diff --git a/admin/database_updates/2.7.7.php b/admin/database_updates/2.7.7.php new file mode 100644 index 000000000..f911d60af --- /dev/null +++ b/admin/database_updates/2.7.7.php @@ -0,0 +1,20 @@ +"), but the send-email + // and mark-sent flows now record who the document actually went to - a + // "Name " pair per recipient - and the mark-sent note the agent + // types. Five billing contacts alone blows past 200 characters, and under + // strict mode an over-long value is an error, not a truncation, so the + // history row would be lost and the send would 500. + // + // text rather than a bigger varchar: there is no index on this column and + // no length worth defending, so a cap would only be a future bug. + mysqli_query($mysqli, "ALTER TABLE `history` MODIFY `history_description` text NOT NULL"); diff --git a/agent/invoice.php b/agent/invoice.php index 7d49ec282..74ee65681 100644 --- a/agent/invoice.php +++ b/agent/invoice.php @@ -106,6 +106,17 @@ if (isset($_GET['invoice_id'])) { } $company_logo = escapeHtml($row['company_logo']); + // Send Email used to be gated on the PRIMARY contact having an email, which + // hid the button on a client whose only emailable contact was a billing or + // secondary one. The modal can send to any of them, so gate on whether the + // client has anybody reachable at all. + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(contact_id) AS emailable_contacts FROM contacts + WHERE contact_client_id = $client_id + AND contact_archived_at IS NULL + AND contact_email IS NOT NULL + AND contact_email != ''")); + $emailable_contacts = intval($row['emailable_contacts']); + $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC"); $sql_payments = mysqli_query($mysqli, "SELECT account_name, payment_amount, payment_currency_code, payment_date, payment_id, @@ -234,13 +245,15 @@ if (isset($_GET['invoice_id'])) { Send
- - + 0) { ?> + Send Email
- + Mark Sent
@@ -300,8 +313,9 @@ if (isset($_GET['invoice_id'])) { Packing Slip - - + 0) { ?> + Send Email @@ -614,7 +628,7 @@ if (isset($_GET['invoice_id'])) { while ($row = mysqli_fetch_assoc($sql_history)) { $history_created_at = $row['history_created_at']; $history_status = escapeHtml($row['history_status']); - $history_description = escapeHtml($row['history_description']); + $history_description = nl2br(escapeHtml($row['history_description'])); ?> diff --git a/agent/invoices.php b/agent/invoices.php index a38c77d33..e98bb1a3f 100644 --- a/agent/invoices.php +++ b/agent/invoices.php @@ -434,13 +434,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + Send Email
- + Mark Sent
diff --git a/agent/modals/invoice/invoice_email.php b/agent/modals/invoice/invoice_email.php new file mode 100644 index 000000000..b7b908495 --- /dev/null +++ b/agent/modals/invoice/invoice_email.php @@ -0,0 +1,131 @@ + + +
+
+ Email Invoice +
+ +
+
+ + + +
+ + + +

+ This client has no contacts with an email address, so there is nobody to send to. + Add a contact with an email address, or use Mark Sent to record that the invoice + went out some other way. +

+ + + + + +
+ + + + + + + +
+ + +

+ This invoice is + , so sending it will not change its status. +

+ + + + +
+
+ 0) { ?> + + + +
+
+ + + +
+
+ Mark Invoice Sent +
+ +
+
+ + + +
+ +
+ +
+ + +
+
+ +
+ + +
+ +
+
+ + +
+
+ + + +
+
+ Email Quote +
+ +
+
+ + + +
+ + + +

+ This client has no contacts with an email address, so there is nobody to send to. + Add a contact with an email address, or use Mark Sent to record that the quote + went out some other way. +

+ + + + + +
+ + + + + + + +
+ + +

+ This quote is + , so sending it will not change its status. +

+ + + + +
+
+ 0) { ?> + + + +
+
+ + + +
+
+ Mark Quote Sent +
+ +
+
+ + + +
+ +
+ +
+ + +
+
+ +
+ + +
+ +
+
+ + +
+
+ +
Please click on the link below to see your invoice regarding \"$invoice_scope\" marked paid.

Invoice Link


--
$company_name - Billing
$config_invoice_from_email
$company_phone"; } else { $subject = "Invoice $invoice_prefix$invoice_number"; - $body = "Hello $contact_name,

Please view the details of your invoice regarding \"$invoice_scope\" below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "
Balance Due: " . numfmt_format_currency($currency_format, $balance, $invoice_currency_code) . "
Due Date: $invoice_due


To view your invoice, please click here.


--
$company_name - Billing
$config_invoice_from_email
$company_phone"; } - // Queue Mail - $data[] = [ - 'from' => $config_invoice_from_email, - 'from_name' => $config_invoice_from_name, - 'recipient' => $contact_email, - 'recipient_name' => $contact_name, - 'subject' => $subject, - 'body' => $body - ]; + // One queue row per selected contact, each greeting its own recipient. + // The old handler built a single body around the primary contact's name + // and reused it for the billing copies, so those read "Hello " - visible enough with one hidden copy, wrong enough to keep once + // the recipient list is something the agent picks. + $data = []; + $recipient_labels = []; + + while ($recipient = mysqli_fetch_assoc($sql_recipients)) { + $contact_name = escapeSql($recipient['contact_name']); + $contact_email = escapeSql($recipient['contact_email']); + + if ($invoice_status == 'Paid') { + $body = "Hello $contact_name,

Please click on the link below to see your invoice regarding \"$invoice_scope\" marked paid.

Invoice Link


--
$company_name - Billing
$config_invoice_from_email
$company_phone"; + } else { + $body = "Hello $contact_name,

Please view the details of your invoice regarding \"$invoice_scope\" below.

Invoice: $invoice_prefix$invoice_number
Issue Date: $invoice_date
Total: " . numfmt_format_currency($currency_format, $invoice_amount, $invoice_currency_code) . "
Balance Due: " . numfmt_format_currency($currency_format, $balance, $invoice_currency_code) . "
Due Date: $invoice_due


To view your invoice, please click here.


--
$company_name - Billing
$config_invoice_from_email
$company_phone"; + } + + $data[] = [ + 'from' => $config_invoice_from_email, + 'from_name' => $config_invoice_from_name, + 'recipient' => $contact_email, + 'recipient_name' => $contact_name, + 'subject' => $subject, + 'body' => $body + ]; + + $recipient_labels[] = "$contact_name <$contact_email>"; + + logAudit("Invoice", "Email", "$session_name emailed $contact_email Invoice $invoice_prefix$invoice_number", $client_id, $invoice_id); + } addToMailQueue($data); - // Get Email ID for reference - $email_id = mysqli_insert_id($mysqli); + $recipient_list = implode(', ', $recipient_labels); + $recipient_count = count($recipient_labels); - flashAlert("Invoice sent!"); - - mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Invoice sent by $session_name (mail queue ID: $email_id)', history_invoice_id = $invoice_id"); + logHistory('Sent', "Invoice emailed by $session_name to $recipient_list", $invoice_id); // Don't change the status to sent if the status is anything but draft if ($invoice_status == 'Draft') { mysqli_query($mysqli,"UPDATE invoices SET invoice_status = 'Sent' WHERE invoice_id = $invoice_id"); } - logAudit("Invoice", "Email", "$session_name Emailed $contact_email Invoice $invoice_prefix$invoice_number Email queued to Email ID: $email_id", $client_id, $invoice_id); - - // Send copies of the invoice to any additional billing contacts - $sql_billing_contacts = mysqli_query( - $mysqli, - "SELECT contact_name, contact_email FROM contacts - WHERE contact_billing = 1 - AND contact_email != '$contact_email' - AND contact_email != '' - AND contact_client_id = $client_id" - ); - - $data = []; - - while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) { - $billing_contact_name = escapeSql($billing_contact['contact_name']); - $billing_contact_email = escapeSql($billing_contact['contact_email']); - - $data[] = [ - 'from' => $config_invoice_from_email, - 'from_name' => $config_invoice_from_name, - 'recipient' => $billing_contact_email, - 'recipient_name' => $billing_contact_name, - 'subject' => $subject, - 'body' => $body - ]; - - logAudit("Invoice", "Email", "$session_name Emailed $billing_contact_email Invoice $invoice_prefix$invoice_number Email queued Email ID: $email_id", $client_id, $invoice_id); - - } - - addToMailQueue($data); + flashAlert("Invoice queued to $recipient_count " . ($recipient_count == 1 ? "recipient" : "recipients")); redirect(); diff --git a/agent/post/quote.php b/agent/post/quote.php index fd08febdf..16c7f46e9 100644 --- a/agent/post/quote.php +++ b/agent/post/quote.php @@ -463,13 +463,13 @@ if (isset($_GET['delete_quote_item'])) { } -if (isset($_GET['mark_quote_sent'])) { +if (isset($_POST['mark_quote_sent'])) { validateCSRFToken(); enforceUserPermission('module_sales', 2); - $quote_id = intval($_GET['mark_quote_sent']); + $quote_id = intval($_POST['quote_id']); $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); @@ -479,11 +479,26 @@ if (isset($_GET['mark_quote_sent'])) { enforceClientAccess(); + // The modal offers a fixed list, so anything else is a tampered form + $sent_method = $_POST['sent_method'] ?? ''; + if (!in_array($sent_method, getSentMethods(), true)) { + flashAlert("Invalid delivery method", 'error'); + redirect(); + } + $sent_method = escapeSql($sent_method); + + $note = escapeSql(substr(trim($_POST['note'] ?? ''), 0, 500)); + mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Sent' WHERE quote_id = $quote_id"); - mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Quote marked sent', history_quote_id = $quote_id"); + $history_description = "Quote marked sent by $session_name - $sent_method"; + if (!empty($note)) { + $history_description .= "\nNote: $note"; + } - logAudit("Quote", "Sent", "$session_name marked quote $quote_prefix$quote_number as sent", $client_id, $quote_id); + logHistory('Sent', $history_description, 0, $quote_id); + + logAudit("Quote", "Sent", "$session_name marked quote $quote_prefix$quote_number as sent - $sent_method", $client_id, $quote_id); flashAlert("Quote marked sent"); @@ -551,19 +566,18 @@ if (isset($_GET['decline_quote'])) { } -if (isset($_GET['email_quote'])) { +if (isset($_POST['email_quote'])) { validateCSRFToken(); enforceUserPermission('module_sales', 2); - $quote_id = intval($_GET['email_quote']); + $quote_id = intval($_POST['quote_id']); - $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, quote_amount, quote_currency_code, + $sql = mysqli_query($mysqli,"SELECT client_id, client_name, quote_amount, quote_currency_code, quote_date, quote_expire, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes LEFT JOIN clients ON quote_client_id = client_id - LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 WHERE quote_id = $quote_id" ); @@ -579,11 +593,41 @@ if (isset($_GET['email_quote'])) { $quote_currency_code = escapeSql($row['quote_currency_code']); $client_id = intval($row['client_id']); $client_name = escapeSql($row['client_name']); - $contact_name = escapeSql($row['contact_name']); - $contact_email = escapeSql($row['contact_email']); enforceClientAccess(); + // Recipients come from the Send Email modal's contact picker. Scoping the + // lookup to this quote's client is what makes a tampered contact_id + // harmless - it simply matches nothing. + $selected_contacts = $_POST['contacts'] ?? []; + if (!is_array($selected_contacts)) { + $selected_contacts = []; + } + $selected_contact_ids = array_filter(array_unique(array_map('intval', $selected_contacts))); + + if (empty($selected_contact_ids)) { + flashAlert("Select at least one contact to send to", 'error'); + redirect(); + } + + $selected_contact_id_list = implode(',', $selected_contact_ids); + + $sql_recipients = mysqli_query( + $mysqli, + "SELECT contact_email, contact_name FROM contacts + WHERE contact_id IN ($selected_contact_id_list) + AND contact_client_id = $client_id + AND contact_archived_at IS NULL + AND contact_email IS NOT NULL + AND contact_email != '' + ORDER BY contact_primary DESC, contact_billing DESC, contact_name ASC" + ); + + if (mysqli_num_rows($sql_recipients) == 0) { + flashAlert("None of the selected contacts have a usable email address", 'error'); + redirect(); + } + $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name, company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); @@ -605,33 +649,46 @@ if (isset($_GET['email_quote'])) { $config_base_url = escapeSql($config_base_url); $subject = "Quote [$quote_scope]"; - $body = "Hello $contact_name,

Thank you for your inquiry, we are pleased to provide you with the following estimate.


$quote_scope
Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "


View and accept your estimate online here


--
$company_name - Sales
$config_quote_from_email
$company_phone"; - // Queue Mail - $data = [ - [ + // One queue row per selected contact, each greeting its own recipient + $data = []; + $recipient_labels = []; + + while ($recipient = mysqli_fetch_assoc($sql_recipients)) { + $contact_name = escapeSql($recipient['contact_name']); + $contact_email = escapeSql($recipient['contact_email']); + + $body = "Hello $contact_name,

Thank you for your inquiry, we are pleased to provide you with the following estimate.


$quote_scope
Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "


View and accept your estimate online here


--
$company_name - Sales
$config_quote_from_email
$company_phone"; + + $data[] = [ 'from' => $config_quote_from_email, 'from_name' => $config_quote_from_name, 'recipient' => $contact_email, 'recipient_name' => $contact_name, 'subject' => $subject, 'body' => $body, - ] - ]; + ]; + + $recipient_labels[] = "$contact_name <$contact_email>"; + + logAudit("Quote", "Email", "$session_name emailed quote $quote_prefix$quote_number to $contact_email", $client_id, $quote_id); + } + addToMailQueue($data); + $recipient_list = implode(', ', $recipient_labels); + $recipient_count = count($recipient_labels); + // Update History - mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Sent', history_description = 'Emailed Quote', history_quote_id = $quote_id"); - - logAudit("Quote", "Email", "$session_name emailed quote $quote_prefix$quote_number to $contact_email", $client_id, $quote_id); - - flashAlert("Quote sent!"); + logHistory('Sent', "Quote emailed by $session_name to $recipient_list", 0, $quote_id); //Don't change the status to sent if the status is anything but draft if ($quote_status == 'Draft') { mysqli_query($mysqli,"UPDATE quotes SET quote_status = 'Sent' WHERE quote_id = $quote_id"); } + flashAlert("Quote queued to $recipient_count " . ($recipient_count == 1 ? "recipient" : "recipients")); + redirect(); } diff --git a/agent/quote.php b/agent/quote.php index 19193ba24..48b70952b 100644 --- a/agent/quote.php +++ b/agent/quote.php @@ -99,6 +99,17 @@ if (isset($_GET['quote_id'])) { $company_website = escapeHtml($row['company_website']); $company_logo = escapeHtml($row['company_logo']); + // Send Email used to be gated on the PRIMARY contact having an email, which + // hid the button on a client whose only emailable contact was a billing or + // secondary one. The modal can send to any of them, so gate on whether the + // client has anybody reachable at all. + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(contact_id) AS emailable_contacts FROM contacts + WHERE contact_client_id = $client_id + AND contact_archived_at IS NULL + AND contact_email IS NOT NULL + AND contact_email != ''")); + $emailable_contacts = intval($row['emailable_contacts']); + $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC"); //Set Badge color based off of quote status @@ -156,13 +167,15 @@ if (isset($_GET['quote_id'])) { Send
- - + 0) { ?> + Send Email
- + Mark Sent
@@ -219,8 +232,9 @@ if (isset($_GET['quote_id'])) { Download PDF - - + 0) { ?> + Send Email @@ -565,7 +579,7 @@ if (isset($_GET['quote_id'])) { while ($row = mysqli_fetch_assoc($sql_history)) { $history_created_at = escapeHtml($row['history_created_at']); $history_status = escapeHtml($row['history_status']); - $history_description = escapeHtml($row['history_description']); + $history_description = nl2br(escapeHtml($row['history_description'])); ?> diff --git a/agent/quotes.php b/agent/quotes.php index 2305a0b1e..32efcfa9e 100644 --- a/agent/quotes.php +++ b/agent/quotes.php @@ -224,7 +224,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + Email diff --git a/db.sql b/db.sql index 7ab20499e..98160faac 100644 --- a/db.sql +++ b/db.sql @@ -1369,7 +1369,7 @@ DROP TABLE IF EXISTS `history`; CREATE TABLE `history` ( `history_id` int(11) NOT NULL AUTO_INCREMENT, `history_status` varchar(200) NOT NULL, - `history_description` varchar(200) NOT NULL, + `history_description` text NOT NULL, `history_created_at` datetime NOT NULL DEFAULT current_timestamp(), `history_invoice_id` int(11) NOT NULL DEFAULT 0, `history_recurring_invoice_id` int(11) NOT NULL DEFAULT 0, @@ -3247,4 +3247,4 @@ CREATE TABLE `vendors` ( /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2026-08-28 0:13:03 +-- Dump completed on 2026-08-28 13:31:14 diff --git a/functions/app.php b/functions/app.php index 884ed6676..9362cd4cb 100644 --- a/functions/app.php +++ b/functions/app.php @@ -785,3 +785,24 @@ function createiCalStrCancel($datetime, $title, $uid) { return $cal_event->export(); } + +/* + * The delivery methods offered by the Mark Sent modal on invoices and quotes. + * + * Marking a document sent records that it left the building by some route + * other than ITFlow's own mailer, so the list is about how it got there. It is + * deliberately a fixed list rather than a categories row: the post handler + * validates the submitted value against it, and "Other" plus the free-text + * note covers anything not listed. + */ +function getSentMethods() { + return [ + 'Sent by Snail Mail', + 'Sent by Email Client', + 'Hand Delivered', + 'Sent by Fax', + 'Sent by Courier', + 'Shared Guest Link', + 'Other' + ]; +} diff --git a/functions/logging.php b/functions/logging.php index 21424deff..f14138e1e 100644 --- a/functions/logging.php +++ b/functions/logging.php @@ -95,6 +95,42 @@ function logTicketHistory($ticket_id, $description) { mysqli_query($mysqli, "INSERT INTO ticket_history SET ticket_history_status = '$status_name', ticket_history_description = '$description', ticket_history_ticket_id = $ticket_id"); } +/* + * Records an invoice / quote / recurring invoice history entry - the change + * trail shown in the History card on agent/invoice.php and agent/quote.php. + * + * Same convention as logAudit() and logTicketHistory() above: the description + * is interpolated as-is, so callers pass values that are already SQL-safe. + * + * Pass the id of the document the entry belongs to and leave the other two at + * zero - the history table serves all three from one set of rows and each + * detail page filters on its own column. + */ +function logHistory($status, $description, $invoice_id = 0, $quote_id = 0, $recurring_invoice_id = 0) { + global $mysqli; + + $invoice_id = intval($invoice_id); + $quote_id = intval($quote_id); + $recurring_invoice_id = intval($recurring_invoice_id); + + $status = substr($status, 0, 200); + + // history_description is text as of db 2.7.7, so this cap is about keeping + // the trail readable rather than avoiding an overflow + $description = substr($description, 0, 1000); + + // Both arrive already escaped, and cutting at a fixed length can split a \' + // pair - the leftover backslash would escape this query's closing quote + if ((strlen($status) - strlen(rtrim($status, '\\'))) % 2 === 1) { + $status = substr($status, 0, -1); + } + if ((strlen($description) - strlen(rtrim($description, '\\'))) % 2 === 1) { + $description = substr($description, 0, -1); + } + + mysqli_query($mysqli, "INSERT INTO history SET history_status = '$status', history_description = '$description', history_invoice_id = $invoice_id, history_quote_id = $quote_id, history_recurring_invoice_id = $recurring_invoice_id"); +} + function logApp($category, $type, $details) { global $mysqli;