From 4d90327c792c2585ce482362ad4e866b9a23e427 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Wed, 21 Jun 2023 12:09:32 -0400 Subject: [PATCH] Created Mail Queue Logs / Viewer in settings, enabled manual send invoice to use the new queue system, now it logs the Email ID so you can reference it in the Queue to see if it sent, also do not send mail to blank billing contact emails --- cron_mail_queue.php | 12 ++- post.php | 60 +++++++-------- settings_mail_queue.php | 162 ++++++++++++++++++++++++++++++++++++++++ settings_side_nav.php | 7 ++ 4 files changed, 206 insertions(+), 35 deletions(-) create mode 100644 settings_mail_queue.php diff --git a/cron_mail_queue.php b/cron_mail_queue.php index b084aae3..60005dac 100644 --- a/cron_mail_queue.php +++ b/cron_mail_queue.php @@ -3,6 +3,12 @@ require_once("config.php"); require_once("functions.php"); +//Initialize the HTML Purifier to prevent XSS +require("plugins/htmlpurifier/HTMLPurifier.standalone.php"); +$purifier_config = HTMLPurifier_Config::createDefault(); +$purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); +$purifier = new HTMLPurifier($purifier_config); + $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); $row = mysqli_fetch_array($sql_settings); @@ -42,10 +48,11 @@ if (mysqli_num_rows($sql_queue) > 0) { $email_recipient = nullable_htmlentities($row['email_recipient']); $email_recipient_name = nullable_htmlentities($row['email_recipient_name']); $email_subject = nullable_htmlentities($row['email_subject']); - $email_content = nullable_htmlentities($row['email_content']); + $email_content = $purifier->purify($row['email_content']); $email_queued_at = nullable_htmlentities($row['email_queued_at']); $email_sent_at = nullable_htmlentities($row['email_sent_at']); + // Sanitized Input $email_recipient_logging = sanitizeInput($row['email_recipient']); $email_subject_logging = sanitizeInput($row['email_subject']); @@ -97,12 +104,13 @@ if (mysqli_num_rows($sql_failed_queue) > 0) { $email_recipient = nullable_htmlentities($row['email_recipient']); $email_recipient_name = nullable_htmlentities($row['email_recipient_name']); $email_subject = nullable_htmlentities($row['email_subject']); - $email_content = nullable_htmlentities($row['email_content']); + $email_content = $purifier->purify($row['email_content']); $email_queued_at = nullable_htmlentities($row['email_queued_at']); $email_sent_at = nullable_htmlentities($row['email_sent_at']); // Increment the attempts $email_attempts = intval($row['email_attempts']) + 1; + // Sanitized Input $email_recipient_logging = sanitizeInput($row['email_recipient']); $email_subject_logging = sanitizeInput($row['email_subject']); diff --git a/post.php b/post.php index 8d921b32..348b5202 100644 --- a/post.php +++ b/post.php @@ -4058,6 +4058,7 @@ if(isset($_GET['email_invoice'])){ $client_id = $row['client_id']; $client_name = $row['client_name']; $contact_name = $row['contact_name']; + $contact_name_escaped = sanitizeInput($row['contact_name']); $contact_email = $row['contact_email']; $contact_email_escaped = sanitizeInput($row['contact_email']); $contact_phone = formatPhoneNumber($row['contact_phone']); @@ -4081,7 +4082,7 @@ if(isset($_GET['email_invoice'])){ $sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payment_id DESC"); - //Add up all the payments for the invoice and get the total amount paid to the invoice + // Add up all the payments for the invoice and get the total amount paid to the invoice $sql_amount_paid = mysqli_query($mysqli,"SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"); $row = mysqli_fetch_array($sql_amount_paid); $amount_paid = floatval($row['amount_paid']); @@ -4089,58 +4090,51 @@ if(isset($_GET['email_invoice'])){ $balance = $invoice_amount - $amount_paid; if ($invoice_status == 'Paid') { - $subject = "Invoice $invoice_prefix$invoice_number Copy"; - $body = "Hello $contact_name,

Please click on the link below to see your invoice marked paid.

Invoice Link


~
$company_name
Billing Department
$config_invoice_from_email
$company_phone"; + $subject = sanitizeInput("Invoice $invoice_prefix$invoice_number Copy"); + $body = mysqli_real_escape_string($mysqli, "Hello $contact_name,

Please click on the link below to see your invoice marked paid.

Invoice Link


~
$company_name
Billing Department
$config_invoice_from_email
$company_phone"); } else { - $subject = "Invoice $invoice_prefix$invoice_number"; - $body = "Hello $contact_name,

Please view the details of the invoice below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "
Balance Due: " . numfmt_format_currency($currency_format, $balance, $invoice_currency_code) . "
Due Date: $invoice_due


To view your invoice click here


~
$company_name
Billing Department
$config_invoice_from_email
$company_phone"; + $subject = sanitizeInput("Invoice $invoice_prefix$invoice_number"); + $body = mysqli_real_escape_string($mysqli, "Hello $contact_name,

Please view the details of the invoice below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "
Balance Due: " . numfmt_format_currency($currency_format, $balance, $invoice_currency_code) . "
Due Date: $invoice_due


To view your invoice click here


~
$company_name
Billing Department
$config_invoice_from_email
$company_phone"); } - $mail = sendSingleEmail($config_smtp_host, $config_smtp_username, $config_smtp_password, $config_smtp_encryption, $config_smtp_port, - $config_invoice_from_email, $config_invoice_from_name, - $contact_email, $contact_name, - $subject, $body); + // Queue Mail + mysqli_query($mysqli, "INSERT INTO email_queue SET email_recipient = '$contact_email_escaped', email_recipient_name = '$contact_name_escaped', email_from = '$config_invoice_from_email', email_from_name = '$config_invoice_from_name', email_subject = '$subject', email_content = '$body'"); - if ($mail === true) { - $_SESSION['alert_message'] = "Invoice has been sent"; - mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Emailed invoice', history_invoice_id = $invoice_id"); + // Get Email ID for reference + $email_id = mysqli_insert_id($mysqli); - //Don't change the status to sent if the status is anything but draft - if($invoice_status == 'Draft'){ - mysqli_query($mysqli,"UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id"); - } + $_SESSION['alert_message'] = "Invoice has been sent to the mail queue"; + mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Queued', history_description = 'Invoice sent to the mail queue ID: $email_id', history_invoice_id = $invoice_id"); - //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Invoice', log_action = 'Email', log_description = 'Invoice $invoice_prefix$invoice_number emailed to $contact_email_escaped', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $invoice_id"); - - } else { - $_SESSION['alert_type'] = "error"; - $_SESSION['alert_message'] = "Invoice Failed to send "; - mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Email Invoice Failed', history_invoice_id = $invoice_id"); - - mysqli_query($mysqli,"INSERT INTO notifications SET notification_type = 'Mail', notification = 'Failed to send email to $contact_email_escaped', notification_client_id = $client_id,"); - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Mail', log_action = 'Error', log_description = 'Failed to send email to $contact_email_escaped regarding $subject. $mail', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $invoice_id"); + // Don't change the status to sent if the status is anything but draft + if($invoice_status == 'Draft'){ + mysqli_query($mysqli,"UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id"); } + // Logging + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Invoice', log_action = 'Email Queue', log_description = 'Invoice $invoice_prefix$invoice_number queued to $contact_email_escaped Email ID: $email_id', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $invoice_id"); + // Send copies of the invoice to any additional billing contacts $sql_billing_contacts = mysqli_query( $mysqli, "SELECT contact_name, contact_email FROM contacts WHERE contact_billing = 1 AND contact_email != '$contact_email_escaped' + AND contact_email != '' AND contact_client_id = $client_id" ); while ($billing_contact = mysqli_fetch_array($sql_billing_contacts)) { - $billing_contact_name = $billing_contact['contact_name']; - $billing_contact_email = $billing_contact['contact_email']; + $billing_contact_name = sanitizeInput($billing_contact['contact_name']); + $billing_contact_email = sanitizeInput($billing_contact['contact_email']); + + // Queue Mail + mysqli_query($mysqli, "INSERT INTO email_queue SET email_recipient = '$billing_contact_email', email_recipient_name = '$billing_contact_name', email_from = '$config_invoice_from_email', email_from_name = '$config_invoice_from_name', email_subject = '$subject', email_content = '$body'"); + + // Get Email ID for reference + $email_id = mysqli_insert_id($mysqli); - sendSingleEmail($config_smtp_host, $config_smtp_username, $config_smtp_password, $config_smtp_encryption, $config_smtp_port, - $config_invoice_from_email, $config_invoice_from_name, - $billing_contact_email, $billing_contact_name, - $subject, $body); } - header("Location: " . $_SERVER["HTTP_REFERER"]); } diff --git a/settings_mail_queue.php b/settings_mail_queue.php new file mode 100644 index 00000000..3e329b46 --- /dev/null +++ b/settings_mail_queue.php @@ -0,0 +1,162 @@ +set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); +$purifier = new HTMLPurifier($purifier_config); + +//Rebuild URL +$url_query_strings_sb = http_build_query(array_merge($_GET, array('sb' => $sb, 'o' => $o))); + +$sql = mysqli_query( + $mysqli, + "SELECT SQL_CALC_FOUND_ROWS * FROM email_queue + WHERE (email_from LIKE '%$q%' OR email_from_name LIKE '%$q%' OR email_recipient LIKE '%$q%' OR email_recipient_name LIKE '%$q%' OR email_subject LIKE '%$q%') + AND DATE(email_queued_at) BETWEEN '$dtf' AND '$dtt' + ORDER BY $sb $o LIMIT $record_from, $record_to" +); + +$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + +?> + +
+
+

Email Queue

+
+
+
+
+
+
+ +
+ + +
+
+
+
+
" id="advancedFilter"> +
+
+
+ + +
+
+
+
+ + +
+
+
+
+ + +
+
+
+
+
+
+
+ + "> + + + + + + + + + + + + purify($row['email_content']); + $email_attempts = intval($row['email_attempts']); + $email_queued_at = nullable_htmlentities($row['email_queued_at']); + $email_failed_at = nullable_htmlentities($row['email_failed_at']); + $email_sent_at = nullable_htmlentities($row['email_sent_at']); + $email_status = intval($row['email_status']); + if($email_status == 0){ + $email_status_display = "
Queued
"; + }elseif($email_status == 1){ + $email_status_display = "
Sending
"; + }elseif($email_status_display == 2){ + $email_status_display = "
Failed
$email_failed_at"; + }else{ + $email_status_display = "
Sent
$email_sent_at"; + } + + ?> + + + + + + + + + + + + + + + + +
QueuedFromToSubjectStatusAttemptsAction
$email_from_name"?>$email_recipient_name"?> + +
+
+ +
+
+ + +
  • + "> + +

    Mail Queue

    +     +
    • +
  • ">