AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-09-01 04:15:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Send Email and Mark Sent modals for invoices and quotes (db 2.7.7)

Browse Source 
Send Email opens a contact picker instead of hardcoding the primary contact; Mark Sent asks how it went out and takes a note. Both log recipients / method / note to the document history. Handlers moved GET -> POST.

Fixes two pre-existing bugs in the email path: archived contacts were still receiving billing copies, and every copy was addressed to the primary contact by name.
This commit is contained in:
johnnyq
2026-08-28 13:31:22 -04:00
parent 20b8fb5379
commit 72e6f23e19
14 changed files with 680 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
admin/database_updates/2.7.7.php Normal file
View File

@@ -0,0 +1,20 @@
<?php
/*
* ITFlow - Database update to version 2.7.7 (from 2.7.6)
* Included by admin/database_updates.php - do not access directly
*/
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
// history_description was varchar(200). That was enough while every entry
// was a fixed sentence ("Invoice created by <user>"), but the send-email
// and mark-sent flows now record who the document actually went to - a
// "Name <email>" pair per recipient - and the mark-sent note the agent
// types. Five billing contacts alone blows past 200 characters, and under
// strict mode an over-long value is an error, not a truncation, so the
// history row would be lost and the send would 500.
//
// text rather than a bigger varchar: there is no index on this column and
// no length worth defending, so a cap would only be a future bug.
mysqli_query($mysqli, "ALTER TABLE `history` MODIFY `history_description` text NOT NULL");

26
agent/invoice.php
View File

@@ -106,6 +106,17 @@ if (isset($_GET['invoice_id'])) {
}
$company_logo = escapeHtml($row['company_logo']);
// Send Email used to be gated on the PRIMARY contact having an email, which
// hid the button on a client whose only emailable contact was a billing or
// secondary one. The modal can send to any of them, so gate on whether the
// client has anybody reachable at all.
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(contact_id) AS emailable_contacts FROM contacts
WHERE contact_client_id = $client_id
AND contact_archived_at IS NULL
AND contact_email IS NOT NULL
AND contact_email != ''"));
$emailable_contacts = intval($row['emailable_contacts']);
$sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
$sql_payments = mysqli_query($mysqli, "SELECT account_name, payment_amount, payment_currency_code, payment_date, payment_id,
@@ -234,13 +245,15 @@ if (isset($_GET['invoice_id'])) {
<i class="fas fa-fw fa-paper-plane me-2"></i>Send
</button>
<div class="dropdown-menu">
<?php if (!empty($config_smtp_provider) && !empty($contact_email)) { ?>
<a class="dropdown-item" href="post.php?email_invoice=<?= $invoice_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<?php if (!empty($config_smtp_provider) && $emailable_contacts > 0) { ?>
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/invoice/invoice_email.php?invoice_id=<?= $invoice_id ?>">
<i class="fas fa-fw fa-paper-plane me-2"></i>Send Email
</a>
<div class="dropdown-divider"></div>
<?php } ?>
<a class="dropdown-item" href="post.php?mark_invoice_sent=<?= $invoice_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/invoice/invoice_mark_sent.php?invoice_id=<?= $invoice_id ?>">
<i class="fas fa-fw fa-check me-2"></i>Mark Sent
</a>
</div>
@@ -300,8 +313,9 @@ if (isset($_GET['invoice_id'])) {
<a class="dropdown-item" href="post.php?export_invoice_packing_slip=<?= $invoice_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>" target="_blank">
<i class="fa fa-fw fa-box-open text-secondary me-2"></i>Packing Slip
</a>
<?php if (!empty($config_smtp_provider) && !empty($contact_email)) { ?>
<a class="dropdown-item" href="post.php?email_invoice=<?= $invoice_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<?php if (!empty($config_smtp_provider) && $emailable_contacts > 0) { ?>
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/invoice/invoice_email.php?invoice_id=<?= $invoice_id ?>">
<i class="fa fa-fw fa-paper-plane text-secondary me-2"></i>Send Email
</a>
<?php } ?>
@@ -614,7 +628,7 @@ if (isset($_GET['invoice_id'])) {
while ($row = mysqli_fetch_assoc($sql_history)) {
$history_created_at = $row['history_created_at'];
$history_status = escapeHtml($row['history_status']);
$history_description = escapeHtml($row['history_description']);
$history_description = nl2br(escapeHtml($row['history_description']));
?>
<tr>

6
agent/invoices.php
View File

@@ -434,13 +434,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
</a>
<div class="dropdown-divider"></div>
<?php if (!empty($config_smtp_provider)) { ?>
<a class="dropdown-item" href="post.php?email_invoice=<?= $invoice_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/invoice/invoice_email.php?invoice_id=<?= $invoice_id ?>">
<i class="fas fa-fw fa-paper-plane me-2"></i>Send Email
</a>
<div class="dropdown-divider"></div>
<?php } ?>
<?php if ($invoice_status == 'Draft') { ?>
<a class="dropdown-item" href="post.php?mark_invoice_sent=<?= $invoice_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/invoice/invoice_mark_sent.php?invoice_id=<?= $invoice_id ?>">
<i class="fas fa-fw fa-check me-2"></i>Mark Sent
</a>
<div class="dropdown-divider"></div>

131
agent/modals/invoice/invoice_email.php Normal file
View File

@@ -0,0 +1,131 @@
<?php
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['invoice_id']);
$sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_number, invoice_prefix, invoice_status
FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$invoice_status = escapeHtml($row['invoice_status']);
$client_id = intval($row['invoice_client_id']);
enforceClientAccess();
// Everyone at the client who can actually receive mail. Primary and billing
// contacts lead because they are the ones checked by default below - that
// pairing is the behaviour the old one-click Send Email link had baked in.
$sql_contacts = mysqli_query(
$mysqli,
"SELECT contact_billing, contact_email, contact_id, contact_name, contact_primary, contact_title
FROM contacts
WHERE contact_client_id = $client_id
AND contact_archived_at IS NULL
AND contact_email IS NOT NULL
AND contact_email != ''
ORDER BY contact_primary DESC, contact_billing DESC, contact_name ASC"
);
$contact_count = mysqli_num_rows($sql_contacts);
ob_start();
?>
<div class="modal-header bg-dark">
<h5 class="modal-title text-white">
<i class="fa fa-fw fa-paper-plane me-2"></i>Email Invoice <?= "$invoice_prefix$invoice_number" ?>
</h5>
<button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
</div>
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<input type="hidden" name="invoice_id" value="<?= $invoice_id ?>">
<div class="modal-body">
<?php if ($contact_count == 0) { ?>
<p class="text-muted mb-0">
This client has no contacts with an email address, so there is nobody to send to.
Add a contact with an email address, or use Mark Sent to record that the invoice
went out some other way.
</p>
<?php } else { ?>
<label class="mb-2">Send to <strong class="text-danger">*</strong></label>
<div class="list-group mb-3">
<?php
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id = intval($row['contact_id']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_title = escapeHtml($row['contact_title']);
$contact_primary = intval($row['contact_primary']);
$contact_billing = intval($row['contact_billing']);
// Default selection reproduces the old link exactly: the
// primary contact was the recipient and every billing
// contact got a copy
$contact_checked = ($contact_primary == 1 || $contact_billing == 1);
?>
<label class="list-group-item" for="invoiceEmailContact<?= $contact_id ?>">
<input type="checkbox" class="form-check-input me-2" name="contacts[]"
id="invoiceEmailContact<?= $contact_id ?>" value="<?= $contact_id ?>"
<?php if ($contact_checked) { echo "checked"; } ?>>
<strong><?= $contact_name ?></strong>
<?php if ($contact_primary == 1) { ?>
<span class="badge text-bg-primary ms-1">Primary</span>
<?php } ?>
<?php if ($contact_billing == 1) { ?>
<span class="badge text-bg-success ms-1">Billing</span>
<?php } ?>
<?php if (!empty($contact_title)) { ?>
<span class="text-muted ms-1"><?= $contact_title ?></span>
<?php } ?>
<br>
<span class="text-muted ms-4"><?= $contact_email ?></span>
</label>
<?php
}
?>
</div>
<?php if ($invoice_status !== 'Draft') { ?>
<p class="text-muted mb-0">
<i class="fa fa-fw fa-info-circle me-1"></i>This invoice is
<strong><?= $invoice_status ?></strong>, so sending it will not change its status.
</p>
<?php } ?>
<?php } ?>
</div>
<div class="modal-footer">
<?php if ($contact_count > 0) { ?>
<button type="submit" name="email_invoice" class="btn btn-primary text-bold">
<i class="fa fa-fw fa-paper-plane me-2"></i>Send
</button>
<?php } ?>
<button type="button" class="btn btn-light" data-bs-dismiss="modal">
<i class="fa fa-fw fa-times me-2"></i>Cancel
</button>
</div>
</form>
<?php
require_once '../../../includes/modal_footer.php';

64
agent/modals/invoice/invoice_mark_sent.php Normal file
View File

@@ -0,0 +1,64 @@
<?php
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['invoice_id']);
$sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_number, invoice_prefix
FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$invoice_prefix = escapeHtml($row['invoice_prefix']);
$invoice_number = intval($row['invoice_number']);
$client_id = intval($row['invoice_client_id']);
enforceClientAccess();
ob_start();
?>
<div class="modal-header bg-dark">
<h5 class="modal-title text-white">
<i class="fa fa-fw fa-check me-2"></i>Mark Invoice <?= "$invoice_prefix$invoice_number" ?> Sent
</h5>
<button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
</div>
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<input type="hidden" name="invoice_id" value="<?= $invoice_id ?>">
<div class="modal-body">
<div class="mb-3">
<label>How was it sent? <strong class="text-danger">*</strong></label>
<div class="input-group">
<span class="input-group-text"><i class="fa fa-fw fa-paper-plane"></i></span>
<select class="form-select" name="sent_method" required>
<?php foreach (getSentMethods() as $sent_method) { ?>
<option value="<?= escapeHtml($sent_method) ?>"><?= escapeHtml($sent_method) ?></option>
<?php } ?>
</select>
</div>
</div>
<div class="mb-3">
<label>Note</label>
<textarea class="form-control" name="note" rows="3" maxlength="500"
placeholder="Optional - tracking number, who it went to, anything worth keeping"></textarea>
</div>
</div>
<div class="modal-footer">
<button type="submit" name="mark_invoice_sent" class="btn btn-primary text-bold">
<i class="fa fa-fw fa-check me-2"></i>Mark Sent
</button>
<button type="button" class="btn btn-light" data-bs-dismiss="modal">
<i class="fa fa-fw fa-times me-2"></i>Cancel
</button>
</div>
</form>
<?php
require_once '../../../includes/modal_footer.php';

129
agent/modals/quote/quote_email.php Normal file
View File

@@ -0,0 +1,129 @@
<?php
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['quote_id']);
$sql = mysqli_query($mysqli, "SELECT quote_client_id, quote_number, quote_prefix, quote_status
FROM quotes WHERE quote_id = $quote_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = escapeHtml($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$quote_status = escapeHtml($row['quote_status']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
$sql_contacts = mysqli_query(
$mysqli,
"SELECT contact_billing, contact_email, contact_id, contact_name, contact_primary, contact_title
FROM contacts
WHERE contact_client_id = $client_id
AND contact_archived_at IS NULL
AND contact_email IS NOT NULL
AND contact_email != ''
ORDER BY contact_primary DESC, contact_billing DESC, contact_name ASC"
);
$contact_count = mysqli_num_rows($sql_contacts);
ob_start();
?>
<div class="modal-header bg-dark">
<h5 class="modal-title text-white">
<i class="fa fa-fw fa-paper-plane me-2"></i>Email Quote <?= "$quote_prefix$quote_number" ?>
</h5>
<button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
</div>
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<input type="hidden" name="quote_id" value="<?= $quote_id ?>">
<div class="modal-body">
<?php if ($contact_count == 0) { ?>
<p class="text-muted mb-0">
This client has no contacts with an email address, so there is nobody to send to.
Add a contact with an email address, or use Mark Sent to record that the quote
went out some other way.
</p>
<?php } else { ?>
<label class="mb-2">Send to <strong class="text-danger">*</strong></label>
<div class="list-group mb-3">
<?php
while ($row = mysqli_fetch_assoc($sql_contacts)) {
$contact_id = intval($row['contact_id']);
$contact_name = escapeHtml($row['contact_name']);
$contact_email = escapeHtml($row['contact_email']);
$contact_title = escapeHtml($row['contact_title']);
$contact_primary = intval($row['contact_primary']);
$contact_billing = intval($row['contact_billing']);
// Default selection reproduces the old link: quotes went to
// the primary contact only. Billing contacts are listed and
// one click away, but stay unchecked - a quote is a sales
// conversation, not a bill
$contact_checked = ($contact_primary == 1);
?>
<label class="list-group-item" for="quoteEmailContact<?= $contact_id ?>">
<input type="checkbox" class="form-check-input me-2" name="contacts[]"
id="quoteEmailContact<?= $contact_id ?>" value="<?= $contact_id ?>"
<?php if ($contact_checked) { echo "checked"; } ?>>
<strong><?= $contact_name ?></strong>
<?php if ($contact_primary == 1) { ?>
<span class="badge text-bg-primary ms-1">Primary</span>
<?php } ?>
<?php if ($contact_billing == 1) { ?>
<span class="badge text-bg-success ms-1">Billing</span>
<?php } ?>
<?php if (!empty($contact_title)) { ?>
<span class="text-muted ms-1"><?= $contact_title ?></span>
<?php } ?>
<br>
<span class="text-muted ms-4"><?= $contact_email ?></span>
</label>
<?php
}
?>
</div>
<?php if ($quote_status !== 'Draft') { ?>
<p class="text-muted mb-0">
<i class="fa fa-fw fa-info-circle me-1"></i>This quote is
<strong><?= $quote_status ?></strong>, so sending it will not change its status.
</p>
<?php } ?>
<?php } ?>
</div>
<div class="modal-footer">
<?php if ($contact_count > 0) { ?>
<button type="submit" name="email_quote" class="btn btn-primary text-bold">
<i class="fa fa-fw fa-paper-plane me-2"></i>Send
</button>
<?php } ?>
<button type="button" class="btn btn-light" data-bs-dismiss="modal">
<i class="fa fa-fw fa-times me-2"></i>Cancel
</button>
</div>
</form>
<?php
require_once '../../../includes/modal_footer.php';

64
agent/modals/quote/quote_mark_sent.php Normal file
View File

@@ -0,0 +1,64 @@
<?php
require_once '../../../includes/modal_header.php';
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['quote_id']);
$sql = mysqli_query($mysqli, "SELECT quote_client_id, quote_number, quote_prefix
FROM quotes WHERE quote_id = $quote_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$quote_prefix = escapeHtml($row['quote_prefix']);
$quote_number = intval($row['quote_number']);
$client_id = intval($row['quote_client_id']);
enforceClientAccess();
ob_start();
?>
<div class="modal-header bg-dark">
<h5 class="modal-title text-white">
<i class="fa fa-fw fa-check me-2"></i>Mark Quote <?= "$quote_prefix$quote_number" ?> Sent
</h5>
<button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
</div>
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<input type="hidden" name="quote_id" value="<?= $quote_id ?>">
<div class="modal-body">
<div class="mb-3">
<label>How was it sent? <strong class="text-danger">*</strong></label>
<div class="input-group">
<span class="input-group-text"><i class="fa fa-fw fa-paper-plane"></i></span>
<select class="form-select" name="sent_method" required>
<?php foreach (getSentMethods() as $sent_method) { ?>
<option value="<?= escapeHtml($sent_method) ?>"><?= escapeHtml($sent_method) ?></option>
<?php } ?>
</select>
</div>
</div>
<div class="mb-3">
<label>Note</label>
<textarea class="form-control" name="note" rows="3" maxlength="500"
placeholder="Optional - tracking number, who it went to, anything worth keeping"></textarea>
</div>
</div>
<div class="modal-footer">
<button type="submit" name="mark_quote_sent" class="btn btn-primary text-bold">
<i class="fa fa-fw fa-check me-2"></i>Mark Sent
</button>
<button type="button" class="btn btn-light" data-bs-dismiss="modal">
<i class="fa fa-fw fa-times me-2"></i>Cancel
</button>
</div>
</form>
<?php
require_once '../../../includes/modal_footer.php';

149
agent/post/invoice.php
View File

@@ -167,13 +167,13 @@ if (isset($_POST['add_invoice_copy'])) {
}
if (isset($_GET['mark_invoice_sent'])) {
if (isset($_POST['mark_invoice_sent'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['mark_invoice_sent']);
$invoice_id = intval($_POST['invoice_id']);
// Get Invoice Number and Prefix and Client ID for Logging
$sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id");
@@ -184,11 +184,26 @@ if (isset($_GET['mark_invoice_sent'])) {
enforceClientAccess();
// The modal offers a fixed list, so anything else is a tampered form
$sent_method = $_POST['sent_method'] ?? '';
if (!in_array($sent_method, getSentMethods(), true)) {
flashAlert("Invalid delivery method", 'error');
redirect();
}
$sent_method = escapeSql($sent_method);
$note = escapeSql(substr(trim($_POST['note'] ?? ''), 0, 500));
mysqli_query($mysqli,"UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id");
mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Invoice marked sent by $session_name', history_invoice_id = $invoice_id");
$history_description = "Invoice marked sent by $session_name - $sent_method";
if (!empty($note)) {
$history_description .= "\nNote: $note";
}
logAudit("Invoice", "Edit", "$session_name marked invoice $invoice_prefix$invoice_number sent", $client_id, $invoice_id);
logHistory('Sent', $history_description, $invoice_id);
logAudit("Invoice", "Edit", "$session_name marked invoice $invoice_prefix$invoice_number sent - $sent_method", $client_id, $invoice_id);
flashAlert("Invoice marked sent");
@@ -498,19 +513,18 @@ if (isset($_GET['delete_invoice_item'])) {
}
if (isset($_GET['email_invoice'])) {
if (isset($_POST['email_invoice'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$invoice_id = intval($_GET['email_invoice']);
$invoice_id = intval($_POST['invoice_id']);
$sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code,
$sql = mysqli_query($mysqli,"SELECT client_id, client_name, invoice_amount, invoice_currency_code,
invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix, invoice_scope,
invoice_status, invoice_url_key FROM invoices
LEFT JOIN clients ON invoice_client_id = client_id
LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
WHERE invoice_id = $invoice_id"
);
$row = mysqli_fetch_assoc($sql);
@@ -527,11 +541,41 @@ if (isset($_GET['email_invoice'])) {
$invoice_currency_code = escapeSql($row['invoice_currency_code']);
$client_id = intval($row['client_id']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
enforceClientAccess();
// Recipients come from the Send Email modal's contact picker. Scoping the
// lookup to this invoice's client is what makes a tampered contact_id
// harmless - it simply matches nothing.
$selected_contacts = $_POST['contacts'] ?? [];
if (!is_array($selected_contacts)) {
$selected_contacts = [];
}
$selected_contact_ids = array_filter(array_unique(array_map('intval', $selected_contacts)));
if (empty($selected_contact_ids)) {
flashAlert("Select at least one contact to send to", 'error');
redirect();
}
$selected_contact_id_list = implode(',', $selected_contact_ids);
$sql_recipients = mysqli_query(
$mysqli,
"SELECT contact_email, contact_name FROM contacts
WHERE contact_id IN ($selected_contact_id_list)
AND contact_client_id = $client_id
AND contact_archived_at IS NULL
AND contact_email IS NOT NULL
AND contact_email != ''
ORDER BY contact_primary DESC, contact_billing DESC, contact_name ASC"
);
if (mysqli_num_rows($sql_recipients) == 0) {
flashAlert("None of the selected contacts have a usable email address", 'error');
redirect();
}
$sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
@@ -551,8 +595,6 @@ if (isset($_GET['email_invoice'])) {
$config_invoice_from_name = escapeSql($config_invoice_from_name);
$config_invoice_from_email = escapeSql($config_invoice_from_email);
$sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payment_id DESC");
// Add up all the payments for the invoice and get the total amount paid to the invoice
$sql_amount_paid = mysqli_query($mysqli,"SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id");
$row = mysqli_fetch_assoc($sql_amount_paid);
@@ -562,68 +604,55 @@ if (isset($_GET['email_invoice'])) {
if ($invoice_status == 'Paid') {
$subject = "Invoice $invoice_prefix$invoice_number Receipt";
$body = "Hello $contact_name,<br><br>Please click on the link below to see your invoice regarding \"$invoice_scope\" marked <b>paid</b>.<br><br><a href=\'https://$config_base_url/guest/guest_view_invoice.php?invoice_id=$invoice_id&url_key=$invoice_url_key\'>Invoice Link</a><br><br><br>--<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone";
} else {
$subject = "Invoice $invoice_prefix$invoice_number";
$body = "Hello $contact_name,<br><br>Please view the details of your invoice regarding \"$invoice_scope\" below.<br><br>Invoice: $invoice_prefix$invoice_number<br>Issue Date: $invoice_date<br>Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "<br>Balance Due: " . numfmt_format_currency($currency_format, $balance, $invoice_currency_code) . "<br>Due Date: $invoice_due<br><br><br>To view your invoice, please click <a href=\'https://$config_base_url/guest/guest_view_invoice.php?invoice_id=$invoice_id&url_key=$invoice_url_key\'>here</a>.<br><br><br>--<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone";
}
// Queue Mail
$data[] = [
'from' => $config_invoice_from_email,
'from_name' => $config_invoice_from_name,
'recipient' => $contact_email,
'recipient_name' => $contact_name,
'subject' => $subject,
'body' => $body
];
// One queue row per selected contact, each greeting its own recipient.
// The old handler built a single body around the primary contact's name
// and reused it for the billing copies, so those read "Hello <someone
// else>" - visible enough with one hidden copy, wrong enough to keep once
// the recipient list is something the agent picks.
$data = [];
$recipient_labels = [];
while ($recipient = mysqli_fetch_assoc($sql_recipients)) {
$contact_name = escapeSql($recipient['contact_name']);
$contact_email = escapeSql($recipient['contact_email']);
if ($invoice_status == 'Paid') {
$body = "Hello $contact_name,<br><br>Please click on the link below to see your invoice regarding \"$invoice_scope\" marked <b>paid</b>.<br><br><a href=\'https://$config_base_url/guest/guest_view_invoice.php?invoice_id=$invoice_id&url_key=$invoice_url_key\'>Invoice Link</a><br><br><br>--<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone";
} else {
$body = "Hello $contact_name,<br><br>Please view the details of your invoice regarding \"$invoice_scope\" below.<br><br>Invoice: $invoice_prefix$invoice_number<br>Issue Date: $invoice_date<br>Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "<br>Balance Due: " . numfmt_format_currency($currency_format, $balance, $invoice_currency_code) . "<br>Due Date: $invoice_due<br><br><br>To view your invoice, please click <a href=\'https://$config_base_url/guest/guest_view_invoice.php?invoice_id=$invoice_id&url_key=$invoice_url_key\'>here</a>.<br><br><br>--<br>$company_name - Billing<br>$config_invoice_from_email<br>$company_phone";
}
$data[] = [
'from' => $config_invoice_from_email,
'from_name' => $config_invoice_from_name,
'recipient' => $contact_email,
'recipient_name' => $contact_name,
'subject' => $subject,
'body' => $body
];
$recipient_labels[] = "$contact_name <$contact_email>";
logAudit("Invoice", "Email", "$session_name emailed $contact_email Invoice $invoice_prefix$invoice_number", $client_id, $invoice_id);
}
addToMailQueue($data);
// Get Email ID for reference
$email_id = mysqli_insert_id($mysqli);
$recipient_list = implode(', ', $recipient_labels);
$recipient_count = count($recipient_labels);
flashAlert("Invoice sent!");
mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Invoice sent by $session_name (mail queue ID: $email_id)', history_invoice_id = $invoice_id");
logHistory('Sent', "Invoice emailed by $session_name to $recipient_list", $invoice_id);
// Don't change the status to sent if the status is anything but draft
if ($invoice_status == 'Draft') {
mysqli_query($mysqli,"UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id");
}
logAudit("Invoice", "Email", "$session_name Emailed $contact_email Invoice $invoice_prefix$invoice_number Email queued to Email ID: $email_id", $client_id, $invoice_id);
// Send copies of the invoice to any additional billing contacts
$sql_billing_contacts = mysqli_query(
$mysqli,
"SELECT contact_name, contact_email FROM contacts
WHERE contact_billing = 1
AND contact_email != '$contact_email'
AND contact_email != ''
AND contact_client_id = $client_id"
);
$data = [];
while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) {
$billing_contact_name = escapeSql($billing_contact['contact_name']);
$billing_contact_email = escapeSql($billing_contact['contact_email']);
$data[] = [
'from' => $config_invoice_from_email,
'from_name' => $config_invoice_from_name,
'recipient' => $billing_contact_email,
'recipient_name' => $billing_contact_name,
'subject' => $subject,
'body' => $body
];
logAudit("Invoice", "Email", "$session_name Emailed $billing_contact_email Invoice $invoice_prefix$invoice_number Email queued Email ID: $email_id", $client_id, $invoice_id);
}
addToMailQueue($data);
flashAlert("Invoice queued to $recipient_count " . ($recipient_count == 1 ? "recipient" : "recipients"));
redirect();

99
agent/post/quote.php
View File

@@ -463,13 +463,13 @@ if (isset($_GET['delete_quote_item'])) {
}
if (isset($_GET['mark_quote_sent'])) {
if (isset($_POST['mark_quote_sent'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['mark_quote_sent']);
$quote_id = intval($_POST['quote_id']);
$sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
$row = mysqli_fetch_assoc($sql);
@@ -479,11 +479,26 @@ if (isset($_GET['mark_quote_sent'])) {
enforceClientAccess();
// The modal offers a fixed list, so anything else is a tampered form
$sent_method = $_POST['sent_method'] ?? '';
if (!in_array($sent_method, getSentMethods(), true)) {
flashAlert("Invalid delivery method", 'error');
redirect();
}
$sent_method = escapeSql($sent_method);
$note = escapeSql(substr(trim($_POST['note'] ?? ''), 0, 500));
mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Sent' WHERE quote_id = $quote_id");
mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Quote marked sent', history_quote_id = $quote_id");
$history_description = "Quote marked sent by $session_name - $sent_method";
if (!empty($note)) {
$history_description .= "\nNote: $note";
}
logAudit("Quote", "Sent", "$session_name marked quote $quote_prefix$quote_number as sent", $client_id, $quote_id);
logHistory('Sent', $history_description, 0, $quote_id);
logAudit("Quote", "Sent", "$session_name marked quote $quote_prefix$quote_number as sent - $sent_method", $client_id, $quote_id);
flashAlert("Quote marked sent");
@@ -551,19 +566,18 @@ if (isset($_GET['decline_quote'])) {
}
if (isset($_GET['email_quote'])) {
if (isset($_POST['email_quote'])) {
validateCSRFToken();
enforceUserPermission('module_sales', 2);
$quote_id = intval($_GET['email_quote']);
$quote_id = intval($_POST['quote_id']);
$sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, quote_amount, quote_currency_code,
$sql = mysqli_query($mysqli,"SELECT client_id, client_name, quote_amount, quote_currency_code,
quote_date, quote_expire, quote_number, quote_prefix, quote_scope, quote_status,
quote_url_key FROM quotes
LEFT JOIN clients ON quote_client_id = client_id
LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
WHERE quote_id = $quote_id"
);
@@ -579,11 +593,41 @@ if (isset($_GET['email_quote'])) {
$quote_currency_code = escapeSql($row['quote_currency_code']);
$client_id = intval($row['client_id']);
$client_name = escapeSql($row['client_name']);
$contact_name = escapeSql($row['contact_name']);
$contact_email = escapeSql($row['contact_email']);
enforceClientAccess();
// Recipients come from the Send Email modal's contact picker. Scoping the
// lookup to this quote's client is what makes a tampered contact_id
// harmless - it simply matches nothing.
$selected_contacts = $_POST['contacts'] ?? [];
if (!is_array($selected_contacts)) {
$selected_contacts = [];
}
$selected_contact_ids = array_filter(array_unique(array_map('intval', $selected_contacts)));
if (empty($selected_contact_ids)) {
flashAlert("Select at least one contact to send to", 'error');
redirect();
}
$selected_contact_id_list = implode(',', $selected_contact_ids);
$sql_recipients = mysqli_query(
$mysqli,
"SELECT contact_email, contact_name FROM contacts
WHERE contact_id IN ($selected_contact_id_list)
AND contact_client_id = $client_id
AND contact_archived_at IS NULL
AND contact_email IS NOT NULL
AND contact_email != ''
ORDER BY contact_primary DESC, contact_billing DESC, contact_name ASC"
);
if (mysqli_num_rows($sql_recipients) == 0) {
flashAlert("None of the selected contacts have a usable email address", 'error');
redirect();
}
$sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
$row = mysqli_fetch_assoc($sql);
@@ -605,33 +649,46 @@ if (isset($_GET['email_quote'])) {
$config_base_url = escapeSql($config_base_url);
$subject = "Quote [$quote_scope]";
$body = "Hello $contact_name,<br><br>Thank you for your inquiry, we are pleased to provide you with the following estimate.<br><br><br>$quote_scope<br>Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "<br><br><br>View and accept your estimate online <a href=\'https://$config_base_url/guest/guest_view_quote.php?quote_id=$quote_id&url_key=$quote_url_key\'>here</a><br><br><br>--<br>$company_name - Sales<br>$config_quote_from_email<br>$company_phone";
// Queue Mail
$data = [
[
// One queue row per selected contact, each greeting its own recipient
$data = [];
$recipient_labels = [];
while ($recipient = mysqli_fetch_assoc($sql_recipients)) {
$contact_name = escapeSql($recipient['contact_name']);
$contact_email = escapeSql($recipient['contact_email']);
$body = "Hello $contact_name,<br><br>Thank you for your inquiry, we are pleased to provide you with the following estimate.<br><br><br>$quote_scope<br>Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "<br><br><br>View and accept your estimate online <a href=\'https://$config_base_url/guest/guest_view_quote.php?quote_id=$quote_id&url_key=$quote_url_key\'>here</a><br><br><br>--<br>$company_name - Sales<br>$config_quote_from_email<br>$company_phone";
$data[] = [
'from' => $config_quote_from_email,
'from_name' => $config_quote_from_name,
'recipient' => $contact_email,
'recipient_name' => $contact_name,
'subject' => $subject,
'body' => $body,
]
];
];
$recipient_labels[] = "$contact_name <$contact_email>";
logAudit("Quote", "Email", "$session_name emailed quote $quote_prefix$quote_number to $contact_email", $client_id, $quote_id);
}
addToMailQueue($data);
$recipient_list = implode(', ', $recipient_labels);
$recipient_count = count($recipient_labels);
// Update History
mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Emailed Quote', history_quote_id = $quote_id");
logAudit("Quote", "Email", "$session_name emailed quote $quote_prefix$quote_number to $contact_email", $client_id, $quote_id);
flashAlert("Quote sent!");
logHistory('Sent', "Quote emailed by $session_name to $recipient_list", 0, $quote_id);
//Don't change the status to sent if the status is anything but draft
if ($quote_status == 'Draft') {
mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Sent' WHERE quote_id = $quote_id");
}
flashAlert("Quote queued to $recipient_count " . ($recipient_count == 1 ? "recipient" : "recipients"));
redirect();
}

26
agent/quote.php
View File

@@ -99,6 +99,17 @@ if (isset($_GET['quote_id'])) {
$company_website = escapeHtml($row['company_website']);
$company_logo = escapeHtml($row['company_logo']);
// Send Email used to be gated on the PRIMARY contact having an email, which
// hid the button on a client whose only emailable contact was a billing or
// secondary one. The modal can send to any of them, so gate on whether the
// client has anybody reachable at all.
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(contact_id) AS emailable_contacts FROM contacts
WHERE contact_client_id = $client_id
AND contact_archived_at IS NULL
AND contact_email IS NOT NULL
AND contact_email != ''"));
$emailable_contacts = intval($row['emailable_contacts']);
$sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC");
//Set Badge color based off of quote status
@@ -156,13 +167,15 @@ if (isset($_GET['quote_id'])) {
<i class="fas fa-fw fa-paper-plane me-2"></i>Send
</button>
<div class="dropdown-menu">
<?php if (!empty($config_smtp_provider) && !empty($contact_email)) { ?>
<a class="dropdown-item" href="post.php?email_quote=<?= $quote_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<?php if (!empty($config_smtp_provider) && $emailable_contacts > 0) { ?>
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/quote/quote_email.php?quote_id=<?= $quote_id ?>">
<i class="fas fa-fw fa-paper-plane me-2"></i>Send Email
</a>
<div class="dropdown-divider"></div>
<?php } ?>
<a class="dropdown-item" href="post.php?mark_quote_sent=<?= $quote_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/quote/quote_mark_sent.php?quote_id=<?= $quote_id ?>">
<i class="fas fa-fw fa-check me-2"></i>Mark Sent
</a>
</div>
@@ -219,8 +232,9 @@ if (isset($_GET['quote_id'])) {
<a class="dropdown-item" href="post.php?export_quote_pdf=<?= $quote_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>" target="_blank">
<i class="fa fa-fw fa-download text-secondary me-2"></i>Download PDF
</a>
<?php if (!empty($config_smtp_provider) && !empty($contact_email)) { ?>
<a class="dropdown-item" href="post.php?email_quote=<?= $quote_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<?php if (!empty($config_smtp_provider) && $emailable_contacts > 0) { ?>
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/quote/quote_email.php?quote_id=<?= $quote_id ?>">
<i class="fa fa-fw fa-paper-plane text-secondary me-2"></i>Send Email
</a>
<?php } ?>
@@ -565,7 +579,7 @@ if (isset($_GET['quote_id'])) {
while ($row = mysqli_fetch_assoc($sql_history)) {
$history_created_at = escapeHtml($row['history_created_at']);
$history_status = escapeHtml($row['history_status']);
$history_description = escapeHtml($row['history_description']);
$history_description = nl2br(escapeHtml($row['history_description']));
?>
<tr>

3
agent/quotes.php
View File

@@ -224,7 +224,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
</a>
<?php if (!empty($config_smtp_provider)) { ?>
<div class="dropdown-divider"></div>
<a class="dropdown-item" href="post.php?email_quote=<?= $quote_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
<a class="dropdown-item ajax-modal" href="#"
data-modal-url="modals/quote/quote_email.php?quote_id=<?= $quote_id ?>">
<i class="fas fa-fw fa-paper-plane me-2"></i>Email
</a>
<?php } ?>

4
db.sql
View File

@@ -1369,7 +1369,7 @@ DROP TABLE IF EXISTS `history`;
CREATE TABLE `history` (
`history_id` int(11) NOT NULL AUTO_INCREMENT,
`history_status` varchar(200) NOT NULL,
`history_description` varchar(200) NOT NULL,
`history_description` text NOT NULL,
`history_created_at` datetime NOT NULL DEFAULT current_timestamp(),
`history_invoice_id` int(11) NOT NULL DEFAULT 0,
`history_recurring_invoice_id` int(11) NOT NULL DEFAULT 0,
@@ -3247,4 +3247,4 @@ CREATE TABLE `vendors` (
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
-- Dump completed on 2026-08-28 0:13:03
-- Dump completed on 2026-08-28 13:31:14

21
functions/app.php
View File

@@ -785,3 +785,24 @@ function createiCalStrCancel($datetime, $title, $uid) {
return $cal_event->export();
}
/*
* The delivery methods offered by the Mark Sent modal on invoices and quotes.
*
* Marking a document sent records that it left the building by some route
* other than ITFlow's own mailer, so the list is about how it got there. It is
* deliberately a fixed list rather than a categories row: the post handler
* validates the submitted value against it, and "Other" plus the free-text
* note covers anything not listed.
*/
function getSentMethods() {
return [
'Sent by Snail Mail',
'Sent by Email Client',
'Hand Delivered',
'Sent by Fax',
'Sent by Courier',
'Shared Guest Link',
'Other'
];
}

36
functions/logging.php
View File

@@ -95,6 +95,42 @@ function logTicketHistory($ticket_id, $description) {
mysqli_query($mysqli, "INSERT INTO ticket_history SET ticket_history_status = '$status_name', ticket_history_description = '$description', ticket_history_ticket_id = $ticket_id");
}
/*
* Records an invoice / quote / recurring invoice history entry - the change
* trail shown in the History card on agent/invoice.php and agent/quote.php.
*
* Same convention as logAudit() and logTicketHistory() above: the description
* is interpolated as-is, so callers pass values that are already SQL-safe.
*
* Pass the id of the document the entry belongs to and leave the other two at
* zero - the history table serves all three from one set of rows and each
* detail page filters on its own column.
*/
function logHistory($status, $description, $invoice_id = 0, $quote_id = 0, $recurring_invoice_id = 0) {
global $mysqli;
$invoice_id = intval($invoice_id);
$quote_id = intval($quote_id);
$recurring_invoice_id = intval($recurring_invoice_id);
$status = substr($status, 0, 200);
// history_description is text as of db 2.7.7, so this cap is about keeping
// the trail readable rather than avoiding an overflow
$description = substr($description, 0, 1000);
// Both arrive already escaped, and cutting at a fixed length can split a \'
// pair - the leftover backslash would escape this query's closing quote
if ((strlen($status) - strlen(rtrim($status, '\\'))) % 2 === 1) {
$status = substr($status, 0, -1);
}
if ((strlen($description) - strlen(rtrim($description, '\\'))) % 2 === 1) {
$description = substr($description, 0, -1);
}
mysqli_query($mysqli, "INSERT INTO history SET history_status = '$status', history_description = '$description', history_invoice_id = $invoice_id, history_quote_id = $quote_id, history_recurring_invoice_id = $recurring_invoice_id");
}
function logApp($category, $type, $details) {
global $mysqli;