diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 00000000..5ab9f3b4 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,32 @@ +--- +name: Bug report +about: Something not working quite right? Create a report to help us improve! +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**Can you reproduce this on the demo at demo.itflow.org** +Yes/No/NA + +**Are you on the latest available version of ITFlow, with an up-to-date database structure?** +Yes/No + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen, if not obvious. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 00000000..d45e9b7b --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,12 @@ +--- +name: Feature request +about: Please discuss new features on the Forum @ https://forum.itflow.org/t/features +title: '' +labels: Support +assignees: '' + +--- + +Please discuss feature requests on the forum @ https://forum.itflow.org/t/features - Thanks :) + +New feature requests here will be closed. diff --git a/.github/ISSUE_TEMPLATE/support.md b/.github/ISSUE_TEMPLATE/support.md new file mode 100644 index 00000000..101c4fdf --- /dev/null +++ b/.github/ISSUE_TEMPLATE/support.md @@ -0,0 +1,18 @@ +--- +name: Support +about: Please visit the Forum or Discord for support +title: '' +labels: Support +assignees: '' + +--- + +Please visit the Forum or Discord for support + +Forum - https://forum.itflow.org/ + +Discord - https://discord.gg/ZjCcBzTUDr + +-- + +To discuss a security issue, please see: https://i.imgur.com/P03o0Sy.png diff --git a/README.md b/README.md index bba10639..a3a3c3da 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ Username: demo@demo | Password: demo

- Docs + Docs · Forum · diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..2ea30098 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +## In Beta + +ITFlow is currently in early beta and is a work in progress. +We currently advise against storing confidential data in ITFlow for this reason. + +That said, in order to eventually be useful, ITFlow **must** be secure and take security seriously. +We attempt to follow best security practices where possible, including [automated code scanning](https://sonarcloud.io/component_measures?id=itflow-org_itflow&metric=security_rating&view=list). + +## Supported Versions + +ITFlow is in Beta. + +| Version | Supported | +| ------- | ------------------ | +| Beta | :white_check_mark: | + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues.** + +If you have discovered a security issue, please report it to us in as much detail as possible so we can fix it. +You should expect to receive an initial acknowledgement within 72 hours. If you do not, please get in touch discretely via GitHub issues/Forum/Discord to ensure we received your e-mail. + +Security contact: +![image](https://user-images.githubusercontent.com/32306651/160704188-763e6763-429e-41b9-9007-6a09bcfdba2b.png) diff --git a/portal/index.php b/portal/index.php index e38f42ff..9f2a3638 100644 --- a/portal/index.php +++ b/portal/index.php @@ -89,7 +89,7 @@ $total_tickets = $row['total_tickets']; "; - echo " $ticket[ticket_number]"; + echo " $ticket[ticket_prefix]$ticket[ticket_number]"; echo " $ticket[ticket_subject]"; echo "$ticket[ticket_status]"; echo ""; diff --git a/portal/ticket.php b/portal/ticket.php index 89d04fea..13bcfa56 100644 --- a/portal/ticket.php +++ b/portal/ticket.php @@ -23,34 +23,16 @@ if(isset($_GET['id']) && intval($_GET['id'])) { - - - - - -
@@ -66,9 +48,6 @@ if(isset($_GET['id']) && intval($_GET['id'])) {
- - - @@ -170,7 +149,6 @@ if(isset($_GET['id']) && intval($_GET['id'])) { ?> - + # Subject Contact Status @@ -56,6 +57,7 @@ $all_tickets = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN contacts O "; + echo " $ticket[ticket_prefix]$ticket[ticket_id]"; echo " $ticket[ticket_subject]"; echo "$ticket[contact_name]"; echo "$ticket[ticket_status]"; diff --git a/post.php b/post.php index 6a3347c9..9f9f7267 100644 --- a/post.php +++ b/post.php @@ -148,6 +148,7 @@ if(isset($_POST['edit_user'])){ $role = intval($_POST['role']); $existing_file_name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name']))); $extended_log_description = ''; + $two_fa = $_POST['2fa']; if(!file_exists("uploads/users/$user_id/")) { mkdir("uploads/users/$user_id"); @@ -211,6 +212,11 @@ if(isset($_POST['edit_user'])){ $extended_log_description .= ", password changed"; } + if(!empty($two_fa) && $two_fa == 'disable'){ + mysqli_query($mysqli, "UPDATE users SET user_token = '' WHERE user_id = '$user_id'"); + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'User', log_action = 'Modify', log_description = '$session_name disabled 2FA for $name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_created_at = NOW(), log_user_id = $session_user_id, company_id = $session_company_id"); + } + //Update User Settings mysqli_query($mysqli,"UPDATE user_settings SET user_role = $role, user_default_company = $default_company WHERE user_id = $user_id"); diff --git a/settings-user.php b/settings-user.php index 809a8a82..33869c51 100644 --- a/settings-user.php +++ b/settings-user.php @@ -86,12 +86,18 @@ $sql_recent_logs = mysqli_query($mysqli,"SELECT * FROM logs +
+ +

2-Factor Authentication

+
- +

You have not setup 2FA, click on enable to setup 2FA.

+ - +

You have setup 2FA. Your QR code is below.

+
@@ -124,7 +130,7 @@ $sql_recent_logs = mysqli_query($mysqli,"SELECT * FROM logs
- +
diff --git a/user_edit_modal.php b/user_edit_modal.php index a15df457..c158b4fd 100644 --- a/user_edit_modal.php +++ b/user_edit_modal.php @@ -99,6 +99,23 @@ + + + +
+ +
+
+ +
+ +
+
+ +
diff --git a/users.php b/users.php index 9af2c4cc..f493e73e 100644 --- a/users.php +++ b/users.php @@ -85,6 +85,7 @@ $user_name = $row['user_name']; $user_email = $row['user_email']; $user_avatar = $row['user_avatar']; + $user_token = $row['user_token']; $user_default_company = $row['user_default_company']; $user_role = $row['user_role']; if($user_role == 3){