AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-09-09 00:05:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix client portal review findings: PIN wipe, log indexing, statement currency (db 2.7.8)

Browse Source 
Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising.

Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it.

New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable.

Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement.

Quick Send asks for confirmation; confirm-link extended to submit buttons.

Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.
This commit is contained in:
johnnyq
2026-08-28 16:38:42 -04:00
parent 820103460f
commit 156c51224d
12 changed files with 213 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
agent/quote.php
View File

@@ -168,7 +168,10 @@ if (isset($_GET['quote_id'])) {
</button>
<div class="dropdown-menu">
<?php if (!empty($config_smtp_provider) && $emailable_contacts > 0) { ?>
<button type="submit" class="dropdown-item" form="quickSendQuote"
<button type="submit" class="dropdown-item confirm-link" form="quickSendQuote"
data-confirm-title="Send this quote now?"
data-confirm-text="It goes to the default contacts without opening the picker."
data-confirm-button="Send"
name="quote_id" value="<?= $quote_id ?>">
<i class="fas fa-fw fa-bolt me-2"></i>Quick Send
</button>
@@ -237,7 +240,10 @@ if (isset($_GET['quote_id'])) {
<i class="fa fa-fw fa-download text-secondary me-2"></i>Download PDF
</a>
<?php if (!empty($config_smtp_provider) && $emailable_contacts > 0) { ?>
<button type="submit" class="dropdown-item" form="quickSendQuote"
<button type="submit" class="dropdown-item confirm-link" form="quickSendQuote"
data-confirm-title="Send this quote now?"
data-confirm-text="It goes to the default contacts without opening the picker."
data-confirm-button="Send"
name="quote_id" value="<?= $quote_id ?>">
<i class="fa fa-fw fa-bolt text-secondary me-2"></i>Quick Send
</button>