column} = $newEncrypter->encrypt($asset->{$field->db_column});
+                    $this->line('ENCRYPTED: '.$field->db_column);
+                    $asset->save();
+                }
+            }
+
+            // Handle the LDAP password if one is provided
+            $setting = Setting::first();
+            if ($setting->ldap_pword != '') {
+                try {
+                    $setting->ldap_pword = $oldEncrypter->decrypt($setting->ldap_pword);
+                    $setting->ldap_pword = $newEncrypter->encrypt($setting->ldap_pword);
+                    $setting->save();
+                    $this->warn('LDAP password has been re-encrypted.');
+                } catch(DecryptException $e) {
+                    $this->warn("Unable to decrypt old LDAP password; skipping");
+                }
+            }
+        } else {
+            $this->info('This operation has been canceled. No changes have been made.');
+        }
+    }
+
+    /**
+     * Write a new environment file with the given key.
+     *
+     * @param  string  $key
+     * @return void
+     */
+    protected function writeNewEnvironmentFileWith($key)
+    {
+        file_put_contents($this->laravel->environmentFilePath(), preg_replace(
+            $this->keyReplacementPattern(),
+            'APP_KEY="'.$key.'"',
+            file_get_contents($this->laravel->environmentFilePath())
+        ));
+    }
+
+    /**
+     * Get a regex pattern that will match env APP_KEY with any random key.
+     *
+     * @return string
+     */
+    protected function keyReplacementPattern()
+    {
+        $escaped = '="?'.preg_quote($this->laravel['config']['app.key'], '/').'"?';
+
+        return "/^APP_KEY{$escaped}/m";
+    }
+}

SNIPE-IT/app/Console/Commands/SamlClearExpiredNonces.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use App\Models\SamlNonce;
+
+class SamlClearExpiredNonces extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'saml:clear_expired_nonces';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Clears out expired SAML assertions from the saml_nonces table';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return int
+     */
+    public function handle()
+    {
+        SamlNonce::where('not_valid_after','<=',now())->delete();
+        return 0;
+    }
+}

SNIPE-IT/app/Console/Commands/SendCurrentInventoryToUsers.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\User;
+use App\Notifications\CurrentInventory;
+use Illuminate\Console\Command;
+
+class SendCurrentInventoryToUsers extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:user-inventory';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This will send users a report of all of the items currently checked out to them.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $users = User::whereNull('deleted_at')->whereNotNull('email')->with('assets', 'accessories', 'licenses')->get();
+
+        $count = 0;
+        foreach ($users as $user) {
+            if (($user->assets->count() > 0) || ($user->accessories->count() > 0) || ($user->licenses->count() > 0)) {
+                $count++;
+                $user->notify((new CurrentInventory($user)));
+            }
+        }
+
+        $this->info($count.' users notified.');
+    }
+}

SNIPE-IT/app/Console/Commands/SendExpectedCheckinAlerts.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\Recipients\AlertRecipient;
+use App\Models\Setting;
+use App\Notifications\ExpectedCheckinAdminNotification;
+use App\Notifications\ExpectedCheckinNotification;
+use Carbon\Carbon;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+
+class SendExpectedCheckinAlerts extends Command
+{
+    /**
+     * The console command name.
+     *
+     * @var string
+     */
+    protected $name = 'snipeit:expected-checkin';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Check for overdue or upcoming expected checkins.';
+
+    /**
+     * Create a new command instance.
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $settings = Setting::getSettings();
+        $whenNotify = Carbon::now();
+        $assets = Asset::with('assignedTo')->whereNotNull('assigned_to')->whereNotNull('expected_checkin')->where('expected_checkin', '<=', $whenNotify)->get();
+
+        $this->info($whenNotify.' is deadline');
+        $this->info($assets->count().' assets');
+
+        foreach ($assets as $asset) {
+            if ($asset->assigned && $asset->checkedOutToUser()) {
+                Log::info('Sending ExpectedCheckinNotification to ' . $asset->assigned->email);
+                $asset->assigned->notify((new ExpectedCheckinNotification($asset)));
+            }
+        }
+
+        if (($assets) && ($assets->count() > 0) && ($settings->alert_email != '')) {
+            // Send a rollup to the admin, if settings dictate
+            $recipients = collect(explode(',', $settings->alert_email))->map(function ($item, $key) {
+                return new AlertRecipient($item);
+            });
+            \Notification::send($recipients, new ExpectedCheckinAdminNotification($assets));
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/SendExpirationAlerts.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\License;
+use App\Models\Recipients\AlertRecipient;
+use App\Models\Setting;
+use App\Notifications\ExpiringAssetsNotification;
+use App\Notifications\ExpiringLicenseNotification;
+use Illuminate\Console\Command;
+
+class SendExpirationAlerts extends Command
+{
+    /**
+     * The console command name.
+     *
+     * @var string
+     */
+    protected $name = 'snipeit:expiring-alerts';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Check for expiring warrantees and service agreements, and sends out an alert email.';
+
+    /**
+     * Create a new command instance.
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $settings = Setting::getSettings();
+        $threshold = $settings->alert_interval;
+
+        if (($settings->alert_email != '') && ($settings->alerts_enabled == 1)) {
+
+            // Send a rollup to the admin, if settings dictate
+            $recipients = collect(explode(',', $settings->alert_email))->map(function ($item, $key) {
+                return new AlertRecipient($item);
+            });
+
+            // Expiring Assets
+            $assets = Asset::getExpiringWarrantee($threshold);
+            if ($assets->count() > 0) {
+                $this->info(trans_choice('mail.assets_warrantee_alert', $assets->count(), ['count' => $assets->count(), 'threshold' => $threshold]));
+                \Notification::send($recipients, new ExpiringAssetsNotification($assets, $threshold));
+            }
+
+            // Expiring licenses
+            $licenses = License::getExpiringLicenses($threshold);
+            if ($licenses->count() > 0) {
+                $this->info(trans_choice('mail.license_expiring_alert', $licenses->count(), ['count' => $licenses->count(), 'threshold' => $threshold]));
+                \Notification::send($recipients, new ExpiringLicenseNotification($licenses, $threshold));
+            }
+        } else {
+            if ($settings->alert_email == '') {
+                $this->error('Could not send email. No alert email configured in settings');
+            } elseif (1 != $settings->alerts_enabled) {
+                $this->info('Alerts are disabled in the settings. No mail will be sent');
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/SendInventoryAlerts.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Helpers\Helper;
+use App\Models\Recipients\AlertRecipient;
+use App\Models\Setting;
+use App\Notifications\InventoryAlert;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Notification;
+
+class SendInventoryAlerts extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:inventory-alerts';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command checks for low inventory, and sends out an alert email.';
+
+    /**
+     * Create a new command instance.
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $settings = Setting::getSettings();
+
+        if (($settings->alert_email != '') && ($settings->alerts_enabled == 1)) {
+            $items = Helper::checkLowInventory();
+
+            if (($items) && (count($items) > 0)) {
+                $this->info(trans_choice('mail.low_inventory_alert', count($items)));
+                // Send a rollup to the admin, if settings dictate
+                $recipients = collect(explode(',', $settings->alert_email))->map(function ($item, $key) {
+                    return new AlertRecipient($item);
+                });
+
+                \Notification::send($recipients, new InventoryAlert($items, $settings->alert_threshold));
+            }
+        } else {
+            if ($settings->alert_email == '') {
+                $this->error('Could not send email. No alert email configured in settings');
+            } elseif (1 != $settings->alerts_enabled) {
+                $this->info('Alerts are disabled in the settings. No mail will be sent');
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/SendUpcomingAuditReport.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\License;
+use App\Models\Recipients;
+use App\Models\Setting;
+use App\Notifications\ExpiringAssetsNotification;
+use App\Notifications\SendUpcomingAuditNotification;
+use Carbon\Carbon;
+use DB;
+use Illuminate\Console\Command;
+
+class SendUpcomingAuditReport extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:upcoming-audits';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Send email/slack notifications for upcoming asset audits.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $settings = Setting::getSettings();
+
+        if (($settings->alert_email != '') && ($settings->audit_warning_days) && ($settings->alerts_enabled == 1)) {
+
+            // Send a rollup to the admin, if settings dictate
+            $recipients = collect(explode(',', $settings->alert_email))->map(function ($item, $key) {
+                return new \App\Models\Recipients\AlertRecipient($item);
+            });
+
+            // Assets due for auditing
+
+            $assets = Asset::whereNotNull('next_audit_date')
+                    ->DueOrOverdueForAudit($settings)
+                    ->orderBy('last_audit_date', 'asc')->get();
+
+            if ($assets->count() > 0) {
+                $this->info(trans_choice('mail.upcoming-audits', $assets->count(),
+                    ['count' => $assets->count(), 'threshold' => $settings->audit_warning_days]));
+                \Notification::send($recipients, new SendUpcomingAuditNotification($assets, $settings->audit_warning_days));
+                $this->info('Audit report sent to '.$settings->alert_email);
+            } else {
+                $this->info('No assets to be audited. No report sent.');
+            }
+        } elseif ($settings->alert_email == '') {
+            $this->error('Could not send email. No alert email configured in settings');
+        } elseif (! $settings->audit_warning_days) {
+            $this->error('No audit warning days set in Admin Notifications. No mail will be sent.');
+        } elseif ($settings->alerts_enabled != 1) {
+            $this->info('Alerts are disabled in the settings. No mail will be sent');
+        } else {
+            $this->error('Something went wrong. :( ');
+            $this->error('Admin Notifications Email Setting: '.$settings->alert_email);
+            $this->error('Admin Audit Warning Setting: '.$settings->audit_warning_days);
+            $this->error('Admin Alerts Emnabled: '.$settings->alerts_enabled);
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/SyncAssetCounters.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use Illuminate\Console\Command;
+
+class SyncAssetCounters extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:counter-sync';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Syncs checkedout, checked in, and requested counters for assets';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $start = microtime(true);
+
+        // We need the whole count of all assets in order to set up the progress bar
+        $assets_count = Asset::withTrashed()->count();
+        $bar = $this->output->createProgressBar($assets_count);
+
+        $assets = Asset::withCount('checkins as checkins_count', 'checkouts as checkouts_count', 'userRequests as user_requests_count')
+            ->withTrashed()->chunk(100, function ($assets) use ($bar) {
+
+                if ($assets->count() > 0) {
+
+                    foreach ($assets as $asset) {
+
+                        $asset->checkin_counter = (int) $asset->checkins_count;
+                        $asset->checkout_counter = (int) $asset->checkouts_count;
+                        $asset->requests_counter = (int) $asset->user_requests_count;
+                        $asset->unsetEventDispatcher();
+                        $asset->save();
+                        $bar->advance();
+
+                        \Log::debug('Asset: '.$asset->id.' has '.$asset->checkin_counter.' checkins, '.$asset->checkout_counter.' checkouts, and '.$asset->requests_counter.' requests');
+
+                    }
+
+            } else {
+                $this->info('No assets to sync');
+            }
+        });
+        
+
+        $bar->finish();
+        $time_elapsed_secs = microtime(true) - $start;
+        $this->info("\nSync of ".$assets_count.' assets executed in '.$time_elapsed_secs.' seconds');
+
+
+    }
+}

SNIPE-IT/app/Console/Commands/SyncAssetLocations.php

@@ -0,0 +1,138 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use Illuminate\Console\Command;
+
+class SyncAssetLocations extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:sync-asset-locations {--output= : info|warn|error|all} ';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This utility will sync the location_id of assets based on current state. It should not normally be needed, but is a safeguard in case we missed something in the Great Migration when flattening the assets to location relationship.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $output['info'] = [];
+        $output['warn'] = [];
+        $output['error'] = [];
+
+        $total_assets = Asset::whereNull('deleted_at')->get();
+        $bar = $this->output->createProgressBar(count($total_assets));
+
+        // Unassigned
+        $rtd_assets = Asset::whereNull('assigned_to')->whereNull('deleted_at')->with('defaultLoc')->get();
+        $output['info'][] = 'There are '.$rtd_assets->count().' unassigned assets.';
+
+        foreach ($rtd_assets as $rtd_asset) {
+            $output['info'][] = 'Setting Unassigned Asset '.$rtd_asset->id.' ('.$rtd_asset->asset_tag.') to  location: '.$rtd_asset->rtd_location_id.' because their default location is: '.$rtd_asset->rtd_location_id;
+            $rtd_asset->location_id = $rtd_asset->rtd_location_id;
+            $rtd_asset->unsetEventDispatcher();
+            $rtd_asset->save();
+            $bar->advance();
+        }
+
+        $assigned_user_assets = Asset::where('assigned_type', \App\Models\User::class)->whereNotNull('assigned_to')->whereNull('deleted_at')->get();
+        $output['info'][] = 'There are '.$assigned_user_assets->count().' assets checked out to users.';
+        foreach ($assigned_user_assets as $assigned_user_asset) {
+            if (($assigned_user_asset->assignedTo) && ($assigned_user_asset->assignedTo->userLoc)) {
+                $new_location = $assigned_user_asset->assignedTo->userLoc->id;
+                $output['info'][] = 'Setting User Asset '.$assigned_user_asset->id.' ('.$assigned_user_asset->asset_tag.') to  '.$assigned_user_asset->assignedTo->userLoc->name.' which is id: '.$new_location;
+            } else {
+                $output['warn'][] = 'Asset '.$assigned_user_asset->id.' ('.$assigned_user_asset->asset_tag.') still has no location! ';
+                $new_location = $assigned_user_asset->rtd_location_id;
+            }
+            $assigned_user_asset->location_id = $new_location;
+            $assigned_user_asset->unsetEventDispatcher();
+            $assigned_user_asset->save();
+            $bar->advance();
+        }
+
+        $assigned_location_assets = Asset::where('assigned_type', \App\Models\Location::class)
+            ->whereNotNull('assigned_to')->whereNull('deleted_at')->get();
+        $output['info'][] = 'There are '.$assigned_location_assets->count().' assets checked out to locations.';
+
+        foreach ($assigned_location_assets as $assigned_location_asset) {
+            if ($assigned_location_asset->assignedTo) {
+                $assigned_location_asset->location_id = $assigned_location_asset->assignedTo->id;
+                $output['info'][] = 'Setting Location Assigned  asset '.$assigned_location_asset->id.' ('.$assigned_location_asset->asset_tag.') that is checked out to '.$assigned_location_asset->assignedTo->name.' (#'.$assigned_location_asset->assignedTo->id.') to location: '.$assigned_location_asset->assetLoc()->id;
+                $assigned_location_asset->unsetEventDispatcher();
+                $assigned_location_asset->save();
+            } else {
+                $output['warn'][] = 'Asset '.$assigned_location_asset->id.' ('.$assigned_location_asset->asset_tag.') did not return a valid associated location - perhaps it was deleted?';
+            }
+            $bar->advance();
+        }
+
+        // Assigned to assets
+        $assigned_asset_assets = Asset::where('assigned_type', \App\Models\Asset::class)
+            ->whereNotNull('assigned_to')->whereNull('deleted_at')->get();
+        $output['info'][] = 'Asset-assigned assets: '.$assigned_asset_assets->count();
+
+        foreach ($assigned_asset_assets as $assigned_asset_asset) {
+
+                // Check to make sure there aren't any invalid relationships
+            if ($assigned_asset_asset->assetLoc()) {
+                $assigned_asset_asset->location_id = $assigned_asset_asset->assetLoc()->id;
+                $output['info'][] = 'Setting Asset Assigned asset '.$assigned_asset_asset->assetLoc()->id.' ('.$assigned_asset_asset->asset_tag.') location to: '.$assigned_asset_asset->assetLoc()->id;
+                $assigned_asset_asset->unsetEventDispatcher();
+                $assigned_asset_asset->save();
+            } else {
+                $output['warn'][] = 'Asset Assigned asset '.$assigned_asset_asset->id.' ('.$assigned_asset_asset->asset_tag.') does not seem to have a valid location';
+            }
+
+            $bar->advance();
+        }
+
+        $unlocated_assets = Asset::whereNull('location_id')->whereNull('deleted_at')->get();
+        $output['info'][] = 'Assets still without a location: '.$unlocated_assets->count();
+        foreach ($unlocated_assets as $unlocated_asset) {
+            $output['warn'][] = 'Asset: '.$unlocated_asset->id.' still has no location. ';
+            $bar->advance();
+        }
+
+        $bar->finish();
+        $this->info("\n");
+
+        if (($this->option('output') == 'all') || ($this->option('output') == 'info')) {
+            foreach ($output['info'] as $key => $output_text) {
+                $this->info($output_text);
+            }
+        }
+        if (($this->option('output') == 'all') || ($this->option('output') == 'warn')) {
+            foreach ($output['warn'] as $key => $output_text) {
+                $this->warn($output_text);
+            }
+        }
+        if (($this->option('output') == 'all') || ($this->option('output') == 'error')) {
+            foreach ($output['error'] as $key => $output_text) {
+                $this->error($output_text);
+            }
+        }
+    }
+}

SNIPE-IT/app/Console/Commands/SystemBackup.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class SystemBackup extends Command
+{
+    /**
+     * The console command name.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:backup {--filename=}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command creates a database dump and zips up all of the uploaded files in the upload directories.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        if ($this->option('filename')) {
+            $filename = $this->option('filename');
+
+            // Make sure the filename ends in .zip
+            if (!ends_with($filename, '.zip')) {
+                $filename = $filename.'.zip';
+            }
+
+            $this->call('backup:run', ['--filename' => $filename]);
+        } else {
+            $this->call('backup:run');
+        }
+
+    }
+}

SNIPE-IT/app/Console/Commands/ToggleCustomfieldEncryption.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\Asset;
+use App\Models\CustomField;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\DB;
+
+class ToggleCustomfieldEncryption extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:customfield-encryption
+                             {fieldname : the db_column_name of the field}';
+
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command should be used to convert an unencrypted custom field into a custom field and encrypt the associated data in the assets table for that column.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return int
+     */
+    public function handle()
+    {
+        $fieldname = $this->argument('fieldname');
+
+        if ($field = CustomField::where('db_column', $fieldname)->first()) {
+
+            // If the field is not encrypted, make it encrypted and encrypt the data in the assets table for the
+            // corresponding field.
+            DB::transaction(function () use ($field) {
+
+                if ($field->field_encrypted == 0) {
+                    $assets = Asset::whereNotNull($field->db_column)->get();
+
+                    foreach ($assets as $asset) {
+                        $asset->{$field->db_column} = encrypt($asset->{$field->db_column});
+                        $asset->save();
+                    }
+
+                    $field->field_encrypted = 1;
+                    $field->save();
+
+                // This field is already encrypted. Do nothing.
+                } else {
+                    $this->error('The custom field ' . $field->db_column.' is already encrypted. No action was taken.');
+                }
+            });
+
+        // No matching column name found
+        } else {
+            $this->error('No matching results for unencrypted custom fields with db_column name: ' . $fieldname.'. Please check the fieldname.');
+        }
+
+    }
+}

SNIPE-IT/app/Console/Commands/Version.php

@@ -0,0 +1,127 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class Version extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'version:update {--branch=master} {--type=patch}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Command description';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+        $use_branch = $this->option('branch');
+        $use_type = $this->option('type');
+        $git_branch = trim(shell_exec('git rev-parse --abbrev-ref HEAD'));
+        $build_version = trim(shell_exec('git rev-list --count '.$use_branch));
+        $versionFile = 'config/version.php';
+        $full_hash_version = str_replace("\n", '', shell_exec('git describe master --tags'));
+
+        $version = explode('-', $full_hash_version);
+        $app_version = $current_app_version = $version[0];
+        $hash_version = (array_key_exists('2', $version)) ? $version[2] : '';
+        $prerelease_version = '';
+
+        $this->line('Branch is: '.$use_branch);
+        $this->line('Type is: '.$use_type);
+        $this->line('Current version is: '.$full_hash_version);
+
+        if (count($version) == 3) {
+            $this->line('This does not look like an alpha/beta release.');
+        } else {
+            if (array_key_exists('3', $version)) {
+                $this->line('The current version looks like a beta release.');
+                $prerelease_version = $version[1];
+                $hash_version = $version[3];
+            }
+        }
+
+        $app_version_raw = explode('.', $app_version);
+
+        $maj = str_replace('v', '', $app_version_raw[0]);
+        $min = $app_version_raw[1];
+        $patch = '';
+
+        // This is a major release that might not have a third .0
+        if (array_key_exists(2, $app_version_raw)) {
+            $patch = $app_version_raw[2];
+        }
+
+        if ($use_type == 'major') {
+            $app_version = 'v'.($maj + 1).".$min.$patch";
+        } elseif ($use_type == 'minor') {
+            $app_version = 'v'."$maj.".($min + 1).".$patch";
+        } elseif ($use_type == 'pre') {
+            $pre_raw = str_replace('beta', '', $prerelease_version);
+            $pre_raw = str_replace('alpha', '', $pre_raw);
+            $pre_raw = str_ireplace('rc', '', $pre_raw);
+            $pre_raw = $pre_raw++;
+            $this->line('Setting the pre-release to '.$prerelease_version.'-'.$pre_raw);
+            $app_version = 'v'."$maj.".($min + 1).".$patch";
+        } elseif ($use_type == 'patch') {
+            $app_version = 'v'."$maj.$min.".($patch + 1);
+        // If nothing is passed, leave the version as it is, just increment the build
+        } else {
+            $app_version = 'v'."$maj.$min.".$patch;
+        }
+
+        // Determine if this tag already exists, or if this prior to a release
+        $this->line('Running: git rev-parse master '.$current_app_version);
+        // $pre_release = trim(shell_exec('git rev-parse '.$use_branch.' '.$current_app_version.' 2>&1 1> /dev/null'));
+
+        if ($use_branch == 'develop') {
+            $app_version = $app_version.'-pre';
+        }
+
+        $full_app_version = $app_version.' - build '.$build_version.'-'.$hash_version;
+
+        $array = var_export(
+            [
+                'app_version' => $app_version,
+                'full_app_version' => $full_app_version,
+                'build_version' => $build_version,
+                'prerelease_version' => $prerelease_version,
+                'hash_version' => $hash_version,
+                'full_hash' => $full_hash_version,
+                'branch' => $git_branch, ],
+            true
+        );
+
+        // Construct our file content
+        $content = <<<CON
+<?php
+return $array;
+CON;
+
+        // And finally write the file and output the current version
+        \File::put($versionFile, $content);
+        $this->info('Setting NEW version: '.$full_app_version.' ('.$git_branch.')');
+    }
+}

SNIPE-IT/app/Console/Kernel.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Console;
+
+use App\Console\Commands\ImportLocations;
+use App\Console\Commands\ReEncodeCustomFieldNames;
+use App\Console\Commands\RestoreDeletedUsers;
+use Illuminate\Console\Scheduling\Schedule;
+use Illuminate\Foundation\Console\Kernel as ConsoleKernel;
+
+class Kernel extends ConsoleKernel
+{
+    /**
+     * Define the application's command schedule.
+     *
+     * @param  \Illuminate\Console\Scheduling\Schedule  $schedule
+     * @return void
+     */
+    protected function schedule(Schedule $schedule)
+    {
+        $schedule->command('snipeit:inventory-alerts')->daily();
+        $schedule->command('snipeit:expiring-alerts')->daily();
+        $schedule->command('snipeit:expected-checkin')->daily();
+        $schedule->command('snipeit:backup')->weekly();
+        $schedule->command('backup:clean')->daily();
+        $schedule->command('snipeit:upcoming-audits')->daily();
+        $schedule->command('auth:clear-resets')->everyFifteenMinutes();
+        $schedule->command('saml:clear_expired_nonces')->weekly();
+    }
+
+    /**
+     * This method is required by Laravel to handle any console routes
+     * that are defined in routes/console.php.
+     */
+    protected function commands()
+    {
+        require base_path('routes/console.php');
+        $this->load(__DIR__.'/Commands');
+    }
+}

SNIPE-IT/app/Events/CheckoutAccepted.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Events;
+
+use App\Models\CheckoutAcceptance;
+use App\Models\Contracts\Acceptable;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class CheckoutAccepted
+{
+    use Dispatchable, SerializesModels;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct(CheckoutAcceptance $acceptance)
+    {
+        $this->acceptance = $acceptance;
+    }
+}

SNIPE-IT/app/Events/CheckoutDeclined.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Events;
+
+use App\Models\CheckoutAcceptance;
+use App\Models\Contracts\Acceptable;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class CheckoutDeclined
+{
+    use Dispatchable, SerializesModels;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct(CheckoutAcceptance $acceptance)
+    {
+        $this->acceptance = $acceptance;
+    }
+}

SNIPE-IT/app/Events/CheckoutableCheckedIn.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Events;
+
+use App\Models\User;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class CheckoutableCheckedIn
+{
+    use Dispatchable, SerializesModels;
+
+    public $checkoutable;
+    public $checkedOutTo;
+    public $checkedInBy;
+    public $note;
+    public $action_date; // Date setted in the hardware.checkin view at the checkin_at input, for the action log
+    public $originalValues;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct($checkoutable, $checkedOutTo, User $checkedInBy, $note, $action_date = null, $originalValues = [])
+    {
+        $this->checkoutable = $checkoutable;
+        $this->checkedOutTo = $checkedOutTo;
+        $this->checkedInBy = $checkedInBy;
+        $this->note = $note;
+        $this->action_date = $action_date ?? date('Y-m-d');
+        $this->originalValues = $originalValues;
+    }
+}

SNIPE-IT/app/Events/CheckoutableCheckedOut.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Events;
+
+use App\Models\User;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class CheckoutableCheckedOut
+{
+    use Dispatchable, SerializesModels;
+
+    public $checkoutable;
+    public $checkedOutTo;
+    public $checkedOutBy;
+    public $note;
+    public $originalValues;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct($checkoutable, $checkedOutTo, User $checkedOutBy, $note, $originalValues = [])
+    {
+        $this->checkoutable = $checkoutable;
+        $this->checkedOutTo = $checkedOutTo;
+        $this->checkedOutBy = $checkedOutBy;
+        $this->note = $note;
+        $this->originalValues = $originalValues;
+    }
+}

SNIPE-IT/app/Events/Event.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Events;
+
+abstract class Event
+{
+    //
+}

SNIPE-IT/app/Events/UserMerged.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+use App\Models\User;
+
+class UserMerged
+{
+    use Dispatchable, SerializesModels;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct(User $from_user, User $to_user, User $admin)
+    {
+        $this->merged_from        = $from_user;
+        $this->merged_to      = $to_user;
+        $this->admin            = $admin;
+    }
+}

SNIPE-IT/app/Exceptions/CheckoutNotAllowed.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Exceptions;
+
+use Exception;
+
+class CheckoutNotAllowed extends Exception
+{
+    private $errorMessage;
+
+    public function __construct($errorMessage = null)
+    {
+        $this->errorMessage = $errorMessage;
+
+        parent::__construct($errorMessage);
+    }
+
+    public function __toString()
+    {
+        return is_null($this->errorMessage) ? 'A checkout is not allowed under these circumstances' : $this->errorMessage;
+    }
+}

SNIPE-IT/app/Exceptions/Handler.php

@@ -0,0 +1,181 @@
+<?php
+
+namespace App\Exceptions;
+
+use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
+use App\Helpers\Helper;
+use Illuminate\Validation\ValidationException;
+use Illuminate\Auth\AuthenticationException;
+use ArieTimmerman\Laravel\SCIMServer\Exceptions\SCIMException;
+use Log;
+use Throwable;
+use JsonException;
+use Carbon\Exceptions\InvalidFormatException;
+
+class Handler extends ExceptionHandler
+{
+    /**
+     * A list of the exception types that are not reported.
+     *
+     * @var array
+     */
+    protected $dontReport = [
+        \Illuminate\Auth\AuthenticationException::class,
+        \Illuminate\Auth\Access\AuthorizationException::class,
+        \Symfony\Component\HttpKernel\Exception\HttpException::class,
+        \Illuminate\Database\Eloquent\ModelNotFoundException::class,
+        \Illuminate\Session\TokenMismatchException::class,
+        \Illuminate\Validation\ValidationException::class,
+        \Intervention\Image\Exception\NotSupportedException::class,
+        \League\OAuth2\Server\Exception\OAuthServerException::class,
+        JsonException::class,
+        SCIMException::class, //these generally don't need to be reported
+        InvalidFormatException::class,
+    ];
+
+    /**
+     * Report or log an exception.
+     *
+     * This is a great spot to send exceptions to Sentry, Bugsnag, etc.
+     *
+     * @param  \Throwable  $exception
+     * @return void
+     */
+    public function report(Throwable $exception)
+    {
+        if ($this->shouldReport($exception)) {
+            if (class_exists(\Log::class)) {
+                \Log::error($exception);
+            }
+            return parent::report($exception);
+        }
+    }
+
+    /**
+     * Render an exception into an HTTP response.
+     * 
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Exception  $e
+     * @return \Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse|\Illuminate\Http\Response
+     */
+    public function render($request, Throwable $e)
+    {
+
+
+        // CSRF token mismatch error
+        if ($e instanceof \Illuminate\Session\TokenMismatchException) {
+            return redirect()->back()->with('error', trans('general.token_expired'));
+        }
+
+        // Invalid JSON exception
+        // TODO: don't understand why we have to do this when we have the invalidJson() method, below, but, well, whatever
+        if ($e instanceof JsonException) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Invalid JSON'), 422);
+        }
+
+        // Handle SCIM exceptions
+        if ($e instanceof SCIMException) {
+            try {
+                $e->report(); // logs as 'debug', so shouldn't get too noisy
+            } catch(\Exception $reportException) {
+                //do nothing
+            }
+            return $e->render($request); // ALL SCIMExceptions have the 'render()' method
+        }
+
+        // Handle standard requests that fail because Carbon cannot parse the date on validation (when a submitted date value is definitely not a date)
+        if ($e instanceof InvalidFormatException) {
+            return redirect()->back()->withInput()->with('error', trans('validation.date', ['attribute' => 'date']));
+        }
+
+        // Handle API requests that fail
+        if ($request->ajax() || $request->wantsJson()) {
+
+            // Handle API requests that fail because Carbon cannot parse the date on validation (when a submitted date value is definitely not a date)
+            if ($e instanceof InvalidFormatException) {
+                return response()->json(Helper::formatStandardApiResponse('error', null, trans('validation.date', ['attribute' => 'date'])), 200);
+            }
+
+            // Handle API requests that fail because the model doesn't exist
+            if ($e instanceof \Illuminate\Database\Eloquent\ModelNotFoundException) {
+                $className = last(explode('\\', $e->getModel()));
+                return response()->json(Helper::formatStandardApiResponse('error', null, $className . ' not found'), 200);
+            }
+
+            // Handle API requests that fail because of an HTTP status code and return a useful error message
+            if ($this->isHttpException($e)) {
+
+                $statusCode = $e->getStatusCode();
+
+                switch ($e->getStatusCode()) {
+                    case '404':
+                       return response()->json(Helper::formatStandardApiResponse('error', null, $statusCode . ' endpoint not found'), 404);
+                    case '429':
+                        return response()->json(Helper::formatStandardApiResponse('error', null, 'Too many requests'), 429);
+                     case '405':
+                        return response()->json(Helper::formatStandardApiResponse('error', null, 'Method not allowed'), 405);
+                    default:
+                        return response()->json(Helper::formatStandardApiResponse('error', null, $statusCode), $statusCode);
+
+                }
+            }
+        }
+
+
+
+
+        if ($this->isHttpException($e) && (isset($statusCode)) && ($statusCode == '404' )) {
+            return response()->view('layouts/basic', [
+                'content' => view('errors/404')
+            ],$statusCode);
+        }
+
+        return parent::render($request, $e);
+
+    }
+
+ /**
+     * Convert an authentication exception into an unauthenticated response.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Illuminate\Auth\AuthenticationException  $exception
+     * @return \Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+  */
+    protected function unauthenticated($request, AuthenticationException $exception)
+    {
+        if ($request->expectsJson()) {
+            return response()->json(['error' => 'Unauthorized or unauthenticated.'], 401);
+        }
+
+        return redirect()->guest('login');
+    }
+
+    protected function invalidJson($request, ValidationException $exception)
+    {
+        return response()->json(Helper::formatStandardApiResponse('error', null, $exception->errors()), 200);
+    }
+
+
+    /** 
+     * A list of the inputs that are never flashed for validation exceptions.
+     *
+     * @var array
+     */
+    protected $dontFlash = [
+        'current_password',
+        'password',
+        'password_confirmation',
+    ];
+
+    /**
+     * Register the exception handling callbacks for the application.
+     *
+     * @return void
+     */
+    public function register()
+    {
+        $this->reportable(function (Throwable $e) {
+            //
+        });
+    }
+}

SNIPE-IT/app/Helpers/StorageHelper.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Helpers;
+
+use Illuminate\Support\Facades\Storage;
+
+class StorageHelper
+{
+    public static function downloader($filename, $disk = 'default')
+    {
+        if ($disk == 'default') {
+            $disk = config('filesystems.default');
+        }
+        switch (config("filesystems.disks.$disk.driver")) {
+            case 'local':
+                return response()->download(Storage::disk($disk)->path($filename)); //works for PRIVATE or public?!
+
+            case 's3':
+                return redirect()->away(Storage::disk($disk)->temporaryUrl($filename, now()->addMinutes(5))); //works for private or public, I guess?
+
+            default:
+                return Storage::disk($disk)->download($filename);
+        }
+    }
+}

SNIPE-IT/app/Http/Controllers/Accessories/AccessoriesController.php

@@ -0,0 +1,258 @@
+<?php
+
+namespace App\Http\Controllers\Accessories;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\ImageUploadRequest;
+use App\Models\Accessory;
+use App\Models\Company;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
+use Redirect;
+
+/** This controller handles all actions related to Accessories for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v1.0
+ */
+class AccessoriesController extends Controller
+{
+    /**
+     * Returns a view that invokes the ajax tables which actually contains
+     * the content for the accessories listing, which is generated in getDatatable.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see AccessoriesController::getDatatable() method that generates the JSON response
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function index()
+    {
+        $this->authorize('index', Accessory::class);
+
+        return view('accessories/index');
+    }
+
+    /**
+     * Returns a view with a form to create a new Accessory.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create()
+    {
+        $this->authorize('create', Accessory::class);
+        $category_type = 'accessory';
+
+        return view('accessories/edit')->with('category_type', $category_type)
+          ->with('item', new Accessory);
+    }
+
+    /**
+     * Validate and save new Accessory from form post
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param ImageUploadRequest $request
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize(Accessory::class);
+        
+        // create a new model instance
+        $accessory = new Accessory();
+
+        // Update the accessory data
+        $accessory->name                    = request('name');
+        $accessory->category_id             = request('category_id');
+        $accessory->location_id             = request('location_id');
+        $accessory->min_amt                 = request('min_amt');
+        $accessory->company_id              = Company::getIdForCurrentUser(request('company_id'));
+        $accessory->order_number            = request('order_number');
+        $accessory->manufacturer_id         = request('manufacturer_id');
+        $accessory->model_number            = request('model_number');
+        $accessory->purchase_date           = request('purchase_date');
+        $accessory->purchase_cost           = request('purchase_cost');
+        $accessory->qty                     = request('qty');
+        $accessory->user_id                 = Auth::user()->id;
+        $accessory->supplier_id             = request('supplier_id');
+        $accessory->notes                   = request('notes');
+
+        $accessory = $request->handleImages($accessory);
+
+        // Was the accessory created?
+        if ($accessory->save()) {
+            // Redirect to the new accessory  page
+            return redirect()->route('accessories.index')->with('success', trans('admin/accessories/message.create.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($accessory->getErrors());
+    }
+
+    /**
+     * Return view for the Accessory update form, prepopulated with existing data
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $accessoryId
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function edit($accessoryId = null)
+    {
+
+        if ($item = Accessory::find($accessoryId)) {
+            $this->authorize($item);
+
+            return view('accessories/edit', compact('item'))->with('category_type', 'accessory');
+        }
+
+        return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.does_not_exist'));
+
+    }
+
+    /**
+     * Returns a view that presents a form to clone an accessory.
+     *
+     * @author [J. Vinsmoke]
+     * @param int $accessoryId
+     * @since [v6.0]
+     * @return View
+     */
+    public function getClone($accessoryId = null)
+    {
+
+        $this->authorize('create', Accessory::class);
+
+        // Check if the asset exists
+        if (is_null($accessory_to_clone = Accessory::find($accessoryId))) {
+            // Redirect to the asset management page
+            return redirect()->route('accessories.index')
+                ->with('error', trans('admin/accessories/message.does_not_exist', ['id' => $accessoryId]));
+        }
+
+        $accessory = clone $accessory_to_clone;
+        $accessory->id = null;
+        $accessory->location_id = null;
+
+        return view('accessories/edit')
+            ->with('item', $accessory);
+        
+    }
+
+    /**
+     * Save edited Accessory from form post
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param ImageUploadRequest $request
+     * @param  int $accessoryId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function update(ImageUploadRequest $request, $accessoryId = null)
+    {
+        if ($accessory = Accessory::withCount('users as users_count')->find($accessoryId)) {
+
+            $this->authorize($accessory);
+
+            $validator = Validator::make($request->all(), [
+                "qty" => "required|numeric|min:$accessory->users_count"
+            ]);
+
+            if ($validator->fails()) {
+                return redirect()->back()
+                    ->withErrors($validator)
+                    ->withInput();
+            }
+
+
+
+            // Update the accessory data
+            $accessory->name = request('name');
+            $accessory->location_id = request('location_id');
+            $accessory->min_amt = request('min_amt');
+            $accessory->category_id = request('category_id');
+            $accessory->company_id = Company::getIdForCurrentUser(request('company_id'));
+            $accessory->manufacturer_id = request('manufacturer_id');
+            $accessory->order_number = request('order_number');
+            $accessory->model_number = request('model_number');
+            $accessory->purchase_date = request('purchase_date');
+            $accessory->purchase_cost = request('purchase_cost');
+            $accessory->qty = request('qty');
+            $accessory->supplier_id = request('supplier_id');
+            $accessory->notes = request('notes');
+
+            $accessory = $request->handleImages($accessory);
+
+            // Was the accessory updated?
+            if ($accessory->save()) {
+                return redirect()->route('accessories.index')->with('success', trans('admin/accessories/message.update.success'));
+            }
+        } else {
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.does_not_exist'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($accessory->getErrors());
+    }
+
+    /**
+     * Delete the given accessory.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $accessoryId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($accessoryId)
+    {
+        if (is_null($accessory = Accessory::find($accessoryId))) {
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.not_found'));
+        }
+
+        $this->authorize($accessory);
+
+
+        if ($accessory->hasUsers() > 0) {
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.assoc_users', ['count'=> $accessory->hasUsers()]));
+        }
+
+        if ($accessory->image) {
+            try {
+                Storage::disk('public')->delete('accessories'.'/'.$accessory->image);
+            } catch (\Exception $e) {
+                \Log::debug($e);
+            }
+        }
+
+        $accessory->delete();
+
+        return redirect()->route('accessories.index')->with('success', trans('admin/accessories/message.delete.success'));
+    }
+
+
+    /**
+     * Returns a view that invokes the ajax table which  contains
+     * the content for the accessory detail view, which is generated in getDataView.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $accessoryID
+     * @see AccessoriesController::getDataView() method that generates the JSON response
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($accessoryID = null)
+    {
+        $accessory = Accessory::withCount('users as users_count')->find($accessoryID);
+        $this->authorize('view', $accessory);
+        if (isset($accessory->id)) {
+            return view('accessories/view', compact('accessory'));
+        }
+
+        return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.does_not_exist', ['id' => $accessoryID]));
+    }
+}

SNIPE-IT/app/Http/Controllers/Accessories/AccessoriesFilesController.php

@@ -0,0 +1,158 @@
+<?php
+
+namespace App\Http\Controllers\Accessories;
+
+use App\Helpers\StorageHelper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\UploadFileRequest;
+use App\Models\Actionlog;
+use App\Models\Accessory;
+use Illuminate\Support\Facades\Response;
+use Illuminate\Support\Facades\Storage;
+use Symfony\Accessory\HttpFoundation\JsonResponse;
+
+class AccessoriesFilesController extends Controller
+{
+    /**
+     * Validates and stores files associated with a accessory.
+     *
+     * @param UploadFileRequest $request
+     * @param int $accessoryId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     *@author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @todo Switch to using the AssetFileRequest form request validator.
+     */
+    public function store(UploadFileRequest $request, $accessoryId = null)
+    {
+
+        if (config('app.lock_passwords')) {
+            return redirect()->route('accessories.show', ['accessory'=>$accessoryId])->with('error', trans('general.feature_disabled'));
+        }
+
+
+        $accessory = Accessory::find($accessoryId);
+
+        if (isset($accessory->id)) {
+            $this->authorize('accessories.files', $accessory);
+
+            if ($request->hasFile('file')) {
+                if (! Storage::exists('private_uploads/accessories')) {
+                    Storage::makeDirectory('private_uploads/accessories', 775);
+                }
+
+                foreach ($request->file('file') as $file) {
+
+                    $file_name = $request->handleFile('private_uploads/accessories/', 'accessory-'.$accessory->id, $file);
+                    //Log the upload to the log
+                    $accessory->logUpload($file_name, e($request->input('notes')));
+                }
+
+
+                return redirect()->route('accessories.show', $accessory->id)->with('success', trans('general.file_upload_success'));
+
+            }
+
+            return redirect()->route('accessories.show', $accessory->id)->with('error', trans('general.no_files_uploaded'));
+        }
+        // Prepare the error message
+        return redirect()->route('accessories.index')
+            ->with('error', trans('general.file_does_not_exist'));
+    }
+
+    /**
+     * Deletes the selected accessory file.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $accessoryId
+     * @param int $fileId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($accessoryId = null, $fileId = null)
+    {
+        $accessory = Accessory::find($accessoryId);
+
+        // the asset is valid
+        if (isset($accessory->id)) {
+            $this->authorize('update', $accessory);
+            $log = Actionlog::find($fileId);
+
+            // Remove the file if one exists
+            if (Storage::exists('accessories/'.$log->filename)) {
+                try {
+                    Storage::delete('accessories/'.$log->filename);
+                } catch (\Exception $e) {
+                    \Log::debug($e);
+                }
+            }
+
+            $log->delete();
+
+            return redirect()->back()
+                ->with('success', trans('admin/hardware/message.deletefile.success'));
+        }
+
+        // Redirect to the licence management page
+        return redirect()->route('accessories.index')->with('error', trans('general.file_does_not_exist'));
+    }
+
+    /**
+     * Allows the selected file to be viewed.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.4]
+     * @param int $accessoryId
+     * @param int $fileId
+     * @return \Symfony\Accessory\HttpFoundation\Response
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($accessoryId = null, $fileId = null, $download = true)
+    {
+
+        \Log::debug('Private filesystem is: '.config('filesystems.default'));
+        $accessory = Accessory::find($accessoryId);
+
+
+
+        // the accessory is valid
+        if (isset($accessory->id)) {
+            $this->authorize('view', $accessory);
+            $this->authorize('accessories.files', $accessory);
+
+            if (! $log = Actionlog::whereNotNull('filename')->where('item_id', $accessory->id)->find($fileId)) {
+                return redirect()->route('accessories.index')->with('error',  trans('admin/users/message.log_record_not_found'));
+            }
+
+            $file = 'private_uploads/accessories/'.$log->filename;
+
+            if (Storage::missing($file)) {
+                \Log::debug('FILE DOES NOT EXISTS for '.$file);
+                \Log::debug('URL should be '.Storage::url($file));
+
+                return response('File '.$file.' ('.Storage::url($file).') not found on server', 404)
+                    ->header('Content-Type', 'text/plain');
+            } else {
+
+                // Display the file inline
+                if (request('inline') == 'true') {
+                    $headers = [
+                        'Content-Disposition' => 'inline',
+                    ];
+                    return Storage::download($file, $log->filename, $headers);
+                }
+
+
+                // We have to override the URL stuff here, since local defaults in Laravel's Flysystem
+                // won't work, as they're not accessible via the web
+                if (config('filesystems.default') == 'local') { // TODO - is there any way to fix this at the StorageHelper layer?
+                    return StorageHelper::downloader($file);
+                }
+            }
+        }
+
+        return redirect()->route('accessories.index')->with('error', trans('general.file_does_not_exist', ['id' => $fileId]));
+    }
+}

SNIPE-IT/app/Http/Controllers/Accessories/AccessoryCheckinController.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Http\Controllers\Accessories;
+
+use App\Events\CheckoutableCheckedIn;
+use App\Http\Controllers\Controller;
+use App\Models\Accessory;
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+
+class AccessoryCheckinController extends Controller
+{
+    /**
+     * Check the accessory back into inventory
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param Request $request
+     * @param int $accessoryUserId
+     * @param string $backto
+     * @return View
+     * @internal param int $accessoryId
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create($accessoryUserId = null, $backto = null)
+    {
+        // Check if the accessory exists
+        if (is_null($accessory_user = DB::table('accessories_users')->find($accessoryUserId))) {
+            // Redirect to the accessory management page with error
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.not_found'));
+        }
+
+        $accessory = Accessory::find($accessory_user->accessory_id);
+        $this->authorize('checkin', $accessory);
+
+        return view('accessories/checkin', compact('accessory'))->with('backto', $backto);
+    }
+
+    /**
+     * Check in the item so that it can be checked out again to someone else
+     *
+     * @uses Accessory::checkin_email() to determine if an email can and should be sent
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param null $accessoryUserId
+     * @param string $backto
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @internal param int $accessoryId
+     */
+    public function store(Request $request, $accessoryUserId = null, $backto = null)
+    {
+        // Check if the accessory exists
+        if (is_null($accessory_user = DB::table('accessories_users')->find($accessoryUserId))) {
+            // Redirect to the accessory management page with error
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.does_not_exist'));
+        }
+
+        $accessory = Accessory::find($accessory_user->accessory_id);
+
+        $this->authorize('checkin', $accessory);
+
+        $checkin_hours = date('H:i:s');
+        $checkin_at = date('Y-m-d H:i:s');
+        if ($request->filled('checkin_at')) {
+            $checkin_at = $request->input('checkin_at').' '.$checkin_hours;
+        }
+
+        // Was the accessory updated?
+        if (DB::table('accessories_users')->where('id', '=', $accessory_user->id)->delete()) {
+            $return_to = e($accessory_user->assigned_to);
+
+            event(new CheckoutableCheckedIn($accessory, User::find($return_to), Auth::user(), $request->input('note'), $checkin_at));
+
+            return redirect()->route('accessories.show', $accessory->id)->with('success', trans('admin/accessories/message.checkin.success'));
+        }
+        // Redirect to the accessory management page with error
+        return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.checkin.error'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Accessories/AccessoryCheckoutController.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Http\Controllers\Accessories;
+
+use App\Events\CheckoutableCheckedOut;
+use App\Http\Controllers\Controller;
+use App\Models\Accessory;
+use App\Models\User;
+use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Input;
+
+class AccessoryCheckoutController extends Controller
+{
+    /**
+     * Return the form to checkout an Accessory to a user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $id
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create($id)
+    {
+
+        if ($accessory = Accessory::withCount('users as users_count')->find($id)) {
+
+            $this->authorize('checkout', $accessory);
+
+            if ($accessory->category) {
+                // Make sure there is at least one available to checkout
+                if ($accessory->numRemaining() <= 0){
+                    return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.checkout.unavailable'));
+                }
+
+                // Return the checkout view
+                return view('accessories/checkout', compact('accessory'));
+            }
+
+            // Invalid category
+            return redirect()->route('accessories.edit', ['accessory' => $accessory->id])
+                ->with('error', trans('general.invalid_item_category_single', ['type' => trans('general.accessory')]));
+
+        }
+
+        // Not found
+        return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.not_found'));
+
+    }
+
+    /**
+     * Save the Accessory checkout information.
+     *
+     * If Slack is enabled and/or asset acceptance is enabled, it will also
+     * trigger a Slack message and send an email.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param Request $request
+     * @param  int $accessoryId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(Request $request, $accessoryId)
+    {
+        // Check if the accessory exists
+        if (is_null($accessory = Accessory::withCount('users as users_count')->find($accessoryId))) {
+            // Redirect to the accessory management page with error
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.user_not_found'));
+        }
+
+        $this->authorize('checkout', $accessory);
+
+        if (!$user = User::find($request->input('assigned_to'))) {
+            return redirect()->route('accessories.checkout.show', $accessory->id)->with('error', trans('admin/accessories/message.checkout.user_does_not_exist'));
+        }
+
+        // Make sure there is at least one available to checkout
+        if ($accessory->numRemaining() <= 0){
+            return redirect()->route('accessories.index')->with('error', trans('admin/accessories/message.checkout.unavailable'));
+        }
+
+
+        // Update the accessory data
+        $accessory->assigned_to = e($request->input('assigned_to'));
+
+        $accessory->users()->attach($accessory->id, [
+            'accessory_id' => $accessory->id,
+            'created_at' => Carbon::now(),
+            'user_id' => Auth::id(),
+            'assigned_to' => $request->get('assigned_to'),
+            'note' => $request->input('note'),
+        ]);
+
+        DB::table('accessories_users')->where('assigned_to', '=', $accessory->assigned_to)->where('accessory_id', '=', $accessory->id)->first();
+
+        event(new CheckoutableCheckedOut($accessory, $user, Auth::user(), $request->input('note')));
+
+        // Redirect to the new accessory page
+        return redirect()->route('accessories.index')->with('success', trans('admin/accessories/message.checkout.success'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Account/AcceptanceController.php

@@ -0,0 +1,336 @@
+<?php
+
+namespace App\Http\Controllers\Account;
+
+use App\Events\CheckoutAccepted;
+use App\Events\CheckoutDeclined;
+use App\Events\ItemAccepted;
+use App\Events\ItemDeclined;
+use App\Http\Controllers\Controller;
+use App\Models\Actionlog;
+use App\Models\Asset;
+use App\Models\CheckoutAcceptance;
+use App\Models\Company;
+use App\Models\Contracts\Acceptable;
+use App\Models\Setting;
+use App\Models\User;
+use App\Models\AssetModel;
+use App\Models\Accessory;
+use App\Models\License;
+use App\Models\Component;
+use App\Models\Consumable;
+use App\Notifications\AcceptanceAssetAcceptedNotification;
+use App\Notifications\AcceptanceAssetDeclinedNotification;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use App\Http\Controllers\SettingsController;
+use Barryvdh\DomPDF\Facade\Pdf;
+use Carbon\Carbon;
+use phpDocumentor\Reflection\Types\Compound;
+
+class AcceptanceController extends Controller
+{
+    /**
+     * Show a listing of pending checkout acceptances for the current user
+     *
+     * @return View
+     */
+    public function index()
+    {
+        $acceptances = CheckoutAcceptance::forUser(Auth::user())->pending()->get();
+
+        return view('account/accept.index', compact('acceptances'));
+    }
+
+    /**
+     * Shows a form to either accept or decline the checkout acceptance
+     *
+     * @param  int  $id
+     * @return mixed
+     */
+    public function create($id)
+    {
+        $acceptance = CheckoutAcceptance::find($id);
+
+
+        if (is_null($acceptance)) {
+            return redirect()->route('account.accept')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        if (! $acceptance->isPending()) {
+            return redirect()->route('account.accept')->with('error', trans('admin/users/message.error.asset_already_accepted'));
+        }
+
+        if (! $acceptance->isCheckedOutTo(Auth::user())) {
+            return redirect()->route('account.accept')->with('error', trans('admin/users/message.error.incorrect_user_accepted'));
+        }
+
+        if (! Company::isCurrentUserHasAccess($acceptance->checkoutable)) {
+            return redirect()->route('account.accept')->with('error', trans('general.error_user_company'));
+        }
+
+        return view('account/accept.create', compact('acceptance'));
+    }
+
+    /**
+     * Stores the accept/decline of the checkout acceptance
+     *
+     * @param  Request $request
+     * @param  int  $id
+     * @return Redirect
+     */
+    public function store(Request $request, $id)
+    {
+        $acceptance = CheckoutAcceptance::find($id);
+
+        if (is_null($acceptance)) {
+            return redirect()->route('account.accept')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        if (! $acceptance->isPending()) {
+            return redirect()->route('account.accept')->with('error', trans('admin/users/message.error.asset_already_accepted'));
+        }
+
+        if (! $acceptance->isCheckedOutTo(Auth::user())) {
+            return redirect()->route('account.accept')->with('error', trans('admin/users/message.error.incorrect_user_accepted'));
+        }
+
+        if (! Company::isCurrentUserHasAccess($acceptance->checkoutable)) {
+            return redirect()->route('account.accept')->with('error', trans('general.insufficient_permissions'));
+        }
+
+        if (! $request->filled('asset_acceptance')) {
+            return redirect()->back()->with('error', trans('admin/users/message.error.accept_or_decline'));
+        }
+
+        /**
+         * Get the signature and save it
+         */
+        if (! Storage::exists('private_uploads/signatures')) {
+            Storage::makeDirectory('private_uploads/signatures', 775);
+        }
+
+
+
+        $item = $acceptance->checkoutable_type::find($acceptance->checkoutable_id);
+        $display_model = '';
+        $pdf_view_route = '';
+        $pdf_filename = 'accepted-eula-'.date('Y-m-d-h-i-s').'.pdf';
+        $sig_filename='';
+
+        if ($request->input('asset_acceptance') == 'accepted') {
+
+            /**
+             * Check for the eula-pdfs directory
+             */
+            if (! Storage::exists('private_uploads/eula-pdfs')) {
+                Storage::makeDirectory('private_uploads/eula-pdfs', 775);
+            }
+
+            if (Setting::getSettings()->require_accept_signature == '1') {
+                
+                // Check if the signature directory exists, if not create it
+                if (!Storage::exists('private_uploads/signatures')) {
+                    Storage::makeDirectory('private_uploads/signatures', 775);
+                }
+
+                // The item was accepted, check for a signature
+                if ($request->filled('signature_output')) {
+                    $sig_filename = 'siglog-' . Str::uuid() . '-' . date('Y-m-d-his') . '.png';
+                    $data_uri = $request->input('signature_output');
+                    $encoded_image = explode(',', $data_uri);
+                    $decoded_image = base64_decode($encoded_image[1]);
+                    Storage::put('private_uploads/signatures/' . $sig_filename, (string)$decoded_image);
+
+                    // No image data is present, kick them back.
+                    // This mostly only applies to users on super-duper crapola browsers *cough* IE *cough*
+                } else {
+                    return redirect()->back()->with('error', trans('general.shitty_browser'));
+                }
+            }
+
+            // this is horrible
+            switch($acceptance->checkoutable_type){
+                case 'App\Models\Asset':
+                        $pdf_view_route ='account.accept.accept-asset-eula';
+                        $asset_model = AssetModel::find($item->model_id);
+                        if (!$asset_model) {
+                            return redirect()->back()->with('error', trans('admin/models/message.does_not_exist'));
+                        }
+                        $display_model = $asset_model->name;
+                        $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                break;
+
+                case 'App\Models\Accessory':
+                        $pdf_view_route ='account.accept.accept-accessory-eula';
+                        $accessory = Accessory::find($item->id);
+                        $display_model = $accessory->name;
+                        $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                break;
+
+                case 'App\Models\LicenseSeat':
+                        $pdf_view_route ='account.accept.accept-license-eula';
+                        $license = License::find($item->license_id);
+                        $display_model = $license->name;
+                        $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                break;
+
+                case 'App\Models\Component':
+                        $pdf_view_route ='account.accept.accept-component-eula';
+                        $component = Component::find($item->id);
+                        $display_model = $component->name;
+                        $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                break;
+
+                case 'App\Models\Consumable':
+                        $pdf_view_route ='account.accept.accept-consumable-eula';
+                        $consumable = Consumable::find($item->id);
+                        $display_model = $consumable->name;
+                        $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                break;
+            }
+//            if ($acceptance->checkoutable_type == 'App\Models\Asset') {
+//                $pdf_view_route ='account.accept.accept-asset-eula';
+//                $asset_model = AssetModel::find($item->model_id);
+//                $display_model = $asset_model->name;
+//                $assigned_to = User::find($item->assigned_to)->present()->fullName;
+//
+//            } elseif ($acceptance->checkoutable_type== 'App\Models\Accessory') {
+//                $pdf_view_route ='account.accept.accept-accessory-eula';
+//                $accessory = Accessory::find($item->id);
+//                $display_model = $accessory->name;
+//                $assigned_to = User::find($item->assignedTo);
+//
+//            }
+
+            /**
+             * Gather the data for the PDF. We fire this whether there is a signature required or not,
+             * since we want the moment-in-time proof of what the EULA was when they accepted it.
+             */
+            $branding_settings = SettingsController::getPDFBranding();
+
+            if (is_null($branding_settings->logo)){
+                $path_logo = "";
+            } else {
+                $path_logo = public_path() . '/uploads/' . $branding_settings->logo;
+            }
+            
+            $data = [
+                'item_tag' => $item->asset_tag,
+                'item_model' => $display_model,
+                'item_serial' => $item->serial,
+                'eula' => $item->getEula(),
+                'check_out_date' => Carbon::parse($acceptance->created_at)->format('Y-m-d'),
+                'accepted_date' => Carbon::parse($acceptance->accepted_at)->format('Y-m-d'),
+                'assigned_to' => $assigned_to,
+                'company_name' => $branding_settings->site_name,
+                'signature' => ($sig_filename) ? storage_path() . '/private_uploads/signatures/' . $sig_filename : null,
+                'logo' => $path_logo,
+                'date_settings' => $branding_settings->date_display_format,
+            ];
+
+            if ($pdf_view_route!='') {
+                \Log::debug($pdf_filename.' is the filename, and the route was specified.');
+                $pdf = Pdf::loadView($pdf_view_route, $data);
+                Storage::put('private_uploads/eula-pdfs/' .$pdf_filename, $pdf->output());
+            }
+
+            $acceptance->accept($sig_filename, $item->getEula(), $pdf_filename);
+            $acceptance->notify(new AcceptanceAssetAcceptedNotification($data));
+            event(new CheckoutAccepted($acceptance));
+
+            $return_msg = trans('admin/users/message.accepted');
+
+        } else {
+
+            /**
+             * Check for the eula-pdfs directory
+             */
+            if (! Storage::exists('private_uploads/eula-pdfs')) {
+                Storage::makeDirectory('private_uploads/eula-pdfs', 775);
+            }
+
+            if (Setting::getSettings()->require_accept_signature == '1') {
+                
+                // Check if the signature directory exists, if not create it
+                if (!Storage::exists('private_uploads/signatures')) {
+                    Storage::makeDirectory('private_uploads/signatures', 775);
+                }
+
+                // The item was accepted, check for a signature
+                if ($request->filled('signature_output')) {
+                    $sig_filename = 'siglog-' . Str::uuid() . '-' . date('Y-m-d-his') . '.png';
+                    $data_uri = $request->input('signature_output');
+                    $encoded_image = explode(',', $data_uri);
+                    $decoded_image = base64_decode($encoded_image[1]);
+                    Storage::put('private_uploads/signatures/' . $sig_filename, (string)$decoded_image);
+
+                    // No image data is present, kick them back.
+                    // This mostly only applies to users on super-duper crapola browsers *cough* IE *cough*
+                } else {
+                    return redirect()->back()->with('error', trans('general.shitty_browser'));
+                }
+            }
+            
+            // Format the data to send the declined notification
+            $branding_settings = SettingsController::getPDFBranding();
+
+            // This is the most horriblest
+            switch($acceptance->checkoutable_type){
+                case 'App\Models\Asset':
+                    $asset_model = AssetModel::find($item->model_id);
+                    $display_model = $asset_model->name;
+                    $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                    break;
+
+                case 'App\Models\Accessory':
+                    $accessory = Accessory::find($item->id);
+                    $display_model = $accessory->name;
+                    $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                    break;
+
+                case 'App\Models\LicenseSeat':
+                    $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                    break;
+
+                case 'App\Models\Component':
+                    $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                    break;
+
+                case 'App\Models\Consumable':
+                    $consumable = Consumable::find($item->id);
+                    $display_model = $consumable->name;
+                    $assigned_to = User::find($acceptance->assigned_to_id)->present()->fullName;
+                    break;
+            }
+            $data = [
+                'item_tag' => $item->asset_tag,
+                'item_model' => $display_model,
+                'item_serial' => $item->serial,
+                'declined_date' => Carbon::parse($acceptance->declined_at)->format('Y-m-d'),
+                'signature' => ($sig_filename) ? storage_path() . '/private_uploads/signatures/' . $sig_filename : null,
+                'assigned_to' => $assigned_to,
+                'company_name' => $branding_settings->site_name,
+                'date_settings' => $branding_settings->date_display_format,
+            ];
+
+            if ($pdf_view_route!='') {
+                \Log::debug($pdf_filename.' is the filename, and the route was specified.');
+                $pdf = Pdf::loadView($pdf_view_route, $data);
+                Storage::put('private_uploads/eula-pdfs/' .$pdf_filename, $pdf->output());
+            }
+
+            $acceptance->decline($sig_filename);
+            $acceptance->notify(new AcceptanceAssetDeclinedNotification($data));
+            event(new CheckoutDeclined($acceptance));
+            $return_msg = trans('admin/users/message.declined');
+        }
+
+
+        return redirect()->to('account/accept')->with('success', $return_msg);
+
+    }
+}

SNIPE-IT/app/Http/Controllers/ActionlogController.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Helpers\Helper;
+use App\Models\Actionlog;
+use Response;
+
+class ActionlogController extends Controller
+{
+    public function displaySig($filename)
+    {
+        // PHP doesn't let you handle file not found errors well with 
+        // file_get_contents, so we set the error reporting for just this class
+        error_reporting(0);
+
+        $this->authorize('view', \App\Models\Asset::class);
+        $file = config('app.private_uploads').'/signatures/'.$filename;
+        $filetype = Helper::checkUploadIsImage($file);
+
+        $contents = file_get_contents($file, false, stream_context_create(['http' => ['ignore_errors' => true]]));
+        if ($contents === false) {
+            \Log::warn('File '.$file.' not found');
+            return false;
+        } else {
+            return Response::make($contents)->header('Content-Type', $filetype);
+        }
+       
+    }
+    public function getStoredEula($filename){
+        $this->authorize('view', \App\Models\Asset::class);
+        $file = config('app.private_uploads').'/eula-pdfs/'.$filename;
+
+        return Response::download($file);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/AccessoriesController.php

@@ -0,0 +1,382 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Events\CheckoutableCheckedOut;
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\AccessoriesTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Accessory;
+use App\Models\Company;
+use App\Models\User;
+use Auth;
+use Carbon\Carbon;
+use DB;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+
+class AccessoriesController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        if ($request->user()->cannot('reports.view')) {
+            $this->authorize('view', Accessory::class);
+        }
+
+
+        // This array is what determines which fields should be allowed to be sorted on ON the table itself, no relations
+        // Relations will be handled in query scopes a little further down.
+        $allowed_columns = 
+            [
+                'id',
+                'name',
+                'model_number',
+                'eol',
+                'notes',
+                'created_at',
+                'min_amt',
+                'company_id',
+                'notes',
+                'users_count',
+                'qty',
+            ];
+
+
+        $accessories = Accessory::select('accessories.*')->with('category', 'company', 'manufacturer', 'users', 'location', 'supplier')
+                                ->withCount('users as users_count');
+
+        if ($request->filled('search')) {
+            $accessories = $accessories->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('company_id')) {
+            $accessories->where('company_id', '=', $request->input('company_id'));
+        }
+
+        if ($request->filled('category_id')) {
+            $accessories->where('category_id', '=', $request->input('category_id'));
+        }
+
+        if ($request->filled('manufacturer_id')) {
+            $accessories->where('manufacturer_id', '=', $request->input('manufacturer_id'));
+        }
+
+        if ($request->filled('supplier_id')) {
+            $accessories->where('supplier_id', '=', $request->input('supplier_id'));
+        }
+
+        if ($request->filled('location_id')) {
+            $accessories->where('location_id','=',$request->input('location_id'));
+        }
+
+        if ($request->filled('notes')) {
+            $accessories->where('notes','=',$request->input('notes'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $accessories->count()) ? $accessories->count() : abs($request->input('offset'));
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort_override =  $request->input('sort');
+        $column_sort = in_array($sort_override, $allowed_columns) ? $sort_override : 'created_at';
+
+        switch ($sort_override) {
+            case 'category':
+                $accessories = $accessories->OrderCategory($order);
+                break;
+            case 'company':
+                $accessories = $accessories->OrderCompany($order);
+                break;
+            case 'location':
+                $accessories = $accessories->OrderLocation($order);
+                break;
+            case 'manufacturer':
+                $accessories = $accessories->OrderManufacturer($order);
+                break;    
+            case 'supplier':
+                $accessories = $accessories->OrderSupplier($order);
+                break;       
+            default:
+                $accessories = $accessories->orderBy($column_sort, $order);
+                break;
+        }
+ 
+        $total = $accessories->count();
+        $accessories = $accessories->skip($offset)->take($limit)->get();
+
+        return (new AccessoriesTransformer)->transformAccessories($accessories, $total);
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Accessory::class);
+        $accessory = new Accessory;
+        $accessory->fill($request->all());
+        $accessory = $request->handleImages($accessory);
+
+        if ($accessory->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $accessory, trans('admin/accessories/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $accessory->getErrors()));
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Accessory::class);
+        $accessory = Accessory::withCount('users as users_count')->findOrFail($id);
+
+        return (new AccessoriesTransformer)->transformAccessory($accessory);
+    }
+
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function accessory_detail($id)
+    {
+        $this->authorize('view', Accessory::class);
+        $accessory = Accessory::findOrFail($id);
+
+        return (new AccessoriesTransformer)->transformAccessory($accessory);
+    }
+
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function checkedout($id, Request $request)
+    {
+        $this->authorize('view', Accessory::class);
+
+        $accessory = Accessory::with('lastCheckout')->findOrFail($id);
+        if (! Company::isCurrentUserHasAccess($accessory)) {
+            return ['total' => 0, 'rows' => []];
+        }
+
+        $offset = request('offset', 0);
+        $limit = request('limit', 50);
+
+        $accessory_users = $accessory->users;
+        $total = $accessory_users->count();
+
+        if ($total < $offset) {
+            $offset = 0;
+        }
+
+        $accessory_users = $accessory->users()->skip($offset)->take($limit)->get();
+
+        if ($request->filled('search')) {
+            $accessory_users = $accessory->users()
+                                         ->where(function ($query) use ($request) {
+                                             $search_str = '%' . $request->input('search') . '%';
+                                             $query->where('first_name', 'like', $search_str)
+                                                   ->orWhere('last_name', 'like', $search_str)
+                                                   ->orWhere('note', 'like', $search_str);
+                                         })
+                                         ->get();
+            $total = $accessory_users->count();
+        }
+
+        return (new AccessoriesTransformer)->transformCheckedoutAccessory($accessory, $accessory_users, $total);
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Accessory::class);
+        $accessory = Accessory::findOrFail($id);
+        $accessory->fill($request->all());
+        $accessory = $request->handleImages($accessory);
+
+        if ($accessory->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $accessory, trans('admin/accessories/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $accessory->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Accessory::class);
+        $accessory = Accessory::findOrFail($id);
+        $this->authorize($accessory);
+
+        if ($accessory->hasUsers() > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/accessories/message.assoc_users', ['count'=> $accessory->hasUsers()])));
+        }
+
+        $accessory->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/accessories/message.delete.success')));
+    }
+
+
+    /**
+     * Save the Accessory checkout information.
+     *
+     * If Slack is enabled and/or asset acceptance is enabled, it will also
+     * trigger a Slack message and send an email.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int  $accessoryId
+     * @return Redirect
+     */
+    public function checkout(Request $request, $accessoryId)
+    {
+        // Check if the accessory exists
+        if (is_null($accessory = Accessory::withCount('users as users_count')->find($accessoryId))) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/accessories/message.does_not_exist')));
+        }
+
+        $this->authorize('checkout', $accessory);
+
+
+        if ($accessory->numRemaining() > 0) {
+
+            if (! $user = User::find($request->input('assigned_to'))) {
+                return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/accessories/message.checkout.user_does_not_exist')));
+            }
+
+            // Update the accessory data
+            $accessory->assigned_to = $request->input('assigned_to');
+
+            $accessory->users()->attach($accessory->id, [
+                'accessory_id' => $accessory->id,
+                'created_at' => Carbon::now(),
+                'user_id' => Auth::id(),
+                'assigned_to' => $request->get('assigned_to'),
+                'note' => $request->get('note'),
+            ]);
+
+            event(new CheckoutableCheckedOut($accessory, $user, Auth::user(), $request->input('note')));
+
+            return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/accessories/message.checkout.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, 'No accessories remaining'));
+
+    }
+
+    /**
+     * Check in the item so that it can be checked out again to someone else
+     *
+     * @uses Accessory::checkin_email() to determine if an email can and should be sent
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param Request $request
+     * @param int $accessoryUserId
+     * @param string $backto
+     * @return Redirect
+     * @internal param int $accessoryId
+     */
+    public function checkin(Request $request, $accessoryUserId = null)
+    {
+        if (is_null($accessory_user = DB::table('accessories_users')->find($accessoryUserId))) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/accessories/message.does_not_exist')));
+        }
+
+        $accessory = Accessory::find($accessory_user->accessory_id);
+        $this->authorize('checkin', $accessory);
+
+        $logaction = $accessory->logCheckin(User::find($accessory_user->assigned_to), $request->input('note'));
+
+        // Was the accessory updated?
+        if (DB::table('accessories_users')->where('id', '=', $accessory_user->id)->delete()) {
+            if (! is_null($accessory_user->assigned_to)) {
+                $user = User::find($accessory_user->assigned_to);
+            }
+
+            $data['log_id'] = $logaction->id;
+            $data['first_name'] = $user->first_name;
+            $data['last_name'] = $user->last_name;
+            $data['item_name'] = $accessory->name;
+            $data['checkin_date'] = $logaction->created_at;
+            $data['item_tag'] = '';
+            $data['note'] = $logaction->note;
+
+            return response()->json(Helper::formatStandardApiResponse('success', null,  trans('admin/accessories/message.checkin.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/accessories/message.checkin.error')));
+
+    }
+
+
+    /**
+    * Gets a paginated collection for the select2 menus
+    *
+    * @see \App\Http\Transformers\SelectlistTransformer
+    *
+    */
+    public function selectlist(Request $request)
+    {
+
+        $accessories = Accessory::select([
+            'accessories.id',
+            'accessories.name',
+        ]);
+
+        if ($request->filled('search')) {
+            $accessories = $accessories->where('accessories.name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $accessories = $accessories->orderBy('name', 'ASC')->paginate(50);
+
+        return (new SelectlistTransformer)->transformSelectlist($accessories);
+    }
+
+}

SNIPE-IT/app/Http/Controllers/Api/AssetMaintenancesController.php

@@ -0,0 +1,228 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\AssetMaintenancesTransformer;
+use App\Models\Asset;
+use App\Models\AssetMaintenance;
+use App\Models\Company;
+use Auth;
+use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Input;
+
+/**
+ * This controller handles all actions related to Asset Maintenance for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v2.0
+ */
+class AssetMaintenancesController extends Controller
+{
+
+
+    /**
+     *  Generates the JSON response for asset maintenances listing view.
+     *
+     * @see AssetMaintenancesController::getIndex() method that generates view
+     * @author  Vincent Sposato <vincent.sposato@gmail.com>
+     * @version v1.0
+     * @since [v1.8]
+     * @return string JSON
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Asset::class);
+
+        $maintenances = AssetMaintenance::select('asset_maintenances.*')
+            ->with('asset', 'asset.model', 'asset.location', 'asset.defaultLoc', 'supplier', 'asset.company',  'asset.assetstatus', 'admin');
+
+        if ($request->filled('search')) {
+            $maintenances = $maintenances->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('asset_id')) {
+            $maintenances->where('asset_id', '=', $request->input('asset_id'));
+        }
+
+        if ($request->filled('supplier_id')) {
+            $maintenances->where('asset_maintenances.supplier_id', '=', $request->input('supplier_id'));
+        }
+
+        if ($request->filled('asset_maintenance_type')) {
+            $maintenances->where('asset_maintenance_type', '=', $request->input('asset_maintenance_type'));
+        }
+
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $maintenances->count()) ? $maintenances->count() : abs($request->input('offset'));
+        $limit = app('api_limit_value');
+
+        $allowed_columns = [
+                                'id',
+                                'title',
+                                'asset_maintenance_time',
+                                'asset_maintenance_type',
+                                'cost',
+                                'start_date',
+                                'completion_date',
+                                'notes',
+                                'asset_tag',
+                                'asset_name',
+                                'serial',
+                                'user_id',
+                                'supplier',
+                                'is_warranty',
+                                'status_label',
+                            ];
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? e($request->input('sort')) : 'created_at';
+
+        switch ($sort) {
+            case 'user_id':
+                $maintenances = $maintenances->OrderAdmin($order);
+                break;
+            case 'supplier':
+                $maintenances = $maintenances->OrderBySupplier($order);
+                break;
+            case 'asset_tag':
+                $maintenances = $maintenances->OrderByTag($order);
+                break;
+            case 'asset_name':
+                $maintenances = $maintenances->OrderByAssetName($order);
+                break;
+            case 'serial':
+                $maintenances = $maintenances->OrderByAssetSerial($order);
+                break;
+            case 'status_label':
+                $maintenances = $maintenances->OrderStatusName($order);
+                break;
+            default:
+                $maintenances = $maintenances->orderBy($sort, $order);
+                break;
+        }
+
+        $total = $maintenances->count();
+        $maintenances = $maintenances->skip($offset)->take($limit)->get();
+        return (new AssetMaintenancesTransformer())->transformAssetMaintenances($maintenances, $total);
+
+
+    }
+
+
+    /**
+     *  Validates and stores the new asset maintenance
+     *
+     * @see AssetMaintenancesController::getCreate() method for the form
+     * @author  Vincent Sposato <vincent.sposato@gmail.com>
+     * @version v1.0
+     * @since [v1.8]
+     * @return string JSON
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('update', Asset::class);
+        // create a new model instance
+        $maintenance = new AssetMaintenance();
+        $maintenance->fill($request->all());
+        $maintenance->user_id = Auth::id();
+
+        // Was the asset maintenance created?
+        if ($maintenance->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $maintenance, trans('admin/asset_maintenances/message.create.success')));
+
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $maintenance->getErrors()));
+
+    }
+
+    /**
+     *  Validates and stores an update to an asset maintenance
+     *
+     * @author  A. Gianotto <snipe@snipe.net>
+     * @param int $id
+     * @param int $request
+     * @version v1.0
+     * @since [v4.0]
+     * @return string JSON
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('update', Asset::class);
+
+        if ($maintenance = AssetMaintenance::with('asset')->find($id)) {
+
+            // Can this user manage this asset?
+            if (! Company::isCurrentUserHasAccess($maintenance->asset)) {
+                return response()->json(Helper::formatStandardApiResponse('error', null, trans('general.action_permission_denied', ['item_type' => trans('admin/asset_maintenances/general.maintenance'), 'id' => $id, 'action' => trans('general.edit')])));
+            }
+
+            // The asset this miantenance is attached to is not valid or has been deleted
+            if (!$maintenance->asset) {
+                return response()->json(Helper::formatStandardApiResponse('error', null, trans('general.item_not_found', ['item_type' => trans('general.asset'), 'id' => $id])));
+            }
+
+            $maintenance->fill($request->all());
+
+            if ($maintenance->save()) {
+                return response()->json(Helper::formatStandardApiResponse('success', $maintenance, trans('admin/asset_maintenances/message.edit.success')));
+            }
+
+            return response()->json(Helper::formatStandardApiResponse('error', null, $maintenance->getErrors()));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('general.item_not_found', ['item_type' => trans('admin/asset_maintenances/general.maintenance'), 'id' => $id])));
+
+    }
+
+    /**
+     *  Delete an asset maintenance
+     *
+     * @author  A. Gianotto <snipe@snipe.net>
+     * @param int $assetMaintenanceId
+     * @version v1.0
+     * @since [v4.0]
+     * @return string JSON
+     */
+    public function destroy($assetMaintenanceId)
+    {
+        $this->authorize('update', Asset::class);
+        // Check if the asset maintenance exists
+        $assetMaintenance = AssetMaintenance::findOrFail($assetMaintenanceId);
+
+        if (! Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'You cannot delete a maintenance for that asset'));
+        }
+
+        $assetMaintenance->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', $assetMaintenance, trans('admin/asset_maintenances/message.delete.success')));
+
+
+    }
+
+    /**
+     *  View an asset maintenance
+     *
+     * @author  A. Gianotto <snipe@snipe.net>
+     * @param int $assetMaintenanceId
+     * @version v1.0
+     * @since [v4.0]
+     * @return string JSON
+     */
+    public function show($assetMaintenanceId)
+    {
+        $this->authorize('view', Asset::class);
+        $assetMaintenance = AssetMaintenance::findOrFail($assetMaintenanceId);
+        if (! Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'You cannot view a maintenance for that asset'));
+        }
+
+        return (new AssetMaintenancesTransformer())->transformAssetMaintenance($assetMaintenance);
+
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/AssetModelsController.php

@@ -0,0 +1,286 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\AssetModelsTransformer;
+use App\Http\Transformers\AssetsTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Asset;
+use App\Models\AssetModel;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * This class controls all actions related to asset models for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v4.0
+ * @author [A. Gianotto] [<snipe@snipe.net>]
+ */
+class AssetModelsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', AssetModel::class);
+        $allowed_columns =
+            [
+                'id',
+                'image',
+                'name',
+                'model_number',
+                'min_amt',
+                'eol',
+                'notes',
+                'created_at',
+                'manufacturer',
+                'requestable',
+                'assets_count',
+                'category',
+                'fieldset',
+            ];
+
+        $assetmodels = AssetModel::select([
+            'models.id',
+            'models.image',
+            'models.name',
+            'model_number',
+            'min_amt',
+            'eol',
+            'requestable',
+            'models.notes',
+            'models.created_at',
+            'category_id',
+            'manufacturer_id',
+            'depreciation_id',
+            'fieldset_id',
+            'models.deleted_at',
+            'models.updated_at',
+         ])
+            ->with('category', 'depreciation', 'manufacturer', 'fieldset.fields.defaultValues')
+            ->withCount('assets as assets_count');
+
+        if ($request->input('status')=='deleted') {
+            $assetmodels->onlyTrashed();
+        }
+
+        if ($request->filled('category_id')) {
+            $assetmodels = $assetmodels->where('models.category_id', '=', $request->input('category_id'));
+        }
+
+        if ($request->filled('search')) {
+            $assetmodels->TextSearch($request->input('search'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $assetmodels->count()) ? $assetmodels->count() : abs($request->input('offset'));
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'models.created_at';
+
+        switch ($sort) {
+            case 'manufacturer':
+                $assetmodels->OrderManufacturer($order);
+                break;
+            case 'category':
+                $assetmodels->OrderCategory($order);
+                break;
+            case 'fieldset':
+                $assetmodels->OrderFieldset($order);
+                break;
+            default:
+                $assetmodels->orderBy($sort, $order);
+                break;
+        }
+
+        $total = $assetmodels->count();
+        $assetmodels = $assetmodels->skip($offset)->take($limit)->get();
+
+        return (new AssetModelsTransformer)->transformAssetModels($assetmodels, $total);
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', AssetModel::class);
+        $assetmodel = new AssetModel;
+        $assetmodel->fill($request->all());
+        $assetmodel = $request->handleImages($assetmodel);
+
+        if ($assetmodel->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $assetmodel, trans('admin/models/message.create.success')));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, $assetmodel->getErrors()));
+
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', AssetModel::class);
+        $assetmodel = AssetModel::withCount('assets as assets_count')->findOrFail($id);
+
+        return (new AssetModelsTransformer)->transformAssetModel($assetmodel);
+    }
+
+    /**
+     * Display the specified resource's assets
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function assets($id)
+    {
+        $this->authorize('view', AssetModel::class);
+        $assets = Asset::where('model_id', '=', $id)->get();
+
+        return (new AssetsTransformer)->transformAssets($assets, $assets->count());
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', AssetModel::class);
+        $assetmodel = AssetModel::findOrFail($id);
+        $assetmodel->fill($request->all());
+        $assetmodel = $request->handleImages($assetmodel);
+        
+        /**
+         * Allow custom_fieldset_id to override and populate fieldset_id.
+         * This is stupid, but required for legacy API support.
+         *
+         * I have no idea why we manually overrode that field name
+         * in previous versions. I assume there was a good reason for
+         * it, but I'll be damned if I can think of one. - snipe
+         */
+        if ($request->filled('custom_fieldset_id')) {
+            $assetmodel->fieldset_id = $request->get('custom_fieldset_id');
+        }
+
+
+        if ($assetmodel->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $assetmodel, trans('admin/models/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $assetmodel->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', AssetModel::class);
+        $assetmodel = AssetModel::findOrFail($id);
+        $this->authorize('delete', $assetmodel);
+
+        if ($assetmodel->assets()->count() > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/models/message.assoc_users')));
+        }
+
+        if ($assetmodel->image) {
+            try {
+                Storage::disk('public')->delete('assetmodels/'.$assetmodel->image);
+            } catch (\Exception $e) {
+                \Log::info($e);
+            }
+        }
+
+        $assetmodel->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/models/message.delete.success')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+
+        $this->authorize('view.selectlists');
+        $assetmodels = AssetModel::select([
+            'models.id',
+            'models.name',
+            'models.image',
+            'models.model_number',
+            'models.manufacturer_id',
+            'models.category_id',
+        ])->with('manufacturer', 'category');
+
+        $settings = \App\Models\Setting::getSettings();
+
+        if ($request->filled('search')) {
+            $assetmodels = $assetmodels->SearchByManufacturerOrCat($request->input('search'));
+        }
+
+        $assetmodels = $assetmodels->OrderCategory('ASC')->OrderManufacturer('ASC')->orderby('models.name', 'asc')->orderby('models.model_number', 'asc')->paginate(50);
+
+        foreach ($assetmodels as $assetmodel) {
+            $assetmodel->use_text = '';
+
+            if ($settings->modellistCheckedValue('category')) {
+                $assetmodel->use_text .= (($assetmodel->category) ? $assetmodel->category->name.' - ' : '');
+            }
+
+            if ($settings->modellistCheckedValue('manufacturer')) {
+                $assetmodel->use_text .= (($assetmodel->manufacturer) ? $assetmodel->manufacturer->name.' ' : '');
+            }
+
+            $assetmodel->use_text .= $assetmodel->name;
+
+            if (($settings->modellistCheckedValue('model_number')) && ($assetmodel->model_number != '')) {
+                $assetmodel->use_text .= ' (#'.$assetmodel->model_number.')';
+            }
+
+            $assetmodel->use_image = ($settings->modellistCheckedValue('image') && ($assetmodel->image)) ? Storage::disk('public')->url('models/'.e($assetmodel->image)) : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($assetmodels);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/CategoriesController.php

@@ -0,0 +1,235 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\CategoriesTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Category;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
+
+class CategoriesController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Category::class);
+        $allowed_columns = [
+            'id',
+            'name',
+            'category_type',
+            'category_type',
+            'use_default_eula',
+            'eula_text',
+            'require_acceptance',
+            'checkin_email',
+            'assets_count',
+            'accessories_count',
+            'consumables_count',
+            'components_count',
+            'licenses_count',
+            'image',
+        ];
+
+        $categories = Category::select([
+            'id',
+            'created_at',
+            'updated_at',
+            'name', 'category_type',
+            'use_default_eula',
+            'eula_text',
+            'require_acceptance',
+            'checkin_email',
+            'image'
+            ])->withCount('accessories as accessories_count', 'consumables as consumables_count', 'components as components_count', 'licenses as licenses_count');
+
+
+        /*
+         * This checks to see if we should override the Admin Setting to show archived assets in list.
+         * We don't currently use it within the Snipe-IT GUI, but will be useful for API integrations where they
+         * may actually need to fetch assets that are archived.
+         *
+         * @see \App\Models\Category::showableAssets()
+         */
+        if ($request->input('archived')=='true') {
+            $categories = $categories->withCount('assets as assets_count');
+        } else {
+            $categories = $categories->withCount('showableAssets as assets_count');
+        }
+
+        if ($request->filled('search')) {
+            $categories = $categories->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $categories->where('name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('category_type')) {
+            $categories->where('category_type', '=', $request->input('category_type'));
+        }
+
+        if ($request->filled('use_default_eula')) {
+            $categories->where('use_default_eula', '=', $request->input('use_default_eula'));
+        }
+
+        if ($request->filled('require_acceptance')) {
+            $categories->where('require_acceptance', '=', $request->input('require_acceptance'));
+        }
+
+        if ($request->filled('checkin_email')) {
+            $categories->where('checkin_email', '=', $request->input('checkin_email'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $categories->count()) ? $categories->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'assets_count';
+        $categories->orderBy($sort, $order);
+
+        $total = $categories->count();
+        $categories = $categories->skip($offset)->take($limit)->get();
+
+        return (new CategoriesTransformer)->transformCategories($categories, $total);
+
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Category::class);
+        $category = new Category;
+        $category->fill($request->all());
+        $category->category_type = strtolower($request->input('category_type'));
+        $category = $request->handleImages($category);
+
+        if ($category->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $category, trans('admin/categories/message.create.success')));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, $category->getErrors()));
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Category::class);
+        $category = Category::withCount('assets as assets_count', 'accessories as accessories_count', 'consumables as consumables_count', 'components as components_count', 'licenses as licenses_count')->findOrFail($id);
+        return (new CategoriesTransformer)->transformCategory($category);
+
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Category::class);
+        $category = Category::findOrFail($id);
+
+        // Don't allow the user to change the category_type once it's been created
+        if (($request->filled('category_type')) && ($category->category_type != $request->input('category_type'))) {
+            return response()->json(
+                Helper::formatStandardApiResponse('error', null,  trans('admin/categories/message.update.cannot_change_category_type'))
+            );
+        }
+        $category->fill($request->all());
+        $category = $request->handleImages($category);
+
+        if ($category->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $category, trans('admin/categories/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $category->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Category::class);
+        $category = Category::withCount('assets as assets_count', 'accessories as accessories_count', 'consumables as consumables_count', 'components as components_count', 'licenses as licenses_count')->findOrFail($id);
+
+        if (! $category->isDeletable()) {
+            return response()->json(
+                Helper::formatStandardApiResponse('error', null, trans('admin/categories/message.assoc_items', ['asset_type'=>$category->category_type]))
+            );
+        }
+        $category->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/categories/message.delete.success')));
+    }
+
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request, $category_type = 'asset')
+    {
+        $this->authorize('view.selectlists');
+        $categories = Category::select([
+            'id',
+            'name',
+            'image',
+        ]);
+
+        if ($request->filled('search')) {
+            $categories = $categories->where('name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $categories = $categories->where('category_type', $category_type)->orderBy('name', 'ASC')->paginate(50);
+
+        // Loop through and set some custom properties for the transformer to use.
+        // This lets us have more flexibility in special cases like assets, where
+        // they may not have a ->name value but we want to display something anyway
+        foreach ($categories as $category) {
+            $category->use_image = ($category->image) ? Storage::disk('public')->url('categories/'.$category->image, $category->image) : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($categories);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/CompaniesController.php

@@ -0,0 +1,197 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\CompaniesTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Company;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Storage;
+
+class CompaniesController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Company::class);
+
+        $allowed_columns = [
+            'id',
+            'name',
+            'phone',
+            'fax',
+            'email',
+            'created_at',
+            'updated_at',
+            'users_count',
+            'assets_count',
+            'licenses_count',
+            'accessories_count',
+            'consumables_count',
+            'components_count',
+        ];
+
+        $companies = Company::withCount(['assets as assets_count'  => function ($query) {
+            $query->AssetsForShow();
+        }])->withCount('licenses as licenses_count', 'accessories as accessories_count', 'consumables as consumables_count', 'components as components_count', 'users as users_count');
+
+        if ($request->filled('search')) {
+            $companies->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $companies->where('name', '=', $request->input('name'));
+        }
+
+		if ($request->filled('email')) {
+            $companies->where('email', '=', $request->input('email'));
+        }
+
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $companies->count()) ? $companies->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $companies->orderBy($sort, $order);
+
+        $total = $companies->count();
+        $companies = $companies->skip($offset)->take($limit)->get();
+        return (new CompaniesTransformer)->transformCompanies($companies, $total);
+
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Company::class);
+        $company = new Company;
+        $company->fill($request->all());
+        $company = $request->handleImages($company);
+        
+        if ($company->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', (new CompaniesTransformer)->transformCompany($company), trans('admin/companies/message.create.success')));
+        }
+
+        return response()
+            ->json(Helper::formatStandardApiResponse('error', null, $company->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Company::class);
+        $company = Company::findOrFail($id);
+        return (new CompaniesTransformer)->transformCompany($company);
+
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Company::class);
+        $company = Company::findOrFail($id);
+        $company->fill($request->all());
+        $company = $request->handleImages($company);
+
+        if ($company->save()) {
+            return response()
+                ->json(Helper::formatStandardApiResponse('success', (new CompaniesTransformer)->transformCompany($company), trans('admin/companies/message.update.success')));
+        }
+
+        return response()
+            ->json(Helper::formatStandardApiResponse('error', null, $company->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Company::class);
+        $company = Company::findOrFail($id);
+        $this->authorize('delete', $company);
+
+        if (! $company->isDeletable()) {
+            return response()
+                    ->json(Helper::formatStandardApiResponse('error', null, trans('admin/companies/message.assoc_users')));
+        }
+        $company->delete();
+
+        return response()
+            ->json(Helper::formatStandardApiResponse('success', null, trans('admin/companies/message.delete.success')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+        $this->authorize('view.selectlists');
+        $companies = Company::select([
+            'companies.id',
+            'companies.name',
+            'companies.email',
+            'companies.image',
+        ]);
+
+        if ($request->filled('search')) {
+            $companies = $companies->where('companies.name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $companies = $companies->orderBy('name', 'ASC')->paginate(50);
+
+        // Loop through and set some custom properties for the transformer to use.
+        // This lets us have more flexibility in special cases like assets, where
+        // they may not have a ->name value but we want to display something anyway
+        foreach ($companies as $company) {
+            $company->use_image = ($company->image) ? Storage::disk('public')->url('companies/'.$company->image, $company->image) : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($companies);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/ComponentsController.php

@@ -0,0 +1,359 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\ComponentsTransformer;
+use App\Models\Company;
+use App\Models\Component;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use App\Events\CheckoutableCheckedIn;
+use App\Events\ComponentCheckedIn;
+use App\Models\Asset;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Database\Query\Builder;
+
+class ComponentsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Component::class);
+
+        // This array is what determines which fields should be allowed to be sorted on ON the table itself, no relations
+        // Relations will be handled in query scopes a little further down.
+        $allowed_columns = 
+            [
+                'id',
+                'name',
+                'min_amt',
+                'order_number',
+                'serial',
+                'purchase_date',
+                'purchase_cost',
+                'qty',
+                'image',
+                'notes',
+            ];
+
+        $components = Component::select('components.*')
+            ->with('company', 'location', 'category', 'assets', 'supplier');
+
+        if ($request->filled('search')) {
+            $components = $components->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $components->where('name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('company_id')) {
+            $components->where('company_id', '=', $request->input('company_id'));
+        }
+
+        if ($request->filled('category_id')) {
+            $components->where('category_id', '=', $request->input('category_id'));
+        }
+
+        if ($request->filled('supplier_id')) {
+            $components->where('supplier_id', '=', $request->input('supplier_id'));
+        }
+
+        if ($request->filled('location_id')) {
+            $components->where('location_id', '=', $request->input('location_id'));
+        }
+
+        if ($request->filled('notes')) {
+            $components->where('notes','=',$request->input('notes'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $components->count()) ? $components->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort_override =  $request->input('sort');
+        $column_sort = in_array($sort_override, $allowed_columns) ? $sort_override : 'created_at';
+
+        switch ($sort_override) {
+            case 'category':
+                $components = $components->OrderCategory($order);
+                break;
+            case 'location':
+                $components = $components->OrderLocation($order);
+                break;
+            case 'company':
+                $components = $components->OrderCompany($order);
+                break;
+            case 'supplier':
+                $components = $components->OrderSupplier($order);
+                break;
+            default:
+                $components = $components->orderBy($column_sort, $order);
+                break;
+        }
+
+        $total = $components->count();
+        $components = $components->skip($offset)->take($limit)->get();
+
+        return (new ComponentsTransformer)->transformComponents($components, $total);
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Component::class);
+        $component = new Component;
+        $component->fill($request->all());
+        $component = $request->handleImages($component);
+
+        if ($component->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $component, trans('admin/components/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $component->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Component::class);
+        $component = Component::findOrFail($id);
+
+        if ($component) {
+            return (new ComponentsTransformer)->transformComponent($component);
+        }
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param   \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Component::class);
+        $component = Component::findOrFail($id);
+        $component->fill($request->all());
+        $component = $request->handleImages($component);
+        
+
+        if ($component->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $component, trans('admin/components/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $component->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Component::class);
+        $component = Component::findOrFail($id);
+        $this->authorize('delete', $component);
+        $component->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/components/message.delete.success')));
+    }
+
+    /**
+     * Display all assets attached to a component
+     *
+     * @author [A. Bergamasco] [@vjandrea]
+     * @since [v4.0]
+     * @param Request $request
+     * @param int $id
+     * @return \Illuminate\Http\Response
+    */
+    public function getAssets(Request $request, $id)
+    {
+        $this->authorize('view', \App\Models\Asset::class);
+        
+        $component = Component::findOrFail($id);
+        
+        $offset = request('offset', 0);
+        $limit = $request->input('limit', 50);
+        
+        if ($request->filled('search')) {
+            $assets = $component->assets()
+                                ->where(function ($query) use ($request) {
+                                    $search_str = '%' . $request->input('search') . '%';
+                                    $query->where('name', 'like', $search_str)
+                                            ->orWhereIn('model_id', function (Builder $query) use ($request) {
+                                                $search_str = '%' . $request->input('search') . '%';
+                                                $query->selectRaw('id')->from('models')->where('name', 'like', $search_str);
+                                            })
+                                            ->orWhere('asset_tag', 'like', $search_str);
+                                         })
+                                         ->get();
+            $total = $assets->count();
+        } else {
+            $assets = $component->assets();
+            
+            $total = $assets->count();
+            $assets = $assets->skip($offset)->take($limit)->get();
+        }
+
+        return (new ComponentsTransformer)->transformCheckedoutComponents($assets, $total);
+    }
+
+
+    /**
+     * Validate and checkout the component.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * t
+     * @since [v5.1.8]
+     * @param Request $request
+     * @param int $componentId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function checkout(Request $request, $componentId)
+    {
+        // Check if the component exists
+        if (!$component = Component::find($componentId)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/components/message.does_not_exist')));
+        }
+
+        $this->authorize('checkout', $component);
+
+        $validator = Validator::make($request->all(), [
+            'assigned_to'          => 'required|exists:assets,id',
+            'assigned_qty'      => "required|numeric|min:1|digits_between:1,".$component->numRemaining(),
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json(Helper::formatStandardApiResponse('error', $validator->errors()));
+
+        }
+
+        // Make sure there is at least one available to checkout
+        if ($component->numRemaining() < $request->get('assigned_qty')) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/components/message.checkout.unavailable', ['remaining' => $component->numRemaining(), 'requested' => $request->get('assigned_qty')])));
+        }
+
+        if ($component->numRemaining() >= $request->get('assigned_qty')) {
+
+            $asset = Asset::find($request->input('assigned_to'));
+            $component->assigned_to = $request->input('assigned_to');
+
+            $component->assets()->attach($component->id, [
+                'component_id' => $component->id,
+                'created_at' => \Carbon::now(),
+                'assigned_qty' => $request->get('assigned_qty', 1),
+                'user_id' => \Auth::id(),
+                'asset_id' => $request->get('assigned_to'),
+                'note' => $request->get('note'),
+            ]);
+
+            $component->logCheckout($request->input('note'), $asset);
+
+            return response()->json(Helper::formatStandardApiResponse('success', null,  trans('admin/components/message.checkout.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/components/message.checkout.unavailable', ['remaining' => $component->numRemaining(), 'requested' => $request->get('assigned_qty')])));
+    }
+
+    /**
+     * Validate and store checkin data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v5.1.8]
+     * @param Request $request
+     * @param $component_asset_id
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function checkin(Request $request, $component_asset_id)
+    {
+        if ($component_assets = \DB::table('components_assets')->find($component_asset_id)) {
+
+            if (is_null($component = Component::find($component_assets->component_id))) {
+
+                return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/components/message.not_found')));
+            }
+
+            $this->authorize('checkin', $component);
+
+            $max_to_checkin = $component_assets->assigned_qty;
+
+            if ($max_to_checkin > 1) {
+                
+                $validator = \Validator::make($request->all(), [
+                    "checkin_qty" => "required|numeric|between:1,$max_to_checkin"
+                ]);
+    
+                if ($validator->fails()) {
+                    return response()->json(Helper::formatStandardApiResponse('error', null, 'Checkin quantity must be between 1 and '.$max_to_checkin));
+                }
+            }
+            
+
+            // Validation passed, so let's figure out what we have to do here.
+            $qty_remaining_in_checkout = ($component_assets->assigned_qty - (int)$request->input('checkin_qty', 1));
+
+            // We have to modify the record to reflect the new qty that's
+            // actually checked out.
+            $component_assets->assigned_qty = $qty_remaining_in_checkout;
+
+            \Log::debug($component_asset_id.' - '.$qty_remaining_in_checkout.' remaining in record '.$component_assets->id);
+            
+            \DB::table('components_assets')->where('id',
+                $component_asset_id)->update(['assigned_qty' => $qty_remaining_in_checkout]);
+
+            // If the checked-in qty is exactly the same as the assigned_qty,
+            // we can simply delete the associated components_assets record
+            if ($qty_remaining_in_checkout == 0) {
+                \DB::table('components_assets')->where('id', '=', $component_asset_id)->delete();
+            }
+            
+
+            $asset = Asset::find($component_assets->asset_id);
+
+            event(new CheckoutableCheckedIn($component, $asset, \Auth::user(), $request->input('note'), \Carbon::now()));
+
+            return response()->json(Helper::formatStandardApiResponse('success', null,  trans('admin/components/message.checkin.success')));
+
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, 'No matching checkouts for that component join record'));
+
+    
+    }
+
+}

SNIPE-IT/app/Http/Controllers/Api/ConsumablesController.php

@@ -0,0 +1,321 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Events\CheckoutableCheckedOut;
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\ConsumablesTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Company;
+use App\Models\Consumable;
+use App\Models\User;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Auth;
+
+class ConsumablesController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('index', Consumable::class);
+
+        // This array is what determines which fields should be allowed to be sorted on ON the table itself, no relations
+        // Relations will be handled in query scopes a little further down.
+        $allowed_columns = 
+            [
+                'id',
+                'name',
+                'order_number',
+                'min_amt',
+                'purchase_date',
+                'purchase_cost',
+                'company',
+                'category',
+                'model_number', 
+                'item_no', 
+                'qty',
+                'image',
+                'notes',
+                ];
+
+        $consumables = Consumable::select('consumables.*')
+            ->with('company', 'location', 'category', 'users', 'manufacturer');
+
+        if ($request->filled('search')) {
+            $consumables = $consumables->TextSearch(e($request->input('search')));
+        }
+
+        if ($request->filled('name')) {
+            $consumables->where('name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('company_id')) {
+            $consumables->where('company_id', '=', $request->input('company_id'));
+        }
+
+        if ($request->filled('category_id')) {
+            $consumables->where('category_id', '=', $request->input('category_id'));
+        }
+
+        if ($request->filled('model_number')) {
+            $consumables->where('model_number','=',$request->input('model_number'));
+        }
+
+        if ($request->filled('manufacturer_id')) {
+            $consumables->where('manufacturer_id', '=', $request->input('manufacturer_id'));
+        }
+
+        if ($request->filled('supplier_id')) {
+            $consumables->where('supplier_id', '=', $request->input('supplier_id'));
+        }
+
+        if ($request->filled('location_id')) {
+            $consumables->where('location_id','=',$request->input('location_id'));
+        }
+
+        if ($request->filled('notes')) {
+            $consumables->where('notes','=',$request->input('notes'));
+        }
+
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $consumables->count()) ? $consumables->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $allowed_columns = ['id', 'name', 'order_number', 'min_amt', 'purchase_date', 'purchase_cost', 'company', 'category', 'model_number', 'item_no', 'manufacturer', 'location', 'qty', 'image'];
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+
+        $sort_override =  $request->input('sort');
+        $column_sort = in_array($sort_override, $allowed_columns) ? $sort_override : 'created_at';
+
+
+        switch ($sort_override) {
+            case 'category':
+                $consumables = $consumables->OrderCategory($order);
+                break;
+            case 'location':
+                $consumables = $consumables->OrderLocation($order);
+                break;
+            case 'manufacturer':
+                $consumables = $consumables->OrderManufacturer($order);
+                break;
+            case 'company':
+                $consumables = $consumables->OrderCompany($order);
+                break;
+            case 'supplier':
+                $components = $consumables->OrderSupplier($order);
+                break;
+            default:
+                $consumables = $consumables->orderBy($column_sort, $order);
+                break;
+        }
+
+        $total = $consumables->count();
+        $consumables = $consumables->skip($offset)->take($limit)->get();
+
+        return (new ConsumablesTransformer)->transformConsumables($consumables, $total);
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Consumable::class);
+        $consumable = new Consumable;
+        $consumable->fill($request->all());
+        $consumable = $request->handleImages($consumable);
+
+        if ($consumable->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $consumable, trans('admin/consumables/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $consumable->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Consumable::class);
+        $consumable = Consumable::with('users')->findOrFail($id);
+
+        return (new ConsumablesTransformer)->transformConsumable($consumable);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @param  int $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Consumable::class);
+        $consumable = Consumable::findOrFail($id);
+        $consumable->fill($request->all());
+        $consumable = $request->handleImages($consumable);
+        
+        if ($consumable->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $consumable, trans('admin/consumables/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $consumable->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Consumable::class);
+        $consumable = Consumable::findOrFail($id);
+        $this->authorize('delete', $consumable);
+        $consumable->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/consumables/message.delete.success')));
+    }
+
+    /**
+    * Returns a JSON response containing details on the users associated with this consumable.
+    *
+    * @author [A. Gianotto] [<snipe@snipe.net>]
+    * @see \App\Http\Controllers\Consumables\ConsumablesController::getView() method that returns the form.
+    * @since [v1.0]
+    * @param int $consumableId
+    * @return array
+     */
+    public function getDataView($consumableId)
+    {
+        $consumable = Consumable::with(['consumableAssignments'=> function ($query) {
+            $query->orderBy($query->getModel()->getTable().'.created_at', 'DESC');
+        },
+        'consumableAssignments.admin'=> function ($query) {
+        },
+        'consumableAssignments.user'=> function ($query) {
+        },
+        ])->find($consumableId);
+
+        if (! Company::isCurrentUserHasAccess($consumable)) {
+            return ['total' => 0, 'rows' => []];
+        }
+        $this->authorize('view', Consumable::class);
+        $rows = [];
+
+        foreach ($consumable->consumableAssignments as $consumable_assignment) {
+            $rows[] = [
+                'avatar' => ($consumable_assignment->user) ? e($consumable_assignment->user->present()->gravatar) : '',
+                'name' => ($consumable_assignment->user) ? $consumable_assignment->user->present()->nameUrl() : 'Deleted User',
+                'created_at' => Helper::getFormattedDateObject($consumable_assignment->created_at, 'datetime'),
+                'note' => ($consumable_assignment->note) ? e($consumable_assignment->note) : null,
+                'admin' => ($consumable_assignment->admin) ? $consumable_assignment->admin->present()->nameUrl() : null,
+            ];
+        }
+
+        $consumableCount = $consumable->users->count();
+        $data = ['total' => $consumableCount, 'rows' => $rows];
+
+        return $data;
+    }
+
+    /**
+     * Checkout a consumable
+     *
+     * @author [A. Gutierrez] [<andres@baller.tv>]
+     * @param int $id
+     * @since [v4.9.5]
+     * @return JsonResponse
+     */
+    public function checkout(Request $request, $id)
+    {
+        // Check if the consumable exists
+        if (!$consumable = Consumable::with('users')->find($id)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/consumables/message.does_not_exist')));
+        }
+
+        $this->authorize('checkout', $consumable);
+
+        // Make sure there is at least one available to checkout
+        if ($consumable->numRemaining() <= 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/consumables/message.checkout.unavailable')));
+        }
+
+        // Make sure there is a valid category
+        if (!$consumable->category){
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('general.invalid_item_category_single', ['type' => trans('general.consumable')])));
+        }
+
+
+        // Check if the user exists - @TODO:  this should probably be handled via validation, not here??
+        if (!$user = User::find($request->input('assigned_to'))) {
+            // Return error message
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'No user found'));
+            \Log::debug('No valid user');
+        }
+
+        // Update the consumable data
+        $consumable->assigned_to = $request->input('assigned_to');
+
+        $consumable->users()->attach($consumable->id,
+                [
+                    'consumable_id' => $consumable->id,
+                    'user_id' => $user->id,
+                    'assigned_to' => $request->input('assigned_to'),
+                    'note' => $request->input('note'),
+                ]
+            );
+
+        event(new CheckoutableCheckedOut($consumable, $user, Auth::user(), $request->input('note')));
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/consumables/message.checkout.success')));
+
+    }
+
+    /**
+    * Gets a paginated collection for the select2 menus
+    *
+    * @see \App\Http\Transformers\SelectlistTransformer
+    */
+    public function selectlist(Request $request)
+    {
+        $consumables = Consumable::select([
+            'consumables.id',
+            'consumables.name',
+        ]);
+
+        if ($request->filled('search')) {
+            $consumables = $consumables->where('consumables.name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $consumables = $consumables->orderBy('name', 'ASC')->paginate(50);
+
+        return (new SelectlistTransformer)->transformSelectlist($consumables);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/CustomFieldsController.php

@@ -0,0 +1,198 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\CustomFieldsTransformer;
+use App\Models\CustomField;
+use App\Models\CustomFieldset;
+use Illuminate\Http\Request;
+use Validator;
+
+class CustomFieldsController extends Controller
+{
+    /**
+     * Reorder the custom fields within a fieldset
+     *
+     * @author [Brady Wetherington] [<uberbrady@gmail.com>]
+     * @param  int  $id
+     * @since [v3.0]
+     * @return array
+     */
+    public function index()
+    {
+        $this->authorize('index', CustomField::class);
+        $fields = CustomField::get();
+
+        return (new CustomFieldsTransformer)->transformCustomFields($fields, $fields->count());
+    }
+
+    /**
+     * Shows the given field
+     * @author [V. Cordes] [<volker@fdatek.de>]
+     * @param int $id
+     * @since [v4.1.10]
+     * @return View
+     */
+    public function show($id)
+    {
+        $this->authorize('view', CustomField::class);
+        if ($field = CustomField::find($id)) {
+            return (new CustomFieldsTransformer)->transformCustomField($field);
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/custom_fields/message.field.invalid')), 200);
+    }
+
+    /**
+     * Update the specified field
+     *
+     * @author [V. Cordes] [<volker@fdatek.de>]
+     * @since [v4.1.10]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('update', CustomField::class);
+        $field = CustomField::findOrFail($id);
+
+        /**
+         * Updated values for the field,
+         * without the "field_encrypted" flag, preventing the change of encryption status
+         * @var array
+         */
+        $data = $request->except(['field_encrypted']);
+
+        $validator = Validator::make($data, $field->validationRules());
+        if ($validator->fails()) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, $validator->errors()));
+        }
+
+        $field->fill($data);
+
+        if ($field->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $field, trans('admin/custom_fields/message.field.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $field->getErrors()));
+    }
+
+    /**
+     * Store a newly created field.
+     *
+     * @author [V. Cordes] [<volker@fdatek.de>]
+     * @since [v4.1.10]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('create', CustomField::class);
+        $field = new CustomField;
+
+        $data = $request->all();
+        $regex_format = null;
+
+        if ((array_key_exists('format', $data)) && (str_contains($data['format'], 'regex:'))) {
+            $regex_format = $data['format'];
+        }
+
+        $validator = Validator::make($data, $field->validationRules($regex_format));
+
+        if ($validator->fails()) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, $validator->errors()));
+        }
+        $field->fill($data);
+
+        if ($field->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $field, trans('admin/custom_fields/message.field.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $field->getErrors()));
+    }
+
+    public function postReorder(Request $request, $id)
+    {
+        $fieldset = CustomFieldset::find($id);
+
+        $this->authorize('update', $fieldset);
+
+        $fields = [];
+        $order_array = [];
+
+        $items = $request->input('item');
+
+        foreach ($items as $order => $field_id) {
+            $order_array[$field_id] = $order;
+        }
+
+        foreach ($fieldset->fields as $field) {
+            $fields[$field->id] = ['required' => $field->pivot->required, 'order' => $order_array[$field->id]];
+        }
+
+        return $fieldset->fields()->sync($fields);
+    }
+
+    public function associate(Request $request, $field_id)
+    {
+        $this->authorize('update', CustomFieldset::class);
+
+        $field = CustomField::findOrFail($field_id);
+
+        $fieldset_id = $request->input('fieldset_id');
+        foreach ($field->fieldset as $fieldset) {
+            if ($fieldset->id == $fieldset_id) {
+                return response()->json(Helper::formatStandardApiResponse('success', $fieldset, trans('admin/custom_fields/message.fieldset.update.success')));
+            }
+        }
+
+        $fieldset = CustomFieldset::findOrFail($fieldset_id);
+        $fieldset->fields()->attach($field->id, ['required' => ($request->input('required') == 'on'), 'order' => $request->input('order', $fieldset->fields->count())]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $fieldset, trans('admin/custom_fields/message.fieldset.update.success')));
+    }
+
+    public function disassociate(Request $request, $field_id)
+    {
+        $this->authorize('update', CustomFieldset::class);
+
+        $field = CustomField::findOrFail($field_id);
+
+        $fieldset_id = $request->input('fieldset_id');
+        foreach ($field->fieldset as $fieldset) {
+            if ($fieldset->id == $fieldset_id) {
+                $fieldset->fields()->detach($field->id);
+
+                return response()->json(Helper::formatStandardApiResponse('success', $fieldset, trans('admin/custom_fields/message.fieldset.update.success')));
+            }
+        }
+        $fieldset = CustomFieldset::findOrFail($fieldset_id);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $fieldset, trans('admin/custom_fields/message.fieldset.update.success')));
+    }
+
+    /**
+     * Delete a custom field.
+     *
+     * @author [Brady Wetherington] [<uberbrady@gmail.com>]
+     * @since [v1.8]
+     * @return Redirect
+     */
+    public function destroy($field_id)
+    {
+        $field = CustomField::findOrFail($field_id);
+
+        $this->authorize('delete', $field);
+
+        if ($field->fieldset->count() > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Field is in use.'));
+        }
+
+        $field->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/custom_fields/message.field.delete.success')));
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/CustomFieldsetsController.php

@@ -0,0 +1,177 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\CustomFieldsetsTransformer;
+use App\Http\Transformers\CustomFieldsTransformer;
+use App\Models\CustomFieldset;
+use App\Models\CustomField;
+use Illuminate\Http\Request;
+use Redirect;
+use View;
+
+/**
+ * This controller handles all actions related to Custom Asset Fieldsets for
+ * the Snipe-IT Asset Management application.
+ *
+ * @todo Improve documentation here.
+ * @todo Check for raw DB queries and try to convert them to query builder statements
+ * @version    v2.0
+ * @author [Brady Wetherington] [<uberbrady@gmail.com>]
+ * @author [Josh Gibson]
+ */
+class CustomFieldsetsController extends Controller
+{
+    /**
+     * Shows the given fieldset and its fields
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @author [Josh Gibson]
+     * @param int $id
+     * @since [v1.8]
+     * @return View
+     */
+    public function index()
+    {
+        $this->authorize('index', CustomField::class);
+        $fieldsets = CustomFieldset::withCount('fields as fields_count', 'models as models_count')->get();
+
+        return (new CustomFieldsetsTransformer)->transformCustomFieldsets($fieldsets, $fieldsets->count());
+    }
+
+    /**
+     * Shows the given fieldset and its fields
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @author [Josh Gibson]
+     * @param int $id
+     * @since [v1.8]
+     * @return View
+     */
+    public function show($id)
+    {
+        $this->authorize('view', CustomField::class);
+        if ($fieldset = CustomFieldset::find($id)) {
+            return (new CustomFieldsetsTransformer)->transformCustomFieldset($fieldset);
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/custom_fields/message.fieldset.does_not_exist')), 200);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('update', CustomField::class);
+        $fieldset = CustomFieldset::findOrFail($id);
+        $fieldset->fill($request->all());
+
+        if ($fieldset->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $fieldset, trans('admin/custom_fields/message.fieldset.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $fieldset->getErrors()));
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('create', CustomField::class);
+        $fieldset = new CustomFieldset;
+        $fieldset->fill($request->all());
+
+        if ($fieldset->save()) {
+            // Sync fieldset with auto_add_to_fieldsets
+            $fields = CustomField::select('id')->where('auto_add_to_fieldsets', '=', '1')->get();
+
+            if ($fields->count() > 0) {
+
+                foreach ($fields as $field) {
+                    $field_ids[] = $field->id;
+                }
+
+                $fieldset->fields()->sync($field_ids);
+            }
+
+            return response()->json(Helper::formatStandardApiResponse('success', $fieldset, trans('admin/custom_fields/message.fieldset.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $fieldset->getErrors()));
+    }
+
+    /**
+     * Delete a custom fieldset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return Redirect
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', CustomField::class);
+        $fieldset = CustomFieldset::findOrFail($id);
+
+        $modelsCount = $fieldset->models->count();
+        $fieldsCount = $fieldset->fields->count();
+
+        if (($modelsCount > 0) || ($fieldsCount > 0)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Fieldset is in use.'));
+        }
+
+        if ($fieldset->delete()) {
+            return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/custom_fields/message.fieldset.delete.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, 'Unspecified error'));
+    }
+
+    /**
+     * Return JSON containing a list of fields belonging to a fieldset.
+     *
+     * @author [V. Cordes] [<volker@fdatek.de>]
+     * @since [v4.1.10]
+     * @param $fieldsetId
+     * @return string JSON
+     */
+    public function fields($id)
+    {
+        $this->authorize('view', CustomField::class);
+        $set = CustomFieldset::findOrFail($id);
+        $fields = $set->fields;
+
+        return (new CustomFieldsTransformer)->transformCustomFields($fields, $fields->count());
+    }
+
+    /**
+     * Return JSON containing a list of fields belonging to a fieldset with the
+     * default values for a given model
+     *
+     * @param $modelId
+     * @param $fieldsetId
+     * @return string JSON
+     */
+    public function fieldsWithDefaultValues($fieldsetId, $modelId)
+    {
+        $this->authorize('view', CustomField::class);
+
+        $set = CustomFieldset::findOrFail($fieldsetId);
+
+        $fields = $set->fields;
+
+        return (new CustomFieldsTransformer)->transformCustomFieldsWithDefaultValues($fields, $modelId, $fields->count());
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/DepartmentsController.php

@@ -0,0 +1,208 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\DepartmentsTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Company;
+use App\Models\Department;
+use Auth;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Storage;
+
+class DepartmentsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [Godfrey Martinez] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Department::class);
+        $allowed_columns = ['id', 'name', 'image', 'users_count'];
+
+        $departments = Department::select(
+            'departments.id',
+            'departments.name',
+            'departments.phone',
+            'departments.fax',
+            'departments.location_id',
+            'departments.company_id',
+            'departments.manager_id',
+            'departments.created_at',
+            'departments.updated_at',
+            'departments.image'
+        )->with('users')->with('location')->with('manager')->with('company')->withCount('users as users_count');
+
+        if ($request->filled('search')) {
+            $departments = $departments->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $departments->where('name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('company_id')) {
+            $departments->where('company_id', '=', $request->input('company_id'));
+        }
+
+        if ($request->filled('manager_id')) {
+            $departments->where('manager_id', '=', $request->input('manager_id'));
+        }
+
+        if ($request->filled('location_id')) {
+            $departments->where('location_id', '=', $request->input('location_id'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $departments->count()) ? $departments->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+
+        switch ($request->input('sort')) {
+            case 'location':
+                $departments->OrderLocation($order);
+                break;
+            case 'manager':
+                $departments->OrderManager($order);
+                break;
+            default:
+                $departments->orderBy($sort, $order);
+                break;
+        }
+
+        $total = $departments->count();
+        $departments = $departments->skip($offset)->take($limit)->get();
+        return (new DepartmentsTransformer)->transformDepartments($departments, $total);
+
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Department::class);
+        $department = new Department;
+        $department->fill($request->all());
+        $department = $request->handleImages($department);
+
+        $department->user_id = Auth::user()->id;
+        $department->manager_id = ($request->filled('manager_id') ? $request->input('manager_id') : null);
+
+        if ($department->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $department, trans('admin/departments/message.create.success')));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, $department->getErrors()));
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Department::class);
+        $department = Department::findOrFail($id);
+
+        return (new DepartmentsTransformer)->transformDepartment($department);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v5.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Department::class);
+        $department = Department::findOrFail($id);
+        $department->fill($request->all());
+        $department = $request->handleImages($department);
+
+        if ($department->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $department, trans('admin/departments/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $department->getErrors()));
+    }
+
+
+    /**
+     * Validates and deletes selected department.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $locationId
+     * @since [v4.0]
+     * @return \Illuminate\Http\RedirectResponse
+     */
+    public function destroy($id)
+    {
+        $department = Department::findOrFail($id);
+
+        $this->authorize('delete', $department);
+
+        if ($department->users->count() > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/departments/message.assoc_users')));
+        }
+
+        $department->delete();
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/departments/message.delete.success')));
+
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+
+        $this->authorize('view.selectlists');
+        $departments = Department::select([
+            'id',
+            'name',
+            'image',
+        ]);
+
+        if ($request->filled('search')) {
+            $departments = $departments->where('name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $departments = $departments->orderBy('name', 'ASC')->paginate(50);
+
+        // Loop through and set some custom properties for the transformer to use.
+        // This lets us have more flexibility in special cases like assets, where
+        // they may not have a ->name value but we want to display something anyway
+        foreach ($departments as $department) {
+            $department->use_image = ($department->image) ? Storage::disk('public')->url('departments/'.$department->image, $department->image) : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($departments);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/DepreciationsController.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\DepreciationsTransformer;
+use App\Models\Depreciation;
+use Illuminate\Http\Request;
+
+class DepreciationsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Depreciation::class);
+        $allowed_columns = ['id','name','months','depreciation_min','created_at'];
+
+        $depreciations = Depreciation::select('id','name','months','depreciation_min','user_id','created_at','updated_at');
+
+        if ($request->filled('search')) {
+            $depreciations = $depreciations->TextSearch($request->input('search'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $depreciations->count()) ? $depreciations->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $depreciations->orderBy($sort, $order);
+
+        $total = $depreciations->count();
+        $depreciations = $depreciations->skip($offset)->take($limit)->get();
+
+        return (new DepreciationsTransformer)->transformDepreciations($depreciations, $total);
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('create', Depreciation::class);
+        $depreciation = new Depreciation;
+        $depreciation->fill($request->all());
+
+        if ($depreciation->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $depreciation, trans('admin/depreciations/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $depreciation->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Depreciation::class);
+        $depreciation = Depreciation::findOrFail($id);
+
+        return (new DepreciationsTransformer)->transformDepreciation($depreciation);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('update', Depreciation::class);
+        $depreciation = Depreciation::findOrFail($id);
+        $depreciation->fill($request->all());
+
+        if ($depreciation->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $depreciation, trans('admin/depreciations/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $depreciation->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Depreciation::class);
+        $depreciation = Depreciation::withCount('models as models_count')->findOrFail($id);
+        $this->authorize('delete', $depreciation);
+
+        if ($depreciation->models_count > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', trans('admin/depreciations/message.assoc_users')));
+        }
+
+        $depreciation->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/depreciations/message.delete.success')));
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/GroupsController.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\GroupsTransformer;
+use App\Models\Group;
+use Illuminate\Http\Request;
+use Auth;
+
+
+class GroupsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('superadmin');
+
+        $this->authorize('view', Group::class);
+        $allowed_columns = ['id', 'name', 'created_at', 'users_count'];
+
+        $groups = Group::select('id', 'name', 'permissions', 'created_at', 'updated_at', 'created_by')->with('admin')->withCount('users as users_count');
+
+        if ($request->filled('search')) {
+            $groups = $groups->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $groups->where('name', '=', $request->input('name'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $groups->count()) ? $groups->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $groups->orderBy($sort, $order);
+
+        $total = $groups->count();
+        $groups = $groups->skip($offset)->take($limit)->get();
+
+        return (new GroupsTransformer)->transformGroups($groups, $total);
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('superadmin');
+        $group = new Group;
+
+        $group->name = $request->input('name');
+        $group->created_by = Auth::user()->id;
+        $group->permissions = json_encode($request->input('permissions')); // Todo - some JSON validation stuff here
+
+        if ($group->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $group, trans('admin/groups/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $group->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('superadmin');
+        $group = Group::findOrFail($id);
+
+        return (new GroupsTransformer)->transformGroup($group);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('superadmin');
+        $group = Group::findOrFail($id);
+
+        $group->name = $request->input('name');
+        $group->permissions = $request->input('permissions'); // Todo - some JSON validation stuff here
+
+        if ($group->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $group, trans('admin/groups/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $group->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('superadmin');
+        $group = Group::findOrFail($id);
+        $group->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/groups/message.delete.success')));
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/ImportController.php

@@ -0,0 +1,235 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\ItemImportRequest;
+use App\Http\Transformers\ImportsTransformer;
+use App\Models\Asset;
+use App\Models\Company;
+use App\Models\Import;
+use Artisan;
+use Illuminate\Database\Eloquent\JsonEncodingException;
+use Illuminate\Support\Facades\Request;
+use Illuminate\Support\Facades\Session;
+use Illuminate\Support\Facades\Storage;
+use League\Csv\Reader;
+use Symfony\Component\HttpFoundation\File\Exception\FileException;
+
+class ImportController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function index()
+    {
+        $this->authorize('import');
+        $imports = Import::latest()->get();
+
+        return (new ImportsTransformer)->transformImports($imports);
+    }
+
+    /**
+     * Process and store a CSV upload file.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function store()
+    {
+        $this->authorize('import');
+        if (! config('app.lock_passwords')) {
+            $files = Request::file('files');
+            $path = config('app.private_uploads').'/imports';
+            $results = [];
+            $import = new Import;
+            foreach ($files as $file) {
+                if (! in_array($file->getMimeType(), [
+                    'application/vnd.ms-excel',
+                    'text/csv',
+                    'application/csv',
+                    'text/x-Algol68', // because wtf CSV files?
+                    'text/plain',
+                    'text/comma-separated-values',
+                    'text/tsv', ])) {
+                    $results['error'] = 'File type must be CSV. Uploaded file is '.$file->getMimeType();
+
+                    return response()->json(Helper::formatStandardApiResponse('error', null, $results['error']), 422);
+                }
+
+                //TODO: is there a lighter way to do this?
+                if (! ini_get('auto_detect_line_endings')) {
+                    ini_set('auto_detect_line_endings', '1');
+                }
+                $reader = Reader::createFromFileObject($file->openFile('r')); //file pointer leak?
+
+                try {
+                    $import->header_row = $reader->fetchOne(0);
+                } catch (JsonEncodingException $e) {
+                    return response()->json(
+                        Helper::formatStandardApiResponse(
+                            'error',
+                            null,
+                            trans('admin/hardware/message.import.header_row_has_malformed_characters')
+                        ),
+                        422
+                    );
+                }
+
+                //duplicate headers check
+                $duplicate_headers = [];
+
+                for ($i = 0; $i < count($import->header_row); $i++) {
+                    $header = $import->header_row[$i];
+                    if (in_array($header, $import->header_row)) {
+                        $found_at = array_search($header, $import->header_row);
+                        if ($i > $found_at) {
+                            //avoid reporting duplicates twice, e.g. "1 is same as 17! 17 is same as 1!!!"
+                            //as well as "1 is same as 1!!!" (which is always true)
+                            //has to be > because otherwise the first result of array_search will always be $i itself(!)
+                            array_push($duplicate_headers, "Duplicate header '$header' detected, first at column: ".($found_at + 1).', repeats at column: '.($i + 1));
+                        }
+                    }
+                }
+                if (count($duplicate_headers) > 0) {
+                    return response()->json(Helper::formatStandardApiResponse('error', null, implode('; ', $duplicate_headers)),422);
+                }
+
+                try {
+                    // Grab the first row to display via ajax as the user picks fields
+                    $import->first_row = $reader->fetchOne(1);
+                } catch (JsonEncodingException $e) {
+                    return response()->json(
+                        Helper::formatStandardApiResponse(
+                            'error',
+                            null,
+                            trans('admin/hardware/message.import.content_row_has_malformed_characters')
+                        ),
+                        422
+                    );
+                }
+
+                $date = date('Y-m-d-his');
+                $fixed_filename = str_slug($file->getClientOriginalName());
+                try {
+                    $file->move($path, $date.'-'.$fixed_filename);
+                } catch (FileException $exception) {
+                    $results['error'] = trans('admin/hardware/message.upload.error');
+                    if (config('app.debug')) {
+                        $results['error'] .= ' '.$exception->getMessage();
+                    }
+
+                    return response()->json(Helper::formatStandardApiResponse('error', null, $results['error']), 500);
+                }
+                $file_name = date('Y-m-d-his').'-'.$fixed_filename;
+                $import->file_path = $file_name;
+                $import->filesize = null;
+
+                if (!file_exists($path.'/'.$file_name)) {
+                    return response()->json(Helper::formatStandardApiResponse('error', null, trans('general.file_not_found')), 500);
+                }
+
+                $import->filesize = filesize($path.'/'.$file_name);
+                
+                $import->save();
+                $results[] = $import;
+            }
+            $results = (new ImportsTransformer)->transformImports($results);
+
+            return response()->json([
+                'files' => $results,
+            ]);
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('general.feature_disabled')), 422);
+    }
+
+    /**
+     * Processes the specified Import.
+     *
+     * @param  int  $import_id
+     * @return \Illuminate\Http\Response
+     */
+    public function process(ItemImportRequest $request, $import_id)
+    {
+        $this->authorize('import');
+
+        // Run a backup immediately before processing
+        if ($request->get('run-backup')) {
+            \Log::debug('Backup manually requested via importer');
+            Artisan::call('snipeit:backup', ['--filename' => 'pre-import-backup-'.date('Y-m-d-H:i:s')]);
+        } else {
+            \Log::debug('NO BACKUP requested via importer');
+        }
+
+        $import = Import::find($import_id);
+
+        if(is_null($import)){
+            $error[0][0] = trans("validation.exists", ["attribute" => "file"]);
+            return response()->json(Helper::formatStandardApiResponse('import-errors', null, $error), 500);
+        }
+
+        $errors = $request->import($import);
+        $redirectTo = 'hardware.index';
+        switch ($request->get('import-type')) {
+            case 'asset':
+                $redirectTo = 'hardware.index';
+                break;
+            case 'accessory':
+                $redirectTo = 'accessories.index';
+                break;
+            case 'consumable':
+                $redirectTo = 'consumables.index';
+                break;
+            case 'component':
+                $redirectTo = 'components.index';
+                break;
+            case 'license':
+                $redirectTo = 'licenses.index';
+                break;
+            case 'user':
+                $redirectTo = 'users.index';
+                break;
+            case 'location':
+                $redirectTo = 'locations.index';
+                break;
+        }
+
+        if ($errors) { //Failure
+            return response()->json(Helper::formatStandardApiResponse('import-errors', null, $errors), 500);
+        }
+        //Flash message before the redirect
+        Session::flash('success', trans('admin/hardware/message.import.success'));
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, ['redirect_url' => route($redirectTo)]));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @param  int  $import_id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($import_id)
+    {
+        $this->authorize('create', Asset::class);
+
+        if ($import = Import::find($import_id)) {
+            try {
+                // Try to delete the file
+                Storage::delete('imports/'.$import->file_path);
+                $import->delete();
+
+                return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/hardware/message.import.file_delete_success')));
+            } catch (\Exception $e) {
+                // If the file delete didn't work, remove it from the database anyway and return a warning
+                $import->delete();
+
+                return response()->json(Helper::formatStandardApiResponse('warning', null, trans('admin/hardware/message.import.file_not_deleted_warning')));
+            }
+        }
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/LabelsController.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\LabelsTransformer;
+use App\Models\Labels\Label;
+use Illuminate\Http\Request;
+use Illuminate\Support\ItemNotFoundException;
+use Auth;
+
+class LabelsController extends Controller
+{
+    /**
+     * Returns JSON listing of all labels.
+     *
+     * @author Grant Le Roux <grant.leroux+snipe-it@gmail.com>
+     * @return JsonResponse
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Label::class);
+
+        $labels = Label::find();
+
+        if ($request->filled('search')) {
+            $search = $request->get('search');
+            $labels = $labels->filter(function ($label, $index) use ($search) {
+                return stripos($label->getName(), $search) !== false;
+            });
+        }
+
+        $total = $labels->count();
+
+        $offset = $request->get('offset', 0);
+        $offset = ($offset > $total) ? $total : $offset;
+
+        $maxLimit = config('app.max_results');
+        $limit = $request->get('limit', $maxLimit);
+        $limit = ($limit > $maxLimit) ? $maxLimit : $limit;
+        
+        $labels = $labels->skip($offset)->take($limit);
+
+        return (new LabelsTransformer)->transformLabels($labels, $total, $request);
+    }
+
+    /**
+     * Returns JSON with information about a label for detail view.
+     *
+     * @author Grant Le Roux <grant.leroux+snipe-it@gmail.com>
+     * @param  string  $labelName
+     * @return JsonResponse
+     */
+    public function show(string $labelName)
+    {
+        $labelName = str_replace('/', '\\', $labelName);
+        try {
+            $label = Label::find($labelName);
+        } catch(ItemNotFoundException $e) {
+            return response()
+                ->json(
+                    Helper::formatStandardApiResponse('error', null, trans('admin/labels/message.does_not_exist')), 
+                    404
+                );
+        }
+        $this->authorize('view', $label);
+        return (new LabelsTransformer)->transformLabel($label);
+    }
+
+}

SNIPE-IT/app/Http/Controllers/Api/LicenseSeatsController.php

@@ -0,0 +1,155 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\LicenseSeatsTransformer;
+use App\Models\Asset;
+use App\Models\License;
+use App\Models\LicenseSeat;
+use App\Models\User;
+use Auth;
+use Illuminate\Http\Request;
+
+class LicenseSeatsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $licenseId
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request, $licenseId)
+    {
+        //
+        if ($license = License::find($licenseId)) {
+            $this->authorize('view', $license);
+
+            $seats = LicenseSeat::with('license', 'user', 'asset', 'user.department')
+                ->where('license_seats.license_id', $licenseId);
+
+            $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+
+            if ($request->input('sort') == 'department') {
+                $seats->OrderDepartments($order);
+            } else {
+                $seats->orderBy('id', $order);
+            }
+
+            $total = $seats->count();
+
+            // Make sure the offset and limit are actually integers and do not exceed system limits
+            $offset = ($request->input('offset') > $seats->count()) ? $seats->count() : app('api_offset_value');
+
+            if ($offset >= $total ){
+                $offset = 0;
+            }
+
+            $limit = app('api_limit_value');
+
+            $seats = $seats->skip($offset)->take($limit)->get();
+
+            if ($seats) {
+                return (new LicenseSeatsTransformer)->transformLicenseSeats($seats, $total);
+            }
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/licenses/message.does_not_exist')), 200);
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @param  int  $licenseId
+     * @param  int  $seatId
+     * @return \Illuminate\Http\Response
+     */
+    public function show($licenseId, $seatId)
+    {
+        //
+        $this->authorize('view', License::class);
+        // sanity checks:
+        // 1. does the license seat exist?
+        if (! $licenseSeat = LicenseSeat::find($seatId)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Seat not found'));
+        }
+        // 2. does the seat belong to the specified license?
+        if (! $license = $licenseSeat->license()->first() || $license->id != intval($licenseId)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Seat does not belong to the specified license'));
+        }
+
+        return (new LicenseSeatsTransformer)->transformLicenseSeat($licenseSeat);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $licenseId
+     * @param  int  $seatId
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $licenseId, $seatId)
+    {
+        $this->authorize('checkout', License::class);
+
+        // sanity checks:
+        // 1. does the license seat exist?
+        if (! $licenseSeat = LicenseSeat::find($seatId)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Seat not found'));
+        }
+        // 2. does the seat belong to the specified license?
+        if (! $license = $licenseSeat->license()->first() || $license->id != intval($licenseId)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Seat does not belong to the specified license'));
+        }
+
+        $oldUser = $licenseSeat->user()->first();
+        $oldAsset = $licenseSeat->asset()->first();
+
+        // attempt to update the license seat
+        $licenseSeat->fill($request->all());
+        $licenseSeat->user_id = Auth::user()->id;
+
+        // check if this update is a checkin operation
+        // 1. are relevant fields touched at all?
+        $touched = $licenseSeat->isDirty('assigned_to') || $licenseSeat->isDirty('asset_id');
+        // 2. are they cleared? if yes then this is a checkin operation
+        $is_checkin = ($touched && $licenseSeat->assigned_to === null && $licenseSeat->asset_id === null);
+
+        if (! $touched) {
+            // nothing to update
+            return response()->json(Helper::formatStandardApiResponse('success', $licenseSeat, trans('admin/licenses/message.update.success')));
+        }
+
+        // the logging functions expect only one "target". if both asset and user are present in the request,
+        // we simply let assets take precedence over users...
+        if ($licenseSeat->isDirty('assigned_to')) {
+            $target = $is_checkin ? $oldUser : User::find($licenseSeat->assigned_to);
+        }
+        if ($licenseSeat->isDirty('asset_id')) {
+            $target = $is_checkin ? $oldAsset : Asset::find($licenseSeat->asset_id);
+        }
+
+        if (is_null($target)){
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Target not found'));
+        }
+
+        if ($licenseSeat->save()) {
+
+            if ($is_checkin) {
+                $licenseSeat->logCheckin($target, $request->input('note'));
+
+                return response()->json(Helper::formatStandardApiResponse('success', $licenseSeat, trans('admin/licenses/message.update.success')));
+            }
+
+            // in this case, relevant fields are touched but it's not a checkin operation. so it must be a checkout operation.
+            $licenseSeat->logCheckout($request->input('note'), $target);
+
+            return response()->json(Helper::formatStandardApiResponse('success', $licenseSeat, trans('admin/licenses/message.update.success')));
+        }
+
+        return Helper::formatStandardApiResponse('error', null, $licenseSeat->getErrors());
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/LicensesController.php

@@ -0,0 +1,266 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\LicenseSeatsTransformer;
+use App\Http\Transformers\LicensesTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Company;
+use App\Models\License;
+use App\Models\LicenseSeat;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+class LicensesController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', License::class);
+
+        $licenses = License::with('company', 'manufacturer', 'supplier','category')->withCount('freeSeats as free_seats_count');
+
+        if ($request->filled('company_id')) {
+            $licenses->where('company_id', '=', $request->input('company_id'));
+        }
+
+        if ($request->filled('name')) {
+            $licenses->where('licenses.name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('product_key')) {
+            $licenses->where('licenses.serial', '=', $request->input('product_key'));
+        }
+
+        if ($request->filled('order_number')) {
+            $licenses->where('order_number', '=', $request->input('order_number'));
+        }
+
+        if ($request->filled('purchase_order')) {
+            $licenses->where('purchase_order', '=', $request->input('purchase_order'));
+        }
+
+        if ($request->filled('license_name')) {
+            $licenses->where('license_name', '=', $request->input('license_name'));
+        }
+
+        if ($request->filled('license_email')) {
+            $licenses->where('license_email', '=', $request->input('license_email'));
+        }
+
+        if ($request->filled('manufacturer_id')) {
+            $licenses->where('manufacturer_id', '=', $request->input('manufacturer_id'));
+        }
+
+        if ($request->filled('supplier_id')) {
+            $licenses->where('supplier_id', '=', $request->input('supplier_id'));
+        }
+
+        if ($request->filled('category_id')) {
+            $licenses->where('category_id', '=', $request->input('category_id'));
+        }
+
+        if ($request->filled('depreciation_id')) {
+            $licenses->where('depreciation_id', '=', $request->input('depreciation_id'));
+        }
+
+
+        if (($request->filled('maintained')) && ($request->input('maintained')=='true')) {
+            $licenses->where('maintained','=',1);
+        } elseif (($request->filled('maintained')) && ($request->input('maintained')=='false')) {
+            $licenses->where('maintained','=',0);
+        }
+
+        if (($request->filled('expires')) && ($request->input('expires')=='true')) {
+            $licenses->whereNotNull('expiration_date');
+        } elseif (($request->filled('expires')) && ($request->input('expires')=='false')) {
+            $licenses->whereNull('expiration_date');
+        }
+
+        if ($request->filled('search')) {
+            $licenses = $licenses->TextSearch($request->input('search'));
+        }
+
+        if ($request->input('deleted')=='true') {
+            $licenses->onlyTrashed();
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $licenses->count()) ? $licenses->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+
+        switch ($request->input('sort')) {
+                case 'manufacturer':
+                    $licenses = $licenses->leftJoin('manufacturers', 'licenses.manufacturer_id', '=', 'manufacturers.id')->orderBy('manufacturers.name', $order);
+                break;
+            case 'supplier':
+                $licenses = $licenses->leftJoin('suppliers', 'licenses.supplier_id', '=', 'suppliers.id')->orderBy('suppliers.name', $order);
+                break;
+            case 'category':
+                $licenses = $licenses->leftJoin('categories', 'licenses.category_id', '=', 'categories.id')->orderBy('categories.name', $order);
+                break;
+            case 'depreciation':
+                $licenses = $licenses->leftJoin('depreciations', 'licenses.depreciation_id', '=', 'depreciations.id')->orderBy('depreciations.name', $order);
+                break;
+            case 'company':
+                $licenses = $licenses->leftJoin('companies', 'licenses.company_id', '=', 'companies.id')->orderBy('companies.name', $order);
+                break;
+            default:
+                $allowed_columns =
+                    [
+                        'id',
+                        'name',
+                        'purchase_cost',
+                        'expiration_date',
+                        'purchase_order',
+                        'order_number',
+                        'notes',
+                        'purchase_date',
+                        'serial',
+                        'company',
+                        'category',
+                        'license_name',
+                        'license_email',
+                        'free_seats_count',
+                        'seats',
+                        'termination_date',
+                        'depreciation_id',
+                        'min_amt',
+                    ];
+                $sort = in_array($request->input('sort'), $allowed_columns) ? e($request->input('sort')) : 'created_at';
+                $licenses = $licenses->orderBy($sort, $order);
+                break;
+        }
+
+        $total = $licenses->count();
+
+        $licenses = $licenses->skip($offset)->take($limit)->get();
+        return (new LicensesTransformer)->transformLicenses($licenses, $total);
+
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        //
+        $this->authorize('create', License::class);
+        $license = new License;
+        $license->fill($request->all());
+
+        if ($license->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $license, trans('admin/licenses/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $license->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', License::class);
+        $license = License::withCount('freeSeats')->findOrFail($id);
+        $license = $license->load('assignedusers', 'licenseSeats.user', 'licenseSeats.asset');
+
+        return (new LicensesTransformer)->transformLicense($license);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        //
+        $this->authorize('update', License::class);
+
+        $license = License::findOrFail($id);
+        $license->fill($request->all());
+
+        if ($license->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $license, trans('admin/licenses/message.update.success')));
+        }
+
+        return Helper::formatStandardApiResponse('error', null, $license->getErrors());
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        //
+        $license = License::findOrFail($id);
+        $this->authorize('delete', $license);
+
+        if ($license->assigned_seats_count == 0) {
+            // Delete the license and the associated license seats
+            DB::table('license_seats')
+                ->where('id', $license->id)
+                ->update(['assigned_to' => null, 'asset_id' => null]);
+
+            $licenseSeats = $license->licenseseats();
+            $licenseSeats->delete();
+            $license->delete();
+
+            // Redirect to the licenses management page
+            return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/licenses/message.delete.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/licenses/message.assoc_users')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+        $licenses = License::select([
+            'licenses.id',
+            'licenses.name',
+        ]);
+
+        if ($request->filled('search')) {
+            $licenses = $licenses->where('licenses.name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $licenses = $licenses->orderBy('name', 'ASC')->paginate(50);
+
+        return (new SelectlistTransformer)->transformSelectlist($licenses);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/LocationsController.php

@@ -0,0 +1,331 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Requests\ImageUploadRequest;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\LocationsTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Location;
+use Illuminate\Http\Request;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+
+class LocationsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Location::class);
+        $allowed_columns = [
+            'id',
+            'name',
+            'address',
+            'address2',
+            'city',
+            'state',
+            'country',
+            'zip',
+            'created_at',
+            'updated_at',
+            'manager_id',
+            'image',
+            'assigned_assets_count',
+            'users_count',
+            'assets_count',
+            'assigned_assets_count',
+            'assets_count',
+            'rtd_assets_count',
+            'currency',
+            'ldap_ou',
+            ];
+
+        $locations = Location::with('parent', 'manager', 'children')->select([
+            'locations.id',
+            'locations.name',
+            'locations.address',
+            'locations.address2',
+            'locations.city',
+            'locations.state',
+            'locations.zip',
+            'locations.phone',
+            'locations.fax',
+            'locations.country',
+            'locations.parent_id',
+            'locations.manager_id',
+            'locations.created_at',
+            'locations.updated_at',
+            'locations.image',
+            'locations.ldap_ou',
+            'locations.currency',
+        ])->withCount('assignedAssets as assigned_assets_count')
+            ->withCount('assets as assets_count')
+            ->withCount('rtd_assets as rtd_assets_count')
+            ->withCount('children as children_count')
+            ->withCount('users as users_count');
+
+        if ($request->filled('search')) {
+            $locations = $locations->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $locations->where('locations.name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('address')) {
+            $locations->where('locations.address', '=', $request->input('address'));
+        }
+
+        if ($request->filled('address2')) {
+            $locations->where('locations.address2', '=', $request->input('address2'));
+        }
+
+        if ($request->filled('city')) {
+            $locations->where('locations.city', '=', $request->input('city'));
+        }
+
+        if ($request->filled('zip')) {
+            $locations->where('locations.zip', '=', $request->input('zip'));
+        }
+
+        if ($request->filled('country')) {
+            $locations->where('locations.country', '=', $request->input('country'));
+        }
+
+        if ($request->filled('manager_id')) {
+            $locations->where('locations.manager_id', '=', $request->input('manager_id'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $locations->count()) ? $locations->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+
+
+
+        switch ($request->input('sort')) {
+            case 'parent':
+                $locations->OrderParent($order);
+                break;
+            case 'manager':
+                $locations->OrderManager($order);
+                break;
+            default:
+                $locations->orderBy($sort, $order);
+                break;
+        }
+
+
+        $total = $locations->count();
+        $locations = $locations->skip($offset)->take($limit)->get();
+
+        return (new LocationsTransformer)->transformLocations($locations, $total);
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Location::class);
+        $location = new Location;
+        $location->fill($request->all());
+        $location = $request->handleImages($location);
+
+        if ($location->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', (new LocationsTransformer)->transformLocation($location), trans('admin/locations/message.create.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $location->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Location::class);
+        $location = Location::with('parent', 'manager', 'children')
+            ->select([
+                'locations.id',
+                'locations.name',
+                'locations.address',
+                'locations.address2',
+                'locations.city',
+                'locations.state',
+                'locations.zip',
+                'locations.country',
+                'locations.parent_id',
+                'locations.manager_id',
+                'locations.created_at',
+                'locations.updated_at',
+                'locations.image',
+                'locations.currency',
+            ])
+            ->withCount('assignedAssets as assigned_assets_count')
+            ->withCount('assets as assets_count')
+            ->withCount('rtd_assets as rtd_assets_count')
+            ->withCount('users as users_count')
+            ->findOrFail($id);
+
+        return (new LocationsTransformer)->transformLocation($location);
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Location::class);
+        $location = Location::findOrFail($id);
+
+        $location->fill($request->all());
+        $location = $request->handleImages($location);
+
+        if ($location->isValid()) {
+
+            $location->save();
+            return response()->json(
+                Helper::formatStandardApiResponse(
+                    'success',
+                    (new LocationsTransformer)->transformLocation($location),
+                    trans('admin/locations/message.update.success')
+                )
+            );
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $location->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Location::class);
+        $location = Location::withCount('assignedAssets as assigned_assets_count')
+            ->withCount('assets as assets_count')
+            ->withCount('rtd_assets as rtd_assets_count')
+            ->withCount('children as children_count')
+            ->withCount('users as users_count')
+            ->findOrFail($id);
+
+        if (! $location->isDeletable()) {
+            return response()
+                    ->json(Helper::formatStandardApiResponse('error', null, trans('admin/companies/message.assoc_users')));
+        }
+        $this->authorize('delete', $location);
+        $location->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/locations/message.delete.success')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * This is handled slightly differently as of ~4.7.8-pre, as
+     * we have to do some recursive magic to get the hierarchy to display
+     * properly when looking at the parent/child relationship in the
+     * rich menus.
+     *
+     * This means we can't use the normal pagination that we use elsewhere
+     * in our selectlists, since we have to get the full set before we can
+     * determine which location is parent/child/grandchild, etc.
+     *
+     * This also means that hierarchy display gets a little funky when people
+     * use the Select2 search functionality, but there's not much we can do about
+     * that right now.
+     *
+     * As a result, instead of paginating as part of the query, we have to grab
+     * the entire data set, and then invoke a paginator manually and pass that
+     * through to the SelectListTransformer.
+     *
+     * Many thanks to @uberbrady for the help getting this working better.
+     * Recursion still sucks, but I guess he doesn't have to get in the
+     * sea... this time.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+        // If a user is in the process of editing their profile, as determined by the referrer,
+        // then we check that they have permission to edit their own location.
+        // Otherwise, we do our normal check that they can view select lists.
+        $request->headers->get('referer') === route('profile')
+            ? $this->authorize('self.edit_location')
+            : $this->authorize('view.selectlists');
+
+        $locations = Location::select([
+            'locations.id',
+            'locations.name',
+            'locations.parent_id',
+            'locations.image',
+        ]);
+
+        $page = 1;
+        if ($request->filled('page')) {
+            $page = $request->input('page');
+        }
+
+        if ($request->filled('search')) {
+            $locations = $locations->where('locations.name', 'LIKE', '%'.$request->input('search').'%');
+        }
+
+        $locations = $locations->orderBy('name', 'ASC')->get();
+
+        $locations_with_children = [];
+
+        foreach ($locations as $location) {
+            if (! array_key_exists($location->parent_id, $locations_with_children)) {
+                $locations_with_children[$location->parent_id] = [];
+            }
+            $locations_with_children[$location->parent_id][] = $location;
+        }
+
+        if ($request->filled('search')) {
+            $locations_formatted = $locations;
+        } else {
+            $location_options = Location::indenter($locations_with_children);
+            $locations_formatted = new Collection($location_options);
+        }
+
+        $paginated_results = new LengthAwarePaginator($locations_formatted->forPage($page, 500), $locations_formatted->count(), 500, $page, []);
+
+        //return [];
+        return (new SelectlistTransformer)->transformSelectlist($paginated_results);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/ManufacturersController.php

@@ -0,0 +1,235 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\ManufacturersTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Models\Actionlog;
+use App\Models\Manufacturer;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Storage;
+
+class ManufacturersController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Manufacturer::class);
+        $allowed_columns = ['id', 'name', 'url', 'support_url', 'support_email', 'warranty_lookup_url', 'support_phone', 'created_at', 'updated_at', 'image', 'assets_count', 'consumables_count', 'components_count', 'licenses_count'];
+
+        $manufacturers = Manufacturer::select(
+            ['id', 'name', 'url', 'support_url', 'warranty_lookup_url', 'support_email', 'support_phone', 'created_at', 'updated_at', 'image', 'deleted_at']
+        )->withCount('assets as assets_count')->withCount('licenses as licenses_count')->withCount('consumables as consumables_count')->withCount('accessories as accessories_count');
+
+        if ($request->input('deleted') == 'true') {
+            $manufacturers->onlyTrashed();
+        }
+
+        if ($request->filled('search')) {
+            $manufacturers = $manufacturers->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $manufacturers->where('name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('url')) {
+            $manufacturers->where('url', '=', $request->input('url'));
+        }
+
+        if ($request->filled('support_url')) {
+            $manufacturers->where('support_url', '=', $request->input('support_url'));
+        }
+
+        if ($request->filled('warranty_lookup_url')) {
+            $manufacturers->where('warranty_lookup_url', '=', $request->input('warranty_lookup_url'));
+        }
+
+        if ($request->filled('support_phone')) {
+            $manufacturers->where('support_phone', '=', $request->input('support_phone'));
+        }
+
+        if ($request->filled('support_email')) {
+            $manufacturers->where('support_email', '=', $request->input('support_email'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $manufacturers->count()) ? $manufacturers->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $manufacturers->orderBy($sort, $order);
+
+        $total = $manufacturers->count();
+        $manufacturers = $manufacturers->skip($offset)->take($limit)->get();
+
+        return (new ManufacturersTransformer)->transformManufacturers($manufacturers, $total);
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Manufacturer::class);
+        $manufacturer = new Manufacturer;
+        $manufacturer->fill($request->all());
+        $manufacturer = $request->handleImages($manufacturer);
+
+        if ($manufacturer->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $manufacturer, trans('admin/manufacturers/message.create.success')));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, $manufacturer->getErrors()));
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Manufacturer::class);
+        $manufacturer = Manufacturer::withCount('assets as assets_count')->withCount('licenses as licenses_count')->withCount('consumables as consumables_count')->withCount('accessories as accessories_count')->findOrFail($id);
+
+        return (new ManufacturersTransformer)->transformManufacturer($manufacturer);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Manufacturer::class);
+        $manufacturer = Manufacturer::findOrFail($id);
+        $manufacturer->fill($request->all());
+        $manufacturer = $request->handleImages($manufacturer);
+
+        if ($manufacturer->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $manufacturer, trans('admin/manufacturers/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $manufacturer->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Manufacturer::class);
+        $manufacturer = Manufacturer::findOrFail($id);
+        $this->authorize('delete', $manufacturer);
+
+        if ($manufacturer->isDeletable()) {
+            $manufacturer->delete();
+            return response()->json(Helper::formatStandardApiResponse('success', null,  trans('admin/manufacturers/message.delete.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null,  trans('admin/manufacturers/message.assoc_users')));
+
+    }
+
+    /**
+     * Restore a given Manufacturer (mark as un-deleted)
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v6.3.4]
+     * @param int $id
+     * @return \Illuminate\Http\JsonResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function restore($id)
+    {
+        $this->authorize('delete', Manufacturer::class);
+
+        if ($manufacturer = Manufacturer::withTrashed()->find($id)) {
+
+            if ($manufacturer->deleted_at == '') {
+                return response()->json(Helper::formatStandardApiResponse('error', trans('general.not_deleted', ['item_type' => trans('general.manufacturer')])), 200);
+            }
+
+            if ($manufacturer->restore()) {
+
+                $logaction = new Actionlog();
+                $logaction->item_type = Manufacturer::class;
+                $logaction->item_id = $manufacturer->id;
+                $logaction->created_at = date('Y-m-d H:i:s');
+                $logaction->user_id = Auth::user()->id;
+                $logaction->logaction('restore');
+
+                return response()->json(Helper::formatStandardApiResponse('success', trans('admin/manufacturers/message.restore.success')), 200);
+            }
+
+            // Check validation to make sure we're not restoring an item with the same unique attributes as a non-deleted one
+            return response()->json(Helper::formatStandardApiResponse('error', trans('general.could_not_restore', ['item_type' => trans('general.manufacturer'), 'error' => $manufacturer->getErrors()->first()])), 200);
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null,  trans('admin/manufacturers/message.does_not_exist')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+
+        $this->authorize('view.selectlists');
+        $manufacturers = Manufacturer::select([
+            'id',
+            'name',
+            'image',
+        ]);
+
+        if ($request->filled('search')) {
+            $manufacturers = $manufacturers->where('name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $manufacturers = $manufacturers->orderBy('name', 'ASC')->paginate(50);
+
+        // Loop through and set some custom properties for the transformer to use.
+        // This lets us have more flexibility in special cases like assets, where
+        // they may not have a ->name value but we want to display something anyway
+        foreach ($manufacturers as $manufacturer) {
+            $manufacturer->use_text = $manufacturer->name;
+            $manufacturer->use_image = ($manufacturer->image) ? Storage::disk('public')->url('manufacturers/'.$manufacturer->image, $manufacturer->image) : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($manufacturers);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/PredefinedKitsController.php

@@ -0,0 +1,453 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\PredefinedKitsTransformer;
+use App\Models\PredefinedKit;
+use Illuminate\Http\Request;
+
+/**
+ *  @author [D. Minaev.] [<dmitriy.minaev.v@gmail.com>]
+ */
+class PredefinedKitsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', PredefinedKit::class);
+        $allowed_columns = ['id', 'name'];
+
+        $kits = PredefinedKit::query();
+
+        if ($request->filled('search')) {
+            $kits = $kits->TextSearch($request->input('search'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $kits->count()) ? $kits->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'desc' ? 'desc' : 'asc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'name';
+        $kits->orderBy($sort, $order);
+
+        $total = $kits->count();
+        $kits = $kits->skip($offset)->take($limit)->get();
+
+        return (new PredefinedKitsTransformer)->transformPredefinedKits($kits, $total);
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('create', PredefinedKit::class);
+        $kit = new PredefinedKit;
+        $kit->fill($request->all());
+
+        if ($kit->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.create_success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $kit->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($id);
+
+        return (new PredefinedKitsTransformer)->transformPredefinedKit($kit);
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id kit id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($id);
+        $kit->fill($request->all());
+
+        if ($kit->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.update_success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $kit->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($id);
+
+        // Delete childs
+        $kit->models()->detach();
+        $kit->licenses()->detach();
+        $kit->consumables()->detach();
+        $kit->accessories()->detach();
+
+        $kit->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/kits/general.delete_success')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+        $kits = PredefinedKit::select([
+            'id',
+            'name',
+        ]);
+
+        if ($request->filled('search')) {
+            $kits = $kits->where('name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $kits = $kits->orderBy('name', 'ASC')->paginate(50);
+
+        return (new SelectlistTransformer)->transformSelectlist($kits);
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function indexLicenses($kit_id)
+    {
+        $this->authorize('view', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $licenses = $kit->licenses;
+
+        return (new PredefinedKitsTransformer)->transformElements($licenses, $licenses->count());
+    }
+
+    /**
+     * Store the specified resource.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function storeLicense(Request $request, $kit_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+
+        $license_id = $request->get('license');
+        $relation = $kit->licenses();
+        if ($relation->find($license_id)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, ['license' => trans('admin/kits/general.license_error')]));
+        }
+
+        $relation->attach($license_id, ['quantity' => $quantity]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.license_added_success')));
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function updateLicense(Request $request, $kit_id, $license_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+        $kit->licenses()->syncWithoutDetaching([$license_id => ['quantity' =>  $quantity]]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.license_updated')));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function detachLicense($kit_id, $license_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+
+        $kit->licenses()->detach($license_id);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.delete_success')));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function indexModels($kit_id)
+    {
+        $this->authorize('view', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $models = $kit->models;
+
+        return (new PredefinedKitsTransformer)->transformElements($models, $models->count());
+    }
+
+    /**
+     * Store the specified resource.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function storeModel(Request $request, $kit_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+
+        $kit = PredefinedKit::findOrFail($kit_id);
+
+        $model_id = $request->get('model');
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+
+        $relation = $kit->models();
+        if ($relation->find($model_id)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, ['model' => 'Model already attached to kit']));
+        }
+        $relation->attach($model_id, ['quantity' => $quantity]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, 'Model added successfull'));
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function updateModel(Request $request, $kit_id, $model_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+        $kit->models()->syncWithoutDetaching([$model_id => ['quantity' =>  $quantity]]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.license_updated')));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function detachModel($kit_id, $model_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+
+        $kit->models()->detach($model_id);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.model_removed_success')));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function indexConsumables($kit_id)
+    {
+        $this->authorize('view', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $consumables = $kit->consumables;
+
+        return (new PredefinedKitsTransformer)->transformElements($consumables, $consumables->count());
+    }
+
+    /**
+     * Store the specified resource.
+     *
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function storeConsumable(Request $request, $kit_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+
+        $consumable_id = $request->get('consumable');
+        $relation = $kit->consumables();
+        if ($relation->find($consumable_id)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, ['consumable' => trans('admin/kits/general.consumable_error')]));
+        }
+
+        $relation->attach($consumable_id, ['quantity' => $quantity]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.consumable_added_success')));
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function updateConsumable(Request $request, $kit_id, $consumable_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+        $kit->consumables()->syncWithoutDetaching([$consumable_id => ['quantity' =>  $quantity]]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.consumable_updated')));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function detachConsumable($kit_id, $consumable_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+
+        $kit->consumables()->detach($consumable_id);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.consumable_deleted')));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function indexAccessories($kit_id)
+    {
+        $this->authorize('view', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $accessories = $kit->accessories;
+
+        return (new PredefinedKitsTransformer)->transformElements($accessories, $accessories->count());
+    }
+
+    /**
+     * Store the specified resource.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function storeAccessory(Request $request, $kit_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+
+        $accessory_id = $request->get('accessory');
+        $relation = $kit->accessories();
+        if ($relation->find($accessory_id)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, ['accessory' => trans('admin/kits/general.accessory_error')]));
+        }
+
+        $relation->attach($accessory_id, ['quantity' => $quantity]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.accessory_added_success')));
+    }
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function updateAccessory(Request $request, $kit_id, $accessory_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+        $quantity = $request->input('quantity', 1);
+        if ($quantity < 1) {
+            $quantity = 1;
+        }
+        $kit->accessories()->syncWithoutDetaching([$accessory_id => ['quantity' =>  $quantity]]);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.accessory_updated')));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @param  int  $kit_id
+     * @return \Illuminate\Http\Response
+     */
+    public function detachAccessory($kit_id, $accessory_id)
+    {
+        $this->authorize('update', PredefinedKit::class);
+        $kit = PredefinedKit::findOrFail($kit_id);
+
+        $kit->accessories()->detach($accessory_id);
+
+        return response()->json(Helper::formatStandardApiResponse('success', $kit, trans('admin/kits/general.accessory_deleted')));
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/ProfileController.php

@@ -0,0 +1,177 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Models\CheckoutRequest;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Http\Request;
+use Laravel\Passport\TokenRepository;
+use Illuminate\Contracts\Validation\Factory as ValidationFactory;
+use Illuminate\Support\Facades\Gate;
+use App\Models\CustomField;
+use DB;
+
+class ProfileController extends Controller
+{
+
+    /**
+     * The token repository implementation.
+     *
+     * @var \Laravel\Passport\TokenRepository
+     */
+    protected $tokenRepository;
+
+    /**
+     * Create a controller instance.
+     *
+     * @param  \Laravel\Passport\TokenRepository  $tokenRepository
+     * @param  \Illuminate\Contracts\Validation\Factory  $validation
+     * @return void
+     */
+    public function __construct(TokenRepository $tokenRepository, ValidationFactory $validation)
+    {
+        $this->validation = $validation;
+        $this->tokenRepository = $tokenRepository;
+    }
+
+    /**
+     * Display a listing of requested assets.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.3.0]
+     *
+     * @return array
+     */
+    public function requestedAssets()
+    {
+        $checkoutRequests = CheckoutRequest::where('user_id', '=', Auth::user()->id)->get();
+
+        $results = array();
+        $show_field = array();
+        $showable_fields = array();
+        $results['total'] = $checkoutRequests->count();
+
+        $all_custom_fields = CustomField::all(); //used as a 'cache' of custom fields throughout this page load
+        foreach ($all_custom_fields as $field) {
+            if (($field->field_encrypted=='0') && ($field->show_in_requestable_list=='1')) {
+                $showable_fields[] = $field->db_column_name();
+            }
+        }
+
+        foreach ($checkoutRequests as $checkoutRequest) {
+
+            // Make sure the asset and request still exist
+            if ($checkoutRequest && $checkoutRequest->itemRequested()) {
+                $assets = [
+                    'image' => e($checkoutRequest->itemRequested()->present()->getImageUrl()),
+                    'name' => e($checkoutRequest->itemRequested()->present()->name()),
+                    'type' => e($checkoutRequest->itemType()),
+                    'qty' => (int) $checkoutRequest->quantity,
+                    'location' => ($checkoutRequest->location()) ? e($checkoutRequest->location()->name) : null,
+                    'expected_checkin' => Helper::getFormattedDateObject($checkoutRequest->itemRequested()->expected_checkin, 'datetime'),
+                    'request_date' => Helper::getFormattedDateObject($checkoutRequest->created_at, 'datetime'),
+                ];
+
+                foreach ($showable_fields as $showable_field_name) {
+                    $show_field['custom_fields.'.$showable_field_name] =  $checkoutRequest->itemRequested()->{$showable_field_name};
+                }
+
+                // Merge the plain asset data and the custom fields data
+                $results['rows'][] = array_merge($assets, $show_field);
+            }
+
+
+        }
+
+        return $results;
+    }
+
+
+    /**
+     * Delete an API token
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v6.0.5]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function createApiToken(Request $request) {
+
+        if (!Gate::allows('self.api')) {
+            abort(403);
+        }
+
+        $accessTokenName = $request->input('name', 'Auth Token');
+
+        if ($accessToken = Auth::user()->createToken($accessTokenName)->accessToken) {
+
+            // Get the ID so we can return that with the payload
+            $token = DB::table('oauth_access_tokens')->where('user_id', '=', Auth::user()->id)->where('name','=',$accessTokenName)->orderBy('created_at', 'desc')->first();
+            $accessTokenData['id'] = $token->id;
+            $accessTokenData['token'] = $accessToken;
+            $accessTokenData['name'] = $accessTokenName;
+            return response()->json(Helper::formatStandardApiResponse('success', $accessTokenData, 'Personal access token '.$accessTokenName.' created successfully'));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, 'Token could not be created.'));
+
+    }
+
+
+    /**
+     * Delete an API token
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v6.0.5]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function deleteApiToken($tokenId) {
+
+        if (!Gate::allows('self.api')) {
+            abort(403);
+        }
+
+        $token = $this->tokenRepository->findForUser(
+            $tokenId, Auth::user()->getAuthIdentifier()
+        );
+
+        if (is_null($token)) {
+            return new Response('', 404);
+        }
+
+        $token->revoke();
+
+        return new Response('', Response::HTTP_NO_CONTENT);
+
+    }
+
+
+    /**
+     * Show user's API tokens
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v6.0.5]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function showApiTokens(Request $request) {
+
+        if (!Gate::allows('self.api')) {
+            abort(403);
+        }
+        
+        $tokens = $this->tokenRepository->forUser(Auth::user()->getAuthIdentifier());
+        $token_values = $tokens->load('client')->filter(function ($token) {
+            return $token->client->personal_access_client && ! $token->revoked;
+        })->values();
+
+        return response()->json(Helper::formatStandardApiResponse('success', $token_values, null));
+
+    }
+
+
+
+}

SNIPE-IT/app/Http/Controllers/Api/ReportsController.php

@@ -0,0 +1,93 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\ActionlogsTransformer;
+use App\Models\Actionlog;
+use Illuminate\Http\Request;
+
+class ReportsController extends Controller
+{
+    /**
+     * Returns Activity Report JSON.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return View
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('reports.view');
+
+        $actionlogs = Actionlog::with('item', 'user', 'admin', 'target', 'location');
+
+        if ($request->filled('search')) {
+            $actionlogs = $actionlogs->TextSearch(e($request->input('search')));
+        }
+
+        if (($request->filled('target_type')) && ($request->filled('target_id'))) {
+            $actionlogs = $actionlogs->where('target_id', '=', $request->input('target_id'))
+                ->where('target_type', '=', 'App\\Models\\'.ucwords($request->input('target_type')));
+        }
+
+        if (($request->filled('item_type')) && ($request->filled('item_id'))) {
+            $actionlogs = $actionlogs->where(function($query) use ($request)
+            {
+                $query->where('item_id', '=', $request->input('item_id'))
+                ->where('item_type', '=', 'App\\Models\\'.ucwords($request->input('item_type')))
+                ->orWhere(function($query) use ($request)
+                {
+                    $query->where('target_id', '=', $request->input('item_id'))
+                    ->where('target_type', '=', 'App\\Models\\'.ucwords($request->input('item_type')));
+                });
+            });
+        }
+
+        if ($request->filled('action_type')) {
+            $actionlogs = $actionlogs->where('action_type', '=', $request->input('action_type'))->orderBy('created_at', 'desc');
+        }
+
+        if ($request->filled('user_id')) {
+            $actionlogs = $actionlogs->where('user_id', '=', $request->input('user_id'));
+        }
+
+        if ($request->filled('action_source')) {
+            $actionlogs = $actionlogs->where('action_source', '=', $request->input('action_source'))->orderBy('created_at', 'desc');
+        }
+
+        if ($request->filled('remote_ip')) {
+            $actionlogs = $actionlogs->where('remote_ip', '=', $request->input('remote_ip'))->orderBy('created_at', 'desc');
+        }
+
+        if ($request->filled('uploads')) {
+            $actionlogs = $actionlogs->whereNotNull('filename')->orderBy('created_at', 'desc');
+        }
+
+        $allowed_columns = [
+            'id',
+            'created_at',
+            'target_id',
+            'user_id',
+            'accept_signature',
+            'action_type',
+            'note',
+            'remote_ip',
+            'user_agent',
+            'action_source',
+        ];
+
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $actionlogs->count()) ? $actionlogs->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $sort = in_array($request->input('sort'), $allowed_columns) ? e($request->input('sort')) : 'created_at';
+        $order = ($request->input('order') == 'asc') ? 'asc' : 'desc';
+        $total = $actionlogs->count();
+
+        $actionlogs = $actionlogs->orderBy($sort, $order)->skip($offset)->take($limit)->get();
+
+        return response()->json((new ActionlogsTransformer)->transformActionlogs($actionlogs, $total), 200, ['Content-Type' => 'application/json;charset=utf8'], JSON_UNESCAPED_UNICODE);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/SettingsController.php

@@ -0,0 +1,325 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Helpers\StorageHelper;
+use App\Http\Transformers\DatatablesTransformer;
+use Illuminate\Http\Request;
+use App\Http\Controllers\Controller;
+use App\Models\Ldap;
+use App\Models\Setting;
+use Mail;
+use App\Notifications\SlackTest;
+use App\Notifications\MailTest;
+use GuzzleHttp\Client;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator; 
+use App\Http\Requests\SlackSettingsRequest;
+use App\Http\Transformers\LoginAttemptsTransformer;
+
+
+class SettingsController extends Controller
+{
+
+
+    public function ldaptest()
+    {
+        $settings = Setting::getSettings();
+
+        if ($settings->ldap_enabled!='1') {
+            \Log::debug('LDAP is not enabled cannot test.');
+            return response()->json(['message' => 'LDAP is not enabled, cannot test.'], 400);
+        }
+
+        \Log::debug('Preparing to test LDAP connection');
+
+        $message = []; //where we collect together test messages
+        try {
+            $connection = Ldap::connectToLdap();
+            try {
+                $message['bind'] = ['message' => 'Successfully bound to LDAP server.'];
+                \Log::debug('attempting to bind to LDAP for LDAP test');
+                Ldap::bindAdminToLdap($connection);
+                $message['login'] = [
+                    'message' => 'Successfully connected to LDAP server.',
+                ];
+
+                $users = collect(Ldap::findLdapUsers(null,10))->filter(function ($value, $key) {
+                    return is_int($key);
+                })->slice(0, 10)->map(function ($item) use ($settings) {
+                    return (object) [
+                        'username'        => $item[$settings['ldap_username_field']][0] ?? null,
+                        'employee_number' => $item[$settings['ldap_emp_num']][0] ?? null,
+                        'lastname'        => $item[$settings['ldap_lname_field']][0] ?? null,
+                        'firstname'       => $item[$settings['ldap_fname_field']][0] ?? null,
+                        'email'           => $item[$settings['ldap_email']][0] ?? null,
+                    ];
+                });
+                if ($users->count() > 0) {
+                    $message['user_sync'] = [
+                        'users' => $users,
+                    ];
+                } else {
+                    $message['user_sync'] = [
+                        'message' => 'Connection to LDAP was successful, however there were no users returned from your query. You should confirm the Base Bind DN above.',
+                    ];
+    
+                    return response()->json($message, 400);
+                }
+
+                return response()->json($message, 200);
+            } catch (\Exception $e) {
+                \Log::debug('Bind failed');
+                \Log::debug("Exception was: ".$e->getMessage());
+                return response()->json(['message' => $e->getMessage()], 400);
+                //return response()->json(['message' => $e->getMessage()], 500);
+            }
+        } catch (\Exception $e) {
+            \Log::debug('Connection failed but we cannot debug it any further on our end.');
+            return response()->json(['message' => $e->getMessage()], 500);
+        }
+
+
+    }
+
+    public function ldaptestlogin(Request $request)
+    {
+
+        if (Setting::getSettings()->ldap_enabled != '1') {
+            \Log::debug('LDAP is not enabled. Cannot test.');
+            return response()->json(['message' => 'LDAP is not enabled, cannot test.'], 400);
+        }
+
+
+        $rules = array(
+            'ldaptest_user' => 'required',
+            'ldaptest_password' => 'required'
+        );
+
+        $validator = Validator::make($request->all(), $rules);
+        if ($validator->fails()) {
+            \Log::debug('LDAP Validation test failed.');
+            $validation_errors = implode(' ',$validator->errors()->all());
+            return response()->json(['message' => $validator->errors()->all()], 400);
+        }
+        
+
+
+        \Log::debug('Preparing to test LDAP login');
+        try {
+            $connection = Ldap::connectToLdap();
+            try {
+                Ldap::bindAdminToLdap($connection);
+                \Log::debug('Attempting to bind to LDAP for LDAP test');
+                try {
+                    $ldap_user = Ldap::findAndBindUserLdap($request->input('ldaptest_user'), $request->input('ldaptest_password'));
+                    if ($ldap_user) {
+                        \Log::debug('It worked! '. $request->input('ldaptest_user').' successfully binded to LDAP.');
+                        return response()->json(['message' => 'It worked! '. $request->input('ldaptest_user').' successfully binded to LDAP.'], 200);
+                    }
+                    return response()->json(['message' => 'Login Failed. '. $request->input('ldaptest_user').' did not successfully bind to LDAP.'], 400);
+
+                } catch (\Exception $e) {
+                    \Log::debug('LDAP login failed');
+                    return response()->json(['message' => $e->getMessage()], 400);
+                }
+
+            } catch (\Exception $e) {
+                \Log::debug('Bind failed');
+                return response()->json(['message' => $e->getMessage()], 400);
+                //return response()->json(['message' => $e->getMessage()], 500);
+            }
+        } catch (\Exception $e) {
+            \Log::debug('Connection failed');
+            return response()->json(['message' => $e->getMessage()], 500);
+        }
+
+
+    }
+
+    /**
+     * Test the email configuration
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @return JsonResponse
+     */
+    public function ajaxTestEmail()
+    {
+        if (!config('app.lock_passwords')) {
+            try {
+                Notification::send(Setting::first(), new MailTest());
+                return response()->json(['message' => 'Mail sent to '.config('mail.reply_to.address')], 200);
+            } catch (\Exception $e) {
+                return response()->json(['message' => $e->getMessage()], 500);
+            }
+        }
+        return response()->json(['message' => 'Mail would have been sent, but this application is in demo mode! '], 200);
+
+    }
+
+
+    /**
+     * Delete server-cached barcodes
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v5.0.0]
+     * @return JsonResponse
+     */
+    public function purgeBarcodes()
+    {
+        $file_count = 0;
+        $files = Storage::disk('public')->files('barcodes');
+
+        foreach ($files as $file) { // iterate files
+
+            $file_parts = explode('.', $file);
+            $extension = end($file_parts);
+            \Log::debug($extension);
+
+            // Only generated barcodes would have a .png file extension
+            if ($extension == 'png') {
+                \Log::debug('Deleting: '.$file);
+
+
+                try {
+                    Storage::disk('public')->delete($file);
+                    \Log::debug('Deleting: '.$file);
+                    $file_count++;
+                } catch (\Exception $e) {
+                    \Log::debug($e);
+                }
+            }
+        }
+
+        return response()->json(['message' => 'Deleted '.$file_count.' barcodes'], 200);
+    }
+
+
+
+
+
+    /**
+     * Get a list of login attempts
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v5.0.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return array | JsonResponse
+     */
+    public function showLoginAttempts(Request $request)
+    {
+        $allowed_columns = ['id', 'username', 'remote_ip', 'user_agent', 'successful', 'created_at'];
+
+        $login_attempts = DB::table('login_attempts');
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->get('sort'), $allowed_columns) ? $request->get('sort') : 'created_at';
+
+        $total = $login_attempts->count();
+        $login_attempts->orderBy($sort, $order);
+        $login_attempt_results = $login_attempts->skip(request('offset', 0))->take(request('limit', 20))->get();
+
+        return (new LoginAttemptsTransformer)->transformLoginAttempts($login_attempt_results, $total);
+    }
+
+
+    /**
+     * Lists backup files
+     *
+     * @author [A. Gianotto]
+     * @return array | JsonResponse
+     */
+    public function listBackups() {
+        $settings = Setting::getSettings();
+        $path = 'app/backups';
+        $backup_files = Storage::files($path);
+        $files_raw = [];
+        $count = 0;
+
+        if (count($backup_files) > 0) {
+
+            for ($f = 0; $f < count($backup_files); $f++) {
+
+                // Skip dotfiles like .gitignore and .DS_STORE
+                if ((substr(basename($backup_files[$f]), 0, 1) != '.')) {
+                    $file_timestamp = Storage::lastModified($backup_files[$f]);
+
+                    $files_raw[] = [
+                        'filename' => basename($backup_files[$f]),
+                        'filesize' => Setting::fileSizeConvert(Storage::size($backup_files[$f])),
+                        'modified_value' => $file_timestamp,
+                        'modified_display' => date($settings->date_display_format.' '.$settings->time_display_format, $file_timestamp),
+                        'backup_url' => config('app.url').'/settings/backups/download/'.basename($backup_files[$f]),
+
+                    ];
+                    $count++;
+                }
+
+            }
+        }
+
+        $files = array_reverse($files_raw);
+        return (new DatatablesTransformer)->transformDatatables($files, $count);
+
+    }
+
+
+    /**
+     * Downloads a backup file.
+     * We use response()->download() here instead of Storage::download() because Storage::download()
+     * exhausts memory on larger files.
+     *
+     * @author [A. Gianotto]
+     * @return JsonResponse|\Symfony\Component\HttpFoundation\BinaryFileResponse
+     */
+    public function downloadBackup($file) {
+
+        $path = storage_path('app/backups');
+        
+        if (Storage::exists('app/backups/'.$file)) {
+            $headers = ['ContentType' => 'application/zip'];
+            return response()->download($path.'/'.$file, $file, $headers);
+        } else {
+            return response()->json(Helper::formatStandardApiResponse('error', null,  trans('general.file_not_found')), 404);
+        }
+
+    }
+
+    /**
+     * Determines and downloads the latest backup
+     *
+     * @author [A. Gianotto]
+     * @since [v6.3.1]
+     * @return JsonResponse|\Symfony\Component\HttpFoundation\BinaryFileResponse
+     */
+    public function downloadLatestBackup() {
+
+        $fileData = collect();
+        foreach (Storage::files('app/backups') as $file) {
+            if (pathinfo($file, PATHINFO_EXTENSION) == 'zip') {
+                $fileData->push([
+                    'file' => $file,
+                    'date' => Storage::lastModified($file)
+                ]);
+            }
+        }
+
+        $newest = $fileData->sortByDesc('date')->first();
+        if (Storage::exists($newest['file'])) {
+            $headers = ['ContentType' => 'application/zip'];
+            return response()->download(storage_path($newest['file']), basename($newest['file']), $headers);
+        } else {
+            return response()->json(Helper::formatStandardApiResponse('error', null,  trans('general.file_not_found')), 404);
+        }
+
+
+    }
+
+
+}

SNIPE-IT/app/Http/Controllers/Api/StatuslabelsController.php

@@ -0,0 +1,336 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\AssetsTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Http\Transformers\StatuslabelsTransformer;
+use App\Models\Asset;
+use App\Models\Statuslabel;
+use Illuminate\Http\Request;
+use App\Http\Transformers\PieChartTransformer;
+use Illuminate\Support\Arr;
+
+class StatuslabelsController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Statuslabel::class);
+        $allowed_columns = ['id', 'name', 'created_at', 'assets_count', 'color', 'notes', 'default_label'];
+
+        $statuslabels = Statuslabel::withCount('assets as assets_count');
+
+        if ($request->filled('search')) {
+            $statuslabels = $statuslabels->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $statuslabels->where('name', '=', $request->input('name'));
+        }
+
+
+        // if a status_type is passed, filter by that
+        if ($request->filled('status_type')) {
+            if (strtolower($request->input('status_type')) == 'pending') {
+                $statuslabels = $statuslabels->Pending();
+            } elseif (strtolower($request->input('status_type')) == 'archived') {
+                $statuslabels = $statuslabels->Archived();
+            } elseif (strtolower($request->input('status_type')) == 'deployable') {
+                $statuslabels = $statuslabels->Deployable();
+            } elseif (strtolower($request->input('status_type')) == 'undeployable') {
+                $statuslabels = $statuslabels->Undeployable();
+            }
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $statuslabels->count()) ? $statuslabels->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $statuslabels->orderBy($sort, $order);
+
+        $total = $statuslabels->count();
+        $statuslabels = $statuslabels->skip($offset)->take($limit)->get();
+
+        return (new StatuslabelsTransformer)->transformStatuslabels($statuslabels, $total);
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(Request $request)
+    {
+        $this->authorize('create', Statuslabel::class);
+        $request->except('deployable', 'pending', 'archived');
+
+        if (! $request->filled('type')) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, ['type' => ['Status label type is required.']]), 500);
+        }
+
+        $statuslabel = new Statuslabel;
+        $statuslabel->fill($request->all());
+
+        $statusType = Statuslabel::getStatuslabelTypesForDB($request->input('type'));
+        $statuslabel->deployable = $statusType['deployable'];
+        $statuslabel->pending = $statusType['pending'];
+        $statuslabel->archived = $statusType['archived'];
+        $statuslabel->color             =  $request->input('color');
+        $statuslabel->show_in_nav       =  $request->input('show_in_nav', 0);
+        $statuslabel->default_label     =  $request->input('default_label', 0);
+
+
+        if ($statuslabel->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $statuslabel, trans('admin/statuslabels/message.create.success')));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, $statuslabel->getErrors()));
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Statuslabel::class);
+        $statuslabel = Statuslabel::findOrFail($id);
+
+        return (new StatuslabelsTransformer)->transformStatuslabel($statuslabel);
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(Request $request, $id)
+    {
+        $this->authorize('update', Statuslabel::class);
+        $statuslabel = Statuslabel::findOrFail($id);
+        
+        $request->except('deployable', 'pending', 'archived');
+
+
+        if (! $request->filled('type')) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Status label type is required.'));
+        }
+
+        $statuslabel->fill($request->all());
+
+        $statusType = Statuslabel::getStatuslabelTypesForDB($request->input('type'));
+        $statuslabel->deployable = $statusType['deployable'];
+        $statuslabel->pending = $statusType['pending'];
+        $statuslabel->archived = $statusType['archived'];
+        $statuslabel->color             =  $request->input('color');
+        $statuslabel->show_in_nav       =  $request->input('show_in_nav', 0);
+        $statuslabel->default_label     =  $request->input('default_label', 0);
+
+        if ($statuslabel->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $statuslabel, trans('admin/statuslabels/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $statuslabel->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Statuslabel::class);
+        $statuslabel = Statuslabel::findOrFail($id);
+        $this->authorize('delete', $statuslabel);
+
+        // Check that there are no assets associated
+        if ($statuslabel->assets()->count() == 0) {
+            $statuslabel->delete();
+
+            return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/statuslabels/message.delete.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/statuslabels/message.assoc_assets')));
+    }
+
+
+
+     /**
+     * Show a count of assets by status label for pie chart
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @return array
+     */
+    public function getAssetCountByStatuslabel()
+    {
+        $this->authorize('view', Statuslabel::class);
+        $statuslabels = Statuslabel::withCount('assets')->get();
+        $total = Array();
+
+        foreach ($statuslabels as $statuslabel) {
+
+            $total[$statuslabel->name]['label'] = $statuslabel->name;
+            $total[$statuslabel->name]['count'] = $statuslabel->assets_count;
+
+            if ($statuslabel->color != '') {
+                $total[$statuslabel->name]['color'] = $statuslabel->color;
+            }
+        }
+
+        return (new PieChartTransformer())->transformPieChartDate($total);
+
+    }
+
+    /**
+     * Show a count of assets by meta status type for pie chart
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v6.0.11]
+     * @return array
+     */
+    public function getAssetCountByMetaStatus()
+    {
+        $this->authorize('view', Statuslabel::class);
+
+        $total['rtd']['label'] = trans('general.ready_to_deploy');
+        $total['rtd']['count'] = Asset::RTD()->count();
+
+        $total['deployed']['label'] = trans('general.deployed');
+        $total['deployed']['count'] = Asset::Deployed()->count();
+
+        $total['archived']['label'] = trans('general.archived');
+        $total['archived']['count'] = Asset::Archived()->count();
+
+        $total['pending']['label'] = trans('general.pending');
+        $total['pending']['count'] = Asset::Pending()->count();
+
+        $total['undeployable']['label'] = trans('general.undeployable');
+        $total['undeployable']['count'] = Asset::Undeployable()->count();
+
+        return (new PieChartTransformer())->transformPieChartDate($total);
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function assets(Request $request, $id)
+    {
+        $this->authorize('view', Statuslabel::class);
+        $this->authorize('index', Asset::class);
+        $assets = Asset::where('status_id', '=', $id)->with('assignedTo');
+
+        $allowed_columns = [
+            'id',
+            'name',
+        ];
+
+        $offset = request('offset', 0);
+        $limit = $request->input('limit', 50);
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $assets->orderBy($sort, $order);
+
+        $total = $assets->count();
+        $assets = $assets->skip($offset)->take($limit)->get();
+
+
+        return (new AssetsTransformer)->transformAssets($assets, $total);
+    }
+
+
+    /**
+     * Returns a boolean response based on whether the status label
+     * is one that is deployable.
+     *
+     * This is used by the hardware create/edit view to determine whether
+     * we should provide a dropdown of users for them to check the asset out to.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return bool
+     */
+    public function checkIfDeployable($id)
+    {
+        $statuslabel = Statuslabel::findOrFail($id);
+        if ($statuslabel->getStatuslabelType() == 'deployable') {
+            return '1';
+        }
+
+        return '0';
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v6.1.1]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+
+        $this->authorize('view.selectlists');
+        $statuslabels = Statuslabel::orderBy('default_label', 'desc')->orderBy('name', 'asc')->orderBy('deployable', 'desc');
+
+        if ($request->filled('search')) {
+            $statuslabels = $statuslabels->where('name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        if ($request->filled('deployable')) {
+            $statuslabels = $statuslabels->where('deployable', '=', '1');
+        }
+
+        if ($request->filled('pending')) {
+            $statuslabels = $statuslabels->where('pending', '=', '1');
+        }
+
+        if ($request->filled('archived')) {
+            $statuslabels = $statuslabels->where('archived', '=', '1');
+        }
+
+        $statuslabels = $statuslabels->orderBy('name', 'ASC')->paginate(50);
+
+        // Loop through and set some custom properties for the transformer to use.
+        // This lets us have more flexibility in special cases like assets, where
+        // they may not have a ->name value but we want to display something anyway
+        foreach ($statuslabels as $statuslabel) {
+            $statuslabels->use_text = $statuslabel->name;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($statuslabels);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/SuppliersController.php

@@ -0,0 +1,239 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Http\Transformers\SuppliersTransformer;
+use App\Models\Supplier;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Storage;
+
+class SuppliersController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', Supplier::class);
+        $allowed_columns = ['
+            id',
+            'name',
+            'address',
+            'phone',
+            'contact',
+            'fax',
+            'email',
+            'image',
+            'assets_count',
+            'licenses_count',
+            'accessories_count',
+            'components_count',
+            'consumables_count',
+            'url',
+        ];
+        
+        $suppliers = Supplier::select(
+                ['id', 'name', 'address', 'address2', 'city', 'state', 'country', 'fax', 'phone', 'email', 'contact', 'created_at', 'updated_at', 'deleted_at', 'image', 'notes', 'url'])
+                    ->withCount('assets as assets_count')
+                    ->withCount('licenses as licenses_count')
+                    ->withCount('accessories as accessories_count')
+                    ->withCount('components as components_count')
+                    ->withCount('consumables as consumables_count');
+
+
+        if ($request->filled('search')) {
+            $suppliers = $suppliers->TextSearch($request->input('search'));
+        }
+
+        if ($request->filled('name')) {
+            $suppliers->where('name', '=', $request->input('name'));
+        }
+
+        if ($request->filled('address')) {
+            $suppliers->where('address', '=', $request->input('address'));
+        }
+
+        if ($request->filled('address2')) {
+            $suppliers->where('address2', '=', $request->input('address2'));
+        }
+
+        if ($request->filled('city')) {
+            $suppliers->where('city', '=', $request->input('city'));
+        }
+
+        if ($request->filled('zip')) {
+            $suppliers->where('zip', '=', $request->input('zip'));
+        }
+
+        if ($request->filled('country')) {
+            $suppliers->where('country', '=', $request->input('country'));
+        }
+
+        if ($request->filled('fax')) {
+            $suppliers->where('fax', '=', $request->input('fax'));
+        }
+
+        if ($request->filled('email')) {
+            $suppliers->where('email', '=', $request->input('email'));
+        }
+
+        if ($request->filled('url')) {
+            $suppliers->where('url', '=', $request->input('url'));
+        }
+
+        if ($request->filled('notes')) {
+            $suppliers->where('notes', '=', $request->input('notes'));
+        }
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $suppliers->count()) ? $suppliers->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort = in_array($request->input('sort'), $allowed_columns) ? $request->input('sort') : 'created_at';
+        $suppliers->orderBy($sort, $order);
+
+        $total = $suppliers->count();
+        $suppliers = $suppliers->skip($offset)->take($limit)->get();
+
+        return (new SuppliersTransformer)->transformSuppliers($suppliers, $total);
+    }
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Supplier::class);
+        $supplier = new Supplier;
+        $supplier->fill($request->all());
+        $supplier = $request->handleImages($supplier);
+
+        if ($supplier->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $supplier, trans('admin/suppliers/message.create.success')));
+        }
+        return response()->json(Helper::formatStandardApiResponse('error', null, $supplier->getErrors()));
+
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Supplier::class);
+        $supplier = Supplier::findOrFail($id);
+
+        return (new SuppliersTransformer)->transformSupplier($supplier);
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \App\Http\Requests\ImageUploadRequest  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(ImageUploadRequest $request, $id)
+    {
+        $this->authorize('update', Supplier::class);
+        $supplier = Supplier::findOrFail($id);
+        $supplier->fill($request->all());
+        $supplier = $request->handleImages($supplier);
+
+        if ($supplier->save()) {
+            return response()->json(Helper::formatStandardApiResponse('success', $supplier, trans('admin/suppliers/message.update.success')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $supplier->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', Supplier::class);
+        $supplier = Supplier::with('asset_maintenances', 'assets', 'licenses')->withCount('asset_maintenances as asset_maintenances_count', 'assets as assets_count', 'licenses as licenses_count')->findOrFail($id);
+        $this->authorize('delete', $supplier);
+
+
+        if ($supplier->assets_count > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/suppliers/message.delete.assoc_assets', ['asset_count' => (int) $supplier->assets_count])));
+        }
+
+        if ($supplier->asset_maintenances_count > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/suppliers/message.delete.assoc_maintenances', ['asset_maintenances_count' => $supplier->asset_maintenances_count])));
+        }
+
+        if ($supplier->licenses_count > 0) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/suppliers/message.delete.assoc_licenses', ['licenses_count' => (int) $supplier->licenses_count])));
+        }
+
+        $supplier->delete();
+
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/suppliers/message.delete.success')));
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+
+        $this->authorize('view.selectlists');
+
+        $suppliers = Supplier::select([
+            'id',
+            'name',
+            'image',
+        ]);
+
+        if ($request->filled('search')) {
+            $suppliers = $suppliers->where('suppliers.name', 'LIKE', '%'.$request->get('search').'%');
+        }
+
+        $suppliers = $suppliers->orderBy('name', 'ASC')->paginate(50);
+
+        // Loop through and set some custom properties for the transformer to use.
+        // This lets us have more flexibility in special cases like assets, where
+        // they may not have a ->name value but we want to display something anyway
+        foreach ($suppliers as $supplier) {
+            $supplier->use_text = $supplier->name;
+            $supplier->use_image = ($supplier->image) ? Storage::disk('public')->url('suppliers/'.$supplier->image, $supplier->image) : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($suppliers);
+    }
+}

SNIPE-IT/app/Http/Controllers/Api/UsersController.php

@@ -0,0 +1,755 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\SaveUserRequest;
+use App\Http\Transformers\AccessoriesTransformer;
+use App\Http\Transformers\AssetsTransformer;
+use App\Http\Transformers\ConsumablesTransformer;
+use App\Http\Transformers\LicensesTransformer;
+use App\Http\Transformers\SelectlistTransformer;
+use App\Http\Transformers\UsersTransformer;
+use App\Models\Actionlog;
+use App\Models\Asset;
+use App\Models\Company;
+use App\Models\License;
+use App\Models\User;
+use App\Notifications\CurrentInventory;
+use Auth;
+use Illuminate\Http\Request;
+use App\Http\Requests\ImageUploadRequest;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
+
+class UsersController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     *
+     * @return \Illuminate\Http\Response
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('view', User::class);
+
+        $users = User::select([
+            'users.activated',
+            'users.created_by',
+            'users.address',
+            'users.avatar',
+            'users.city',
+            'users.company_id',
+            'users.country',
+            'users.created_at',
+            'users.deleted_at',
+            'users.department_id',
+            'users.email',
+            'users.employee_num',
+            'users.first_name',
+            'users.id',
+            'users.jobtitle',
+            'users.last_login',
+            'users.last_name',
+            'users.locale',
+            'users.location_id',
+            'users.manager_id',
+            'users.notes',
+            'users.permissions',
+            'users.phone',
+            'users.state',
+            'users.two_factor_enrolled',
+            'users.two_factor_optin',
+            'users.updated_at',
+            'users.username',
+            'users.zip',
+            'users.remote',
+            'users.ldap_import',
+            'users.start_date',
+            'users.end_date',
+            'users.vip',
+            'users.autoassign_licenses',
+            'users.website',
+
+        ])->with('manager', 'groups', 'userloc', 'company', 'department', 'assets', 'licenses', 'accessories', 'consumables', 'createdBy',)
+            ->withCount('assets as assets_count', 'licenses as licenses_count', 'accessories as accessories_count', 'consumables as consumables_count');
+
+
+        if ($request->filled('activated')) {
+            $users = $users->where('users.activated', '=', $request->input('activated'));
+        }
+
+        if ($request->filled('company_id')) {
+            $users = $users->where('users.company_id', '=', $request->input('company_id'));
+        }
+
+        if ($request->filled('location_id')) {
+            $users = $users->where('users.location_id', '=', $request->input('location_id'));
+        }
+
+        if ($request->filled('created_by')) {
+            $users = $users->where('users.created_by', '=', $request->input('created_by'));
+        }
+
+        if ($request->filled('email')) {
+            $users = $users->where('users.email', '=', $request->input('email'));
+        }
+
+        if ($request->filled('username')) {
+            $users = $users->where('users.username', '=', $request->input('username'));
+        }
+
+        if ($request->filled('first_name')) {
+            $users = $users->where('users.first_name', '=', $request->input('first_name'));
+        }
+
+        if ($request->filled('last_name')) {
+            $users = $users->where('users.last_name', '=', $request->input('last_name'));
+        }
+
+        if ($request->filled('employee_num')) {
+            $users = $users->where('users.employee_num', '=', $request->input('employee_num'));
+        }
+
+        if ($request->filled('state')) {
+            $users = $users->where('users.state', '=', $request->input('state'));
+        }
+
+        if ($request->filled('country')) {
+            $users = $users->where('users.country', '=', $request->input('country'));
+        }
+
+        if ($request->filled('website')) {
+            $users = $users->where('users.website', '=', $request->input('website'));
+        }
+
+        if ($request->filled('zip')) {
+            $users = $users->where('users.zip', '=', $request->input('zip'));
+        }
+
+        if ($request->filled('group_id')) {
+            $users = $users->ByGroup($request->get('group_id'));
+        }
+
+        if ($request->filled('department_id')) {
+            $users = $users->where('users.department_id', '=', $request->input('department_id'));
+        }
+
+        if ($request->filled('manager_id')) {
+            $users = $users->where('users.manager_id','=',$request->input('manager_id'));
+        }
+
+        if ($request->filled('ldap_import')) {
+            $users = $users->where('ldap_import', '=', $request->input('ldap_import'));
+        }
+
+        if ($request->filled('remote')) {
+            $users = $users->where('remote', '=', $request->input('remote'));
+        }
+
+        if ($request->filled('vip')) {
+            $users = $users->where('vip', '=', $request->input('vip'));
+        }
+
+        if ($request->filled('two_factor_enrolled')) {
+            $users = $users->where('two_factor_enrolled', '=', $request->input('two_factor_enrolled'));
+        }
+
+        if ($request->filled('two_factor_optin')) {
+            $users = $users->where('two_factor_optin', '=', $request->input('two_factor_optin'));
+        }
+
+        if ($request->filled('start_date')) {
+            $users = $users->where('users.start_date', '=', $request->input('start_date'));
+        }
+
+        if ($request->filled('end_date')) {
+            $users = $users->where('users.end_date', '=', $request->input('end_date'));
+        }
+
+        if ($request->filled('assets_count')) {
+           $users->has('assets', '=', $request->input('assets_count'));
+        }
+
+        if ($request->filled('consumables_count')) {
+            $users->has('consumables', '=', $request->input('consumables_count'));
+        }
+
+        if ($request->filled('licenses_count')) {
+            $users->has('licenses', '=', $request->input('licenses_count'));
+        }
+
+        if ($request->filled('accessories_count')) {
+            $users->has('accessories', '=', $request->input('accessories_count'));
+        }
+
+        if ($request->filled('autoassign_licenses')) {
+            $users->where('autoassign_licenses', '=', $request->input('autoassign_licenses'));
+        }
+
+        if ($request->filled('search')) {
+            $users = $users->TextSearch($request->input('search'));
+        }
+
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+
+        switch ($request->input('sort')) {
+            case 'manager':
+                $users = $users->OrderManager($order);
+                break;
+            case 'location':
+                $users = $users->OrderLocation($order);
+                break;
+            case 'department':
+                $users = $users->OrderDepartment($order);
+                break;
+            case 'created_by':
+                $users = $users->OrderByCreatedBy($order);
+                break;
+            case 'company':
+                $users = $users->OrderCompany($order);
+                break;
+            case 'first_name':
+                $users->orderBy('first_name', $order);
+                $users->orderBy('last_name', $order);
+                break;
+            case 'last_name':
+                $users->orderBy('last_name', $order);
+                $users->orderBy('first_name', $order);
+                break;
+            default:
+                $allowed_columns =
+                    [
+                        'last_name',
+                        'first_name',
+                        'email',
+                        'jobtitle',
+                        'username',
+                        'employee_num',
+                        'assets',
+                        'accessories',
+                        'consumables',
+                        'licenses',
+                        'groups',
+                        'activated',
+                        'created_at',
+                        'two_factor_enrolled',
+                        'two_factor_optin',
+                        'last_login',
+                        'assets_count',
+                        'licenses_count',
+                        'consumables_count',
+                        'accessories_count',
+                        'phone',
+                        'address',
+                        'city',
+                        'state',
+                        'country',
+                        'zip',
+                        'id',
+                        'ldap_import',
+                        'two_factor_optin',
+                        'two_factor_enrolled',
+                        'remote',
+                        'vip',
+                        'start_date',
+                        'end_date',
+                        'autoassign_licenses',
+                        'website',
+                    ];
+
+                $sort = in_array($request->get('sort'), $allowed_columns) ? $request->get('sort') : 'first_name';
+                $users = $users->orderBy($sort, $order);
+                break;
+        }
+
+        if (($request->filled('deleted')) && ($request->input('deleted') == 'true')) {
+            $users = $users->onlyTrashed();
+        } elseif (($request->filled('all')) && ($request->input('all') == 'true')) {
+            $users = $users->withTrashed();
+        }
+
+        $users = Company::scopeCompanyables($users);
+
+
+        // Make sure the offset and limit are actually integers and do not exceed system limits
+        $offset = ($request->input('offset') > $users->count()) ? $users->count() : app('api_offset_value');
+        $limit = app('api_limit_value');
+
+        $total = $users->count();
+        $users = $users->skip($offset)->take($limit)->get();
+
+        return (new UsersTransformer)->transformUsers($users, $total);
+    }
+
+    /**
+     * Gets a paginated collection for the select2 menus
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0.16]
+     * @see \App\Http\Transformers\SelectlistTransformer
+     */
+    public function selectlist(Request $request)
+    {
+        $users = User::select(
+            [
+                'users.id',
+                'users.username',
+                'users.employee_num',
+                'users.first_name',
+                'users.last_name',
+                'users.gravatar',
+                'users.avatar',
+                'users.email',
+            ]
+            )->where('show_in_list', '=', '1');
+
+        $users = Company::scopeCompanyables($users);
+
+        if ($request->filled('search')) {
+            $users = $users->where(function ($query) use ($request) {
+                $query->SimpleNameSearch($request->get('search'))
+                    ->orWhere('username', 'LIKE', '%'.$request->get('search').'%')
+                    ->orWhere('employee_num', 'LIKE', '%'.$request->get('search').'%');
+            });
+        }
+
+        $users = $users->orderBy('last_name', 'asc')->orderBy('first_name', 'asc');
+        $users = $users->paginate(50);
+
+        foreach ($users as $user) {
+            $name_str = '';
+            if ($user->last_name != '') {
+                $name_str .= $user->last_name.', ';
+            }
+            $name_str .= $user->first_name;
+
+            if ($user->username != '') {
+                $name_str .= ' ('.$user->username.')';
+            }
+
+            if ($user->employee_num != '') {
+                $name_str .= ' - #'.$user->employee_num;
+            }
+
+            $user->use_text = $name_str;
+            $user->use_image = ($user->present()->gravatar) ? $user->present()->gravatar : null;
+        }
+
+        return (new SelectlistTransformer)->transformSelectlist($users);
+    }
+
+
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function store(SaveUserRequest $request)
+    {
+        $this->authorize('create', User::class);
+
+        $user = new User;
+        $user->fill($request->all());
+        $user->created_by = Auth::user()->id;
+
+        if ($request->has('permissions')) {
+            $permissions_array = $request->input('permissions');
+
+            // Strip out the superuser permission if the API user isn't a superadmin
+            if (! Auth::user()->isSuperUser()) {
+                unset($permissions_array['superuser']);
+            }
+            $user->permissions = $permissions_array;
+        }
+
+        // 
+        if ($request->filled('password')) {
+            $user->password = bcrypt($request->get('password'));
+        } else {
+            $user->password = $user->noPassword();
+        }
+
+        app('App\Http\Requests\ImageUploadRequest')->handleImages($user, 600, 'image', 'avatars', 'avatar');
+        
+        if ($user->save()) {
+            if ($request->filled('groups')) {
+                $user->groups()->sync($request->input('groups'));
+            } else {
+                $user->groups()->sync([]);
+            }
+
+            return response()->json(Helper::formatStandardApiResponse('success', (new UsersTransformer)->transformUser($user), trans('admin/users/message.success.create')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $user->getErrors()));
+    }
+
+    /**
+     * Display the specified resource.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function show($id)
+    {
+        $this->authorize('view', User::class);
+        $user = User::withCount('assets as assets_count', 'licenses as licenses_count', 'accessories as accessories_count', 'consumables as consumables_count')->findOrFail($id);
+
+        return (new UsersTransformer)->transformUser($user);
+    }
+
+
+    /**
+     * Update the specified resource in storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  \Illuminate\Http\Request  $request
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function update(SaveUserRequest $request, $id)
+    {
+        $this->authorize('update', User::class);
+
+        $user = User::findOrFail($id);
+
+        /**
+         * This is a janky hack to prevent people from changing admin demo user data on the public demo.
+         * 
+         * The $ids 1 and 2 are special since they are seeded as superadmins in the demo seeder.
+         * 
+         *  Thanks, jerks. You are why we can't have nice things. - snipe
+         * 
+         */ 
+
+
+        if ((($id == 1) || ($id == 2)) && (config('app.lock_passwords'))) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'Permission denied. You cannot update user information via API on the demo.'));
+        }
+
+
+        $user->fill($request->all());
+        
+        if ($user->id == $request->input('manager_id')) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'You cannot be your own manager'));
+        }
+
+        if ($request->filled('password')) {
+            $user->password = bcrypt($request->input('password'));
+        }
+
+        // We need to use has()  instead of filled()
+        // here because we need to overwrite permissions
+        // if someone needs to null them out
+        if ($request->has('permissions')) {
+            $permissions_array = $request->input('permissions');
+
+            // Strip out the superuser permission if the API user isn't a superadmin
+            if (! Auth::user()->isSuperUser()) {
+                unset($permissions_array['superuser']);
+            }
+            $user->permissions = $permissions_array;
+        }
+
+
+
+        // Update the location of any assets checked out to this user
+        Asset::where('assigned_type', User::class)
+            ->where('assigned_to', $user->id)->update(['location_id' => $request->input('location_id', null)]);
+
+        
+        app('App\Http\Requests\ImageUploadRequest')->handleImages($user, 600, 'image', 'avatars', 'avatar');
+          
+        if ($user->save()) {
+
+            // Sync group memberships:
+            // This was changed in Snipe-IT v4.6.x to 4.7, since we upgraded to Laravel 5.5
+            // which changes the behavior of has vs filled.
+            // The $request->has method will now return true even if the input value is an empty string or null.
+            // A new $request->filled method has was added that provides the previous behavior of the has method.
+
+            // Check if the request has groups passed and has a value
+            if ($request->filled('groups')) {
+                $validator = Validator::make($request->all(), [
+                    'groups.*' => 'integer|exists:permission_groups,id',
+                ]);
+                
+                if ($validator->fails()){
+                    return response()->json(Helper::formatStandardApiResponse('error', null, $user->getErrors()));
+                }
+                $user->groups()->sync($request->input('groups'));
+            // The groups field has been passed but it is null, so we should blank it out
+            } elseif ($request->has('groups')) {
+                $user->groups()->sync([]);
+            }
+
+
+            return response()->json(Helper::formatStandardApiResponse('success', (new UsersTransformer)->transformUser($user), trans('admin/users/message.success.update')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, $user->getErrors()));
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.0]
+     * @param  int  $id
+     * @return \Illuminate\Http\Response
+     */
+    public function destroy($id)
+    {
+        $this->authorize('delete', User::class);
+        $user = User::findOrFail($id);
+        $this->authorize('delete', $user);
+
+        if (($user->assets) && ($user->assets->count() > 0)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/users/message.error.delete_has_assets')));
+        }
+
+        if (($user->licenses) && ($user->licenses->count() > 0)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'This user still has '.$user->licenses->count().' license(s) associated with them and cannot be deleted.'));
+        }
+
+        if (($user->accessories) && ($user->accessories->count() > 0)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'This user still has '.$user->accessories->count().' accessories associated with them.'));
+        }
+
+        if (($user->managedLocations()) && ($user->managedLocations()->count() > 0)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'This user still has '.$user->managedLocations()->count().' locations that they manage.'));
+        }
+
+        if ($user->delete()) {
+
+            // Remove the user's avatar if they have one
+            if (Storage::disk('public')->exists('avatars/'.$user->avatar)) {
+                try {
+                    Storage::disk('public')->delete('avatars/'.$user->avatar);
+                } catch (\Exception $e) {
+                    \Log::debug($e);
+                }
+            }
+
+            return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/users/message.success.delete')));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/users/message.error.delete')));
+    }
+
+    /**
+     * Return JSON containing a list of assets assigned to a user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @param $userId
+     * @return string JSON
+     */
+    public function assets(Request $request, $id)
+    {
+        $this->authorize('view', User::class);
+        $this->authorize('view', Asset::class);
+        $assets = Asset::where('assigned_to', '=', $id)->where('assigned_type', '=', User::class)->with('model');
+
+
+        // Filter on category ID
+        if ($request->filled('category_id')) {
+            $assets = $assets->InCategory($request->input('category_id'));
+        }
+
+
+        // Filter on model ID
+        if ($request->filled('model_id')) {
+
+            $model_ids = $request->input('model_id');
+            if (!is_array($model_ids)) {
+                $model_ids = array($model_ids);
+            }
+            $assets = $assets->InModelList($model_ids);
+        }
+
+        $assets = $assets->get();
+
+        return (new AssetsTransformer)->transformAssets($assets, $assets->count(), $request);
+    }
+
+    /**
+     * Notify a specific user via email with all of their assigned assets.
+     *
+     * @author [Lukas Fehling] [<lukas.fehling@adabay.rocks>]
+     * @since [v6.0.13]
+     * @param Request $request
+     * @param $id
+     * @return string JSON
+     */
+    public function emailAssetList(Request $request, $id)
+    {
+        $user = User::findOrFail($id);
+
+        if (empty($user->email)) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/users/message.inventorynotification.error')));
+        }
+
+        $user->notify((new CurrentInventory($user)));
+ 
+        return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/users/message.inventorynotification.success')));
+    }
+
+    /**
+     * Return JSON containing a list of consumables assigned to a user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @param $userId
+     * @return string JSON
+     */
+    public function consumables(Request $request, $id)
+    {
+        $this->authorize('view', User::class);
+        $this->authorize('view', Consumable::class);
+        $user = User::findOrFail($id);
+        $consumables = $user->consumables;
+        return (new ConsumablesTransformer)->transformConsumables($consumables, $consumables->count(), $request);
+    }
+
+    /**
+     * Return JSON containing a list of accessories assigned to a user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v4.6.14]
+     * @param $userId
+     * @return string JSON
+     */
+    public function accessories($id)
+    {
+        $this->authorize('view', User::class);
+        $user = User::findOrFail($id);
+        $this->authorize('view', Accessory::class);
+        $accessories = $user->accessories;
+
+        return (new AccessoriesTransformer)->transformAccessories($accessories, $accessories->count());
+    }
+
+    /**
+     * Return JSON containing a list of licenses assigned to a user.
+     *
+     * @author [N. Mathar] [<snipe@snipe.net>]
+     * @since [v5.0]
+     * @param $userId
+     * @return string JSON
+     */
+    public function licenses($id)
+    {
+        $this->authorize('view', User::class);
+        $this->authorize('view', License::class);
+        
+        if ($user = User::where('id', $id)->withTrashed()->first()) {
+            $licenses = $user->licenses()->get();
+            return (new LicensesTransformer())->transformLicenses($licenses, $licenses->count());
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/users/message.user_not_found', compact('id'))));
+
+    }
+
+    /**
+     * Reset the user's two-factor status
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @param $userId
+     * @return string JSON
+     */
+    public function postTwoFactorReset(Request $request)
+    {
+        $this->authorize('update', User::class);
+
+        if ($request->filled('id')) {
+            try {
+                $user = User::find($request->get('id'));
+                $user->two_factor_secret = null;
+                $user->two_factor_enrolled = 0;
+                $user->saveQuietly();
+
+                // Log the reset
+                $logaction = new Actionlog();
+                $logaction->target_type = User::class;
+                $logaction->target_id = $user->id;
+                $logaction->item_type = User::class;
+                $logaction->item_id = $user->id;
+                $logaction->created_at = date('Y-m-d H:i:s');
+                $logaction->user_id = Auth::user()->id;
+                $logaction->logaction('2FA reset');
+
+                return response()->json(['message' => trans('admin/settings/general.two_factor_reset_success')], 200);
+            } catch (\Exception $e) {
+                return response()->json(['message' => trans('admin/settings/general.two_factor_reset_error')], 500);
+            }
+        }
+        return response()->json(['message' => 'No ID provided'], 500);
+
+
+    }
+
+    /**
+     * Get info on the current user.
+     *
+     * @author [Juan Font] [<juanfontalonso@gmail.com>]
+     * @since [v4.4.2]
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\Response
+     */
+    public function getCurrentUserInfo(Request $request)
+    {
+        return (new UsersTransformer)->transformUser($request->user());
+    }
+
+    /**
+     * Restore a soft-deleted user.
+     *
+     * @author [E. Taylor] [<dev@evantaylor.name>]
+     * @param int $userId
+     * @since [v6.0.0]
+     * @return JsonResponse
+     */
+    public function restore($userId = null)
+    {
+
+        if ($user = User::withTrashed()->find($userId)) {
+            $this->authorize('delete', $user);
+
+            if ($user->deleted_at == '') {
+                return response()->json(Helper::formatStandardApiResponse('error', trans('general.not_deleted', ['item_type' => trans('general.user')])), 200);
+            }
+
+            if ($user->restore()) {
+
+                $logaction = new Actionlog();
+                $logaction->item_type = User::class;
+                $logaction->item_id = $user->id;
+                $logaction->created_at = date('Y-m-d H:i:s');
+                $logaction->user_id = Auth::user()->id;
+                $logaction->logaction('restore');
+
+                return response()->json(Helper::formatStandardApiResponse('success', null, trans('admin/users/message.success.restored')), 200);
+            }
+
+            // Check validation to make sure we're not restoring a user with the same username as an existing user
+            return response()->json(Helper::formatStandardApiResponse('error', null, $user->getErrors()));
+        }
+
+        return response()->json(Helper::formatStandardApiResponse('error', null, trans('admin/users/message.user_not_found')), 200);
+
+    }
+}

SNIPE-IT/app/Http/Controllers/AssetMaintenancesController.php

@@ -0,0 +1,304 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Helpers\Helper;
+use App\Models\Asset;
+use App\Models\AssetMaintenance;
+use App\Models\Company;
+use Auth;
+use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Slack;
+use Str;
+use TCPDF;
+use View;
+
+/**
+ * This controller handles all actions related to Asset Maintenance for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v2.0
+ */
+class AssetMaintenancesController extends Controller
+{
+    /**
+    * Checks for permissions for this action.
+    *
+    * @todo This should be replaced with middleware and/or policies
+    * @author  Vincent Sposato <vincent.sposato@gmail.com>
+    * @version v1.0
+    * @since [v1.8]
+    * @return View
+    */
+    private static function getInsufficientPermissionsRedirect()
+    {
+        return redirect()->route('maintenances.index')
+          ->with('error', trans('general.insufficient_permissions'));
+    }
+
+    /**
+    *  Returns a view that invokes the ajax tables which actually contains
+    * the content for the asset maintenances listing, which is generated in getDatatable.
+    *
+    * @todo This should be replaced with middleware and/or policies
+    * @see AssetMaintenancesController::getDatatable() method that generates the JSON response
+    * @author  Vincent Sposato <vincent.sposato@gmail.com>
+    * @version v1.0
+    * @since [v1.8]
+    * @return View
+    */
+    public function index()
+    {
+        $this->authorize('view', Asset::class);
+        return view('asset_maintenances/index');
+    }
+
+    /**
+     *  Returns a form view to create a new asset maintenance.
+     *
+     * @see AssetMaintenancesController::postCreate() method that stores the data
+     * @author  Vincent Sposato <vincent.sposato@gmail.com>
+     * @version v1.0
+     * @since [v1.8]
+     * @return mixed
+     */
+    public function create()
+    {
+        $this->authorize('update', Asset::class);
+        $asset = null;
+
+        if ($asset = Asset::find(request('asset_id'))) {
+            // We have to set this so that the correct property is set in the select2 ajax dropdown
+            $asset->asset_id = $asset->id;
+        }
+
+        // Prepare Asset Maintenance Type List
+        $assetMaintenanceType = [
+                                    '' => 'Select an asset maintenance type',
+                                ] + AssetMaintenance::getImprovementOptions();
+        // Mark the selected asset, if it came in
+
+        return view('asset_maintenances/edit')
+                   ->with('asset', $asset)
+                   ->with('assetMaintenanceType', $assetMaintenanceType)
+                   ->with('item', new AssetMaintenance);
+    }
+
+    /**
+    *  Validates and stores the new asset maintenance
+    *
+    * @see AssetMaintenancesController::getCreate() method for the form
+    * @author  Vincent Sposato <vincent.sposato@gmail.com>
+    * @version v1.0
+    * @since [v1.8]
+    * @return mixed
+    */
+    public function store(Request $request)
+    {
+        $this->authorize('update', Asset::class);
+        // create a new model instance
+        $assetMaintenance = new AssetMaintenance();
+        $assetMaintenance->supplier_id = $request->input('supplier_id');
+        $assetMaintenance->is_warranty = $request->input('is_warranty');
+        $assetMaintenance->cost = $request->input('cost');
+        $assetMaintenance->notes = $request->input('notes');
+        $asset = Asset::find($request->input('asset_id'));
+
+        if ((! Company::isCurrentUserHasAccess($asset)) && ($asset != null)) {
+            return static::getInsufficientPermissionsRedirect();
+        }
+
+        // Save the asset maintenance data
+        $assetMaintenance->asset_id = $request->input('asset_id');
+        $assetMaintenance->asset_maintenance_type = $request->input('asset_maintenance_type');
+        $assetMaintenance->title = $request->input('title');
+        $assetMaintenance->start_date = $request->input('start_date');
+        $assetMaintenance->completion_date = $request->input('completion_date');
+        $assetMaintenance->user_id = Auth::id();
+
+        if (($assetMaintenance->completion_date !== null)
+            && ($assetMaintenance->start_date !== '')
+            && ($assetMaintenance->start_date !== '0000-00-00')
+        ) {
+            $startDate = Carbon::parse($assetMaintenance->start_date);
+            $completionDate = Carbon::parse($assetMaintenance->completion_date);
+            $assetMaintenance->asset_maintenance_time = $completionDate->diffInDays($startDate);
+        }
+
+        // Was the asset maintenance created?
+        if ($assetMaintenance->save()) {
+            // Redirect to the new asset maintenance page
+            return redirect()->route('maintenances.index')
+                           ->with('success', trans('admin/asset_maintenances/message.create.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($assetMaintenance->getErrors());
+    }
+
+    /**
+    *  Returns a form view to edit a selected asset maintenance.
+    *
+    * @see AssetMaintenancesController::postEdit() method that stores the data
+    * @author  Vincent Sposato <vincent.sposato@gmail.com>
+    * @param int $assetMaintenanceId
+    * @version v1.0
+    * @since [v1.8]
+    * @return mixed
+    */
+    public function edit($assetMaintenanceId = null)
+    {
+        $this->authorize('update', Asset::class);
+        // Check if the asset maintenance exists
+        $this->authorize('update', Asset::class);
+        // Check if the asset maintenance exists
+        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
+            // Redirect to the asset maintenance management page
+            return redirect()->route('maintenances.index')->with('error', trans('admin/asset_maintenances/message.not_found'));
+        } elseif ((!$assetMaintenance->asset) || ($assetMaintenance->asset->deleted_at!='')) {
+            // Redirect to the asset maintenance management page
+            return redirect()->route('maintenances.index')->with('error', 'asset does not exist');
+        } elseif (! Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
+            return static::getInsufficientPermissionsRedirect();
+        }
+
+
+        // Prepare Improvement Type List
+        $assetMaintenanceType = [
+                                    '' => 'Select an improvement type',
+                                ] + AssetMaintenance::getImprovementOptions();
+
+        // Get Supplier List
+        // Render the view
+        return view('asset_maintenances/edit')
+                   ->with('selectedAsset', null)
+                   ->with('assetMaintenanceType', $assetMaintenanceType)
+                   ->with('item', $assetMaintenance);
+    }
+
+    /**
+     *  Validates and stores an update to an asset maintenance
+     *
+     * @see AssetMaintenancesController::postEdit() method that stores the data
+     * @author  Vincent Sposato <vincent.sposato@gmail.com>
+     * @param Request $request
+     * @param int $assetMaintenanceId
+     * @return mixed
+     * @version v1.0
+     * @since [v1.8]
+     */
+    public function update(Request $request, $assetMaintenanceId = null)
+    {
+        $this->authorize('update', Asset::class);
+        // Check if the asset maintenance exists
+        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
+            // Redirect to the asset maintenance management page
+            return redirect()->route('maintenances.index')->with('error', trans('admin/asset_maintenances/message.not_found'));
+        } elseif ((!$assetMaintenance->asset) || ($assetMaintenance->asset->deleted_at!='')) {
+                // Redirect to the asset maintenance management page
+                return redirect()->route('maintenances.index')->with('error', 'asset does not exist');
+        } elseif (! Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
+            return static::getInsufficientPermissionsRedirect();
+        }
+
+        $assetMaintenance->supplier_id = $request->input('supplier_id');
+        $assetMaintenance->is_warranty = $request->input('is_warranty');
+        $assetMaintenance->cost =  $request->input('cost');
+        $assetMaintenance->notes = $request->input('notes');
+
+        $asset = Asset::find(request('asset_id'));
+
+        if (! Company::isCurrentUserHasAccess($asset)) {
+            return static::getInsufficientPermissionsRedirect();
+        }
+
+        // Save the asset maintenance data
+        $assetMaintenance->asset_id = $request->input('asset_id');
+        $assetMaintenance->asset_maintenance_type = $request->input('asset_maintenance_type');
+        $assetMaintenance->title = $request->input('title');
+        $assetMaintenance->start_date = $request->input('start_date');
+        $assetMaintenance->completion_date = $request->input('completion_date');
+
+        if (($assetMaintenance->completion_date == null)
+        ) {
+            if (($assetMaintenance->asset_maintenance_time !== 0)
+              || (! is_null($assetMaintenance->asset_maintenance_time))
+            ) {
+                $assetMaintenance->asset_maintenance_time = null;
+            }
+        }
+
+        if (($assetMaintenance->completion_date !== null)
+          && ($assetMaintenance->start_date !== '')
+          && ($assetMaintenance->start_date !== '0000-00-00')
+        ) {
+            $startDate = Carbon::parse($assetMaintenance->start_date);
+            $completionDate = Carbon::parse($assetMaintenance->completion_date);
+            $assetMaintenance->asset_maintenance_time = $completionDate->diffInDays($startDate);
+        }
+
+      // Was the asset maintenance created?
+        if ($assetMaintenance->save()) {
+
+            // Redirect to the new asset maintenance page
+            return redirect()->route('maintenances.index')
+                         ->with('success', trans('admin/asset_maintenances/message.edit.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($assetMaintenance->getErrors());
+    }
+
+    /**
+    *  Delete an asset maintenance
+    *
+    * @author  Vincent Sposato <vincent.sposato@gmail.com>
+    * @param int $assetMaintenanceId
+    * @version v1.0
+    * @since [v1.8]
+    * @return mixed
+    */
+    public function destroy($assetMaintenanceId)
+    {
+        $this->authorize('update', Asset::class);
+        // Check if the asset maintenance exists
+        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
+            // Redirect to the asset maintenance management page
+            return redirect()->route('maintenances.index')
+                           ->with('error', trans('admin/asset_maintenances/message.not_found'));
+        } elseif (! Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
+            return static::getInsufficientPermissionsRedirect();
+        }
+
+        // Delete the asset maintenance
+        $assetMaintenance->delete();
+
+        // Redirect to the asset_maintenance management page
+        return redirect()->route('maintenances.index')
+                       ->with('success', trans('admin/asset_maintenances/message.delete.success'));
+    }
+
+    /**
+    *  View an asset maintenance
+    *
+    * @author  Vincent Sposato <vincent.sposato@gmail.com>
+    * @param int $assetMaintenanceId
+    * @version v1.0
+    * @since [v1.8]
+    * @return View
+    */
+    public function show($assetMaintenanceId)
+    {
+        $this->authorize('view', Asset::class);
+
+        // Check if the asset maintenance exists
+        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
+            // Redirect to the asset maintenance management page
+            return redirect()->route('maintenances.index')
+                           ->with('error', trans('admin/asset_maintenances/message.not_found'));
+        } elseif (! Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
+            return static::getInsufficientPermissionsRedirect();
+        }
+
+        return view('asset_maintenances/view')->with('assetMaintenance', $assetMaintenance);
+    }
+}

SNIPE-IT/app/Http/Controllers/AssetModelsController.php

@@ -0,0 +1,537 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Helpers\Helper;
+use App\Http\Requests\ImageUploadRequest;
+use App\Models\Actionlog;
+use App\Models\Asset;
+use App\Models\AssetModel;
+use App\Models\CustomField;
+use App\Models\User;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Input;
+use Illuminate\Support\Facades\View;
+use Illuminate\Support\Facades\Validator;
+use Redirect;
+use Request;
+use Storage;
+use Symfony\Component\HttpFoundation\JsonResponse;
+
+/**
+ * This class controls all actions related to asset models for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v1.0
+ * @author [A. Gianotto] [<snipe@snipe.net>]
+ */
+class AssetModelsController extends Controller
+{
+    /**
+     * Returns a view that invokes the ajax tables which actually contains
+     * the content for the accessories listing, which is generated in getDatatable.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function index()
+    {
+        $this->authorize('index', AssetModel::class);
+
+        return view('models/index');
+    }
+
+    /**
+     * Returns a view containing the asset model creation form.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create()
+    {
+        $this->authorize('create', AssetModel::class);
+
+        return view('models/edit')->with('category_type', 'asset')
+            ->with('depreciation_list', Helper::depreciationList())
+            ->with('item', new AssetModel);
+    }
+
+    /**
+     * Validate and process the new Asset Model data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param ImageUploadRequest $request
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', AssetModel::class);
+        // Create a new asset model
+        $model = new AssetModel;
+
+        // Save the model data
+        $model->eol = $request->input('eol');
+        $model->depreciation_id = $request->input('depreciation_id');
+        $model->name = $request->input('name');
+        $model->model_number = $request->input('model_number');
+        $model->min_amt = $request->input('min_amt');
+        $model->manufacturer_id = $request->input('manufacturer_id');
+        $model->category_id = $request->input('category_id');
+        $model->notes = $request->input('notes');
+        $model->user_id = Auth::id();
+        $model->requestable = Request::has('requestable');
+
+        if ($request->input('fieldset_id') != '') {
+            $model->fieldset_id = $request->input('fieldset_id');
+        }
+
+        $model = $request->handleImages($model);
+
+        // Was it created?
+        if ($model->save()) {
+            if ($this->shouldAddDefaultValues($request->input())) {
+                if (!$this->assignCustomFieldsDefaultValues($model, $request->input('default_values'))){
+                    return redirect()->back()->withInput()->with('error', trans('admin/custom_fields/message.fieldset_default_value.error'));
+                }
+            }
+
+            return redirect()->route('models.index')->with('success', trans('admin/models/message.create.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($model->getErrors());
+    }
+
+    /**
+     * Returns a view containing the asset model edit form.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $modelId
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function edit($modelId = null)
+    {
+        $this->authorize('update', AssetModel::class);
+        if ($item = AssetModel::find($modelId)) {
+            $category_type = 'asset';
+            $view = View::make('models/edit', compact('item', 'category_type'));
+            $view->with('depreciation_list', Helper::depreciationList());
+
+            return $view;
+        }
+
+        return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));
+    }
+
+
+    /**
+     * Validates and processes form data from the edit
+     * Asset Model form based on the model ID passed.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param ImageUploadRequest $request
+     * @param int $modelId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function update(ImageUploadRequest $request, $modelId = null)
+    {
+        $this->authorize('update', AssetModel::class);
+        // Check if the model exists
+        if (is_null($model = AssetModel::find($modelId))) {
+            // Redirect to the models management page
+            return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));
+        }
+
+        $model = $request->handleImages($model);
+
+        $model->depreciation_id = $request->input('depreciation_id');
+        $model->eol = $request->input('eol');
+        $model->name = $request->input('name');
+        $model->model_number = $request->input('model_number');
+        $model->min_amt = $request->input('min_amt');
+        $model->manufacturer_id = $request->input('manufacturer_id');
+        $model->category_id = $request->input('category_id');
+        $model->notes = $request->input('notes');
+        $model->requestable = $request->input('requestable', '0');
+
+        $this->removeCustomFieldsDefaultValues($model);
+
+        $model->fieldset_id = $request->input('fieldset_id');
+
+        if ($this->shouldAddDefaultValues($request->input())) {
+            if (!$this->assignCustomFieldsDefaultValues($model, $request->input('default_values'))){
+                return redirect()->back()->withInput()->with('error', trans('admin/custom_fields/message.fieldset_default_value.error'));
+            }
+        }
+
+       
+      
+       
+        if ($model->save()) {
+            if ($model->wasChanged('eol')) {
+                    if ($model->eol > 0) {
+                        $newEol = $model->eol; 
+                        $model->assets()->whereNotNull('purchase_date')->where('eol_explicit', false)
+                            ->update(['asset_eol_date' => DB::raw('DATE_ADD(purchase_date, INTERVAL ' . $newEol . ' MONTH)')]);
+                        } elseif ($model->eol == 0) {
+    						$model->assets()->whereNotNull('purchase_date')->where('eol_explicit', false)
+    							->update(['asset_eol_date' => DB::raw('null')]);
+					}
+                }
+            return redirect()->route('models.index')->with('success', trans('admin/models/message.update.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($model->getErrors());
+    }
+
+    /**
+     * Validate and delete the given Asset Model. An Asset Model
+     * cannot be deleted if there are associated assets.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $modelId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($modelId)
+    {
+        $this->authorize('delete', AssetModel::class);
+        // Check if the model exists
+        if (is_null($model = AssetModel::find($modelId))) {
+            return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));
+        }
+
+        if ($model->assets()->count() > 0) {
+            // Throw an error that this model is associated with assets
+            return redirect()->route('models.index')->with('error', trans('admin/models/message.assoc_users'));
+        }
+
+        if ($model->image) {
+            try {
+                Storage::disk('public')->delete('models/'.$model->image);
+            } catch (\Exception $e) {
+                \Log::info($e);
+            }
+        }
+
+        // Delete the model
+        $model->delete();
+
+        // Redirect to the models management page
+        return redirect()->route('models.index')->with('success', trans('admin/models/message.delete.success'));
+    }
+
+    /**
+     * Restore a given Asset Model (mark as un-deleted)
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $id
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function getRestore($id)
+    {
+        $this->authorize('create', AssetModel::class);
+
+        if ($model = AssetModel::withTrashed()->find($id)) {
+
+            if ($model->deleted_at == '') {
+                return redirect()->back()->with('error', trans('general.not_deleted', ['item_type' => trans('general.asset_model')]));
+            }
+
+            if ($model->restore()) {
+                $logaction = new Actionlog();
+                $logaction->item_type = User::class;
+                $logaction->item_id = $model->id;
+                $logaction->created_at = date('Y-m-d H:i:s');
+                $logaction->user_id = Auth::user()->id;
+                $logaction->logaction('restore');
+
+
+                // Redirect them to the deleted page if there are more, otherwise the section index
+                $deleted_models = AssetModel::onlyTrashed()->count();
+                if ($deleted_models > 0) {
+                    return redirect()->back()->with('success', trans('admin/models/message.restore.success'));
+                }
+                return redirect()->route('models.index')->with('success', trans('admin/models/message.restore.success'));
+            }
+
+            // Check validation
+            return redirect()->back()->with('error', trans('general.could_not_restore', ['item_type' => trans('general.asset_model'), 'error' => $model->getErrors()->first()]));
+        }
+
+        return redirect()->back()->with('error', trans('admin/models/message.does_not_exist'));
+
+    }
+
+
+    /**
+     * Get the model information to present to the model view page
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $modelId
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($modelId = null)
+    {
+        $this->authorize('view', AssetModel::class);
+        $model = AssetModel::withTrashed()->withCount('assets')->find($modelId);
+
+        if (isset($model->id)) {
+            return view('models/view', compact('model'));
+        }
+
+        return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));
+    }
+
+    /**
+     * Get the clone page to clone a model
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $modelId
+     * @return View
+     */
+    public function getClone($modelId = null)
+    {
+        $this->authorize('create', AssetModel::class);
+        // Check if the model exists
+        if (is_null($model_to_clone = AssetModel::find($modelId))) {
+            return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));
+        }
+
+        $model = clone $model_to_clone;
+        $model->id = null;
+
+        // Show the page
+        return view('models/edit')
+            ->with('depreciation_list', Helper::depreciationList())
+            ->with('item', $model)
+            ->with('model_id', $model_to_clone->id)
+            ->with('clone_model', $model_to_clone);
+    }
+
+
+    /**
+     * Get the custom fields form
+     *
+     * @author [B. Wetherington] [<uberbrady@gmail.com>]
+     * @since [v2.0]
+     * @param int $modelId
+     * @return View
+     */
+    public function getCustomFields($modelId)
+    {
+        return view('models.custom_fields_form')->with('model', AssetModel::find($modelId));
+    }
+
+
+
+    /**
+     * Returns a view that allows the user to bulk edit model attrbutes
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.7]
+     * @return \Illuminate\Contracts\View\View
+     */
+    public function postBulkEdit(Request $request)
+    {
+        $models_raw_array = $request->input('ids');
+
+        // Make sure some IDs have been selected
+        if ((is_array($models_raw_array)) && (count($models_raw_array) > 0)) {
+            $models = AssetModel::whereIn('id', $models_raw_array)->withCount('assets as assets_count')->orderBy('assets_count', 'ASC')->get();
+
+            // If deleting....
+            if ($request->input('bulk_actions') == 'delete') {
+                $valid_count = 0;
+                foreach ($models as $model) {
+                    if ($model->assets_count == 0) {
+                        $valid_count++;
+                    }
+                }
+
+                return view('models/bulk-delete', compact('models'))->with('valid_count', $valid_count);
+
+            // Otherwise display the bulk edit screen
+            } else {
+                $nochange = ['NC' => 'No Change'];
+                $fieldset_list = $nochange + Helper::customFieldsetList();
+                $depreciation_list = $nochange + Helper::depreciationList();
+
+                return view('models/bulk-edit', compact('models'))
+                    ->with('fieldset_list', $fieldset_list)
+                    ->with('depreciation_list', $depreciation_list);
+            }
+        }
+
+        return redirect()->route('models.index')
+            ->with('error', 'You must select at least one model to edit.');
+    }
+
+
+
+    /**
+     * Returns a view that allows the user to bulk edit model attrbutes
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.7]
+     * @return \Illuminate\Contracts\View\View
+     */
+    public function postBulkEditSave(Request $request)
+    {
+        $models_raw_array = $request->input('ids');
+        $update_array = [];
+
+
+        if (($request->filled('manufacturer_id') && ($request->input('manufacturer_id') != 'NC'))) {
+            $update_array['manufacturer_id'] = $request->input('manufacturer_id');
+        }
+        if (($request->filled('category_id') && ($request->input('category_id') != 'NC'))) {
+            $update_array['category_id'] = $request->input('category_id');
+        }
+        if ($request->input('fieldset_id') != 'NC') {
+            $update_array['fieldset_id'] = $request->input('fieldset_id');
+        }
+        if ($request->input('depreciation_id') != 'NC') {
+            $update_array['depreciation_id'] = $request->input('depreciation_id');
+        }
+
+        
+        if (count($update_array) > 0) {
+            AssetModel::whereIn('id', $models_raw_array)->update($update_array);
+
+            return redirect()->route('models.index')
+                ->with('success', trans('admin/models/message.bulkedit.success'));
+        }
+
+        return redirect()->route('models.index')
+            ->with('warning', trans('admin/models/message.bulkedit.error'));
+    }
+
+    /**
+     * Validate and delete the given Asset Models. An Asset Model
+     * cannot be deleted if there are associated assets.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $modelId
+     * @return Redirect
+     */
+    public function postBulkDelete(Request $request)
+    {
+        $models_raw_array = $request->input('ids');
+
+        if ((is_array($models_raw_array)) && (count($models_raw_array) > 0)) {
+            $models = AssetModel::whereIn('id', $models_raw_array)->withCount('assets as assets_count')->get();
+
+            $del_error_count = 0;
+            $del_count = 0;
+
+            foreach ($models as $model) {
+
+                if ($model->assets_count > 0) {
+                    $del_error_count++;
+                } else {
+                    $model->delete();
+                    $del_count++;
+                }
+            }
+
+
+            if ($del_error_count == 0) {
+                return redirect()->route('models.index')
+                    ->with('success', trans('admin/models/message.bulkdelete.success', ['success_count'=> $del_count]));
+            }
+
+            return redirect()->route('models.index')
+                ->with('warning', trans('admin/models/message.bulkdelete.success_partial', ['fail_count'=>$del_error_count, 'success_count'=> $del_count]));
+        }
+
+        return redirect()->route('models.index')
+            ->with('error', trans('admin/models/message.bulkdelete.error'));
+    }
+
+    /**
+     * Returns true if a fieldset is set, 'add default values' is ticked and if
+     * any default values were entered into the form.
+     *
+     * @param  array  $input
+     * @return bool
+     */
+    private function shouldAddDefaultValues(array $input)
+    {
+        return ! empty($input['add_default_values'])
+            && ! empty($input['default_values'])
+            && ! empty($input['fieldset_id']);
+    }
+
+    /**
+     * Adds default values to a model (as long as they are truthy)
+     *
+     * @param  AssetModel $model
+     * @param  array      $defaultValues
+     * @return void
+     */
+    private function assignCustomFieldsDefaultValues(AssetModel $model, array $defaultValues): bool
+    {
+        $data = array();
+        foreach ($defaultValues as $customFieldId => $defaultValue) {
+            $customField = CustomField::find($customFieldId);
+
+            $data[$customField->db_column] = $defaultValue;
+        }
+
+        $fieldsets = $model->fieldset->validation_rules();
+        $rules = array();
+
+        foreach ($fieldsets as $fieldset => $validation){
+            // If the field is marked as required, eliminate the rule so it doesn't interfere with the default values
+            // (we are at model level, the rule still applies when creating a new asset using this model)
+            $index = array_search('required', $validation);
+            if ($index !== false){
+                $validation[$index] = 'nullable';
+            }
+            $rules[$fieldset] = $validation;
+        }
+
+        $validator = Validator::make($data, $rules);
+
+        if($validator->fails()){
+            return false;
+        }
+
+        foreach ($defaultValues as $customFieldId => $defaultValue) {
+            if(is_array($defaultValue)){
+                $model->defaultValues()->attach($customFieldId, ['default_value' => implode(', ', $defaultValue)]);
+            }elseif ($defaultValue) {
+                $model->defaultValues()->attach($customFieldId, ['default_value' => $defaultValue]);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Removes all default values
+     *
+     * @return void
+     */
+    private function removeCustomFieldsDefaultValues(AssetModel $model)
+    {
+        $model->defaultValues()->detach();
+    }
+}

SNIPE-IT/app/Http/Controllers/AssetModelsFilesController.php

@@ -0,0 +1,135 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Helpers\StorageHelper;
+use App\Http\Requests\UploadFileRequest;
+use App\Models\Actionlog;
+use App\Models\AssetModel;
+use Illuminate\Support\Facades\Response;
+use Illuminate\Support\Facades\Storage;
+
+class AssetModelsFilesController extends Controller
+{
+    /**
+     * Upload a file to the server.
+     *
+     * @param UploadFileRequest $request
+     * @param int $modelId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     *@since [v1.0]
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     */
+    public function store(UploadFileRequest $request, $modelId = null)
+    {
+        if (! $model = AssetModel::find($modelId)) {
+            return redirect()->route('models.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        $this->authorize('update', $model);
+
+        if ($request->hasFile('file')) {
+            if (! Storage::exists('private_uploads/assetmodels')) {
+                Storage::makeDirectory('private_uploads/assetmodels', 775);
+            }
+
+            foreach ($request->file('file') as $file) {
+
+                $file_name = $request->handleFile('private_uploads/assetmodels/','model-'.$model->id,$file);
+
+                $model->logUpload($file_name, e($request->get('notes')));
+            }
+
+            return redirect()->back()->with('success', trans('general.file_upload_success'));
+        }
+
+        return redirect()->back()->with('error', trans('admin/hardware/message.upload.nofiles'));
+    }
+
+    /**
+     * Check for permissions and display the file.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $modelId
+     * @param  int $fileId
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($modelId = null, $fileId = null)
+    {
+        $model = AssetModel::find($modelId);
+        // the asset is valid
+        if (isset($model->id)) {
+            $this->authorize('view', $model);
+
+            if (! $log = Actionlog::find($fileId)) {
+                return response('No matching record for that model/file', 500)
+                    ->header('Content-Type', 'text/plain');
+            }
+
+            $file = 'private_uploads/assetmodels/'.$log->filename;
+            \Log::debug('Checking for '.$file);
+
+
+            if (! Storage::exists($file)) {
+                return response('File '.$file.' not found on server', 404)
+                    ->header('Content-Type', 'text/plain');
+            }
+
+            if (request('inline') == 'true') {
+
+                $headers = [
+                    'Content-Disposition' => 'inline',
+                ];
+
+                return Storage::download($file, $log->filename, $headers);
+            }
+
+            return StorageHelper::downloader($file);
+        }
+        // Prepare the error message
+        $error = trans('admin/hardware/message.does_not_exist', ['id' => $fileId]);
+
+        // Redirect to the hardware management page
+        return redirect()->route('hardware.index')->with('error', $error);
+    }
+
+    /**
+     * Delete the associated file
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $modelId
+     * @param  int $fileId
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($modelId = null, $fileId = null)
+    {
+        $model = AssetModel::find($modelId);
+        $this->authorize('update', $model);
+        $rel_path = 'private_uploads/assetmodels';
+
+        // the asset is valid
+        if (isset($model->id)) {
+            $this->authorize('update', $model);
+            $log = Actionlog::find($fileId);
+            if ($log) {
+                if (Storage::exists($rel_path.'/'.$log->filename)) {
+                    Storage::delete($rel_path.'/'.$log->filename);
+                }
+                $log->delete();
+
+                return redirect()->back()->with('success', trans('admin/hardware/message.deletefile.success'));
+            }
+
+            return redirect()->back()
+                ->with('success', trans('admin/hardware/message.deletefile.success'));
+        }
+
+        // Redirect to the hardware management page
+        return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Assets/AssetCheckinController.php

@@ -0,0 +1,138 @@
+<?php
+
+namespace App\Http\Controllers\Assets;
+
+use App\Events\CheckoutableCheckedIn;
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\AssetCheckinRequest;
+use App\Http\Traits\MigratesLegacyAssetLocations;
+use App\Models\Asset;
+use App\Models\CheckoutAcceptance;
+use App\Models\LicenseSeat;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Redirect;
+use Illuminate\Support\Facades\View;
+
+class AssetCheckinController extends Controller
+{
+    use MigratesLegacyAssetLocations;
+
+    /**
+     * Returns a view that presents a form to check an asset back into inventory.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @param string $backto
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @since [v1.0]
+     */
+    public function create($assetId, $backto = null)
+    {
+        // Check if the asset exists
+        if (is_null($asset = Asset::find($assetId))) {
+            // Redirect to the asset management page with error
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        $this->authorize('checkin', $asset);
+
+        // This asset is already checked in, redirect
+        
+        if (is_null($asset->assignedTo)) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.checkin.already_checked_in'));
+        }
+
+        return view('hardware/checkin', compact('asset'))->with('statusLabel_list', Helper::statusLabelList())->with('backto', $backto);
+    }
+
+    /**
+     * Validate and process the form data to check an asset back into inventory.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param AssetCheckinRequest $request
+     * @param int $assetId
+     * @param null $backto
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @since [v1.0]
+     */
+    public function store(AssetCheckinRequest $request, $assetId = null, $backto = null)
+    {
+        // Check if the asset exists
+        if (is_null($asset = Asset::find($assetId))) {
+            // Redirect to the asset management page with error
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        if (is_null($target = $asset->assignedTo)) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.checkin.already_checked_in'));
+        }
+        $this->authorize('checkin', $asset);
+
+        if ($asset->assignedType() == Asset::USER) {
+            $user = $asset->assignedTo;
+        }
+
+        $asset->expected_checkin = null;
+        //$asset->last_checkout = null;
+        $asset->last_checkin = now();
+        $asset->assignedTo()->disassociate($asset);
+        $asset->accepted = null;
+        $asset->name = $request->get('name');
+
+        if ($request->filled('status_id')) {
+            $asset->status_id = e($request->get('status_id'));
+        }
+
+        $this->migrateLegacyLocations($asset);
+
+        $asset->location_id = $asset->rtd_location_id;
+
+        if ($request->filled('location_id')) {
+            \Log::debug('NEW Location ID: '.$request->get('location_id'));
+            $asset->location_id = $request->get('location_id');
+
+            if ($request->get('update_default_location') == 0){
+                $asset->rtd_location_id = $request->get('location_id');
+            }
+        }
+
+        $originalValues = $asset->getRawOriginal();
+
+        $checkin_at = date('Y-m-d H:i:s');
+        if (($request->filled('checkin_at')) && ($request->get('checkin_at') != date('Y-m-d'))) {
+            $originalValues['action_date'] = $checkin_at;
+            $checkin_at = $request->get('checkin_at');
+        }
+
+        $asset->licenseseats->each(function (LicenseSeat $seat) {
+            $seat->update(['assigned_to' => null]);
+        });
+
+        // Get all pending Acceptances for this asset and delete them
+        $acceptances = CheckoutAcceptance::pending()->whereHasMorph('checkoutable',
+            [Asset::class],
+            function (Builder $query) use ($asset) {
+                $query->where('id', $asset->id);
+            })->get();
+        $acceptances->map(function($acceptance) {
+            $acceptance->delete();
+        });
+
+        // Was the asset updated?
+        if ($asset->save()) {
+            event(new CheckoutableCheckedIn($asset, $target, Auth::user(), $request->input('note'), $checkin_at, $originalValues));
+
+            if ((isset($user)) && ($backto == 'user')) {
+                return redirect()->route('users.show', $user->id)->with('success', trans('admin/hardware/message.checkin.success'));
+            }
+
+            return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.checkin.success'));
+        }
+        // Redirect to the asset management page with error
+        return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.checkin.error').$asset->getErrors());
+    }
+}

SNIPE-IT/app/Http/Controllers/Assets/AssetCheckoutController.php

@@ -0,0 +1,113 @@
+<?php
+
+namespace App\Http\Controllers\Assets;
+
+use App\Exceptions\CheckoutNotAllowed;
+use App\Helpers\Helper;
+use App\Http\Controllers\CheckInOutRequest;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\AssetCheckoutRequest;
+use App\Models\Asset;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Support\Facades\Auth;
+
+class AssetCheckoutController extends Controller
+{
+    use CheckInOutRequest;
+
+    /**
+     * Returns a view that presents a form to check an asset out to a
+     * user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return View
+     */
+    public function create($assetId)
+    {
+        // Check if the asset exists
+        if (is_null($asset = Asset::with('company')->find(e($assetId)))) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        $this->authorize('checkout', $asset);
+
+        if ($asset->availableForCheckout()) {
+            return view('hardware/checkout', compact('asset'))
+                ->with('statusLabel_list', Helper::deployableStatusLabelList());
+        }
+
+        return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.checkout.not_available'));
+    }
+
+    /**
+     * Validate and process the form data to check out an asset to a user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param AssetCheckoutRequest $request
+     * @param int $assetId
+     * @return Redirect
+     * @since [v1.0]
+     */
+    public function store(AssetCheckoutRequest $request, $assetId)
+    {
+        try {
+            // Check if the asset exists
+            if (! $asset = Asset::find($assetId)) {
+                return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+            } elseif (! $asset->availableForCheckout()) {
+                return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.checkout.not_available'));
+            }
+            $this->authorize('checkout', $asset);
+            $admin = Auth::user();
+
+            $target = $this->determineCheckoutTarget($asset);
+
+            $asset = $this->updateAssetLocation($asset, $target);
+
+            $checkout_at = date('Y-m-d H:i:s');
+            if (($request->filled('checkout_at')) && ($request->get('checkout_at') != date('Y-m-d'))) {
+                $checkout_at = $request->get('checkout_at');
+            }
+
+            $expected_checkin = '';
+            if ($request->filled('expected_checkin')) {
+                $expected_checkin = $request->get('expected_checkin');
+            }
+
+            if ($request->filled('status_id')) {
+                $asset->status_id = $request->get('status_id');
+            }
+
+            if(!empty($asset->licenseseats->all())){
+                if(request('checkout_to_type') == 'user') {
+                    foreach ($asset->licenseseats as $seat){
+                        $seat->assigned_to = $target->id;
+                        $seat->save();
+                    }
+                }
+            }
+
+            $settings = \App\Models\Setting::getSettings();
+
+            // We have to check whether $target->company_id is null here since locations don't have a company yet
+            if (($settings->full_multiple_companies_support) && ((!is_null($target->company_id)) &&  (!is_null($asset->company_id)))) {
+                if ($target->company_id != $asset->company_id){
+                    return redirect()->to("hardware/$assetId/checkout")->with('error', trans('general.error_user_company'));
+                }
+            }
+            
+            if ($asset->checkOut($target, $admin, $checkout_at, $expected_checkin, $request->get('note'), $request->get('name'))) {
+                return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.checkout.success'));
+            }
+
+            // Redirect to the asset management page with error
+            return redirect()->to("hardware/$assetId/checkout")->with('error', trans('admin/hardware/message.checkout.error').$asset->getErrors());
+        } catch (ModelNotFoundException $e) {
+            return redirect()->back()->with('error', trans('admin/hardware/message.checkout.error'))->withErrors($asset->getErrors());
+        } catch (CheckoutNotAllowed $e) {
+            return redirect()->back()->with('error', $e->getMessage());
+        }
+    }
+}

SNIPE-IT/app/Http/Controllers/Assets/AssetFilesController.php

@@ -0,0 +1,138 @@
+<?php
+
+namespace App\Http\Controllers\Assets;
+
+use App\Helpers\StorageHelper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\UploadFileRequest;
+use App\Models\Actionlog;
+use App\Models\Asset;
+use Illuminate\Support\Facades\Response;
+use Illuminate\Support\Facades\Storage;
+
+class AssetFilesController extends Controller
+{
+    /**
+     * Upload a file to the server.
+     *
+     * @param UploadFileRequest $request
+     * @param int $assetId
+     * @return Redirect
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     *@since [v1.0]
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     */
+    public function store(UploadFileRequest $request, $assetId = null)
+    {
+        if (! $asset = Asset::find($assetId)) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        $this->authorize('update', $asset);
+
+        if ($request->hasFile('file')) {
+            if (! Storage::exists('private_uploads/assets')) {
+                Storage::makeDirectory('private_uploads/assets', 775);
+            }
+
+            foreach ($request->file('file') as $file) {
+                $file_name = $request->handleFile('private_uploads/assets/','hardware-'.$asset->id, $file);
+                
+                $asset->logUpload($file_name, e($request->get('notes')));
+            }
+
+            return redirect()->back()->with('success', trans('admin/hardware/message.upload.success'));
+        }
+
+        return redirect()->back()->with('error', trans('admin/hardware/message.upload.nofiles'));
+    }
+
+    /**
+     * Check for permissions and display the file.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $assetId
+     * @param  int $fileId
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($assetId = null, $fileId = null)
+    {
+        $asset = Asset::find($assetId);
+        // the asset is valid
+        if (isset($asset->id)) {
+            $this->authorize('view', $asset);
+
+            if (! $log = Actionlog::whereNotNull('filename')->where('item_id', $asset->id)->find($fileId)) {
+                return response('No matching record for that asset/file', 500)
+                    ->header('Content-Type', 'text/plain');
+            }
+
+            $file = 'private_uploads/assets/'.$log->filename;
+            \Log::debug('Checking for '.$file);
+
+            if ($log->action_type == 'audit') {
+                $file = 'private_uploads/audits/'.$log->filename;
+            }
+
+            if (! Storage::exists($file)) {
+                return response('File '.$file.' not found on server', 404)
+                    ->header('Content-Type', 'text/plain');
+            }
+
+            if (request('inline') == 'true') {
+
+                $headers = [
+                    'Content-Disposition' => 'inline',
+                ];
+
+                return Storage::download($file, $log->filename, $headers);
+            }
+
+            return StorageHelper::downloader($file);
+        }
+        // Prepare the error message
+        $error = trans('admin/hardware/message.does_not_exist', ['id' => $fileId]);
+
+        // Redirect to the hardware management page
+        return redirect()->route('hardware.index')->with('error', $error);
+    }
+
+    /**
+     * Delete the associated file
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param  int $assetId
+     * @param  int $fileId
+     * @since [v1.0]
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($assetId = null, $fileId = null)
+    {
+        $asset = Asset::find($assetId);
+        $this->authorize('update', $asset);
+        $rel_path = 'private_uploads/assets';
+
+        // the asset is valid
+        if (isset($asset->id)) {
+            $this->authorize('update', $asset);
+            $log = Actionlog::find($fileId);
+            if ($log) {
+                if (Storage::exists($rel_path.'/'.$log->filename)) {
+                    Storage::delete($rel_path.'/'.$log->filename);
+                }
+                $log->delete();
+
+                return redirect()->back()->with('success', trans('admin/hardware/message.deletefile.success'));
+            }
+
+            return redirect()->back()
+                ->with('success', trans('admin/hardware/message.deletefile.success'));
+        }
+
+        // Redirect to the hardware management page
+        return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Assets/AssetsController.php

@@ -0,0 +1,929 @@
+<?php
+
+namespace App\Http\Controllers\Assets;
+
+use App\Helpers\Helper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\ImageUploadRequest;
+use App\Models\Actionlog;
+use App\Models\Manufacturer;
+use Illuminate\Support\Facades\Log;
+use App\Models\Asset;
+use App\Models\AssetModel;
+use App\Models\CheckoutRequest;
+use App\Models\Company;
+use App\Models\Location;
+use App\Models\Setting;
+use App\Models\Statuslabel;
+use App\Models\User;
+use Illuminate\Support\Facades\Auth;
+use App\View\Label;
+use Carbon\Carbon;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\View;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
+use League\Csv\Reader;
+use Illuminate\Support\Facades\Redirect;
+
+/**
+ * This class controls all actions related to assets for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v1.0
+ * @author [A. Gianotto] [<snipe@snipe.net>]
+ */
+class AssetsController extends Controller
+{
+    protected $qrCodeDimensions = ['height' => 3.5, 'width' => 3.5];
+    protected $barCodeDimensions = ['height' => 2, 'width' => 22];
+
+    public function __construct()
+    {
+        $this->middleware('auth');
+        parent::__construct();
+    }
+
+    /**
+     * Returns a view that invokes the ajax tables which actually contains
+     * the content for the assets listing, which is generated in getDatatable.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see AssetController::getDatatable() method that generates the JSON response
+     * @since [v1.0]
+     * @param Request $request
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function index(Request $request)
+    {
+        $this->authorize('index', Asset::class);
+        $company = Company::find($request->input('company_id'));
+
+        return view('hardware/index')->with('company', $company);
+    }
+
+    /**
+     * Returns a view that presents a form to create a new asset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param Request $request
+     * @return View
+     * @internal param int $model_id
+     */
+    public function create(Request $request)
+    {
+        $this->authorize('create', Asset::class);
+        $view = View::make('hardware/edit')
+            ->with('statuslabel_list', Helper::statusLabelList())
+            ->with('item', new Asset)
+            ->with('statuslabel_types', Helper::statusTypeList());
+
+        if ($request->filled('model_id')) {
+            $selected_model = AssetModel::find($request->input('model_id'));
+            $view->with('selected_model', $selected_model);
+        }
+
+        return $view;
+    }
+
+    /**
+     * Validate and process new asset form data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @return Redirect
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize(Asset::class);
+
+        // There are a lot more rules to add here but prevents
+        // errors around `asset_tags` not being present below.
+        $this->validate($request, ['asset_tags' => ['required', 'array']]);
+
+        // Handle asset tags - there could be one, or potentially many.
+        // This is only necessary on create, not update, since bulk editing is handled
+        // differently
+        $asset_tags = $request->input('asset_tags');
+
+        $settings = Setting::getSettings();
+
+        $success = false;
+        $serials = $request->input('serials');
+
+        for ($a = 1; $a <= count($asset_tags); $a++) {
+            $asset = new Asset();
+            $asset->model()->associate(AssetModel::find($request->input('model_id')));
+            $asset->name = $request->input('name');
+
+            // Check for a corresponding serial
+            if (($serials) && (array_key_exists($a, $serials))) {
+                $asset->serial = $serials[$a];
+            }
+
+            if (($asset_tags) && (array_key_exists($a, $asset_tags))) {
+                $asset->asset_tag = $asset_tags[$a];
+            }
+
+            $asset->company_id              = Company::getIdForCurrentUser($request->input('company_id'));
+            $asset->model_id                = $request->input('model_id');
+            $asset->order_number            = $request->input('order_number');
+            $asset->notes                   = $request->input('notes');
+            $asset->user_id                 = Auth::id();
+            $asset->status_id               = request('status_id');
+            $asset->warranty_months         = request('warranty_months', null);
+            $asset->purchase_cost           = request('purchase_cost');
+            $asset->purchase_date           = request('purchase_date', null);
+            $asset->asset_eol_date          = request('asset_eol_date', null);
+            $asset->assigned_to             = request('assigned_to', null);
+            $asset->supplier_id             = request('supplier_id', null);
+            $asset->requestable             = request('requestable', 0);
+            $asset->rtd_location_id         = request('rtd_location_id', null);
+            $asset->byod                    = request('byod', 0);
+
+            if (! empty($settings->audit_interval)) {
+                $asset->next_audit_date = Carbon::now()->addMonths($settings->audit_interval)->toDateString();
+            }
+
+            // Set location_id to rtd_location_id ONLY if the asset isn't being checked out
+            if (!request('assigned_user') && !request('assigned_asset') && !request('assigned_location')) {
+                $asset->location_id = $request->input('rtd_location_id', null);
+            }
+
+            // Create the image (if one was chosen.)
+            if ($request->has('image')) {
+                $asset = $request->handleImages($asset);
+            }
+
+            // Update custom fields in the database.
+            // Validation for these fields is handled through the AssetRequest form request
+            $model = AssetModel::find($request->get('model_id'));
+
+            if (($model) && ($model->fieldset)) {
+                foreach ($model->fieldset->fields as $field) {
+                    if ($field->field_encrypted == '1') {
+                        if (Gate::allows('admin')) {
+                            if (is_array($request->input($field->db_column))) {
+                                $asset->{$field->db_column} = Crypt::encrypt(implode(', ', $request->input($field->db_column)));
+                            } else {
+                                $asset->{$field->db_column} = Crypt::encrypt($request->input($field->db_column));
+                            }
+                        }
+                    } else {
+                        if (is_array($request->input($field->db_column))) {
+                            $asset->{$field->db_column} = implode(', ', $request->input($field->db_column));
+                        } else {
+                            $asset->{$field->db_column} = $request->input($field->db_column);
+                        }
+                    }
+                }
+            }
+
+            // Validate the asset before saving
+            if ($asset->isValid() && $asset->save()) {
+                if (request('assigned_user')) {
+                    $target = User::find(request('assigned_user'));
+                    $location = $target->location_id;
+                } elseif (request('assigned_asset')) {
+                    $target = Asset::find(request('assigned_asset'));
+                    $location = $target->location_id;
+                } elseif (request('assigned_location')) {
+                    $target = Location::find(request('assigned_location'));
+                    $location = $target->id;
+                }
+
+                if (isset($target)) {
+                    $asset->checkOut($target, Auth::user(), date('Y-m-d H:i:s'), $request->input('expected_checkin', null), 'Checked out on asset creation', $request->get('name'), $location);
+                }
+
+                $success = true;
+                
+            }
+        }
+
+        if ($success) {
+            \Log::debug(e($asset->asset_tag));
+            return redirect()->route('hardware.index')
+                ->with('success-unescaped', trans('admin/hardware/message.create.success_linked', ['link' => route('hardware.show', $asset->id), 'id', 'tag' => e($asset->asset_tag)]));
+               
+      
+        }
+
+        return redirect()->back()->withInput()->withErrors($asset->getErrors());
+    }
+
+    public function getOptionCookie(Request $request){
+        $value = $request->cookie('optional_info');
+        echo $value;
+        return $value;
+     }
+
+    /**
+     * Returns a view that presents a form to edit an existing asset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return View
+     */
+    public function edit($assetId = null)
+    {
+        if (! $item = Asset::find($assetId)) {
+            // Redirect to the asset management page with error
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+        //Handles company checks and permissions.
+        $this->authorize($item);
+
+        return view('hardware/edit', compact('item'))
+            ->with('statuslabel_list', Helper::statusLabelList())
+            ->with('statuslabel_types', Helper::statusTypeList());
+    }
+
+
+    /**
+     * Returns a view that presents information about an asset for detail view.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return View
+     */
+    public function show($assetId = null)
+    {
+        $asset = Asset::withTrashed()->find($assetId);
+        $this->authorize('view', $asset);
+        $settings = Setting::getSettings();
+
+        if (isset($asset)) {
+            $audit_log = Actionlog::where('action_type', '=', 'audit')
+                ->where('item_id', '=', $assetId)
+                ->where('item_type', '=', Asset::class)
+                ->orderBy('created_at', 'DESC')->first();
+
+            if ($asset->location) {
+                $use_currency = $asset->location->currency;
+            } else {
+                if ($settings->default_currency != '') {
+                    $use_currency = $settings->default_currency;
+                } else {
+                    $use_currency = trans('general.currency');
+                }
+            }
+
+            $qr_code = (object) [
+                'display' => $settings->qr_code == '1',
+                'url' => route('qr_code/hardware', $asset->id),
+            ];
+
+            return view('hardware/view', compact('asset', 'qr_code', 'settings'))
+                ->with('use_currency', $use_currency)->with('audit_log', $audit_log);
+        }
+
+        return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+    }
+
+    /**
+     * Validate and process asset edit form.
+     *
+     * @param int $assetId
+     * @return \Illuminate\Http\RedirectResponse|Redirect
+     *@since [v1.0]
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     */
+    public function update(ImageUploadRequest $request, $assetId = null)
+    {
+        // Check if the asset exists
+        if (! $asset = Asset::find($assetId)) {
+            // Redirect to the asset management page with error
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+        $this->authorize($asset);
+
+        $asset->status_id = $request->input('status_id', null);
+        $asset->warranty_months = $request->input('warranty_months', null);
+        $asset->purchase_cost = $request->input('purchase_cost', null);
+        $asset->purchase_date = $request->input('purchase_date', null); 
+        if ($request->filled('purchase_date') && !$request->filled('asset_eol_date') && ($asset->model->eol > 0)) {
+            $asset->purchase_date = $request->input('purchase_date', null); 
+            $asset->asset_eol_date = Carbon::parse($request->input('purchase_date'))->addMonths($asset->model->eol)->format('Y-m-d');
+            $asset->eol_explicit = false;
+        } elseif ($request->filled('asset_eol_date')) {
+           $asset->asset_eol_date = $request->input('asset_eol_date', null);
+           $months = Carbon::parse($asset->asset_eol_date)->diffInMonths($asset->purchase_date);
+           if($asset->model->eol) {
+               if($months != $asset->model->eol > 0) {
+                   $asset->eol_explicit = true;
+               } else {
+                   $asset->eol_explicit = false;
+               }
+           } else {
+               $asset->eol_explicit = true;
+           }
+        } elseif (!$request->filled('asset_eol_date') && (($asset->model->eol) == 0)) {
+           $asset->asset_eol_date = null;
+		   $asset->eol_explicit = false;
+        }
+        $asset->supplier_id = $request->input('supplier_id', null);
+        $asset->expected_checkin = $request->input('expected_checkin', null);
+
+        // If the box isn't checked, it's not in the request at all.
+        $asset->requestable = $request->filled('requestable');
+        $asset->rtd_location_id = $request->input('rtd_location_id', null);
+        $asset->byod = $request->input('byod', 0);
+
+        $status = Statuslabel::find($asset->status_id);
+
+        if($status->archived){
+            $asset->assigned_to = null;
+        }
+
+        if ($asset->assigned_to == '') {
+            $asset->location_id = $request->input('rtd_location_id', null);
+        }
+
+
+        if ($request->filled('image_delete')) {
+            try {
+                unlink(public_path().'/uploads/assets/'.$asset->image);
+                $asset->image = '';
+            } catch (\Exception $e) {
+                Log::info($e);
+            }
+        }
+
+        // Update the asset data
+        $asset_tag = $request->input('asset_tags');
+        $serial = $request->input('serials');
+        $asset->name = $request->input('name');
+        $asset->serial = $serial[1];
+        $asset->company_id = Company::getIdForCurrentUser($request->input('company_id'));
+        $asset->model_id = $request->input('model_id');
+        $asset->order_number = $request->input('order_number');
+        $asset->asset_tag = $asset_tag[1];
+        $asset->notes = $request->input('notes');
+
+        $asset = $request->handleImages($asset);
+
+        // Update custom fields in the database.
+        // Validation for these fields is handlded through the AssetRequest form request
+        // FIXME: No idea why this is returning a Builder error on db_column_name.
+        // Need to investigate and fix. Using static method for now.
+        $model = AssetModel::find($request->get('model_id'));
+        if (($model) && ($model->fieldset)) {
+            foreach ($model->fieldset->fields as $field) {
+                if ($field->field_encrypted == '1') {
+                    if (Gate::allows('admin')) {
+                        if (is_array($request->input($field->db_column))) {
+                            $asset->{$field->db_column} = Crypt::encrypt(implode(', ', $request->input($field->db_column)));
+                        } else {
+                            $asset->{$field->db_column} = Crypt::encrypt($request->input($field->db_column));
+                        }
+                    }
+                } else {
+                    if (is_array($request->input($field->db_column))) {
+                        $asset->{$field->db_column} = implode(', ', $request->input($field->db_column));
+                    } else {
+                        $asset->{$field->db_column} = $request->input($field->db_column);
+                    }
+                }
+            }
+        }
+
+
+        if ($asset->save()) {
+            return redirect()->route('hardware.show', $assetId)
+                ->with('success', trans('admin/hardware/message.update.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($asset->getErrors());
+    }
+
+    /**
+     * Delete a given asset (mark as deleted).
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return Redirect
+     */
+    public function destroy($assetId)
+    {
+        // Check if the asset exists
+        if (is_null($asset = Asset::find($assetId))) {
+            // Redirect to the asset management page with error
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        $this->authorize('delete', $asset);
+
+        DB::table('assets')
+            ->where('id', $asset->id)
+            ->update(['assigned_to' => null]);
+
+        if ($asset->image) {
+            try {
+                Storage::disk('public')->delete('assets'.'/'.$asset->image);
+            } catch (\Exception $e) {
+                Log::debug($e);
+            }
+        }
+
+        $asset->delete();
+
+        return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.delete.success'));
+    }
+
+    /**
+     * Searches the assets table by serial, and redirects if it finds one
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @return Redirect
+     */
+    public function getAssetBySerial(Request $request)
+    {
+        $topsearch = ($request->get('topsearch')=="true");
+
+        if (!$asset = Asset::where('serial', '=', $request->get('serial'))->first()) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+        $this->authorize('view', $asset);
+        return redirect()->route('hardware.show', $asset->id)->with('topsearch', $topsearch);
+    }
+
+    /**
+     * Searches the assets table by asset tag, and redirects if it finds one
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @return Redirect
+     */
+    public function getAssetByTag(Request $request, $tag=null)
+    {
+        $tag = $tag ? $tag : $request->get('assetTag');
+        $topsearch = ($request->get('topsearch') == 'true');
+
+        if (! $asset = Asset::where('asset_tag', '=', $tag)->first()) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+        $this->authorize('view', $asset);
+
+        return redirect()->route('hardware.show', $asset->id)->with('topsearch', $topsearch);
+    }
+
+
+    /**
+     * Return a QR code for the asset
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return Response
+     */
+    public function getQrCode($assetId = null)
+    {
+        $settings = Setting::getSettings();
+
+        if ($settings->qr_code == '1') {
+            $asset = Asset::withTrashed()->find($assetId);
+            if ($asset) {
+                $size = Helper::barcodeDimensions($settings->barcode_type);
+                $qr_file = public_path().'/uploads/barcodes/qr-'.str_slug($asset->asset_tag).'-'.str_slug($asset->id).'.png';
+
+                if (isset($asset->id, $asset->asset_tag)) {
+                    if (file_exists($qr_file)) {
+                        $header = ['Content-type' => 'image/png'];
+
+                        return response()->file($qr_file, $header);
+                    } else {
+                        $barcode = new \Com\Tecnick\Barcode\Barcode();
+                        $barcode_obj = $barcode->getBarcodeObj($settings->barcode_type, route('hardware.show', $asset->id), $size['height'], $size['width'], 'black', [-2, -2, -2, -2]);
+                        file_put_contents($qr_file, $barcode_obj->getPngData());
+
+                        return response($barcode_obj->getPngData())->header('Content-type', 'image/png');
+                    }
+                }
+            }
+
+            return 'That asset is invalid';
+        }
+    }
+
+    /**
+     * Return a 2D barcode for the asset
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return Response
+     */
+    public function getBarCode($assetId = null)
+    {
+        $settings = Setting::getSettings();
+        if ($asset = Asset::withTrashed()->find($assetId)) {
+            $barcode_file = public_path().'/uploads/barcodes/'.str_slug($settings->alt_barcode).'-'.str_slug($asset->asset_tag).'.png';
+
+            if (isset($asset->id, $asset->asset_tag)) {
+                if (file_exists($barcode_file)) {
+                    $header = ['Content-type' => 'image/png'];
+
+                    return response()->file($barcode_file, $header);
+                } else {
+                    // Calculate barcode width in pixel based on label width (inch)
+                    $barcode_width = ($settings->labels_width - $settings->labels_display_sgutter) * 200.000000000001;
+
+                    $barcode = new \Com\Tecnick\Barcode\Barcode();
+                    try {
+                        $barcode_obj = $barcode->getBarcodeObj($settings->alt_barcode, $asset->asset_tag, ($barcode_width < 300 ? $barcode_width : 300), 50);
+                        file_put_contents($barcode_file, $barcode_obj->getPngData());
+
+                        return response($barcode_obj->getPngData())->header('Content-type', 'image/png');
+                    } catch (\Exception $e) {
+                        Log::debug('The barcode format is invalid.');
+
+                        return response(file_get_contents(public_path('uploads/barcodes/invalid_barcode.gif')))->header('Content-type', 'image/gif');
+                    }
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Return a label for an individual asset.
+     *
+     * @author [L. Swartzendruber] [<logan.swartzendruber@gmail.com>
+     * @param int $assetId
+     * @return View
+     */
+    public function getLabel($assetId = null)
+    {
+        if (isset($assetId)) {
+            $asset = Asset::find($assetId);
+            $this->authorize('view', $asset);
+
+            return (new Label())
+                ->with('assets', collect([ $asset ]))
+                ->with('settings', Setting::getSettings())
+                ->with('template', request()->get('template'))
+                ->with('offset', request()->get('offset'))
+                ->with('bulkedit', false)
+                ->with('count', 0);
+        }
+    }
+
+    /**
+     * Returns a view that presents a form to clone an asset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return View
+     */
+    public function getClone($assetId = null)
+    {
+        // Check if the asset exists
+        if (is_null($asset_to_clone = Asset::find($assetId))) {
+            // Redirect to the asset management page
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+
+        $this->authorize('create', $asset_to_clone);
+
+        $asset = clone $asset_to_clone;
+        $asset->id = null;
+        $asset->asset_tag = '';
+        $asset->serial = '';
+        $asset->assigned_to = '';
+
+        return view('hardware/edit')
+            ->with('statuslabel_list', Helper::statusLabelList())
+            ->with('statuslabel_types', Helper::statusTypeList())
+            ->with('item', $asset);
+    }
+
+    /**
+     * Return history import view
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @return View
+     */
+    public function getImportHistory()
+    {
+        $this->authorize('admin');
+
+        return view('hardware/history');
+    }
+
+    /**
+     * Import history
+     *
+     * This needs a LOT of love. It's done very inelegantly right now, and there are
+     * a ton of optimizations that could (and should) be done.
+     *
+     * Updated to respect checkin dates:
+     * No checkin column, assume all items are checked in (todays date)
+     * Checkin date in the past, update history.
+     * Checkin date in future or empty, check the item out to the user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.3]
+     * @return View
+     */
+    public function postImportHistory(Request $request)
+    {
+        if (! $request->hasFile('user_import_csv')) {
+            return back()->with('error', 'No file provided. Please select a file for import and try again. ');
+        }
+
+        if (! ini_get('auto_detect_line_endings')) {
+            ini_set('auto_detect_line_endings', '1');
+        }
+        $csv = Reader::createFromPath($request->file('user_import_csv'));
+        $csv->setHeaderOffset(0);
+        $header = $csv->getHeader();
+        $isCheckinHeaderExplicit = in_array('checkin date', (array_map('strtolower', $header)));
+        try {
+            $results = $csv->getRecords();
+        } catch (\Exception $e) {
+            return back()->with('error', trans('general.error_in_import_file', ['error' => $e->getMessage()]));
+        } 
+        $item = [];
+        $status = [];
+        $status['error'] = [];
+        $status['success'] = [];
+        foreach ($results as $row) {
+            if (is_array($row)) {
+                $row = array_change_key_case($row, CASE_LOWER);
+                $asset_tag = Helper::array_smart_fetch($row, 'asset tag');
+                if (! array_key_exists($asset_tag, $item)) {
+                    $item[$asset_tag] = [];
+                }
+                $batch_counter = count($item[$asset_tag]);
+                $item[$asset_tag][$batch_counter]['checkout_date'] = Carbon::parse(Helper::array_smart_fetch($row, 'checkout date'))->format('Y-m-d H:i:s');
+
+                if ($isCheckinHeaderExplicit) {
+                    //checkin date not empty, assume past transaction or future checkin date (expected)
+                    if (! empty(Helper::array_smart_fetch($row, 'checkin date'))) {
+                        $item[$asset_tag][$batch_counter]['checkin_date'] = Carbon::parse(Helper::array_smart_fetch($row, 'checkin date'))->format('Y-m-d H:i:s');
+                    } else {
+                        $item[$asset_tag][$batch_counter]['checkin_date'] = '';
+                    }
+                } else {
+                    //checkin header missing, assume data is unavailable and make checkin date explicit (now) so we don't encounter invalid state.
+                    $item[$asset_tag][$batch_counter]['checkin_date'] = Carbon::parse(now())->format('Y-m-d H:i:s');
+                }
+
+                $item[$asset_tag][$batch_counter]['asset_tag'] = Helper::array_smart_fetch($row, 'asset tag');
+                $item[$asset_tag][$batch_counter]['name'] = Helper::array_smart_fetch($row, 'name');
+                $item[$asset_tag][$batch_counter]['email'] = Helper::array_smart_fetch($row, 'email');
+                if ($asset = Asset::where('asset_tag', '=', $asset_tag)->first()) {
+                    $item[$asset_tag][$batch_counter]['asset_id'] = $asset->id;
+                    $base_username = User::generateFormattedNameFromFullName(Setting::getSettings()->username_format, $item[$asset_tag][$batch_counter]['name']);
+                    $user = User::where('username', '=', $base_username['username']);
+                    $user_query = ' on username '.$base_username['username'];
+                    if ($request->input('match_firstnamelastname') == '1') {
+                        $firstnamedotlastname = User::generateFormattedNameFromFullName('firstname.lastname', $item[$asset_tag][$batch_counter]['name']);
+                        $item[$asset_tag][$batch_counter]['username'][] = $firstnamedotlastname['username'];
+                        $user->orWhere('username', '=', $firstnamedotlastname['username']);
+                        $user_query .= ', or on username '.$firstnamedotlastname['username'];
+                    }
+                    if ($request->input('match_flastname') == '1') {
+                        $flastname = User::generateFormattedNameFromFullName('filastname', $item[$asset_tag][$batch_counter]['name']);
+                        $item[$asset_tag][$batch_counter]['username'][] = $flastname['username'];
+                        $user->orWhere('username', '=', $flastname['username']);
+                        $user_query .= ', or on username '.$flastname['username'];
+                    }
+                    if ($request->input('match_firstname') == '1') {
+                        $firstname = User::generateFormattedNameFromFullName('firstname', $item[$asset_tag][$batch_counter]['name']);
+                        $item[$asset_tag][$batch_counter]['username'][] = $firstname['username'];
+                        $user->orWhere('username', '=', $firstname['username']);
+                        $user_query .= ', or on username '.$firstname['username'];
+                    }
+                    if ($request->input('match_email') == '1') {
+                        if ($item[$asset_tag][$batch_counter]['name'] == '') {
+                            $item[$asset_tag][$batch_counter]['username'][] = $user_email = User::generateEmailFromFullName($item[$asset_tag][$batch_counter]['name']);
+                            $user->orWhere('username', '=', $user_email);
+                            $user_query .= ', or on username '.$user_email;
+                        }
+                    }
+                    if ($request->input('match_username') == '1') {
+                        // Added #8825: add explicit username lookup
+                        $raw_username = $item[$asset_tag][$batch_counter]['name'];
+                        $user->orWhere('username', '=', $raw_username);
+                        $user_query .= ', or on username '.$raw_username;
+                    }
+
+                    // A matching user was found
+                    if ($user = $user->first()) {
+                        //$user is now matched user from db
+                        $item[$asset_tag][$batch_counter]['user_id'] = $user->id;
+
+                        Actionlog::firstOrCreate([
+                            'item_id' => $asset->id,
+                            'item_type' => Asset::class,
+                            'user_id' =>  Auth::user()->id,
+                            'note' => 'Checkout imported by '.Auth::user()->present()->fullName().' from history importer',
+                            'target_id' => $item[$asset_tag][$batch_counter]['user_id'],
+                            'target_type' => User::class,
+                            'created_at' =>  $item[$asset_tag][$batch_counter]['checkout_date'],
+                            'action_type'   => 'checkout',
+                        ]);
+
+                        $checkin_date = $item[$asset_tag][$batch_counter]['checkin_date'];
+
+                        if ($isCheckinHeaderExplicit) {
+
+                            // if checkin date header exists, assume that empty or future date is still checked out
+                            // if checkin is before today's date, assume it's checked in and do not assign user ID, if checkin date is in the future or blank, this is the expected checkin date, items are checked out
+
+                            if ((strtotime($checkin_date) > strtotime(Carbon::now())) || (empty($checkin_date)))
+                            {
+                                //only do this if item is checked out
+                                $asset->assigned_to = $user->id;
+                                $asset->assigned_type = User::class;
+                            }
+                        }
+
+                        if (! empty($checkin_date)) {
+                            //only make a checkin there is a valid checkin date or we created one on import.
+                            Actionlog::firstOrCreate([
+                                'item_id' => $item[$asset_tag][$batch_counter]['asset_id'],
+                                'item_type' => Asset::class,
+                                'user_id' => Auth::user()->id,
+                                'note' => 'Checkin imported by '.Auth::user()->present()->fullName().' from history importer',
+                                'target_id' => null,
+                                'created_at' => $checkin_date,
+                                'action_type' => 'checkin',
+                            ]);
+                        }
+
+                        if ($asset->save()) {
+                            $status['success'][]['asset'][$asset_tag]['msg'] = 'Asset successfully matched for '.Helper::array_smart_fetch($row, 'name').$user_query.' on '.$item[$asset_tag][$batch_counter]['checkout_date'];
+                        } else {
+                            $status['error'][]['asset'][$asset_tag]['msg'] = 'Asset and user was matched but could not be saved.';
+                        }
+                    } else {
+                        $item[$asset_tag][$batch_counter]['user_id'] = null;
+                        $status['error'][]['user'][Helper::array_smart_fetch($row, 'name')]['msg'] = 'User does not exist so no checkin log was created.';
+                    }
+                } else {
+                    $item[$asset_tag][$batch_counter]['asset_id'] = null;
+                    $status['error'][]['asset'][$asset_tag]['msg'] = 'Asset does not exist so no match was attempted.';
+                }
+            }
+        }
+
+        return view('hardware/history')->with('status', $status);
+    }
+
+    public function sortByName(array $recordA, array $recordB): int
+    {
+        return strcmp($recordB['Full Name'], $recordA['Full Name']);
+    }
+
+    /**
+     * Restore a deleted asset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param int $assetId
+     * @since [v1.0]
+     * @return View
+     */
+    public function getRestore($assetId = null)
+    {
+        if ($asset = Asset::withTrashed()->find($assetId)) {
+            $this->authorize('delete', $asset);
+
+            if ($asset->deleted_at == '') {
+                return redirect()->back()->with('error', trans('general.not_deleted', ['item_type' => trans('general.asset')]));
+            }
+
+            if ($asset->restore()) {
+                // Redirect them to the deleted page if there are more, otherwise the section index
+                $deleted_assets = Asset::onlyTrashed()->count();
+                if ($deleted_assets > 0) {
+                    return redirect()->back()->with('success', trans('admin/hardware/message.restore.success'));
+                }
+                return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.restore.success'));
+            }
+
+            // Check validation to make sure we're not restoring an asset with the same asset tag (or unique attribute) as an existing asset
+            return redirect()->back()->with('error', trans('general.could_not_restore', ['item_type' => trans('general.asset'), 'error' => $asset->getErrors()->first()]));
+        }
+
+        return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+    }
+
+    public function quickScan()
+    {
+        $this->authorize('audit', Asset::class);
+        $dt = Carbon::now()->addMonths(12)->toDateString();
+
+        return view('hardware/quickscan')->with('next_audit_date', $dt);
+    }
+
+    public function quickScanCheckin()
+    {
+        $this->authorize('checkin', Asset::class);
+
+        return view('hardware/quickscan-checkin');
+    }
+
+    public function audit($id)
+    {
+        $settings = Setting::getSettings();
+        $this->authorize('audit', Asset::class);
+        $dt = Carbon::now()->addMonths($settings->audit_interval)->toDateString();
+        $asset = Asset::findOrFail($id);
+
+        return view('hardware/audit')->with('asset', $asset)->with('next_audit_date', $dt)->with('locations_list');
+    }
+
+    public function dueForAudit()
+    {
+        $this->authorize('audit', Asset::class);
+
+        return view('hardware/audit-due');
+    }
+
+    public function overdueForAudit()
+    {
+        $this->authorize('audit', Asset::class);
+
+        return view('hardware/audit-overdue');
+    }
+
+
+    public function auditStore(Request $request, $id)
+    {
+        $this->authorize('audit', Asset::class);
+
+        $rules = [
+            'location_id' => 'exists:locations,id|nullable|numeric',
+            'next_audit_date' => 'date|nullable',
+        ];
+
+        $validator = Validator::make($request->all(), $rules);
+
+        if ($validator->fails()) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, $validator->errors()->all()));
+        }
+
+        $asset = Asset::findOrFail($id);
+
+        // We don't want to log this as a normal update, so let's bypass that
+        $asset->unsetEventDispatcher();
+
+        $asset->next_audit_date = $request->input('next_audit_date');
+        $asset->last_audit_date = date('Y-m-d H:i:s');
+
+        // Check to see if they checked the box to update the physical location,
+        // not just note it in the audit notes
+        if ($request->input('update_location') == '1') {
+            Log::debug('update location in audit');
+            $asset->location_id = $request->input('location_id');
+        }
+
+
+        if ($asset->save()) {
+            $file_name = '';
+            // Upload an image, if attached
+            if ($request->hasFile('image')) {
+                $path = 'private_uploads/audits';
+                if (! Storage::exists($path)) {
+                    Storage::makeDirectory($path, 775);
+                }
+                $upload = $image = $request->file('image');
+                $ext = $image->getClientOriginalExtension();
+                $file_name = 'audit-'.str_random(18).'.'.$ext;
+                Storage::putFileAs($path, $upload, $file_name);
+            }
+
+
+            $asset->logAudit($request->input('note'), $request->input('location_id'), $file_name);
+            return redirect()->route('assets.audit.due')->with('success', trans('admin/hardware/message.audit.success'));
+        }
+    }
+
+    public function getRequestedIndex($user_id = null)
+    {
+        $this->authorize('index', Asset::class);
+        $requestedItems = CheckoutRequest::with('user', 'requestedItem')->whereNull('canceled_at')->with('user', 'requestedItem');
+
+        if ($user_id) {
+            $requestedItems->where('user_id', $user_id)->get();
+        }
+
+        $requestedItems = $requestedItems->orderBy('created_at', 'desc')->get();
+
+        return view('hardware/requested', compact('requestedItems'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Assets/BulkAssetsController.php

@@ -0,0 +1,597 @@
+<?php
+
+namespace App\Http\Controllers\Assets;
+
+use App\Models\Actionlog;
+use App\Helpers\Helper;
+use App\Http\Controllers\CheckInOutRequest;
+use App\Http\Controllers\Controller;
+use App\Models\Asset;
+use App\Models\AssetModel;
+use App\Models\Statuslabel;
+use App\Models\Setting;
+use App\View\Label;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Session;
+use App\Http\Requests\AssetCheckoutRequest;
+use App\Models\CustomField;
+
+class BulkAssetsController extends Controller
+{
+    use CheckInOutRequest;
+
+    /**
+     * Display the bulk edit page.
+     *
+     * This method is super weird because it's kinda of like a controller within a controller.
+     * It's main function is to determine what the bulk action in, and then return a view with
+     * the information that view needs, be it bulk delete, bulk edit, restore, etc.
+     *
+     * This is something that made sense at the time, but sort of doesn't make sense now. A JS front-end to determine form
+     * action would make a lot more sense here and make things a lot more clear.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @return View
+     * @internal param int $assetId
+     * @since [v2.0]
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function edit(Request $request)
+    {
+        $this->authorize('view', Asset::class);
+
+        /**
+         * No asset IDs were passed
+         */
+        if (! $request->filled('ids')) {
+            return redirect()->back()->with('error', trans('admin/hardware/message.update.no_assets_selected'));
+        }
+
+        $asset_ids = $request->input('ids');
+
+        // Figure out where we need to send the user after the update is complete, and store that in the session
+        $bulk_back_url = request()->headers->get('referer');
+        session(['bulk_back_url' => $bulk_back_url]);
+
+        $allowed_columns = [
+            'id',
+            'name',
+            'asset_tag',
+            'serial',
+            'model_number',
+            'last_checkout',
+            'notes',
+            'expected_checkin',
+            'order_number',
+            'image',
+            'assigned_to',
+            'created_at',
+            'updated_at',
+            'purchase_date',
+            'purchase_cost',
+            'last_audit_date',
+            'next_audit_date',
+            'warranty_months',
+            'checkout_counter',
+            'checkin_counter',
+            'requests_counter',
+            'byod',
+            'asset_eol_date',
+        ];
+
+
+        /**
+         * Make sure the column is allowed, and if it's a custom field, make sure we strip the custom_fields. prefix
+         */
+        $order = $request->input('order') === 'asc' ? 'asc' : 'desc';
+        $sort_override = str_replace('custom_fields.', '', $request->input('sort'));
+
+        // This handles all of the pivot sorting below (versus the assets.* fields in the allowed_columns array)
+        $column_sort = in_array($sort_override, $allowed_columns) ? $sort_override : 'assets.id';
+
+        $assets = Asset::with('assignedTo', 'location', 'model')->whereIn('assets.id', $asset_ids);
+
+        $assets = $assets->get();
+
+        if ($assets->isEmpty()) {
+            Log::debug('No assets were found for the provided IDs', ['ids' => $asset_ids]);
+            return redirect()->back()->with('error', trans('admin/hardware/message.update.assets_do_not_exist_or_are_invalid'));
+        }
+
+        $models = $assets->unique('model_id');
+        $modelNames = [];
+        foreach($models as $model) {
+            $modelNames[] = $model->model->name;
+        }
+
+        if ($request->filled('bulk_actions')) {
+
+
+            switch ($request->input('bulk_actions')) {
+                case 'labels':
+                    $this->authorize('view', Asset::class);
+
+                    return (new Label)
+                        ->with('assets', $assets)
+                        ->with('settings', Setting::getSettings())
+                        ->with('bulkedit', true)
+                        ->with('count', 0);
+
+                case 'delete':
+                    $this->authorize('delete', Asset::class);
+                    $assets->each(function ($assets) {
+                        $this->authorize('delete', $assets);
+                    });
+
+                    return view('hardware/bulk-delete')->with('assets', $assets);
+
+                case 'restore':
+                    $this->authorize('update', Asset::class);
+                    $assets = Asset::withTrashed()->find($asset_ids);
+                    $assets->each(function ($asset) {
+                        $this->authorize('delete', $asset);
+                    });
+                    return view('hardware/bulk-restore')->with('assets', $assets);
+
+                case 'edit':
+                    $this->authorize('update', Asset::class);
+
+                    return view('hardware/bulk')
+                        ->with('assets', $asset_ids)
+                        ->with('statuslabel_list', Helper::statusLabelList())
+                        ->with('models', $models->pluck(['model']))
+                        ->with('modelNames', $modelNames);
+            }
+        }
+
+        switch ($sort_override) {
+            case 'model':
+                $assets->OrderModels($order);
+                break;
+            case 'model_number':
+                $assets->OrderModelNumber($order);
+                break;
+            case 'category':
+                $assets->OrderCategory($order);
+                break;
+            case 'manufacturer':
+                $assets->OrderManufacturer($order);
+                break;
+            case 'company':
+                $assets->OrderCompany($order);
+                break;
+            case 'location':
+                $assets->OrderLocation($order);
+            case 'rtd_location':
+                $assets->OrderRtdLocation($order);
+                break;
+            case 'status_label':
+                $assets->OrderStatus($order);
+                break;
+            case 'supplier':
+                $assets->OrderSupplier($order);
+                break;
+            case 'assigned_to':
+                $assets->OrderAssigned($order);
+                break;
+            default:
+                $assets->orderBy($column_sort, $order);
+                break;
+        }
+
+        return redirect()->back()->with('error', 'No action selected');
+    }
+
+    /**
+     * Save bulk edits
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @return Redirect
+     * @internal param array $assets
+     * @since [v2.0]
+     */
+    public function update(Request $request)
+    {
+        $this->authorize('update', Asset::class);
+        $has_errors = 0;
+        $error_array = array();
+
+        // Get the back url from the session and then destroy the session
+        $bulk_back_url = route('hardware.index');
+
+        if ($request->session()->has('bulk_back_url')) {
+            $bulk_back_url = $request->session()->pull('bulk_back_url');
+        }
+
+       $custom_field_columns = CustomField::all()->pluck('db_column')->toArray();
+
+     
+        if (! $request->filled('ids') || count($request->input('ids')) == 0) {
+            return redirect($bulk_back_url)->with('error', trans('admin/hardware/message.update.no_assets_selected'));
+        }
+
+
+        $assets = Asset::whereIn('id', array_keys($request->input('ids')))->get();
+
+
+
+        /**
+         * If ANY of these are filled, prepare to update the values on the assets.
+         *
+         * Additional checks will be needed for some of them to make sure the values
+         * make sense (for example, changing the status ID to something incompatible with
+         * its checkout status.
+         */
+
+        if (($request->filled('purchase_date'))
+            || ($request->filled('expected_checkin'))
+            || ($request->filled('purchase_cost'))
+            || ($request->filled('supplier_id'))
+            || ($request->filled('order_number'))
+            || ($request->filled('warranty_months'))
+            || ($request->filled('rtd_location_id'))
+            || ($request->filled('requestable'))
+            || ($request->filled('company_id'))
+            || ($request->filled('status_id'))
+            || ($request->filled('model_id'))
+            || ($request->filled('next_audit_date'))
+            || ($request->filled('null_purchase_date'))
+            || ($request->filled('null_expected_checkin_date'))
+            || ($request->filled('null_next_audit_date'))
+            || ($request->anyFilled($custom_field_columns))
+
+        ) {
+            // Let's loop through those assets and build an update array
+            foreach ($assets as $asset) {
+
+                $this->update_array = [];
+
+                /**
+                 * Leave out model_id and status here because we do math on that later. We have to do some extra
+                 * validation and checks on those two.
+                 *
+                 * It's tempting to make these match the request check above, but some of these values require
+                 * extra work to make sure the data makes sense.
+                 */
+                $this->conditionallyAddItem('purchase_date')
+                    ->conditionallyAddItem('expected_checkin')
+                    ->conditionallyAddItem('order_number')
+                    ->conditionallyAddItem('requestable')
+                    ->conditionallyAddItem('supplier_id')
+                    ->conditionallyAddItem('warranty_months')
+                    ->conditionallyAddItem('next_audit_date');
+                    foreach ($custom_field_columns as $key => $custom_field_column) {
+                        $this->conditionallyAddItem($custom_field_column); 
+                   }
+
+                /**
+                 * Blank out fields that were requested to be blanked out via checkbox
+                 */
+                if ($request->input('null_purchase_date')=='1') {
+                    $this->update_array['purchase_date'] = null;
+                }
+
+                if ($request->input('null_expected_checkin_date')=='1') {
+                    $this->update_array['expected_checkin'] = null;
+                }
+
+                if ($request->input('null_next_audit_date')=='1') {
+                    $this->update_array['next_audit_date'] = null;
+                }
+
+                if ($request->filled('purchase_cost')) {
+                    $this->update_array['purchase_cost'] =  $request->input('purchase_cost');
+                }
+
+                if ($request->filled('company_id')) {
+                    $this->update_array['company_id'] = $request->input('company_id');
+                    if ($request->input('company_id') == 'clear') {
+                        $this->update_array['company_id'] = null;
+                    }
+                }
+
+                /**
+                 * We're trying to change the model ID - we need to do some extra checks here to make sure
+                 * the custom field values work for the custom fieldset rules around this asset. Uniqueness
+                 * and requiredness across the fieldset is particularly important, since those are
+                 * fieldset-specific attributes.
+                 */
+                if ($request->filled('model_id')) {
+                    $this->update_array['model_id'] = AssetModel::find($request->input('model_id'))->id;
+                }
+
+                /**
+                 * We're trying to change the status ID - we need to do some extra checks here to
+                 * make sure the status label type is one that makes sense for the state of the asset,
+                 * for example, we shouldn't be able to make an asset archived if it's currently assigned
+                 * to someone/something.
+                 */
+                if ($request->filled('status_id')) {
+                    $updated_status = Statuslabel::find($request->input('status_id'));
+
+                    // We cannot assign a non-deployable status type if the asset is already assigned.
+                    // This could probably be added to a form request.
+                    // If the asset isn't assigned, we don't care what the status is.
+                    // Otherwise we need to make sure the status type is still a deployable one.
+                    if (
+                        ($asset->assigned_to == '')
+                        || ($updated_status->deployable == '1') && ($asset->assetstatus->deployable == '1')
+                    ) {
+                        $this->update_array['status_id'] = $updated_status->id;
+                    }
+
+                }
+
+                /**
+                 * We're changing the location ID - figure out which location we should apply
+                 * this change to:
+                 *
+                 * 0 - RTD location only
+                 * 1 - location ID and RTD location ID
+                 * 2 - location ID only
+                 *
+                 * Note: this is kinda dumb and we should just use human-readable values IMHO. - snipe
+                 */
+                if ($request->filled('rtd_location_id')) {
+
+                    if (($request->filled('update_real_loc')) && (($request->input('update_real_loc')) == '0')) {
+                        $this->update_array['rtd_location_id'] = $request->input('rtd_location_id');
+                    }
+
+                    if (($request->filled('update_real_loc')) && (($request->input('update_real_loc')) == '1')) {
+                        $this->update_array['location_id'] = $request->input('rtd_location_id');
+                        $this->update_array['rtd_location_id'] = $request->input('rtd_location_id');
+                    }
+
+                    if (($request->filled('update_real_loc')) && (($request->input('update_real_loc')) == '2')) {
+                        $this->update_array['location_id'] = $request->input('rtd_location_id');
+                    }
+
+                }
+
+
+                /**
+                 * ------------------------------------------------------------------------------
+                 * ANYTHING that happens past this foreach
+                 * WILL NOT BE logged in the edit log_meta data
+                 *  ------------------------------------------------------------------------------
+                 */
+                $changed = [];
+
+                foreach ($this->update_array as $key => $value) {
+
+                    if ($this->update_array[$key] != $asset->{$key}) {
+                        $changed[$key]['old'] = $asset->{$key};
+                        $changed[$key]['new'] = $this->update_array[$key];
+                    }
+
+                }
+
+                /**
+                 * Start all the custom fields shenanigans
+                 */
+
+                // Does the model have a fieldset?
+                if ($asset->model->fieldset) {
+                    foreach ($asset->model->fieldset->fields as $field) {
+
+                        if ((array_key_exists($field->db_column, $this->update_array)) && ($field->field_encrypted == '1')) {
+                            $decrypted_old = Helper::gracefulDecrypt($field, $asset->{$field->db_column});
+
+                            /*
+                             * Check if the decrypted existing value is different from one we just submitted
+                             * and if not, pull it out of the object since it shouldn't really be updating at all.
+                             * If we don't do this, it will try to re-encrypt it, and the same value encrypted two
+                             * different times will have different values, so it will *look* like it was updated
+                             * but it wasn't.
+                             */
+                            if ($decrypted_old != $this->update_array[$field->db_column]) {
+                                $asset->{$field->db_column} = \Crypt::encrypt($this->update_array[$field->db_column]);
+                            } else {
+                                /*
+                                 * Remove the encrypted custom field from the update_array, since nothing changed
+                                 */
+                                unset($this->update_array[$field->db_column]);
+                                unset($asset->{$field->db_column});
+                            }
+
+                            /*
+                             * These custom fields aren't encrypted, just carry on as usual
+                             */
+                        } else {
+
+                            if ((array_key_exists($field->db_column, $this->update_array)) && ($asset->{$field->db_column} != $this->update_array[$field->db_column])) {
+
+                                // Check if this is an array, and if so, flatten it
+                                if (is_array($this->update_array[$field->db_column])) {
+                                    $asset->{$field->db_column} = implode(', ', $this->update_array[$field->db_column]);
+                                } else {
+                                    $asset->{$field->db_column} = $this->update_array[$field->db_column];
+                                }
+                            }
+                        }
+
+                    } // endforeach
+                }
+
+
+                // Check if it passes validation, and then try to save
+                if (!$asset->update($this->update_array)) {
+
+                    // Build the error array
+                    foreach ($asset->getErrors()->toArray() as $key => $message) {
+                        for ($x = 0; $x < count($message); $x++) {
+                            $error_array[$key][] = trans('general.asset') . ' ' . $asset->id . ': ' . $message[$x];
+                            $has_errors++;
+                        }
+                    }
+
+                }  // end if saved
+
+            } // end asset foreach
+
+            if ($has_errors > 0) {
+                return redirect($bulk_back_url)->with('bulk_asset_errors', $error_array);
+            }
+
+            return redirect($bulk_back_url)->with('success', trans('admin/hardware/message.update.success'));
+        }
+        // no values given, nothing to update
+        return redirect($bulk_back_url)->with('warning', trans('admin/hardware/message.update.nothing_updated'));
+    }
+
+    /**
+     * Array to store update data per item
+     * @var array
+     */
+    private $update_array;
+
+    /**
+     * Adds parameter to update array for an item if it exists in request
+     * @param  string $field field name
+     * @return BulkAssetsController Model for Chaining
+     */
+    protected function conditionallyAddItem($field)
+    {
+        if (request()->filled($field)) {
+            $this->update_array[$field] = request()->input($field);
+        }
+
+        return $this;
+    }
+
+    /**
+     * Save bulk deleted.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @param Request $request
+     * @return View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @internal param array $assets
+     * @since [v2.0]
+     */
+    public function destroy(Request $request)
+    {
+        $this->authorize('delete', Asset::class);
+
+        $bulk_back_url = route('hardware.index');
+        if ($request->session()->has('bulk_back_url')) {
+            $bulk_back_url = $request->session()->pull('bulk_back_url');
+        }
+
+        if ($request->filled('ids')) {
+            $assets = Asset::find($request->get('ids'));
+            foreach ($assets as $asset) {
+                $update_array['deleted_at'] = date('Y-m-d H:i:s');
+                $update_array['assigned_to'] = null;
+
+                DB::table('assets')
+                    ->where('id', $asset->id)
+                    ->update($update_array);
+            } // endforeach
+
+            return redirect($bulk_back_url)->with('success', trans('admin/hardware/message.delete.success'));
+            // no values given, nothing to update
+        }
+
+        return redirect($bulk_back_url)->with('error', trans('admin/hardware/message.delete.nothing_updated'));
+    }
+
+    /**
+     * Show Bulk Checkout Page
+     * @return View View to checkout multiple assets
+     */
+    public function showCheckout()
+    {
+        $this->authorize('checkout', Asset::class);
+        // Filter out assets that are not deployable.
+
+        return view('hardware/bulk-checkout');
+    }
+
+    /**
+     * Process Multiple Checkout Request
+     * @return View
+     */
+    public function storeCheckout(AssetCheckoutRequest $request)
+    {
+
+        $this->authorize('checkout', Asset::class);
+
+        try {
+            $admin = Auth::user();
+
+            $target = $this->determineCheckoutTarget();
+
+            if (! is_array($request->get('selected_assets'))) {
+                return redirect()->route('hardware.bulkcheckout.show')->withInput()->with('error', trans('admin/hardware/message.checkout.no_assets_selected'));
+            }
+
+            $asset_ids = array_filter($request->get('selected_assets'));
+
+            if (request('checkout_to_type') == 'asset') {
+                foreach ($asset_ids as $asset_id) {
+                    if ($target->id == $asset_id) {
+                        return redirect()->back()->with('error', 'You cannot check an asset out to itself.');
+                    }
+                }
+            }
+            $checkout_at = date('Y-m-d H:i:s');
+            if (($request->filled('checkout_at')) && ($request->get('checkout_at') != date('Y-m-d'))) {
+                $checkout_at = e($request->get('checkout_at'));
+            }
+
+            $expected_checkin = '';
+
+            if ($request->filled('expected_checkin')) {
+                $expected_checkin = e($request->get('expected_checkin'));
+            }
+
+            $errors = [];
+            DB::transaction(function () use ($target, $admin, $checkout_at, $expected_checkin, $errors, $asset_ids, $request) {
+                foreach ($asset_ids as $asset_id) {
+                    $asset = Asset::findOrFail($asset_id);
+                    $this->authorize('checkout', $asset);
+
+                    $error = $asset->checkOut($target, $admin, $checkout_at, $expected_checkin, e($request->get('note')), $asset->name, null);
+
+                    if ($target->location_id != '') {
+                        $asset->location_id = $target->location_id;
+                        $asset->unsetEventDispatcher();
+                        $asset->save();
+                    }
+
+                    if ($error) {
+                        array_merge_recursive($errors, $asset->getErrors()->toArray());
+                    }
+                }
+            });
+
+            if (! $errors) {
+                // Redirect to the new asset page
+                return redirect()->to('hardware')->with('success', trans('admin/hardware/message.checkout.success'));
+            }
+            // Redirect to the asset management page with error
+            return redirect()->route('hardware.bulkcheckout.show')->with('error', trans('admin/hardware/message.checkout.error'))->withErrors($errors);
+        } catch (ModelNotFoundException $e) {
+            return redirect()->route('hardware.bulkcheckout.show')->with('error', $e->getErrors());
+        }
+        
+    }
+    public function restore(Request $request) {
+        $this->authorize('update', Asset::class);
+       $assetIds = $request->get('ids');
+      if (empty($assetIds)) {
+          return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.restore.nothing_updated'));
+        } else {
+            foreach ($assetIds as $key => $assetId) {
+                    $asset = Asset::withTrashed()->find($assetId);
+                    $asset->restore(); 
+            } 
+        return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.restore.success'));
+        }
+    }
+}

SNIPE-IT/app/Http/Controllers/Auth/ForgotPasswordController.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Foundation\Auth\SendsPasswordResetEmails;
+use Illuminate\Http\Request;
+
+class ForgotPasswordController extends Controller
+{
+    /*
+    |--------------------------------------------------------------------------
+    | Password Reset Controller
+    |--------------------------------------------------------------------------
+    |
+    | This controller is responsible for handling password reset emails and
+    | includes a trait which assists in sending these notifications from
+    | your application to your users. Feel free to explore this trait.
+    |
+    */
+
+    use SendsPasswordResetEmails;
+
+    /**
+     * Create a new controller instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        $this->middleware('guest');
+        $this->middleware('throttle:5,1', ['except' => 'showLinkRequestForm']);
+    }
+
+    /**
+     * Get the e-mail subject line to be used for the reset link email.
+     * Overriding method "getEmailSubject()" from trait "use ResetsPasswords"
+     * @return string
+     */
+    public function getEmailSubject()
+    {
+        return property_exists($this, 'subject') ? $this->subject : \Lang::get('mail.reset_link');
+    }
+
+    /**
+     * Send a reset link to the given user.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\RedirectResponse
+     */
+    public function sendResetLinkEmail(Request $request)
+    {
+
+        /**
+         * Let's set a max character count here to prevent potential
+         * buffer overflow issues with attackers sending very large
+         * payloads through.
+         */
+        $request->validate([
+            'username' => ['required', 'max:255'],
+        ]);
+
+        /**
+         * If we find a matching email with an activated user, we will
+         * send the password reset link to the user.
+         *
+         * Once we have attempted to send the link, we will examine the response
+         * then see the message we need to show to the user. Finally, we'll send out a proper response.
+         */
+        
+        $response = null;
+
+        try {
+            $response = $this->broker()->sendResetLink(
+                array_merge(
+                    $request->only('username'),
+                    ['activated' => '1'],
+                    ['ldap_import' => '0']
+                )
+            );
+        } catch(\Exception $e) {
+            \Log::info('Password reset attempt: User '.$request->input('username').'failed with exception: '.$e );
+        }
+
+        // Prevent timing attack to enumerate users.
+        usleep(500000 + random_int(0, 1500000));
+
+        if ($response === \Password::RESET_LINK_SENT) {
+            \Log::info('Password reset attempt: User '.$request->input('username').' WAS found, password reset sent');
+        } else {
+            \Log::info('Password reset attempt: User matching username '.$request->input('username').' NOT FOUND or user is inactive');
+        }
+
+        /**
+         * If an error was returned by the password broker, we will get this message
+         * translated so we can notify a user of the problem. We'll redirect back
+         * to where the users came from so they can attempt this process again.
+         *
+         * HOWEVER, we do not want to translate the message if the user isn't found
+         * or isn't active, since that would allow an attacker to walk through
+         * a dictionary attack and figure out registered user email addresses.
+         *
+         * Instead we tell the user we've sent an email even though we haven't.
+         * It's bad UX, but better security. The compromises we sometimes have to make.
+        */
+
+        // Regardless of response, we do not want to disclose the status of a user account,
+        // so we give them a generic "If this exists, we're TOTALLY gonna email you" response
+        return redirect()->route('login')->with('success', trans('passwords.sent'));
+        }
+}

SNIPE-IT/app/Http/Controllers/Auth/LoginController.php

@@ -0,0 +1,575 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\SamlNonce;
+use App\Models\Setting;
+use App\Models\User;
+use App\Models\Ldap;
+use App\Services\Saml;
+use Com\Tecnick\Barcode\Barcode;
+use Google2FA;
+use Illuminate\Foundation\Auth\ThrottlesLogins;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Session;
+use Illuminate\Support\Facades\Validator;
+use Log;
+use Redirect;
+
+/**
+ * This controller handles authentication for the user, including local
+ * database users and LDAP users.
+ *
+ * @author [A. Gianotto] [<snipe@snipe.net>]
+ * @version    v1.0
+ */
+class LoginController extends Controller
+{
+    use ThrottlesLogins;
+
+    // This tells the auth controller to use username instead of email address
+    protected $username = 'username';
+
+    /**
+     * Where to redirect users after login / registration.
+     *
+     * @var string
+     */
+    protected $redirectTo = '/';
+
+    /**
+     * @var Saml
+     */
+    protected $saml;
+
+    /**
+     * Create a new authentication controller instance.
+     *
+     * @param Saml $saml
+     *
+     * @return void
+     */
+    public function __construct(Saml $saml)
+    {
+        parent::__construct();
+        $this->middleware('guest', ['except' => ['logout', 'postTwoFactorAuth', 'getTwoFactorAuth', 'getTwoFactorEnroll']]);
+        Session::put('backUrl', \URL::previous());
+        $this->saml = $saml;
+    }
+
+    public function showLoginForm(Request $request)
+    {
+        $this->loginViaRemoteUser($request);
+        $this->loginViaSaml($request);
+        if (Auth::check()) {
+            return redirect()->intended('/');
+        }
+
+        if (!$request->session()->has('loggedout')) {
+            // If the environment is set to ALWAYS require SAML, go straight to the SAML route.
+            // We don't need to check other settings, as this should override those.
+            if (config('app.require_saml')) {
+                return redirect()->route('saml.login');
+            }
+
+
+            if ($this->saml->isEnabled() && Setting::getSettings()->saml_forcelogin == '1' && ! ($request->has('nosaml') || $request->session()->has('error'))) {
+                return redirect()->route('saml.login');
+            }
+        }
+
+        if (Setting::getSettings()->login_common_disabled == '1') {
+            return view('errors.403');
+        }
+
+        return view('auth.login');
+    }
+
+    /**
+     * Log in a user by SAML
+     *
+     * @author Johnson Yi <jyi.dev@outlook.com>
+     *
+     * @since 5.0.0
+     *
+     * @param Request $request
+     *
+     * @return User
+     *
+     * @throws \Exception
+     */
+    private function loginViaSaml(Request $request)
+    {
+        $saml = $this->saml;
+        $samlData = $request->session()->get('saml_login');
+
+        if ($saml->isEnabled() && ! empty($samlData)) {
+
+            try {
+                $user = $saml->samlLogin($samlData);
+                $notValidAfter = new \Carbon\Carbon(@$samlData['assertionNotOnOrAfter']);
+                if(\Carbon::now()->greaterThanOrEqualTo($notValidAfter)) {
+                    abort(400,"Expired SAML Assertion");
+                }
+                if(SamlNonce::where('nonce', @$samlData['nonce'])->count() > 0) {
+                    abort(400,"Assertion has already been used");
+                }
+                Log::debug("okay, fine, this is a new nonce then. Good for you.");
+                if (!is_null($user)) {
+                    Auth::login($user);
+                } else {
+                    $username = $saml->getUsername();
+                    \Log::debug("SAML user '$username' could not be found in database.");
+                    $request->session()->flash('error', trans('auth/message.signin.error'));
+                    $saml->clearData();
+                }
+
+                if ($user = Auth::user()) {
+                    $user->last_login = \Carbon::now();
+                    $user->saveQuietly();
+                }
+                $s = new SamlNonce();
+                $s->nonce = @$samlData['nonce'];
+                $s->not_valid_after = $notValidAfter;
+                $s->save();
+
+            } catch (\Exception $e) {
+                \Log::debug('There was an error authenticating the SAML user: '.$e->getMessage());
+                throw $e;
+            }
+
+        // Fallthrough with better logging
+        } else {
+
+            // Better logging
+            if (empty($samlData)) {
+                \Log::debug("SAML page requested, but samlData seems empty.");
+            }
+        }
+
+
+
+    }
+
+    /**
+     * Log in a user by LDAP
+     *
+     * @author Wes Hulette <jwhulette@gmail.com>
+     *
+     * @since 5.0.0
+     *
+     * @param Request $request
+     *
+     * @return User
+     *
+     * @throws \Exception
+     */
+    private function loginViaLdap(Request $request): User
+    {
+        Log::debug("Binding user to LDAP.");
+         $ldap_user = Ldap::findAndBindUserLdap($request->input('username'), $request->input('password'));
+         if (!$ldap_user) {
+             Log::debug("LDAP user ".$request->input('username')." not found in LDAP or could not bind");
+             throw new \Exception("Could not find user in LDAP directory");
+         } else {
+             Log::debug("LDAP user ".$request->input('username')." successfully bound to LDAP");
+         }
+
+         // Check if the user already exists in the database and was imported via LDAP
+         $user = User::where('username', '=', $request->input('username'))->whereNull('deleted_at')->where('ldap_import', '=', 1)->where('activated', '=', '1')->first(); // FIXME - if we get more than one we should fail. and we sure about this ldap_import thing?
+         Log::debug("Local auth lookup complete");
+
+         // The user does not exist in the database. Try to get them from LDAP.
+         // If user does not exist and authenticates successfully with LDAP we
+         // will create it on the fly and sign in with default permissions
+         if (!$user) {
+             Log::debug("Local user ".$request->input('username')." does not exist");
+             Log::debug("Creating local user ".$request->input('username'));
+
+             if ($user = Ldap::createUserFromLdap($ldap_user, $request->input('password'))) {
+                 Log::debug("Local user created.");
+             } else {
+                 Log::debug("Could not create local user.");
+                 throw new \Exception("Could not create local user");
+             }
+             // If the user exists and they were imported from LDAP already
+         } else {
+             Log::debug("Local user ".$request->input('username')." exists in database. Updating existing user against LDAP.");
+
+             $ldap_attr = Ldap::parseAndMapLdapAttributes($ldap_user);
+
+            $user->password = $user->noPassword();
+            if (Setting::getSettings()->ldap_pw_sync=='1') {
+                $user->password = bcrypt($request->input('password'));
+            }
+
+            $user->email = $ldap_attr['email'];
+            $user->first_name = $ldap_attr['firstname'];
+            $user->last_name = $ldap_attr['lastname']; //FIXME (or TODO?) - do we need to map additional fields that we now support? E.g. country, phone, etc.
+            $user->saveQuietly();
+        } // End if(!user)
+        return $user;
+    }
+
+    private function loginViaRemoteUser(Request $request)
+    {
+        $header_name = Setting::getSettings()->login_remote_user_header_name ?: 'REMOTE_USER';
+        $remote_user = $request->server($header_name);
+        if (!isset($remote_user)) {
+          $remote_user = $request->server('REDIRECT_'.$header_name);
+        }
+        if (Setting::getSettings()->login_remote_user_enabled == '1' && isset($remote_user) && ! empty($remote_user)) {
+            Log::debug("Authenticating via HTTP header $header_name.");
+
+            $strip_prefixes = [
+                // IIS/AD
+                // https://github.com/snipe/snipe-it/pull/5862
+                '\\',
+
+                // Google Cloud IAP
+                // https://cloud.google.com/iap/docs/identity-howto#getting_the_users_identity_with_signed_headers
+                'accounts.google.com:',
+            ];
+
+            $pos = 0;
+            foreach ($strip_prefixes as $needle) {
+                if (($pos = strpos($remote_user, $needle)) !== false) {
+                    $pos += strlen($needle);
+                    break;
+                }
+            }
+
+            if ($pos > 0) {
+                $remote_user = substr($remote_user, $pos);
+            }
+
+            try {
+                $user = User::where('username', '=', $remote_user)->whereNull('deleted_at')->where('activated', '=', '1')->first();
+                Log::debug('Remote user auth lookup complete');
+                if (! is_null($user)) {
+                    Auth::login($user, $request->input('remember'));
+                }
+            } catch (Exception $e) {
+                Log::debug('There was an error authenticating the Remote user: '.$e->getMessage());
+            }
+        }
+    }
+
+    /**
+     * Account sign in form processing.
+     *
+     * @return Redirect
+     */
+    public function login(Request $request)
+    {
+
+        //If the environment is set to ALWAYS require SAML, return access denied
+        if (config('app.require_saml')) {
+            \Log::debug('require SAML is enabled in the .env - return a 403');
+            return view('errors.403');
+        }
+
+        if (Setting::getSettings()->login_common_disabled == '1') {
+            \Log::debug('login_common_disabled is set to 1 - return a 403');
+            return view('errors.403');
+        }
+
+        $validator = $this->validator($request->all());
+
+        if ($validator->fails()) {
+            return redirect()->back()->withInput()->withErrors($validator);
+        }
+
+        $this->maxLoginAttempts = config('auth.passwords.users.throttle.max_attempts');
+        $this->lockoutTime = config('auth.passwords.users.throttle.lockout_duration');
+
+        if ($lockedOut = $this->hasTooManyLoginAttempts($request)) {
+            $this->fireLockoutEvent($request);
+
+            return $this->sendLockoutResponse($request);
+        }
+
+        $user = null;
+
+        // Should we even check for LDAP users?
+        if (Setting::getSettings()->ldap_enabled) { // avoid hitting the $this->ldap
+            LOG::debug('LDAP is enabled.');
+            try {
+                LOG::debug('Attempting to log user in by LDAP authentication.');
+                $user = $this->loginViaLdap($request);
+                Auth::login($user, $request->input('remember'));
+
+                // If the user was unable to login via LDAP, log the error and let them fall through to
+            // local authentication.
+            } catch (\Exception $e) {
+                Log::debug('There was an error authenticating the LDAP user: '.$e->getMessage());
+            }
+        }
+
+        // If the user wasn't authenticated via LDAP, skip to local auth
+        if (! $user) {
+            Log::debug('Authenticating user against database.');
+            // Try to log the user in
+            if (! Auth::attempt(['username' => $request->input('username'), 'password' => $request->input('password'), 'activated' => 1], $request->input('remember'))) {
+                if (! $lockedOut) {
+                    $this->incrementLoginAttempts($request);
+                }
+
+                Log::debug('Local authentication failed.');
+
+                return redirect()->back()->withInput()->with('error', trans('auth/message.account_not_found'));
+            } else {
+                $this->clearLoginAttempts($request);
+            }
+        }
+
+        if ($user = Auth::user()) {
+            $user->last_login = \Carbon::now();
+            $user->activated = 1;
+            $user->saveQuietly();
+        }
+        // Redirect to the users page
+        return redirect()->intended()->with('success', trans('auth/message.signin.success'));
+    }
+
+
+    /**
+     * Two factor enrollment page
+     *
+     * @return Redirect
+     */
+    public function getTwoFactorEnroll()
+    {
+
+        // Make sure the user is logged in
+        if (! Auth::check()) {
+            return redirect()->route('login')->with('error', trans('auth/general.login_prompt'));
+        }
+
+        $settings = Setting::getSettings();
+        $user = Auth::user();
+
+        // We wouldn't normally see this page if 2FA isn't enforced via the
+        // \App\Http\Middleware\CheckForTwoFactor middleware AND if a device isn't enrolled,
+        // but let's check check anyway in case there's a browser history or back button thing.
+        // While you can access this page directly, enrolling a device when 2FA isn't enforced
+        // won't cause any harm.
+
+        if (($user->two_factor_secret != '') && ($user->two_factor_enrolled == 1)) {
+            return redirect()->route('two-factor')->with('error', trans('auth/message.two_factor.already_enrolled'));
+        }
+
+        $secret = Google2FA::generateSecretKey();
+        $user->two_factor_secret = $secret;
+
+        $barcode = new Barcode();
+        $barcode_obj =
+            $barcode->getBarcodeObj(
+                'QRCODE',
+                sprintf(
+                    'otpauth://totp/%s:%s?secret=%s&issuer=Snipe-IT&period=30',
+                    urlencode($settings->site_name),
+                    urlencode($user->username),
+                    urlencode($secret)
+                ),
+                300,
+                300,
+                'black',
+                [-2, -2, -2, -2]
+            );
+
+        $user->saveQuietly(); // make sure to save *AFTER* displaying the barcode, or else we might save a two_factor_secret that we never actually displayed to the user if the barcode fails
+
+        return view('auth.two_factor_enroll')->with('barcode_obj', $barcode_obj);
+    }
+
+    /**
+     * Two factor code form page
+     *
+     * @return Redirect
+     */
+    public function getTwoFactorAuth()
+    {
+        // Check that the user is logged in
+        if (! Auth::check()) {
+            return redirect()->route('login')->with('error', trans('auth/general.login_prompt'));
+        }
+
+        $user = Auth::user();
+
+        // Check whether there is a device enrolled.
+        // This *should* be handled via the \App\Http\Middleware\CheckForTwoFactor middleware
+        // but we're just making sure (in case someone edited the database directly, etc)
+        if (($user->two_factor_secret == '') || ($user->two_factor_enrolled != 1)) {
+            return redirect()->route('two-factor-enroll');
+        }
+
+        return view('auth.two_factor');
+    }
+
+    /**
+     * Two factor code submission
+     *
+     * @param Request $request
+     *
+     * @return Redirect
+     */
+    public function postTwoFactorAuth(Request $request)
+    {
+        if (! Auth::check()) {
+            return redirect()->route('login')->with('error', trans('auth/general.login_prompt'));
+        }
+
+        if (! $request->filled('two_factor_secret')) {
+            return redirect()->route('two-factor')->with('error', trans('auth/message.two_factor.code_required'));
+        }
+
+        if (! $request->has('two_factor_secret')) { // TODO this seems almost the same as above?
+            return redirect()->route('two-factor')->with('error', 'Two-factor code is required.');
+        }
+
+        $user = Auth::user();
+        $secret = $request->input('two_factor_secret');
+
+        if (Google2FA::verifyKey($user->two_factor_secret, $secret)) {
+            $user->two_factor_enrolled = 1;
+            $user->saveQuietly();
+            $request->session()->put('2fa_authed', $user->id);
+
+            return redirect()->route('home')->with('success', 'You are logged in!');
+        }
+
+        return redirect()->route('two-factor')->with('error', trans('auth/message.two_factor.invalid_code'));
+    }
+
+
+    /**
+     * Logout page.
+     *
+     * @param Request $request
+     *
+     * @return Redirect
+     */
+    public function logout(Request $request)
+    {
+        // Logout is only allowed with a http POST but we need to allow GET for SAML SLO
+        $settings = Setting::getSettings();
+        $saml = $this->saml;
+        $samlLogout = $request->session()->get('saml_logout');
+        $sloRedirectUrl = null;
+        $sloRequestUrl = null;
+    
+        // Only allow GET if we are doing SAML SLO otherwise abort with 405
+        if ($request->isMethod('GET') && !$samlLogout) {
+            abort(405);
+        }
+
+        if ($saml->isEnabled()) {
+            $auth = $saml->getAuth();
+            $sloRedirectUrl = $request->session()->get('saml_slo_redirect_url');
+
+            if (! empty($auth->getSLOurl()) && $settings->saml_slo == '1' && $saml->isAuthenticated() && empty($sloRedirectUrl)) {
+                $sloRequestUrl = $auth->logout(null, [], $saml->getNameId(), $saml->getSessionIndex(), true, $saml->getNameIdFormat(), $saml->getNameIdNameQualifier(), $saml->getNameIdSPNameQualifier());
+            }
+
+            $saml->clearData();
+        }
+
+        if (! empty($sloRequestUrl)) {
+            return redirect()->away($sloRequestUrl);
+        }
+
+        $request->session()->regenerate(true);
+
+        if ($request->session()->has('password_hash_'.Auth::getDefaultDriver())){
+            $request->session()->remove('password_hash_'.Auth::getDefaultDriver());
+        }
+
+        Auth::logout();
+
+        if (! empty($sloRedirectUrl)) {
+            return redirect()->away($sloRedirectUrl);
+        }
+
+        $customLogoutUrl = $settings->login_remote_user_custom_logout_url;
+        if ($settings->login_remote_user_enabled == '1' && $customLogoutUrl != '') {
+            return redirect()->away($customLogoutUrl);
+        }
+
+        return redirect()->route('login')->with(['success' => trans('auth/message.logout.success'), 'loggedout' => true]);
+    }
+
+
+    /**
+     * Get a validator for an incoming registration request.
+     *
+     * @param  array  $data
+     * @return \Illuminate\Contracts\Validation\Validator
+     */
+    protected function validator(array $data)
+    {
+        return Validator::make($data, [
+            'username' => 'required',
+            'password' => 'required',
+        ]);
+    }
+
+
+    public function username()
+    {
+        return 'username';
+    }
+
+    /**
+     * Redirect the user after determining they are locked out.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Illuminate\Http\RedirectResponse
+     */
+    protected function sendLockoutResponse(Request $request)
+    {
+        $seconds = $this->limiter()->availableIn(
+            $this->throttleKey($request)
+        );
+
+        $minutes = round($seconds / 60);
+
+        $message = \Lang::get('auth/message.throttle', ['minutes' => $minutes]);
+
+        return redirect()->back()
+            ->withInput($request->only($this->username(), 'remember'))
+            ->withErrors([$this->username() => $message]);
+    }
+
+
+    /**
+     * Override the lockout time and duration
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return bool
+     */
+    protected function hasTooManyLoginAttempts(Request $request)
+    {
+        $lockoutTime = config('auth.passwords.users.throttle.lockout_duration');
+        $maxLoginAttempts = config('auth.passwords.users.throttle.max_attempts');
+
+        return $this->limiter()->tooManyAttempts(
+            $this->throttleKey($request),
+            $maxLoginAttempts,
+            $lockoutTime
+        );
+    }
+
+    public function legacyAuthRedirect()
+    {
+        return redirect()->route('login');
+    }
+
+    public function redirectTo()
+    {
+        return Session::get('backUrl') ? Session::get('backUrl') : $this->redirectTo;
+    }
+}

SNIPE-IT/app/Http/Controllers/Auth/RegisterController.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+
+class RegisterController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware('guest');
+    }
+
+    public function showRegistrationForm()
+    {
+        abort(404, 'Page not found');
+    }
+
+    public function register()
+    {
+        abort(404, 'Page not found');
+    }
+}

SNIPE-IT/app/Http/Controllers/Auth/ResetPasswordController.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\Setting;
+use App\Models\User;
+use Illuminate\Foundation\Auth\ResetsPasswords;
+use Illuminate\Http\Request;
+
+
+class ResetPasswordController extends Controller
+{
+    /*
+    |--------------------------------------------------------------------------
+    | Password Reset Controller
+    |--------------------------------------------------------------------------
+    |
+    | This controller is responsible for handling password reset requests
+    | and uses a simple trait to include this behavior. You're free to
+    | explore this trait and override any methods you wish to tweak.
+    |
+    */
+
+    use ResetsPasswords;
+
+    /**
+     * Where to redirect users after resetting their password.
+     *
+     * @var string
+     */
+    protected $redirectTo = '/';
+
+    protected $username = 'username';
+
+    /**
+     * Create a new controller instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        $this->middleware('guest');
+        $this->middleware('throttle:10,1');
+    }
+
+    protected function rules()
+    {
+        return [
+            'token' => 'required',
+            'username' => 'required',
+            'password' => 'confirmed|'.Setting::passwordComplexityRulesSaving('store'),
+        ];
+    }
+
+    protected function credentials(Request $request)
+    {
+        return $request->only(
+            'username', 'password', 'password_confirmation', 'token'
+        );
+    }
+
+    public function showResetForm(Request $request, $token = null)
+    {
+
+        $credentials =  $request->only('email', 'token');
+
+        if (is_null($this->broker()->getUser($credentials))) {
+            \Log::debug('Password reset form FAILED - this token is not valid.');
+            return redirect()->route('password.request')->with('error', trans('passwords.token'));
+        }
+
+        return view('auth.passwords.reset')->with(
+            [
+                'token' => $token,
+                'username' => $request->input('username'),
+            ]
+        );
+    }
+
+    public function reset(Request $request)
+    {
+
+        $broker = $this->broker();
+
+        $messages = [
+            'password.not_in' => trans('validation.disallow_same_pwd_as_user_fields'),
+        ];
+
+        $request->validate($this->rules(), $request->all(), $this->validationErrorMessages());
+
+        \Log::debug('Checking if '.$request->input('username').' exists');
+        // Check to see if the user even exists - we'll treat the response the same to prevent user sniffing
+        if ($user = User::where('username', '=', $request->input('username'))->where('activated', '1')->whereNotNull('email')->first()) {
+            \Log::debug($user->username.' exists');
+
+
+            // handle the password validation rules set by the admin settings
+            if (strpos(Setting::passwordComplexityRulesSaving('store'), 'disallow_same_pwd_as_user_fields') !== false) {
+                $request->validate(
+                    [
+                        'password' => 'required|notIn:["'.$user->email.'","'.$user->username.'","'.$user->first_name.'","'.$user->last_name.'"',
+                    ], $messages);
+            }
+
+
+            // set the response
+            $response = $broker->reset(
+                $this->credentials($request), function ($user, $password) {
+                $this->resetPassword($user, $password);
+            });
+
+            // Check if the password reset above actually worked
+            if ($response == \Password::PASSWORD_RESET) {
+                \Log::debug('Password reset for '.$user->username.' worked');
+                return redirect()->guest('login')->with('success', trans('passwords.reset'));
+            }
+
+            \Log::debug('Password reset for '.$user->username.' FAILED - this user exists but the token is not valid');
+            return redirect()->back()->withInput($request->only('email'))->with('success', trans('passwords.reset'));
+
+        }
+
+
+        \Log::debug('Password reset for '.$request->input('username').' FAILED - user does not exist or does not have an email address - but make it look like it succeeded');
+        return redirect()->guest('login')->with('success', trans('passwords.reset'));
+
+    }
+
+
+
+}

SNIPE-IT/app/Http/Controllers/Auth/SamlController.php

@@ -0,0 +1,147 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Services\Saml;
+use Illuminate\Http\Request;
+use Log;
+
+/**
+ * This controller provides the endpoint for SAML communication and metadata.
+ *
+ * @author Johnson Yi <jyi.dev@outlook.com>
+ *
+ * @since 5.0.0
+ */
+class SamlController extends Controller
+{
+    /**
+     * @var Saml
+     */
+    protected $saml;
+
+    /**
+     * Create a new authentication controller instance.
+     *
+     * @return void
+     */
+    public function __construct(Saml $saml)
+    {
+        $this->saml = $saml;
+
+        $this->middleware('guest', ['except' => ['metadata', 'sls']]);
+    }
+
+    /**
+     * Return SAML SP metadata for Snipe-IT
+     *
+     * /saml/metadata
+     *
+     * @author Johnson Yi <jyi.dev@outlook.com>
+     *
+     * @since 5.0.0
+     *
+     * @param Request $request
+     *
+     * @return Response
+     */
+    public function metadata(Request $request)
+    {
+        $metadata = $this->saml->getSPMetadata();
+
+        if (empty($metadata)) {
+            \Log::debug('SAML metadata is empty - return a 403');
+            return response()->view('errors.403', [], 403);
+        }
+
+        return response()->streamDownload(function () use ($metadata) {
+            echo $metadata;
+        }, 'snipe-it-metadata.xml', ['Content-Type' => 'text/xml']);
+    }
+
+    /**
+     * Begin the SP-Initiated SSO by sending AuthN to the IdP.
+     *
+     * /login/saml
+     *
+     * @author Johnson Yi <jyi.dev@outlook.com>
+     *
+     * @since 5.0.0
+     *
+     * @param Request $request
+     *
+     * @return Redirect
+     */
+    public function login(Request $request)
+    {
+        $auth = $this->saml->getAuth();
+        $ssoUrl = $auth->login(null, [], false, false, false, false);
+
+        return redirect()->away($ssoUrl);
+    }
+
+    /**
+     * Receives, parses the assertion from IdP and flashes SAML data
+     * back to the LoginController for authentication.
+     *
+     * /saml/acs
+     *
+     * @author Johnson Yi <jyi.dev@outlook.com>
+     *
+     * @since 5.0.0
+     *
+     * @param Request $request
+     *
+     * @return Redirect
+     */
+    public function acs(Request $request)
+    {
+        $saml = $this->saml;
+        $auth = $saml->getAuth();
+        $auth->processResponse();
+        $errors = $auth->getErrors();
+
+        if (! empty($errors)) {
+            Log::error('There was an error with SAML ACS: '.implode(', ', $errors));
+            Log::error('Reason: '.$auth->getLastErrorReason());
+
+            return redirect()->route('login')->with('error', trans('auth/message.signin.error'));
+        }
+
+        $samlData = $saml->extractData();
+
+        return redirect()->route('login')->with('saml_login', $samlData);
+    }
+
+    /**
+     * Receives LogoutRequest/LogoutResponse from IdP and flashes
+     * back to the LoginController for logging out.
+     *
+     * /saml/sls
+     *
+     * @author Johnson Yi <jyi.dev@outlook.com>
+     *
+     * @since 5.0.0
+     *
+     * @param Request $request
+     *
+     * @return Redirect
+     */
+    public function sls(Request $request)
+    {
+        $auth = $this->saml->getAuth();
+        $retrieveParametersFromServer = $this->saml->getSetting('retrieveParametersFromServer', false);
+        $sloUrl = $auth->processSLO(true, null, $retrieveParametersFromServer, null, true);
+        $errors = $auth->getErrors();
+
+        if (! empty($errors)) {
+            Log::error('There was an error with SAML SLS: '.implode(', ', $errors));
+            Log::error('Reason: '.$auth->getLastErrorReason());
+
+            return view('errors.403');
+        }
+
+        return redirect()->route('logout.get')->with(['saml_logout' => true,'saml_slo_redirect_url' => $sloUrl]);
+    }
+}

SNIPE-IT/app/Http/Controllers/BulkAssetModelsController.php

@@ -0,0 +1,143 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Helpers\Helper;
+use App\Models\AssetModel;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Input;
+use Illuminate\Support\Facades\Redirect;
+
+class BulkAssetModelsController extends Controller
+{
+    /**
+     * Returns a view that allows the user to bulk edit model attrbutes
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.7]
+     * @param Request $request
+     * @return \Illuminate\Contracts\View\View
+     */
+    public function edit(Request $request)
+    {
+        $models_raw_array = $request->input('ids');
+
+        // Make sure some IDs have been selected
+        if ((is_array($models_raw_array)) && (count($models_raw_array) > 0)) {
+            $models = AssetModel::whereIn('id', $models_raw_array)
+                ->withCount('assets as assets_count')
+                ->orderBy('assets_count', 'ASC')
+                ->get();
+
+            // If deleting....
+            if ($request->input('bulk_actions') == 'delete') {
+                $this->authorize('delete', AssetModel::class);
+                $valid_count = 0;
+                foreach ($models as $model) {
+                    if ($model->assets_count == 0) {
+                        $valid_count++;
+                    }
+                }
+
+                return view('models/bulk-delete', compact('models'))->with('valid_count', $valid_count);
+
+                // Otherwise display the bulk edit screen
+            }
+            $this->authorize('update', AssetModel::class);
+            $nochange = ['NC' => 'No Change'];
+
+            return view('models/bulk-edit', compact('models'))
+                ->with('fieldset_list', $nochange + Helper::customFieldsetList())
+                ->with('depreciation_list', $nochange + Helper::depreciationList());
+        }
+
+        return redirect()->route('models.index')
+            ->with('error', 'You must select at least one model to edit.');
+    }
+
+    /**
+     * Returns a view that allows the user to bulk edit model attrbutes
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.7]
+     * @param Request $request
+     * @return \Illuminate\Contracts\View\View
+     */
+    public function update(Request $request)
+    {
+        $this->authorize('update', AssetModel::class);
+      
+        $models_raw_array = $request->input('ids');
+        $update_array = [];
+
+        if (($request->filled('manufacturer_id') && ($request->input('manufacturer_id') != 'NC'))) {
+            $update_array['manufacturer_id'] = $request->input('manufacturer_id');
+        }
+        if (($request->filled('category_id') && ($request->input('category_id') != 'NC'))) {
+            $update_array['category_id'] = $request->input('category_id');
+        }
+        if ($request->input('fieldset_id') != 'NC') {
+            $update_array['fieldset_id'] = $request->input('fieldset_id');
+        }
+        if ($request->input('depreciation_id') != 'NC') {
+            $update_array['depreciation_id'] = $request->input('depreciation_id');
+        }
+
+        if ($request->filled('requestable') != '') {
+            $update_array['requestable'] = $request->input('requestable');
+        }
+
+
+        if (count($update_array) > 0) {
+            AssetModel::whereIn('id', $models_raw_array)->update($update_array);
+
+            return redirect()->route('models.index')
+                ->with('success', trans_choice('admin/models/message.bulkedit.success', count($models_raw_array), ['model_count' => count($models_raw_array)]));
+        }
+
+        return redirect()->route('models.index')
+            ->with('warning', trans('admin/models/message.bulkedit.error'));
+    }
+
+    /**
+     * Validate and delete the given Asset Models. An Asset Model
+     * cannot be deleted if there are associated assets.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @return Redirect
+     */
+    public function destroy(Request $request)
+    {
+        $this->authorize('delete', AssetModel::class);
+      
+        $models_raw_array = $request->input('ids');
+
+        if ((is_array($models_raw_array)) && (count($models_raw_array) > 0)) {
+            $models = AssetModel::whereIn('id', $models_raw_array)->withCount('assets as assets_count')->get();
+
+            $del_error_count = 0;
+            $del_count = 0;
+
+            foreach ($models as $model) {
+                if ($model->assets_count > 0) {
+                    $del_error_count++;
+                } else {
+                    $model->delete();
+                    $del_count++;
+                }
+            }
+
+            if ($del_error_count == 0) {
+                return redirect()->route('models.index')
+                    ->with('success', trans('admin/models/message.bulkdelete.success', ['success_count'=> $del_count]));
+            }
+
+            return redirect()->route('models.index')
+                ->with('warning', trans('admin/models/message.bulkdelete.success_partial', ['fail_count'=>$del_error_count, 'success_count'=> $del_count]));
+        }
+
+        return redirect()->route('models.index')
+            ->with('error', trans('admin/models/message.bulkdelete.error'));
+    }
+}

SNIPE-IT/app/Http/Controllers/CategoriesController.php

@@ -0,0 +1,207 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Helpers\Helper;
+use App\Http\Requests\ImageUploadRequest;
+use App\Models\Category as Category;
+use Auth;
+use Illuminate\Support\Facades\Storage;
+use Str;
+
+/**
+ * This class controls all actions related to Categories for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v1.0
+ * @author [A. Gianotto] [<snipe@snipe.net>]
+ */
+class CategoriesController extends Controller
+{
+    /**
+     * Returns a view that invokes the ajax tables which actually contains
+     * the content for the categories listing, which is generated in getDatatable.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see CategoriesController::getDatatable() method that generates the JSON response
+     * @since [v1.0]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function index()
+    {
+        // Show the page
+        $this->authorize('view', Category::class);
+
+        return view('categories/index');
+    }
+
+    /**
+     * Returns a form view to create a new category.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see CategoriesController::store() method that stores the data
+     * @since [v1.0]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create()
+    {
+        // Show the page
+        $this->authorize('create', Category::class);
+
+        return view('categories/edit')->with('item', new Category)
+            ->with('category_types', Helper::categoryTypeList());
+    }
+
+    /**
+     * Validates and stores the new category data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see CategoriesController::create() method that makes the form.
+     * @since [v1.0]
+     * @param ImageUploadRequest $request
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Category::class);
+        $category = new Category();
+        $category->name = $request->input('name');
+        $category->category_type = $request->input('category_type');
+        $category->eula_text = $request->input('eula_text');
+        $category->use_default_eula = $request->input('use_default_eula', '0');
+        $category->require_acceptance = $request->input('require_acceptance', '0');
+        $category->checkin_email = $request->input('checkin_email', '0');
+        $category->user_id = Auth::id();
+
+        $category = $request->handleImages($category);
+        if ($category->save()) {
+            return redirect()->route('categories.index')->with('success', trans('admin/categories/message.create.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($category->getErrors());
+    }
+
+    /**
+     * Returns a view that makes a form to update a category.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see CategoriesController::postEdit() method saves the data
+     * @param int $categoryId
+     * @since [v1.0]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function edit($categoryId = null)
+    {
+        $this->authorize('update', Category::class);
+        if (is_null($item = Category::find($categoryId))) {
+            return redirect()->route('categories.index')->with('error', trans('admin/categories/message.does_not_exist'));
+        }
+
+        return view('categories/edit', compact('item'))
+        ->with('category_types', Helper::categoryTypeList());
+    }
+
+    /**
+     * Validates and stores the updated category data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see CategoriesController::getEdit() method that makes the form.
+     * @param ImageUploadRequest $request
+     * @param int $categoryId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @since [v1.0]
+     */
+    public function update(ImageUploadRequest $request, $categoryId = null)
+    {
+        $this->authorize('update', Category::class);
+        if (is_null($category = Category::find($categoryId))) {
+            // Redirect to the categories management page
+            return redirect()->to('admin/categories')->with('error', trans('admin/categories/message.does_not_exist'));
+        }
+
+        // Update the category data
+        $category->name = $request->input('name');
+        // If the item count is > 0, we disable the category type in the edit. Disabled items
+        // don't POST, so if the category_type is blank we just set it to the default.
+        $category->category_type = $request->input('category_type', $category->category_type);
+        $category->eula_text = $request->input('eula_text');
+        $category->use_default_eula = $request->input('use_default_eula', '0');
+        $category->require_acceptance = $request->input('require_acceptance', '0');
+        $category->checkin_email = $request->input('checkin_email', '0');
+
+        $category = $request->handleImages($category);
+
+        if ($category->save()) {
+            // Redirect to the new category page
+            return redirect()->route('categories.index')->with('success', trans('admin/categories/message.update.success'));
+        }
+        // The given data did not pass validation
+        return redirect()->back()->withInput()->withErrors($category->getErrors());
+    }
+
+    /**
+     * Validates and marks a category as deleted.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $categoryId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($categoryId)
+    {
+        $this->authorize('delete', Category::class);
+        // Check if the category exists
+        if (is_null($category = Category::findOrFail($categoryId))) {
+            return redirect()->route('categories.index')->with('error', trans('admin/categories/message.not_found'));
+        }
+
+        if (! $category->isDeletable()) {
+            return redirect()->route('categories.index')->with('error', trans('admin/categories/message.assoc_items', ['asset_type'=> $category->category_type]));
+        }
+
+        Storage::disk('public')->delete('categories'.'/'.$category->image);
+        $category->delete();
+        // Redirect to the locations management page
+        return redirect()->route('categories.index')->with('success', trans('admin/categories/message.delete.success'));
+    }
+
+    /**
+     * Returns a view that invokes the ajax tables which actually contains
+     * the content for the categories detail view, which is generated in getDataView.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see CategoriesController::getDataView() method that generates the JSON response
+     * @param $id
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @since [v1.8]
+     */
+    public function show($id)
+    {
+        $this->authorize('view', Category::class);
+        if ($category = Category::find($id)) {
+            if ($category->category_type == 'asset') {
+                $category_type = 'hardware';
+                $category_type_route = 'assets';
+            } elseif ($category->category_type == 'accessory') {
+                $category_type = 'accessories';
+                $category_type_route = 'accessories';
+            } else {
+                $category_type = $category->category_type;
+                $category_type_route = $category->category_type.'s';
+            }
+
+            return view('categories/view', compact('category'))
+                ->with('category_type', $category_type)
+                ->with('category_type_route', $category_type_route);
+        }
+
+        return redirect()->route('categories.index')->with('error', trans('admin/categories/message.does_not_exist'));
+    }
+}

SNIPE-IT/app/Http/Controllers/CheckInOutRequest.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\Asset;
+use App\Models\Location;
+use App\Models\SnipeModel;
+use App\Models\User;
+
+trait CheckInOutRequest
+{
+    /**
+     * Find target for checkout
+     * @return SnipeModel        Target asset is being checked out to.
+     */
+    protected function determineCheckoutTarget()
+    {
+        // This item is checked out to a location
+        switch (request('checkout_to_type')) {
+            case 'location':
+                return Location::findOrFail(request('assigned_location'));
+            case 'asset':
+                return Asset::findOrFail(request('assigned_asset'));
+            case 'user':
+                return User::findOrFail(request('assigned_user'));
+        }
+
+        return null;
+    }
+
+    /**
+     * Update the location of the asset passed in.
+     * @param  Asset $asset Asset being updated
+     * @param  SnipeModel $target Target with location
+     * @return Asset        Asset being updated
+     */
+    protected function updateAssetLocation($asset, $target)
+    {
+        switch (request('checkout_to_type')) {
+            case 'location':
+                $asset->location_id = $target->id;
+                Asset::where('assigned_type', 'App\Models\Asset')->where('assigned_to', $asset->id)
+                    ->update(['location_id' => $asset->location_id]);
+                break;
+            case 'asset':
+                $asset->location_id = $target->rtd_location_id;
+                // Override with the asset's location_id if it has one
+                if ($target->location_id != '') {
+                    $asset->location_id = $target->location_id;
+                }
+                break;
+            case 'user':
+                    $asset->location_id = $target->location_id;
+                    break;
+        }
+
+        return $asset;
+    }
+}

SNIPE-IT/app/Http/Controllers/CompaniesController.php

@@ -0,0 +1,178 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\ImageUploadRequest;
+use App\Models\Company;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * This controller handles all actions related to Companies for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v1.0
+ */
+final class CompaniesController extends Controller
+{
+    /**
+     * Returns view to display listing of companies.
+     *
+     * @author [Abdullah Alansari] [<ahimta@gmail.com>]
+     * @since [v1.8]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function index()
+    {
+        $this->authorize('view', Company::class);
+
+        return view('companies/index');
+    }
+
+    /**
+     * Returns view to create a new company.
+     *
+     * @author [Abdullah Alansari] [<ahimta@gmail.com>]
+     * @since [v1.8]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create()
+    {
+        $this->authorize('create', Company::class);
+
+        return view('companies/edit')->with('item', new Company);
+    }
+
+    /**
+     * Save data from new company form.
+     *
+     * @author [Abdullah Alansari] [<ahimta@gmail.com>]
+     * @since [v1.8]
+     * @param Request $request
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Company::class);
+
+        $company = new Company;
+        $company->name = $request->input('name');
+        $company->phone = $request->input('phone');
+        $company->fax = $request->input('fax');
+        $company->email = $request->input('email');
+
+        $company = $request->handleImages($company);
+
+        if ($company->save()) {
+            return redirect()->route('companies.index')
+                ->with('success', trans('admin/companies/message.create.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($company->getErrors());
+    }
+
+    /**
+     * Return form to edit existing company.
+     *
+     * @author [Abdullah Alansari] [<ahimta@gmail.com>]
+     * @since [v1.8]
+     * @param int $companyId
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function edit($companyId)
+    {
+        if (is_null($item = Company::find($companyId))) {
+            return redirect()->route('companies.index')
+                ->with('error', trans('admin/companies/message.does_not_exist'));
+        }
+
+        $this->authorize('update', $item);
+
+        return view('companies/edit')->with('item', $item);
+    }
+
+    /**
+     * Save data from edit company form.
+     *
+     * @author [Abdullah Alansari] [<ahimta@gmail.com>]
+     * @since [v1.8]
+     * @param ImageUploadRequest $request
+     * @param int $companyId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function update(ImageUploadRequest $request, $companyId)
+    {
+        if (is_null($company = Company::find($companyId))) {
+            return redirect()->route('companies.index')->with('error', trans('admin/companies/message.does_not_exist'));
+        }
+
+        $this->authorize('update', $company);
+
+        $company->name = $request->input('name');
+        $company->phone = $request->input('phone');
+        $company->fax = $request->input('fax');
+        $company->email = $request->input('email');
+
+        $company = $request->handleImages($company);
+
+        if ($company->save()) {
+            return redirect()->route('companies.index')
+                ->with('success', trans('admin/companies/message.update.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($company->getErrors());
+    }
+
+    /**
+     * Delete company
+     *
+     * @author [Abdullah Alansari] [<ahimta@gmail.com>]
+     * @since [v1.8]
+     * @param int $companyId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($companyId)
+    {
+        if (is_null($company = Company::find($companyId))) {
+            return redirect()->route('companies.index')
+                ->with('error', trans('admin/companies/message.not_found'));
+        }
+
+        $this->authorize('delete', $company);
+        if (! $company->isDeletable()) {
+            return redirect()->route('companies.index')
+                    ->with('error', trans('admin/companies/message.assoc_users'));
+        }
+
+        if ($company->image) {
+            try {
+                Storage::disk('public')->delete('companies'.'/'.$company->image);
+            } catch (\Exception $e) {
+                \Log::debug($e);
+            }
+        }
+
+        $company->delete();
+
+        return redirect()->route('companies.index')
+            ->with('success', trans('admin/companies/message.delete.success'));
+    }
+
+    public function show($id)
+    {
+        $this->authorize('view', Company::class);
+
+        if (is_null($company = Company::find($id))) {
+            return redirect()->route('companies.index')
+                ->with('error', trans('admin/companies/message.not_found'));
+        }
+
+        return view('companies/view')->with('company', $company);
+    }
+}

SNIPE-IT/app/Http/Controllers/Components/ComponentCheckinController.php

@@ -0,0 +1,110 @@
+<?php
+
+namespace App\Http\Controllers\Components;
+
+use App\Events\CheckoutableCheckedIn;
+use App\Events\ComponentCheckedIn;
+use App\Http\Controllers\Controller;
+use App\Models\Asset;
+use App\Models\Component;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Validator;
+
+class ComponentCheckinController extends Controller
+{
+    /**
+     * Returns a view that allows the checkin of a component from an asset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentCheckinController::store() method that stores the data.
+     * @since [v4.1.4]
+     * @param $component_asset_id
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create($component_asset_id)
+    {
+
+        // This could probably be done more cleanly but I am very tired. - @snipe
+        if ($component_assets = DB::table('components_assets')->find($component_asset_id)) {
+            if (is_null($component = Component::find($component_assets->component_id))) {
+                return redirect()->route('components.index')->with('error', trans('admin/components/messages.not_found'));
+            }
+            if (is_null($asset = Asset::find($component_assets->asset_id))) {
+                return redirect()->route('components.index')->with('error',
+                    trans('admin/components/message.not_found'));
+            }
+            $this->authorize('checkin', $component);
+
+            return view('components/checkin', compact('component_assets', 'component', 'asset'));
+        }
+
+        return redirect()->route('components.index')->with('error', trans('admin/components/messages.not_found'));
+    }
+
+    /**
+     * Validate and store checkin data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentCheckinController::create() method that returns the form.
+     * @since [v4.1.4]
+     * @param Request $request
+     * @param $component_asset_id
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(Request $request, $component_asset_id, $backto = null)
+    {
+        if ($component_assets = DB::table('components_assets')->find($component_asset_id)) {
+            if (is_null($component = Component::find($component_assets->component_id))) {
+
+                return redirect()->route('components.index')->with('error',
+                    trans('admin/components/message.not_found'));
+            }
+
+            $this->authorize('checkin', $component);
+
+            $max_to_checkin = $component_assets->assigned_qty;
+            $validator = Validator::make($request->all(), [
+                'checkin_qty' => "required|numeric|between:1,$max_to_checkin",
+            ]);
+
+            if ($validator->fails()) {
+                return redirect()->back()
+                    ->withErrors($validator)
+                    ->withInput();
+            }
+
+            // Validation passed, so let's figure out what we have to do here.
+            $qty_remaining_in_checkout = ($component_assets->assigned_qty - (int) $request->input('checkin_qty'));
+
+            // We have to modify the record to reflect the new qty that's
+            // actually checked out.
+            $component_assets->assigned_qty = $qty_remaining_in_checkout;
+            DB::table('components_assets')->where('id',
+                $component_asset_id)->update(['assigned_qty' => $qty_remaining_in_checkout]);
+
+            // If the checked-in qty is exactly the same as the assigned_qty,
+            // we can simply delete the associated components_assets record
+            if ($qty_remaining_in_checkout == 0) {
+                DB::table('components_assets')->where('id', '=', $component_asset_id)->delete();
+            }
+
+            $asset = Asset::find($component_assets->asset_id);
+
+            event(new CheckoutableCheckedIn($component, $asset, Auth::user(), $request->input('note'), Carbon::now()));
+            if ($backto == 'asset'){
+                return redirect()->route('hardware.show', $asset->id)->with('success',
+                    trans('admin/components/message.checkin.success'));
+            }
+
+            return redirect()->route('components.index')->with('success',
+                trans('admin/components/message.checkin.success'));
+        }
+
+        return redirect()->route('components.index')->with('error', trans('admin/components/message.does_not_exist'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Components/ComponentCheckoutController.php

@@ -0,0 +1,114 @@
+<?php
+
+namespace App\Http\Controllers\Components;
+
+use App\Events\CheckoutableCheckedOut;
+use App\Events\ComponentCheckedOut;
+use App\Http\Controllers\Controller;
+use App\Models\Asset;
+use App\Models\Component;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Input;
+use Illuminate\Support\Facades\Validator;
+
+class ComponentCheckoutController extends Controller
+{
+    /**
+     * Returns a view that allows the checkout of a component to an asset.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentCheckoutController::store() method that stores the data.
+     * @since [v3.0]
+     * @param int $id
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create($id)
+    {
+
+        if ($component = Component::find($id)) {
+
+            $this->authorize('checkout', $component);
+
+            // Make sure the category is valid
+            if ($component->category) {
+
+                // Make sure there is at least one available to checkout
+                if ($component->numRemaining() <= 0){
+                    return redirect()->route('components.index')
+                        ->with('error', trans('admin/components/message.checkout.unavailable'));
+                }
+
+                // Return the checkout view
+                return view('components/checkout', compact('component'));
+            }
+
+            // Invalid category
+            return redirect()->route('components.edit', ['component' => $component->id])
+                ->with('error', trans('general.invalid_item_category_single', ['type' => trans('general.component')]));
+        }
+
+        // Not found
+        return redirect()->route('components.index')->with('error', trans('admin/components/message.not_found'));
+
+    }
+
+    /**
+     * Validate and store checkout data.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentCheckoutController::create() method that returns the form.
+     * @since [v3.0]
+     * @param Request $request
+     * @param int $componentId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(Request $request, $componentId)
+    {
+        // Check if the component exists
+        if (!$component = Component::find($componentId)) {
+            // Redirect to the component management page with error
+            return redirect()->route('components.index')->with('error', trans('admin/components/message.not_found'));
+        }
+
+        $this->authorize('checkout', $component);
+
+        $max_to_checkout = $component->numRemaining();
+
+        // Make sure there are at least the requested number of components available to checkout
+        if ($max_to_checkout < $request->get('assigned_qty')) {
+            return redirect()->back()->withInput()->with('error', trans('admin/components/message.checkout.unavailable', ['remaining' => $max_to_checkout, 'requested' => $request->get('assigned_qty')]));
+        }
+
+        $validator = Validator::make($request->all(), [
+            'asset_id'          => 'required|exists:assets,id',
+            'assigned_qty'      => "required|numeric|min:1|digits_between:1,$max_to_checkout",
+        ]);
+
+        if ($validator->fails()) {
+            return redirect()->back()
+                ->withErrors($validator)
+                ->withInput();
+        }
+
+        // Check if the user exists
+        $asset = Asset::find($request->input('asset_id'));
+
+        // Update the component data
+        $component->asset_id = $request->input('asset_id');
+        $component->assets()->attach($component->id, [
+            'component_id' => $component->id,
+            'user_id' => Auth::user(),
+            'created_at' => date('Y-m-d H:i:s'),
+            'assigned_qty' => $request->input('assigned_qty'),
+            'asset_id' => $request->input('asset_id'),
+            'note' => $request->input('note'),
+        ]);
+
+        event(new CheckoutableCheckedOut($component, $asset, Auth::user(), $request->input('note')));
+
+        return redirect()->route('components.index')->with('success', trans('admin/components/message.checkout.success'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Components/ComponentsController.php

@@ -0,0 +1,223 @@
+<?php
+
+namespace App\Http\Controllers\Components;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\ImageUploadRequest;
+use App\Models\Company;
+use App\Models\Component;
+use App\Helpers\Helper;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Input;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * This class controls all actions related to Components for
+ * the Snipe-IT Asset Management application.
+ *
+ * @version    v1.0
+ */
+class ComponentsController extends Controller
+{
+    /**
+     * Returns a view that invokes the ajax tables which actually contains
+     * the content for the components listing, which is generated in getDatatable.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentsController::getDatatable() method that generates the JSON response
+     * @since [v3.0]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function index()
+    {
+        $this->authorize('view', Component::class);
+
+        return view('components/index');
+    }
+
+
+    /**
+     * Returns a form to create a new component.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentsController::postCreate() method that stores the data
+     * @since [v3.0]
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function create()
+    {
+        $this->authorize('create', Component::class);
+
+        return view('components/edit')->with('category_type', 'component')
+            ->with('item', new Component);
+    }
+
+    /**
+     * Validate and store data for new component.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentsController::getCreate() method that generates the view
+     * @since [v3.0]
+     * @param ImageUploadRequest $request
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function store(ImageUploadRequest $request)
+    {
+        $this->authorize('create', Component::class);
+        $component = new Component();
+        $component->name                   = $request->input('name');
+        $component->category_id            = $request->input('category_id');
+        $component->supplier_id            = $request->input('supplier_id');
+        $component->location_id            = $request->input('location_id');
+        $component->company_id             = Company::getIdForCurrentUser($request->input('company_id'));
+        $component->order_number           = $request->input('order_number', null);
+        $component->min_amt                = $request->input('min_amt', null);
+        $component->serial                 = $request->input('serial', null);
+        $component->purchase_date          = $request->input('purchase_date', null);
+        $component->purchase_cost          = $request->input('purchase_cost', null);
+        $component->qty                    = $request->input('qty');
+        $component->user_id                = Auth::id();
+        $component->notes                  = $request->input('notes');
+
+        $component = $request->handleImages($component);
+
+        if ($component->save()) {
+            return redirect()->route('components.index')->with('success', trans('admin/components/message.create.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($component->getErrors());
+    }
+
+    /**
+     * Return a view to edit a component.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentsController::postEdit() method that stores the data.
+     * @since [v3.0]
+     * @param int $componentId
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function edit($componentId = null)
+    {
+        if ($item = Component::find($componentId)) {
+            $this->authorize('update', $item);
+
+            return view('components/edit', compact('item'))->with('category_type', 'component');
+        }
+
+        return redirect()->route('components.index')->with('error', trans('admin/components/message.does_not_exist'));
+    }
+
+
+    /**
+     * Return a view to edit a component.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentsController::getEdit() method presents the form.
+     * @param ImageUploadRequest $request
+     * @param int $componentId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     * @since [v3.0]
+     */
+    public function update(ImageUploadRequest $request, $componentId = null)
+    {
+        if (is_null($component = Component::find($componentId))) {
+            return redirect()->route('components.index')->with('error', trans('admin/components/message.does_not_exist'));
+        }
+        $min = $component->numCheckedOut();
+        $validator = Validator::make($request->all(), [
+            'qty' => "required|numeric|min:$min",
+        ]);
+
+        if ($validator->fails()) {
+            return redirect()->back()
+                ->withErrors($validator)
+                ->withInput();
+        }
+
+        $this->authorize('update', $component);
+
+        // Update the component data
+        $component->name                   = $request->input('name');
+        $component->category_id            = $request->input('category_id');
+        $component->supplier_id            = $request->input('supplier_id');
+        $component->location_id            = $request->input('location_id');
+        $component->company_id             = Company::getIdForCurrentUser($request->input('company_id'));
+        $component->order_number           = $request->input('order_number');
+        $component->min_amt                = $request->input('min_amt');
+        $component->serial                 = $request->input('serial');
+        $component->purchase_date          = $request->input('purchase_date');
+        $component->purchase_cost          = request('purchase_cost');
+        $component->qty                    = $request->input('qty');
+        $component->notes                  = $request->input('notes');
+
+        $component = $request->handleImages($component);
+
+        if ($component->save()) {
+            return redirect()->route('components.index')->with('success', trans('admin/components/message.update.success'));
+        }
+
+        return redirect()->back()->withInput()->withErrors($component->getErrors());
+    }
+
+    /**
+     * Delete a component.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @param int $componentId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($componentId)
+    {
+        if (is_null($component = Component::find($componentId))) {
+            return redirect()->route('components.index')->with('error', trans('admin/components/message.does_not_exist'));
+        }
+
+        $this->authorize('delete', $component);
+
+        // Remove the image if one exists
+        if (Storage::disk('public')->exists('components/'.$component->image)) {
+            try {
+                Storage::disk('public')->delete('components/'.$component->image);
+            } catch (\Exception $e) {
+                \Log::debug($e);
+            }
+        }
+
+        $component->delete();
+
+        return redirect()->route('components.index')->with('success', trans('admin/components/message.delete.success'));
+    }
+
+    /**
+     * Return a view to display component information.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @see ComponentsController::getDataView() method that generates the JSON response
+     * @since [v3.0]
+     * @param int $componentId
+     * @return \Illuminate\Contracts\View\View
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($componentId = null)
+    {
+        $component = Component::find($componentId);
+
+        if (isset($component->id)) {
+            $this->authorize('view', $component);
+
+            return view('components/view', compact('component'));
+        }
+        // Redirect to the user management page
+        return redirect()->route('components.index')
+            ->with('error', trans('admin/components/message.does_not_exist'));
+    }
+}

SNIPE-IT/app/Http/Controllers/Components/ComponentsFilesController.php

@@ -0,0 +1,152 @@
+<?php
+
+namespace App\Http\Controllers\Components;
+
+use App\Helpers\StorageHelper;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\UploadFileRequest;
+use App\Models\Actionlog;
+use App\Models\Component;
+use Illuminate\Support\Facades\Response;
+use Illuminate\Support\Facades\Storage;
+use Symfony\Component\HttpFoundation\JsonResponse;
+
+class ComponentsFilesController extends Controller
+{
+    /**
+     * Validates and stores files associated with a component.
+     *
+     * @param UploadFileRequest $request
+     * @param int $componentId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     *@author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @todo Switch to using the AssetFileRequest form request validator.
+     */
+    public function store(UploadFileRequest $request, $componentId = null)
+    {
+
+        if (config('app.lock_passwords')) {
+            return redirect()->route('components.show', ['component'=>$componentId])->with('error', trans('general.feature_disabled'));
+        }
+
+        $component = Component::find($componentId);
+
+        if (isset($component->id)) {
+            $this->authorize('update', $component);
+
+            if ($request->hasFile('file')) {
+                if (! Storage::exists('private_uploads/components')) {
+                    Storage::makeDirectory('private_uploads/components', 775);
+                }
+
+                foreach ($request->file('file') as $file) {
+                    $file_name = $request->handleFile('private_uploads/components/','component-'.$component->id, $file);
+
+                    //Log the upload to the log
+                    $component->logUpload($file_name, e($request->input('notes')));
+                }
+
+
+                return redirect()->route('components.show', $component->id)->with('success', trans('general.file_upload_success'));
+
+            }
+
+            return redirect()->route('components.show', $component->id)->with('error', trans('general.no_files_uploaded'));
+        }
+        // Prepare the error message
+        return redirect()->route('components.index')
+            ->with('error', trans('general.file_does_not_exist'));
+    }
+
+    /**
+     * Deletes the selected component file.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.0]
+     * @param int $componentId
+     * @param int $fileId
+     * @return \Illuminate\Http\RedirectResponse
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function destroy($componentId = null, $fileId = null)
+    {
+        $component = Component::find($componentId);
+
+        // the asset is valid
+        if (isset($component->id)) {
+            $this->authorize('update', $component);
+            $log = Actionlog::find($fileId);
+
+            // Remove the file if one exists
+            if (Storage::exists('components/'.$log->filename)) {
+                try {
+                    Storage::delete('components/'.$log->filename);
+                } catch (\Exception $e) {
+                    \Log::debug($e);
+                }
+            }
+
+            $log->delete();
+
+            return redirect()->back()
+                ->with('success', trans('admin/hardware/message.deletefile.success'));
+        }
+
+        // Redirect to the licence management page
+        return redirect()->route('components.index')->with('error', trans('general.file_does_not_exist'));
+    }
+
+    /**
+     * Allows the selected file to be viewed.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v1.4]
+     * @param int $componentId
+     * @param int $fileId
+     * @return \Symfony\Component\HttpFoundation\Response
+     * @throws \Illuminate\Auth\Access\AuthorizationException
+     */
+    public function show($componentId = null, $fileId = null)
+    {
+        \Log::debug('Private filesystem is: '.config('filesystems.default'));
+        $component = Component::find($componentId);
+
+        // the component is valid
+        if (isset($component->id)) {
+            $this->authorize('view', $component);
+            $this->authorize('components.files', $component);
+
+            if (! $log = Actionlog::whereNotNull('filename')->where('item_id', $component->id)->find($fileId)) {
+                return response('No matching record for that asset/file', 500)
+                    ->header('Content-Type', 'text/plain');
+            }
+
+            $file = 'private_uploads/components/'.$log->filename;
+
+            if (Storage::missing($file)) {
+                \Log::debug('FILE DOES NOT EXISTS for '.$file);
+                \Log::debug('URL should be '.Storage::url($file));
+
+                return response('File '.$file.' ('.Storage::url($file).') not found on server', 404)
+                    ->header('Content-Type', 'text/plain');
+            } else {
+
+                // Display the file inline
+                if (request('inline') == 'true') {
+                    $headers = [
+                        'Content-Disposition' => 'inline',
+                    ];
+                    return Storage::download($file, $log->filename, $headers);
+                }
+
+                if (config('filesystems.default') == 'local') { // TODO - is there any way to fix this at the StorageHelper layer?
+                    return StorageHelper::downloader($file);
+                } 
+            }
+        }
+
+        return redirect()->route('components.index')->with('error', trans('general.file_does_not_exist', ['id' => $fileId]));
+    }
+}