diff --git a/CHANGELOG.md b/CHANGELOG.md index f8d3a6215..7363703b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,9 +6,9 @@ This file documents all notable changes made to ITFlow. ### Upgrading to 26.11 -Update from Maintenance > Update — Queue Update hands the job to cron, which updates the files and applies this release's database changes (2.7.9 to 3.3.2) in the same pass. Nothing else is required. +Update from Maintenance > Update — Queue Update hands the job to cron, which updates the files and applies this release's database changes (2.7.9 to 3.3.4) in the same pass. Nothing else is required. -This is a big release, with fifty-three database steps in one go, so take a backup before you update. +This is a big release, with fifty-five database steps in one go, so take a backup before you update. The update also clears out data that deletes in older versions left behind, all of it pointing at something that no longer exists: @@ -51,6 +51,10 @@ Document templates keep their names, summaries, what they say and their images. License templates keep everything they hold. A license called exactly what one license template is called - as the New License form named it when started from one - counts as made from that template, so a template's use starts out counted; where two templates share a name, neither is given its licenses. Other licenses don't know a template, so they count from the update. No template sets seats, a renewal term, a vendor or a product until you give it one, and none is required of anyone until you set it up on its page. Maintenance > Starter Content has a new License Templates pack to add. +Vendor templates keep everything they hold, and the vendors made from them stay linked to them. Who made each and last changed it is taken from the audit log, where it has a record of it. + +The app logs are kept for as many days as the audit log, as before, and each can now be set on its own in Admin > Settings > Logs, which is where the log retention went from Settings > Security. A retention of 0 now keeps a log forever (see Breaking Changes, Logs). Nothing is sent to a syslog server or SIEM until you set one up there. + If you are coming from 26.08 or earlier, the database update still has to be run from the command line one time, exactly as described under Upgrading to 26.09 below. ### Breaking Changes and Notes @@ -217,6 +221,7 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Admins are now told about a run of failed sign-ins - 10 in 10 minutes from one IP address or against one account - with a notification and an email each. Change or turn it off in Admin > Settings > Security. - A call to the API with a key that has expired now says which key, and is logged against it. Anything that reads the `logs` table for "Incorrect or expired key" needs the new wording. - The `auth_logs` table is removed. Nothing was ever written to it. +- Logs: log retention moved from Admin > Settings > Security to Admin > Settings > Logs, where the audit log (with API key use) and the app logs each keep their own number of days. A retention of 0 now keeps a log forever - it used to delete everything older than today each night. - Audit log: each thing done now has one name, in the entries already there as well as new ones. Unarchive and Restored are Restore, Deleted is Delete, and Closed, Resolved, Reopened, Merged and Sent are Close, Resolve, Reopen, Merge and Send. An agent turned away from a client they can't open is Denied, where it was Access. A saved card or payment provider deleted is Delete and a card saved is Create, where both were Update, and a contract template changed is Edit. A report or script that reads the `logs` table by the old names needs the new ones. ### New Features & Updates @@ -575,6 +580,13 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Starter Content has a License Templates pack: Microsoft 365 Business Basic, Standard and Premium, Exchange Online, Google Workspace, Bitdefender GravityZone, ESET PROTECT, Proofpoint Essentials, Bitwarden Teams, a FortiGate security bundle, Veeam Backup & Replication, Veeam Backup for Microsoft 365, Acronis Cyber Protect Cloud, Synology Active Backup, Adobe Acrobat Pro and Creative Cloud, QuickBooks Online, Zoom and Windows Server with its CALs. Each comes with its type, how it is licensed, how often it renews, notes on how it is licensed and assigned, and its vendor, and is sold as the product of the same name once the Products & Services pack is here. Who should have each is yours to set. Update brings the ones you added up to the current version. - The New License Template button's menu has Import, Export, the report and the starter ones. - Reports > License Templates: for each template, the licenses made from it in the period against the period before, its current licenses and clients, their seats in use against bought - over and spare - the ones renewing in the next 30 days or expired, how many of the clients that should have one do and, for anyone who can see Sales, how many are billed and what that comes to a month. By client too: the licenses each should have, the ones missing, licenses over seats, renewals and the ones not billed. One client can be picked, and each can be exported. +- **Vendor templates** (rebuilt) + - Admin > Vendor Templates lists what each is, its support line, hours and SLA, its support site and email, how many clients have a vendor made from it - and whether it is one of your own - when one was last added and when it last changed, and by whom. Searched by name, what they are, support line, email, site, hours, SLA, account manager or notes, sorted from the column headings, a page at a time, with Active and Archived tabs. + - A template's page shows what a vendor made from it starts with, its support line a click to call, the clients with a vendor from it - each with its own account number, or marked when it has none yet - a click from their vendor, the license templates that take their vendor from it, who made it and last changed it, and its history. Add to clients is on the page and the list. + - The template window has the vendor window's tabs - Details, Support, Account and Notes - with their icons. Editing, any of its fields can be changed on the vendors made from it too, ticked one by one; what the window says replaces what each one had, and each vendor's history says so. The audit log says what changed on the template. + - Templates can be copied, archived - not offered on New Vendor or Add to Clients, while the vendors made from them stay - restored and deleted. Deleted, its vendors and the license templates that used it stay, no longer linked to it. + - Make a template from it, in the menu of a client's vendor for an admin, starts a template from that vendor - leaving its account number, PIN and account manager, which are the client's own - and links the vendor to it, so other clients can have the same one. + - A vendor made from a template links to it from its page, for an admin. - **Assets** - The asset list has: - type icons, colored status pills and OS icons @@ -937,7 +949,7 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Revoke ends a key today. Delete is for expired keys, as before, one at a time or several from the bulk menu. - The audit log says who a new key acts as and when it ends, and what an edit changed: "renamed from RMM, expiring 2027-06-01 (was 2026-12-01), acting as Tess Tech (was Johnny Test)". - **Audit logs** (rebuilt) - - Admin > Audit Logs lists who did what, when and from where, with views for Changes, Deletions, Sign-ins, Security (failed and blocked sign-ins, an agent turned away from a client, viewing the portal as a contact, and changes to users, roles, API keys, the master key, settings and backups) and Data out (passwords looked at, exports, downloads and shared links), each counted for the filters you have picked. + - Admin > Audit Logs lists who did what, when and from where, with views for Changes, Deletions, Sign-ins, Security (failed and blocked sign-ins, an agent turned away from a client, viewing the portal as a contact, app logs cleared, and changes to users, roles, API keys, the master key, settings and backups) and Data out (passwords looked at, exports, downloads and shared links), each counted for the filters you have picked. - Search finds an entry by what it says, who did it, the client, the IP address or the browser, and it can be narrowed by the date, who did it - an agent, a client contact in the portal, or ITFlow itself for cron, the API and the email parser - the client, the type and, under More filters, the action. It sorts from the column headings, a page at a time. - Each entry shows when, who with their picture, the client, the kind of record with the action as a coloured label, what it says, and the IP address with the system and browser in words. A script calling the API shows as itself, for example python-requests. - An entry about a record links to it while it is still there - a client, contact, location, vendor, asset, network, rack, credential, certificate, domain, license, service, document, file, shared link, ticket, project, quote, invoice, recurring invoice, product, expense, recurring expense, trip or template - and says No longer here once it has been deleted. A credential, certificate, domain, file, expense or trip opens on its list with its quick look open. @@ -954,6 +966,13 @@ If you are coming from 26.08 or earlier, the database update still has to be run - Admin > Sign-ins, under Access: People - each agent and portal contact with their last sign in, its IP address and device, how many sign-ins and failed ones (the wrong MFA codes among them), how many IP addresses and, for a date range, how many of them were new - and IP addresses - each address with its sign-ins and failures, the accounts it tried and any emails with no account, when it was first and last seen, and whether it is being turned away now. Searched by name, email or address, for a date range, sorted from the column headings, a page at a time; each opens its sign-ins in the audit log. - Failed sign-in alerts: after a number of failed sign-ins in 10 minutes from one IP address or against one account - 10 to start with, or 5, 20, 50 or never, in Admin > Settings > Security - each admin gets a notification and an email saying who was tried and from where, with a link to look. A run is told about once. The same goes for API calls turned away from one address. Each alert is in the audit log's Security view. - Admin > API Keys counts each key's calls over the last 30 days and shows where the last one came from. Usage, on a key's menu or its count, shows its calls today, this week and this month, each day's as a bar, the endpoints it called and how often, the IP addresses the calls came from, and the calls turned away after it expired. Use is kept as long as the audit log. + - Admin > App Logs is rebuilt: what ITFlow itself does - cron runs, mail, payment providers, the API - by level, Errors, Warnings and Info (and Debug once there is any), each counted for the filters you have picked, with each entry's level as a coloured label and its category with an icon. Search finds an entry by its category or what it says, and it can be narrowed by category - each with how many entries it has - and by date. It sorts from the column headings, a page at a time. + - Each app log entry opens a quick look with all of it, to copy into a bug report, the other app log entries in the five minutes either side, and what was done in the audit log then - so a payment provider's error sits beside the payment. + - The app logs can be exported as a CSV or PDF, with the columns you choose, and cleared - the entries shown, with the search, level, category and dates you picked, or every one. Clearing is in the audit log, in its Security view, saying what went. The audit log itself can't be cleared. + - Admin > Settings > Logs, after Security: how many days the audit log, with API key use, and the app logs are each kept, or Keep forever, with how many entries each holds and when the oldest is from. + - Sending logs on: each audit log entry, and the app log entries from a level up (errors, warnings and errors - to start with - info and up, or everything), can go to a syslog server or SIEM as it is written - Graylog, Splunk, Wazuh, Microsoft Sentinel, QRadar and the like. Over UDP, TCP or TLS (with the server's certificate checked, or not for one on your own network), as JSON, CEF or plain text, as standard syslog messages. Save and send a test sends a test message and says whether it got there - over UDP, whether nothing was listening. A server that can't be reached doesn't slow ITFlow down: the failure goes in the app logs under Log Forwarding, nothing is sent for a minute, and the settings page shows it with a link to it. What an entry looks like in each format is shown from the latest one. + - Reports > Audit Activity, under Activity: what was done in ITFlow in a period - changes, deletions, passwords looked at, exports and, for an admin, sign-ins and the ones that failed - against the period before, over time, and by the hour of the week, with how much was done out of the business hours set for SLAs. Then by person (people since deleted together, and ITFlow itself last), by client and by kind of record, each linking to those entries in the audit log, and for an admin the security events. One client or one agent can be picked, and each table exported. Anyone else sees only the kinds of entry their role covers, for the clients they can open. + - Admin > Audit Logs' Export has a menu with the Activity report, the log settings and the App Logs. - **Emails** (rebuilt) - Ticket emails to clients now look like the billing emails: your logo or name, a coloured heading saying what it is, the ticket's number, subject, status and priority in a box, the reply or the details quoted as they were written with who wrote them, a button to open the ticket, and your details at the foot. This covers a ticket opened by an agent, on a schedule or from an email, a reply, resolved, closed, being made a watcher, replying to a closed ticket, a reply through the API and a task needing their approval. - Each says under it why they get it - the contact on the ticket, watching it, or asking for every update on their company's tickets - in place of the YOU ARE A COLLABORATOR block. @@ -1094,6 +1113,9 @@ If you are coming from 26.08 or earlier, the database update still has to be run - All Client Docs listed Credentials to agents who can't open it. - Notifications: shared-link notifications reached agents without Support, with a link they couldn't open. - License templates: the type picker showed a stray "<" at the top. +- Vendor templates: Delete was only offered to the built-in Administrator role, not to other admin roles. +- App Logs: the category filter did nothing - it read a misspelt field - and the date filter was slow on a large log. +- App logs: an entry over 1,000 characters with an accented letter or a symbol where it was cut could fail to save, stopping what was logging it. - Admin > Settings > Defaults: Payment Method and Expense Payment Method listed the payment method categories that moved to Admin > Payment Methods in 2.3.1, so a new install had nothing to pick. They list Admin > Payment Methods now. - Messages, hints and window titles were reworded where they were unclear, and bulk windows say "1 asset" or "3 assets" correctly. @@ -1615,6 +1637,19 @@ If you are coming from 26.08 or earlier, the database update still has to be run - `auditLogWho()` marks a failed sign in Their account; Security also takes Login Alert and API Failed; Alert is a danger action. Admin > Audit Logs, the client's Audit Log, Your account > Activity and the quick look badge `signInNewIpIds()`. - New `admin/sign_ins.php` (`view` - '' People or `ips` - `q`, the date filter, `sort` - People `user_name`, `sign_ins`, `failures`, `ips` or `last_seen`, IP addresses `log_ip`, `sign_ins`, `failures`, `accounts`, `first_seen` or `last_seen` - `order`, `page`), in the admin nav under Access. Settings > Security takes `config_login_alert_failures` (one of `signInAlertOptions()`, else 10). - API keys, in `functions/api_keys.php`: `apiKeyUsageEndpoint($uri)`, `apiKeyUsageRecord($id, $endpoint, $ip)` (an upsert per call; nothing before the update), `apiKeyUsageSummary($ids, $days)` (`calls`, `endpoints`, `last_at`, `last_ip`), `apiKeyUsageDaily()`, `apiKeyUsageEndpoints()`, `apiKeyUsageIps()`, `apiKeyTurnedAway()` and `apiKeyWatch()`. `api/v1/validate_api_key.php` records each call, and logs a call turned away as "Expired API key NAME used - it ended DATE" with `log_entity_id` the key, or "Unknown API key used". New `admin/modals/api/api_key_usage.php` (`id`); deleting a key deletes its use. + - Database 3.3.3: `settings.config_app_log_retention` (int, 90; copied from `config_log_retention` when it is added), `config_log_forward_enabled` (0), `config_log_forward_host` (varchar 200, NULL), `config_log_forward_port` (514), `config_log_forward_protocol` (`udp`, `tcp` or `tls`), `config_log_forward_format` (`json`, `cef` or `plain`), `config_log_forward_audit` (1), `config_log_forward_app_level` (`warning`; `error`, `info`, `debug` or '' for none) and `config_log_forward_tls_verify` (1), each added only when missing; an `app_log_created_at` key on `app_logs`. Nightly deletes `logs` and `api_key_usage` older than `config_log_retention` days and `app_logs` older than `config_app_log_retention`, each only when it is above 0. Settings > Security no longer takes `config_log_retention`, and nightly no longer reads it with the other settings. + - `logApp()` takes plain text, as before, and now checks the level: lowercased, `critical`, `fatal`, `alert` and `emergency` to `error`, `warn` to `warning`, anything else `info`, as the column takes only `info`, `warning`, `error` and `debug`. The category and details are cut by character (`mb_substr()`). + - New `functions/app_log.php`: `appLogLevels()` (`label`, `one`, `icon`, `tone`, `title`), `appLogLevel()`, `appLogLevelPill()`, `appLogCategoryIcon()` (by name, or the part before a dash), `appLogViews()`, `appLogFiltersSql($src, &$summary)` (`q`, `category`, `view` - a level - `dtf`, `dtt`; a half-open range on `app_log_created_at`), `appLogFiltersText($summary)`, `appLogDate()`, `appLogCategories()` (name => count), `appLogRetention()` (`audit`, `app`; read apart from the page settings, falling back before the update), `appLogRetentionText()` and `appLogSize($table)` (`count`, `oldest`). + - Admin: `admin/app_logs.php` is rebuilt (`q`, `category`, `view` - `error`, `warning`, `info` or `debug` - the date filter, `sort` - `app_log_created_at`, `app_log_type` (worst first), `app_log_category` or `app_log_id` - `order`, `page` and `open`, an entry's id to open its quick look). New `admin/modals/app_log/app_log.php` (`id`), `app_log_export.php` and `app_log_clear.php`, sharing `app_log_filters.php`, and `admin/post/app_log.php` with `export_app_logs` (the same filters, `columns[]` from the new `app_logs` export columns) and `clear_app_logs` (`scope` - `shown`, with the filters, or `all`), audited as App Log Export and Delete. `auditLogKinds()` has App Log, the Security view takes App Log Delete, and Stripe's icon is one the free icons have. + - Forwarding, in the new `functions/log_forward.php`: `LOG_FORWARD_PROTOCOLS`, `LOG_FORWARD_FORMATS`, `LOG_FORWARD_TIMEOUT` (2 seconds), `LOG_FORWARD_BACKOFF` (60), `LOG_FORWARD_BATCH` (50), `LOG_FORWARD_FACILITY` (16, local0) and `LOG_FORWARD_CATEGORY` (Log Forwarding); `logForwardSettings($fresh)` (read apart from the page settings - off before the update), `logForwardTidy()`, `logForwardOn()`, `logForwardTarget()`, `logForwardAppLevels()` and `logForwardAppLevelSent()`. `logAudit()` and `logApp()` call `logForwardQueue($log, $id, $level, $category)` with the new row's id, as do the three places that insert into `logs` themselves (`api/v1/validate_api_key.php`, `client/login_reset.php` and `guest/guest_pay_invoice_stripe.php`) - nothing during an email preview, or for Log Forwarding's own entries. `logForwardFlush()` runs on shutdown and at every 50 queued: it reads the entries back by id, so one written in a transaction that was rolled back isn't sent, and sends them in the order they happened over one connection for the request (`logForwardSend()`, `logForwardConnect()` - TLS 1.2 or later, the peer and its name checked unless `tls_verify` is off - and `logForwardWrite()`). TCP and TLS end each message with a newline (RFC 6587 non-transparent framing); UDP sends one datagram each. On a failure, `logForwardFailed()` writes an app log error under Log Forwarding, with the reason in words (`logForwardReason()`), and a file in the temp directory (`logForwardBackoffFile()`) stops sending for 60 seconds; the entries in between are not sent. + - Each message is RFC 5424 - `1 TIMESTAMP HOST itflow - MSGID - MSG`, the time with ITFlow's timezone offset, the host from `$config_base_url` (else the server's name), MSGID `audit`, `app` or `test`. Severity: an audit entry that failed, was turned away, denied or alerted on is warning (4), a deletion notice (5) and the rest info (6); an app log entry error 3, warning 4, info 6 and debug 7. As JSON, an audit entry has `log`, `id`, `time`, `type`, `action`, `description`, `severity`, `who` (agent, portal or system), `user_id`, `user`, `user_email`, `client_id`, `client`, `record_id`, `ip`, `user_agent` and `host`, and an app log entry `log`, `id`, `time`, `level`, `category`, `details` and `host`. As CEF: `CEF:0|ITFlow|ITFlow|version|type:action|type action|severity|` with `rt`, `externalId`, `cat`, `act`, `msg`, `suid`, `suser`, `src`, `requestClientApplication`, `cs1` (client), `cn1` (client id), `cn2` (record id), `cs2` (who) and `dvchost`, or for an app log entry `app:category` with `cat`, `msg` and `cs1` (level). `logForwardAuditMessage()`, `logForwardAppMessage()` and `logForwardTest($settings, $by)` (`ok`, `error`; over UDP a port that answers it is closed fails). + - New `admin/settings_logs.php`, in the Settings menu after Security, and `admin/post/settings_logs.php`: `edit_log_settings` and `test_log_forward` (saves, then sends a test) take `config_log_retention` and `config_app_log_retention` (1 to 36500), `audit_forever` and `app_forever` (0), and `config_log_forward_enabled`, `_host` (a name or address - one typed with its port, `logs.example.com:1514`, is taken as the two; anything else is dropped and sending stays off), `_port`, `_protocol`, `_format`, `_audit`, `_app_level` and `_tls_verify` (kept as it was unless TLS). Settings Edit in the audit log says what changed. + - Report: `agent/reports/audit_activity.php` (`client_id`, `agent` and the period; `export=csv` by person, `table=clients`, `kinds`, or for an admin `security`), `audit_activity` in `reportCatalog()` in a new Activity group, needing `module_client`; entries scoped by `auditLogRoleSql()` and `clientScopeSql()`. Out of hours uses the SLA business days and hours (`getSlaSettings()`), else 9 to 5 on weekdays. +- Vendor templates: + - Database 3.3.4: `vendor_templates.vendor_template_created_by` and `vendor_template_updated_by` (0), taken from the first Vendor Template Create and the latest Edit in the audit log with `log_entity_id` the template, where they are 0, without touching `vendor_template_updated_at`. + - New `functions/vendor_template.php`: `vendorTemplateFieldLabels()` (key => `label`, `icon`), `vendorTemplateColumns()` (key => [template column, vendor column] pairs - the support line is three), `vendorTemplateInfo()` (archived or not, with `created_by_name` and `updated_by_name`; `vendorTemplateRow()` in `functions/vendor.php` stays the current-only one used to make vendors), `vendorTemplateUsage($ids)` (`clients`, `vendors`, `ours`, `last` - current vendors, current clients), `vendorTemplateFields($post, &$error)` (as `vendorFormSet()` reads a vendor's, and the support email checked), `vendorTemplateRowFields()`, `vendorTemplateSave()`, `vendorTemplateChanged()`, `vendorTemplateCopy()`, `vendorTemplateDelete()` (vendors and license templates unlinked, their updated dates kept), `vendorTemplatePush($id, $keys)`, `vendorTemplateVendors()`, `vendorTemplateLicenseTemplates()`, `vendorTemplateTile()` and `vendorTemplatePhoneHtml()`. + - Admin: `admin/vendor_templates.php` is rebuilt (`q` - a support line searched by its digits - `sort` - `vendor_template_name`, `used_count`, `last_used` or `changed_at` - `order`, `page` and `show=archived`, `archived=1` still taken). New `admin/vendor_template.php` (`vendor_template_id`). `admin/modals/vendor_template/vendor_template_form.php` is shared by `vendor_template_add.php` (`from_vendor`) and `vendor_template_edit.php` (`id`); both post to `/admin/post.php`. `admin/post/vendor_template.php`: `add_vendor_template` (`from_vendor` links that vendor; redirects to its page) and `edit_vendor_template` (`push[]` - keys of `vendorTemplateFieldLabels()`, replacing the `global_update_vendor_*` and `update_base_vendors` fields), GET `copy_vendor_template`, `archive_vendor_template`, `restore_vendor_template` and `delete_vendor_template` (`from_page`). Audit entries are Vendor Template Create (with where a copy or one made from a vendor came from), Edit (with what changed), Archive, Restore and Delete, on the template, and Vendor Edit on each vendor a push changed. It no longer includes `agent/post/vendor.php`, so the agent vendor handlers don't run on `admin/post.php`. + - `auditLogKinds()` links Vendor Template entries to the template's page. `agent/vendor.php` links its template for an admin, and has Make a template from it for a vendor with none. - Empty states: every list page sets `$empty_state` before including `includes/filter_footer.php`, and `includes/inc_empty_state.php` draws it with `emptyStateHtml()` (`functions/format.php`) when the list has nothing - `thing`, `icon`, `title`, `text`, `actions` (`label`, `modal` or `href`, `size`, `icon`; the first is the main one), `archived`, `view`, `filtered`, `views`, `match_title`, `match_text` and `clear_url`. `emptyStateFiltered($views)` reads the GET string for a search or filter, leaving out paging, sorting, `client_id`, `archived` and the page's views, and `emptyStateClearUrl($views)` is the page without them. `emptyStatePill($pills, $key, $default, $good)` builds a pill's own state from the page's pill array (`label`, `icon`, `title`, `alarm`), with a tick for `alarm` pills and the keys in `$good`. Files, notifications and racks call `emptyStateHtml()` in their own layout; files and notifications set `$empty_state_skip`. A page that sets nothing still gets one, worded from `$page_title`. The pages' own empty blocks (`.itflow-asset-empty` under a list) are gone. CSS: `.itflow-empty-state` with `-icon` (a grey round tile), `-title`, `-text` and `-actions`. - Removed unused helpers and files: - `credentialLink()`, `projectLink()`, `linkCounts()`, `assetContactAvatar()`, `clientOverviewPersonInitials()`, and `getMonthlyTax()` and `getQuarterlyTax()`, which looked a tax up by name diff --git a/admin/app_logs.php b/admin/app_logs.php index 1c8fb49bd..9395d9baf 100644 --- a/admin/app_logs.php +++ b/admin/app_logs.php @@ -1,177 +1,222 @@ App Logs - what ITFlow itself does and runs into: cron runs, mail + * going out and coming in, payment providers, the API, errors. Listed by + * level - errors, warnings, info and debug, each counted for the filters + * picked - searched, and filtered by category and date. Each entry opens a + * quick look with all of it and what happened around then + * (modals/app_log/app_log.php). What is shown can be exported + * (export_app_logs) or cleared (clear_app_logs). The work is in + * functions/app_log.php. + */ + // Default Column Sortby Filter $sort = "app_log_id"; $order = "DESC"; require_once "includes/inc_all_admin.php"; -// Log Type Filter -if (isset($_GET['type']) & !empty($_GET['type'])) { - $log_type_query = "AND (app_log_type = '" . escapeSql($_GET['type']) . "')"; - $type_filter = escapeHtml($_GET['type']); -} else { - // Default - any - $log_type_query = ''; - $type_filter = ''; +// Tab title - the file is named for the table, the page for what it holds +$page_title = 'App Logs'; + +// Only these sort - an unknown column would take the page down +$sortable_columns = [ + 'app_log_id' => "app_log_id $order", + 'app_log_created_at' => "app_log_created_at $order, app_log_id $order", + 'app_log_type' => "FIELD(app_log_type, 'error', 'warning', 'info', 'debug') " . ($order === 'ASC' ? 'DESC' : 'ASC') . ", app_log_id DESC", + 'app_log_category' => "app_log_category IS NULL, app_log_category $order, app_log_id DESC", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'app_log_id'; } -// Log Category Filter -if (isset($_GET['category']) & !empty($_GET['catergory'])) { - $log_category_query = "AND (app_log_category = '" . escapeSql($_GET['category']) . "')"; - $category_filter = escapeHtml($_GET['category']); -} else { - // Default - any - $log_category_query = ''; - $category_filter = ''; -} - -$sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS app_log_category, app_log_created_at, app_log_details, app_log_id, app_log_type FROM app_logs - WHERE (app_log_type LIKE '%$q%' OR app_log_category LIKE '%$q%' OR app_log_details LIKE '%$q%') - AND DATE(app_log_created_at) BETWEEN '$dtf' AND '$dtt' - $log_type_query - $log_category_query - ORDER BY $sort $order LIMIT $record_from, $record_to" -); +$views = appLogViews(); +$view = isset($_GET['view']) && is_string($_GET['view']) && isset($views[$_GET['view']]) ? $_GET['view'] : ''; +$category_filter = is_string($_GET['category'] ?? null) ? trim($_GET['category']) : ''; +$filter_src = array_merge($_GET, ['dtf' => $dtf, 'dtt' => $dtt, 'view' => $view, 'category' => $category_filter]); +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS app_log_id, app_log_category, app_log_type, app_log_details, app_log_created_at + FROM app_logs + WHERE " . appLogFiltersSql($filter_src) . " + ORDER BY {$sortable_columns[$sort]} + LIMIT $record_from, $record_to"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); +// Each level counted for the rest of the filters +$count_sql = []; +foreach ($views as $definition) { + $count_sql[] = 'COALESCE(SUM(' . ($definition['where'] === '' ? '1' : $definition['where']) . '), 0)'; +} +$counts = array_combine(array_keys($views), array_map('intval', mysqli_fetch_row(mysqli_query($mysqli, "SELECT " . implode(', ', $count_sql) . " + FROM app_logs WHERE " . appLogFiltersSql(array_merge($filter_src, ['view' => ''])))))); +// Nothing logs at debug as it comes - its view shows once something does +if (!$counts['debug'] && $view !== 'debug') { + unset($views['debug']); +} + +$categories = appLogCategories(); +$any_filter = $q !== '' || $category_filter !== '' || $dtf !== '1970-01-01' || $dtt !== '2099-12-31'; +$retention = appLogRetention(); + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; +// A view keeps the filters, and starts from its first page +$view_url = function ($key) { + $query = $_GET; + unset($query['page'], $query['open']); + $query['view'] = $key; + return '?' . http_build_query(array_filter($query, function ($value) { + return $value !== '' && $value !== null && $value !== []; + })); +}; +// The page with just this category - from a category in the list +$category_url = function ($category) { + $query = $_GET; + unset($query['page'], $query['open']); + $query['category'] = $category; + return '?' . http_build_query($query); +}; +$filters_url = function ($modal) use ($dtf, $dtt, $view, $category_filter) { + return buildExportModalUrl($modal, ['q'], ['dtf' => $dtf, 'dtt' => $dtt, 'view' => $view, 'category' => $category_filter]); +}; + ?> -
-
-

App Logs

-
-
-
-
-
-
-
- - - -
-
-
- -
-
- -
-
- -
-
- -
-
+
+
+

App Logs

+
+
+ + +
+ + Clear + +
+ + Keeping and forwarding + + + Audit Logs +
-
" id="advancedFilter"> -
-
-
- - - - - -
-
-
-
- +
-
- - "> - - - - - - - - - - - - - - - - - - - - -
- - Timestamp - - - - Type - - - - Category - - - - Details - -
-
- 'app logs', - 'icon' => 'fa-history', - 'text' => 'What ITFlow itself does - cron runs, mail, errors - shows here.', - ]; - ?> -
+
+
+ +
+
+
+ + +
+
+
+ + + + +
+
+ +
+
+
+ +
+
+ + "> + + + + + + + + + + 240 ? rtrim(mb_substr($details, 0, 240)) . '…' : $details; + ?> + + + + + + + + + +
Details
+
+
+ 		+ + + + - + + +
+ 		+ +
+
+ 'app log entries', + 'icon' => 'fa-clipboard-list', + 'filtered' => $any_filter, + 'views' => ['view'], + 'view' => $view !== '' ? ['icon' => $views[$view]['icon'], 'title' => 'No ' . ($view === 'info' ? 'info entries' : strtolower($views[$view]['label'])) . ' yet', 'text' => escapeHtml($views[$view]['title']) . ' shows here.'] : null, + 'text' => 'What ITFlow itself does - cron runs, mail, payment providers, the API - and the errors it runs into show here. ' . ($retention['app'] ? 'They are kept for ' . appLogRetentionText($retention['app']) . '.' : 'They are kept until they are cleared.'), + ]; + require_once "../includes/filter_footer.php"; + ?> +
+ + + +

Audit Logs

- +
+ + +
+ + Activity report + + + Keeping and forwarding + + + App Logs + +
+
diff --git a/admin/database_updates/3.3.3.php b/admin/database_updates/3.3.3.php new file mode 100644 index 000000000..3dca77a63 --- /dev/null +++ b/admin/database_updates/3.3.3.php @@ -0,0 +1,56 @@ + 0; + }; + + // 1. The app logs are kept for their own number of days, starting from + // what the audit log keeps, as both were kept for that until now. For + // both, 0 is now keep forever. + if (!$itflow_has_column('config_app_log_retention')) { + mysqli_query($mysqli, "ALTER TABLE `settings` ADD COLUMN `config_app_log_retention` int(11) NOT NULL DEFAULT 90"); + mysqli_query($mysqli, "UPDATE `settings` SET `config_app_log_retention` = `config_log_retention`"); + } + + // 2. Sending log entries on to a syslog server or SIEM as they are + // written: on or off, where to (host, port, and UDP, TCP or TLS), how + // (JSON, CEF or plain text), what (the audit log, and the app logs from + // a level up - '' for none) and, over TLS, whether the server's + // certificate is checked. + $itflow_columns = [ + 'config_log_forward_enabled' => "tinyint(1) NOT NULL DEFAULT 0", + 'config_log_forward_host' => "varchar(200) DEFAULT NULL", + 'config_log_forward_port' => "int(11) NOT NULL DEFAULT 514", + 'config_log_forward_protocol' => "varchar(10) NOT NULL DEFAULT 'udp'", + 'config_log_forward_format' => "varchar(10) NOT NULL DEFAULT 'json'", + 'config_log_forward_audit' => "tinyint(1) NOT NULL DEFAULT 1", + 'config_log_forward_app_level' => "varchar(10) NOT NULL DEFAULT 'warning'", + 'config_log_forward_tls_verify' => "tinyint(1) NOT NULL DEFAULT 1", + ]; + foreach ($itflow_columns as $itflow_column => $itflow_definition) { + if (!$itflow_has_column($itflow_column)) { + mysqli_query($mysqli, "ALTER TABLE `settings` ADD COLUMN `$itflow_column` $itflow_definition"); + } + } + + // 3. The app logs are listed and cleared by date, and nightly deletes the + // old ones by date - a key on it. + $itflow_index = mysqli_query($mysqli, "SELECT 1 FROM information_schema.STATISTICS + WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'app_logs' AND INDEX_NAME = 'app_log_created_at' LIMIT 1"); + if (!$itflow_index || mysqli_num_rows($itflow_index) === 0) { + mysqli_query($mysqli, "ALTER TABLE `app_logs` ADD KEY `app_log_created_at` (`app_log_created_at`)"); + } + + unset($itflow_has_column, $itflow_columns, $itflow_column, $itflow_definition, $itflow_index); diff --git a/admin/database_updates/3.3.4.php b/admin/database_updates/3.3.4.php new file mode 100644 index 000000000..1ce8e465a --- /dev/null +++ b/admin/database_updates/3.3.4.php @@ -0,0 +1,37 @@ + 0 AND `log_user_id` > 0 GROUP BY `log_entity_id` + ) AS `made` ON `made`.`log_entity_id` = `vendor_templates`.`vendor_template_id` + SET `vendor_template_created_by` = `made`.`user_id`, `vendor_template_updated_at` = `vendor_template_updated_at` + WHERE `vendor_template_created_by` = 0"); + mysqli_query($mysqli, "UPDATE `vendor_templates` JOIN ( + SELECT `log_entity_id`, SUBSTRING_INDEX(GROUP_CONCAT(`log_user_id` ORDER BY `log_id` DESC), ',', 1) AS `user_id` + FROM `logs` WHERE `log_type` = 'Vendor Template' AND `log_action` = 'Edit' AND `log_entity_id` > 0 AND `log_user_id` > 0 GROUP BY `log_entity_id` + ) AS `changed` ON `changed`.`log_entity_id` = `vendor_templates`.`vendor_template_id` + SET `vendor_template_updated_by` = `changed`.`user_id`, `vendor_template_updated_at` = `vendor_template_updated_at` + WHERE `vendor_template_updated_by` = 0 AND `vendor_template_updated_at` IS NOT NULL"); + + unset($itflow_column); diff --git a/admin/includes/side_nav.php b/admin/includes/side_nav.php index e053ade01..2fcbf98c5 100644 --- a/admin/includes/side_nav.php +++ b/admin/includes/side_nav.php @@ -150,7 +150,7 @@ -->
  • - +

    Vendor Templates

     @@ -221,7 +221,7 @@
    • -
  • +

  • SETTINGS @@ -253,6 +253,12 @@

    Security
    • +
  • + + +

    Logs

    +     +
  • diff --git a/admin/modals/app_log/app_log.php b/admin/modals/app_log/app_log.php new file mode 100644 index 000000000..9b7de0556 --- /dev/null +++ b/admin/modals/app_log/app_log.php @@ -0,0 +1,155 @@ + App Logs. + */ + +require_once '../../includes/modal_header.php'; + +$app_log_id = intval($_GET['id'] ?? 0); +$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM app_logs WHERE app_log_id = $app_log_id")); +if (!$row) { + echo json_encode(['error' => 'That app log entry no longer exists - it may have been cleared.']); + exit; +} + +$level = appLogLevel($row['app_log_type']); +$style = appLogLevels()[$level]; +$category = (string) $row['app_log_category']; +$created = strtotime($row['app_log_created_at']); +$at = escapeSql($row['app_log_created_at']); +$window = "BETWEEN '$at' - INTERVAL 5 MINUTE AND '$at' + INTERVAL 5 MINUTE"; + +// The other app log entries in the five minutes either side +$around_where = "app_log_created_at $window AND app_log_id <> $app_log_id"; +$around_count = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM app_logs WHERE $around_where"))[0]); +$around = []; +$sql = mysqli_query($mysqli, "SELECT app_log_id, app_log_category, app_log_type, app_log_details, app_log_created_at FROM app_logs WHERE $around_where ORDER BY app_log_created_at ASC, app_log_id ASC LIMIT 8"); +while ($around_row = mysqli_fetch_assoc($sql)) { + $around[] = $around_row; +} + +// What was done in the audit log then +$audit_where = "log_created_at $window"; +$audit_count = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE $audit_where"))[0]); +$audit = []; +$sql = mysqli_query($mysqli, "SELECT log_id, log_type, log_action, log_description, log_created_at FROM logs WHERE $audit_where ORDER BY log_created_at ASC, log_id ASC LIMIT 8"); +while ($audit_row = mysqli_fetch_assoc($sql)) { + $audit[] = $audit_row; +} + +$category_count = $category !== '' ? intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM app_logs WHERE app_log_category = '" . escapeSql($category) . "'"))[0]) : 0; +$day = date('Y-m-d', $created); +$day_query = 'canned_date=custom&dtf=' . $day . '&dtt=' . $day; + +ob_start(); + +?> + +
    +
    + +
    +
    ·
    +
    ·
    +
    +
    + +
    + +
    + +
    + +
    +
    + +
    +
    +
    + + +
    +
    + + + All from it + + None + +
    +
    +
    +
    + + Entry +
    +
    + + +
    +
    +
    + +
    +
    +
    The app logs around then
    + 0) { ?> + All of that day + +
    + +
    + + + + + + + +
    + count($around)) { ?> +
    and more
    + + +
    Nothing else in the five minutes either side.
    + +
    + +
    +
    +
    The audit log then
    + 0) { ?> + All of that day + +
    + +
    + + + + + + + +
    + count($audit)) { ?> +
    and more
    + + +
    Nothing was done in the five minutes either side.
    + +
    + +
    + +
    + +
    + + is_string($_GET['q'] ?? null) ? $_GET['q'] : '', + 'view' => is_string($_GET['view'] ?? null) && isset($views[$_GET['view']]) ? $_GET['view'] : '', + 'category' => is_string($_GET['category'] ?? null) ? $_GET['category'] : '', + 'dtf' => is_string($_GET['dtf'] ?? null) ? $_GET['dtf'] : '', + 'dtt' => is_string($_GET['dtt'] ?? null) ? $_GET['dtt'] : '', +]; +$summary = []; +$where = appLogFiltersSql($src, $summary); +$matching = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM app_logs WHERE $where"))[0]); +$total = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM app_logs"))[0]); +$filtered = !empty($summary); + +ob_start(); + +?> + +
    +
    Clear App Logs
    + +
    + +
    + + $value) { if ($value !== '') { ?> + + + +
    + + +
    There is nothing in the app logs to clear.
    + + +

    The entries are deleted for good. Clearing is in the audit log, with what was cleared.

    + + +
    + > + +
    + +
    + > + +
    + + + +
    +
    + + + + +
    +
    + + + +
    +
    Export App Logs
    + +
    + + + +
    + + +
    + + + + + + + +
    +
    + +
    +
    + + + +
    + +
    + + +
    +
    + +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    diff --git a/admin/modals/vendor_template/vendor_template_add.php b/admin/modals/vendor_template/vendor_template_add.php index 175dc9ce8..e29a97ed4 100644 --- a/admin/modals/vendor_template/vendor_template_add.php +++ b/admin/modals/vendor_template/vendor_template_add.php @@ -1,147 +1,57 @@ $from_vendor['vendor_name'], + 'description' => $from_vendor['vendor_description'], + 'phone_country_code' => $from_vendor['vendor_phone_country_code'], + 'phone' => $from_vendor['vendor_phone'], + 'extension' => $from_vendor['vendor_extension'], + 'hours' => $from_vendor['vendor_hours'], + 'sla' => $from_vendor['vendor_sla'], + 'email' => $from_vendor['vendor_email'], + 'website' => $from_vendor['vendor_website'], + 'notes' => $from_vendor['vendor_notes'], + ]; + } +} + ob_start(); ?> -
    -
    New Vendor Template
    +
    New Vendor Template
    -
    +
    - - - -
    - -
    - -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - + + +
    + Starting from - its account number, PIN and account manager stay its own. It is linked to the new template.
    - -
    - - -
    -
    -
    -
    - - - -
    -
    -
    -
    -
    - -
    -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - - -
    -
    - -
    - -
    - -
    - -
    - -
    - -
    - + +
    - +
    diff --git a/admin/modals/vendor_template/vendor_template_edit.php b/admin/modals/vendor_template/vendor_template_edit.php index 38069756d..85f575240 100644 --- a/admin/modals/vendor_template/vendor_template_edit.php +++ b/admin/modals/vendor_template/vendor_template_edit.php @@ -1,217 +1,45 @@ + +if (!$template) { ?> +
    +
    Vendor template
    + +
    +
    That vendor template is gone - it may have been deleted.
    +
    -
    Editing vendor template:
    +
    Vendor template:
    -
    + - +
    - - - -
    - -
    Check the fields you would like to update globally
    - -
    - -
    - - -
    - -
    - - " required> -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    -
    - - -
    -
    - -
    - -
    - - -
    -
    -
    -
    - - - -
    -
    -
    -
    -
    - -
    - -
    -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - - -
    - -
    -
    -
    - -
    - -
    - -
    - -
    - -
    - - -
    - -
    - -
    - +
    - +
    - + + + +
    + + +
    +
    +
    + +
    + + > +
    +
    +
    + +
    + + +
    +
    +
    +
    A vendor added to a client from it starts with everything here - their own account number and PIN go on after.
    +
    + + +
    +
    +
    + +
    + + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    +
    Fill these in only when every client uses the same one - your own partner or reseller account, say.
    +
    +
    + +
    + + +
    +
    +
    +
    + + +
    + + +
    + +
    + + + +
    +
    Change them on the vendor made from it too
    +
    Ticked fields are set to what is here on each one - what a client's vendor says now is replaced.
    +
    + $field) { ?> +
    +
    + + +
    +
    + +
    +
    + + + diff --git a/admin/post/app_log.php b/admin/post/app_log.php new file mode 100644 index 000000000..b6615c0c1 --- /dev/null +++ b/admin/post/app_log.php @@ -0,0 +1,79 @@ + 0) { + + guardExportPdfRowCount($format, $num_rows); + + $export = beginExport('app_logs', $format, "$session_company_name-App-Logs", 'App Logs', summarizeExportFilters($filter_summary)); + + $sql = mysqli_query($mysqli, "SELECT app_log_id, app_log_category, app_log_type, app_log_details, app_log_created_at FROM app_logs + WHERE $where + ORDER BY app_log_created_at DESC, app_log_id DESC"); + while ($row = mysqli_fetch_assoc($sql)) { + $row['app_log_type'] = appLogLevels()[appLogLevel($row['app_log_type'])]['one']; + addExportRow($export, $row); + } + + finishExport($export); + + logAudit("App Log", "Export", "$session_name exported $num_rows app log " . ($num_rows === 1 ? 'entry' : 'entries') . " to a " . strtoupper($format) . " file"); + + exit; + } + + flashAlert('No app log entries match - nothing to export.', 'error'); + + redirect(); + +} + +if (isset($_POST['clear_app_logs'])) { + + validateCSRFToken(); + + enforceAdminPermission(); + + // The ones shown, with the list's filters - or every one + $all = ($_POST['scope'] ?? '') !== 'shown'; + $summary = []; + $where = $all ? '1 = 1' : appLogFiltersSql($_POST, $summary); + if (!$all && !$summary) { + $all = true; + } + + mysqli_query($mysqli, "DELETE FROM app_logs WHERE $where"); + $cleared = mysqli_affected_rows($mysqli); + + if ($cleared > 0) { + $what = lcfirst(appLogFiltersText($summary)); + logAudit("App Log", "Delete", "$session_name cleared $cleared app log " . ($cleared === 1 ? 'entry' : 'entries') . ($all ? ' - all of them' : ' - ' . escapeSql($what))); + flashAlert("Cleared $cleared app log " . ($cleared === 1 ? 'entry' : 'entries')); + } else { + flashAlert('There was nothing to clear.', 'error'); + } + + redirect('app_logs.php'); + +} diff --git a/admin/post/settings_logs.php b/admin/post/settings_logs.php new file mode 100644 index 000000000..28ace2579 --- /dev/null +++ b/admin/post/settings_logs.php @@ -0,0 +1,119 @@ + Settings > Logs: how long each log is + * kept, and sending entries on to a syslog server or SIEM. Save and send a + * test saves first, then sends one test message with what was saved + * (logForwardTest(), functions/log_forward.php). What changed is in the audit + * log. + */ + +defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); + +if (isset($_POST['edit_log_settings']) || isset($_POST['test_log_forward'])) { + + validateCSRFToken(); + + // Days, or 0 for keep forever + $days = function ($name, $forever) { + if (!empty($_POST[$forever])) { + return 0; + } + return min(36500, max(1, intval($_POST[$name] ?? 90))); + }; + $audit_days = $days('config_log_retention', 'audit_forever'); + $app_days = $days('config_app_log_retention', 'app_forever'); + + $was_retention = appLogRetention(); + $was = logForwardSettings(); + $posted_host = is_string($_POST['config_log_forward_host'] ?? null) ? trim($_POST['config_log_forward_host']) : ''; + $forward = logForwardTidy([ + 'enabled' => $_POST['config_log_forward_enabled'] ?? 0, + 'host' => $posted_host, + 'port' => $_POST['config_log_forward_port'] ?? 514, + 'protocol' => $_POST['config_log_forward_protocol'] ?? 'udp', + 'format' => $_POST['config_log_forward_format'] ?? 'json', + 'audit' => $_POST['config_log_forward_audit'] ?? 0, + 'app_level' => $_POST['config_log_forward_app_level'] ?? '', + // Only asked over TLS - kept as it was otherwise + 'tls_verify' => ($_POST['config_log_forward_protocol'] ?? '') === 'tls' ? ($_POST['config_log_forward_tls_verify'] ?? 0) : $was['tls_verify'], + ]); + + // Nowhere to send to - saved, but off + $warning = ''; + if ($posted_host !== '' && $forward['host'] === '') { + $warning = "That isn't a server name or address, so sending stays off."; + $forward['enabled'] = 0; + } elseif ($forward['enabled'] && $forward['host'] === '') { + $warning = 'Sending stays off until there is a server to send to.'; + $forward['enabled'] = 0; + } + + $host_sql = $forward['host'] !== '' ? "'" . escapeSql($forward['host']) . "'" : 'NULL'; + mysqli_query($mysqli, "UPDATE settings SET config_log_retention = $audit_days, config_app_log_retention = $app_days, + config_log_forward_enabled = {$forward['enabled']}, config_log_forward_host = $host_sql, config_log_forward_port = {$forward['port']}, + config_log_forward_protocol = '{$forward['protocol']}', config_log_forward_format = '{$forward['format']}', config_log_forward_audit = {$forward['audit']}, + config_log_forward_app_level = '{$forward['app_level']}', config_log_forward_tls_verify = {$forward['tls_verify']} + WHERE company_id = 1"); + + // What changed, in words + $changes = []; + if ($audit_days !== $was_retention['audit']) { + $changes[] = 'the audit log kept ' . strtolower(appLogRetentionText($audit_days)) . ' (was ' . strtolower(appLogRetentionText($was_retention['audit'])) . ')'; + } + if ($app_days !== $was_retention['app']) { + $changes[] = 'app logs kept ' . strtolower(appLogRetentionText($app_days)) . ' (was ' . strtolower(appLogRetentionText($was_retention['app'])) . ')'; + } + $target = function ($settings) { + return logForwardTarget($settings) . ($settings['protocol'] === 'tls' && !$settings['tls_verify'] ? ' (certificate not checked)' : ''); + }; + $what = function ($settings) { + return implode(' and ', array_filter([$settings['audit'] ? 'the audit log' : '', $settings['app_level'] !== '' ? 'app ' . strtolower(logForwardAppLevels()[$settings['app_level']]) : ''])) ?: 'nothing'; + }; + $on = logForwardOn($forward); + $was_on = logForwardOn($was); + if ($on && !$was_on) { + $changes[] = 'sending logs to ' . $target($forward) . ' as ' . LOG_FORWARD_FORMATS[$forward['format']] . ' - ' . $what($forward); + } elseif (!$on && $was_on) { + $changes[] = 'stopped sending logs (was to ' . $target($was) . ')'; + } elseif ($on) { + if ($target($forward) !== $target($was)) { + $changes[] = 'sending logs to ' . $target($forward) . ' (was ' . $target($was) . ')'; + } + if ($forward['format'] !== $was['format']) { + $changes[] = 'sent as ' . LOG_FORWARD_FORMATS[$forward['format']] . ' (was ' . LOG_FORWARD_FORMATS[$was['format']] . ')'; + } + if ($what($forward) !== $what($was)) { + $changes[] = 'sending ' . $what($forward) . ' (was ' . $what($was) . ')'; + } + } + + // Read again, so what is logged from here on goes where it now should + logForwardSettings(true); + + if ($changes) { + logAudit("Settings", "Edit", "$session_name edited log settings - " . escapeSql(implode('; ', $changes))); + } + + if (isset($_POST['test_log_forward'])) { + if ($forward['host'] === '') { + flashAlert($warning !== '' ? $warning : 'Give the server to send to first.', 'error'); + redirect(); + } + $test = logForwardTest($forward, stripslashes($session_name)); + $target = logForwardTarget($forward); + if ($test['ok']) { + flashAlert(($forward['protocol'] === 'udp' + ? "Saved, and a test message went to $target. UDP doesn't say whether it arrived - check the server for it." + : "Saved, and $target took the test message.") . ($forward['enabled'] ? '' : ' Sending is still off - switch it on to send entries.')); + } else { + flashAlert("Saved, but the test message couldn't be sent to $target - " . $test['error'] . '.', 'error'); + } + redirect(); + } + + flashAlert($warning !== '' ? "Log settings saved. $warning" : 'Log settings saved', $warning !== '' ? 'warning' : 'success'); + + redirect(); + +} diff --git a/admin/post/settings_security.php b/admin/post/settings_security.php index 1cddac09f..db5dff04f 100644 --- a/admin/post/settings_security.php +++ b/admin/post/settings_security.php @@ -10,7 +10,6 @@ if (isset($_POST['edit_security_settings'])) { $config_login_key_required = intval($_POST['config_login_key_required'] ?? 0); $config_login_key_secret = escapeSql($_POST['config_login_key_secret']); $config_login_remember_me_expire = intval($_POST['config_login_remember_me_expire']); - $config_log_retention = intval($_POST['config_log_retention']); // Shared links (functions/share.php) - only the lengths the share window offers $config_share_max_hours = intval($_POST['config_share_max_hours'] ?? 720); @@ -30,7 +29,7 @@ if (isset($_POST['edit_security_settings'])) { $config_login_key_required = 0; } - mysqli_query($mysqli,"UPDATE settings SET config_login_message = '$config_login_message', config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret', config_login_remember_me_expire = $config_login_remember_me_expire, config_log_retention = $config_log_retention, config_share_max_hours = $config_share_max_hours, config_share_require_protection = $config_share_require_protection, config_login_alert_failures = $config_login_alert_failures WHERE company_id = 1"); + mysqli_query($mysqli,"UPDATE settings SET config_login_message = '$config_login_message', config_login_key_required = '$config_login_key_required', config_login_key_secret = '$config_login_key_secret', config_login_remember_me_expire = $config_login_remember_me_expire, config_share_max_hours = $config_share_max_hours, config_share_require_protection = $config_share_require_protection, config_login_alert_failures = $config_login_alert_failures WHERE company_id = 1"); logAudit("Settings", "Edit", "$session_name edited security settings"); diff --git a/admin/post/vendor_template.php b/admin/post/vendor_template.php index 8578c89d4..ae0460518 100644 --- a/admin/post/vendor_template.php +++ b/admin/post/vendor_template.php @@ -1,146 +1,108 @@ Vendor Templates) - making, changing (and the + * fields ticked on the vendors made from it too), copying, archiving, + * restoring and deleting them. The work is in functions/vendor_template.php; + * a vendor is made from one by add_vendor, add_vendor_from_template and + * add_vendor_template_to_clients (agent/post/vendor.php). + */ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); -// Import shared code from user-side vendor management as we reuse functions -require_once '../agent/post/vendor.php'; +/* The template a request is for - or back to the list, saying it is gone. */ +function vendorTemplateForRequest($vendor_template_id) { + $row = vendorTemplateInfo($vendor_template_id); + if (!$row) { + flashAlert('That vendor template no longer exists.', 'error'); + redirect('vendor_templates.php'); + } + return $row; +} -if (isset($_POST['add_vendor_template'])) { +if (isset($_POST['add_vendor_template']) || isset($_POST['edit_vendor_template'])) { validateCSRFToken(); - $name = escapeSql($_POST['name']); - $description = escapeSql($_POST['description']); - $account_number = escapeSql($_POST['account_number']); - $contact_name = escapeSql($_POST['contact_name']); - $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']); - $phone = preg_replace("/[^0-9]/", '', $_POST['phone']); - $extension = preg_replace("/[^0-9]/", '', $_POST['extension']); - $email = escapeSql($_POST['email']); - $website = preg_replace("(^https?://)", "", escapeSql($_POST['website'])); - $hours = escapeSql($_POST['hours']); - $sla = escapeSql($_POST['sla']); - $code = escapeSql($_POST['code']); - $notes = escapeSql($_POST['notes']); + $editing = isset($_POST['edit_vendor_template']); + $before = $editing ? vendorTemplateForRequest($_POST['vendor_template_id'] ?? 0) : null; + $vendor_template_id = $before ? intval($before['vendor_template_id']) : 0; - mysqli_query($mysqli,"INSERT INTO vendor_templates SET vendor_template_name = '$name', vendor_template_description = '$description', vendor_template_contact_name = '$contact_name', vendor_template_phone_country_code = '$phone_country_code', vendor_template_phone = '$phone', vendor_template_extension = '$extension', vendor_template_email = '$email', vendor_template_website = '$website', vendor_template_hours = '$hours', vendor_template_sla = '$sla', vendor_template_code = '$code', vendor_template_account_number = '$account_number', vendor_template_notes = '$notes'"); + $fields = vendorTemplateFields($_POST, $error); + if (!$fields) { + flashAlert(escapeHtml($error), 'error'); + redirect(); + } + $vendor_template_id = vendorTemplateSave($vendor_template_id, $fields); + $name = $fields['name']; - $vendor_template_id = mysqli_insert_id($mysqli); + if ($editing) { + $changed = vendorTemplateChanged(vendorTemplateRowFields($before), $fields); + $renamed = $before['vendor_template_name'] !== $name ? ' (was ' . $before['vendor_template_name'] . ')' : ''; + logAudit("Vendor Template", "Edit", "$session_name edited vendor template " . escapeSql($name . $renamed) . ($changed ? ' - ' . escapeSql(mb_strtolower(implode(', ', $changed))) : ''), 0, $vendor_template_id); - logAudit("Vendor Template", "Create", "$session_name created vendor template $name", 0, $vendor_template_id); + // The fields ticked, on every vendor made from it too + $labels = array_map(function ($field) { + return $field['label']; + }, vendorTemplateFieldLabels()); + $push = array_values(array_intersect(array_keys($labels), array_map('strval', array_filter((array) ($_POST['push'] ?? []), 'is_scalar')))); + $pushed = $push ? vendorTemplatePush($vendor_template_id, $push) : []; + $what = mb_strtolower(implode(', ', array_intersect_key($labels, array_flip($push)))); + foreach ($pushed as $vendor_id => $vendor) { + logAudit("Vendor", "Edit", "$session_name updated vendor " . escapeSql($vendor['name']) . " from template " . escapeSql($name) . " - " . escapeSql($what), $vendor['client_id'], $vendor_id); + } - flashAlert("Vendor template " . stripslashes($name) . " created"); + flashAlert("Vendor template " . escapeHtml($name) . " saved" . ($pushed ? ", and " . escapeHtml($what) . " changed on " . count($pushed) . " vendor" . (count($pushed) === 1 ? '' : 's') . " made from it" : '')); - redirect(); + redirect(); + } + + // Made from one of a client's vendors - that vendor is now made from it + $from_vendor = vendorRow($_POST['from_vendor'] ?? 0); + if ($from_vendor) { + mysqli_query($mysqli, "UPDATE vendors SET vendor_template_id = $vendor_template_id, vendor_updated_at = vendor_updated_at WHERE vendor_id = " . intval($from_vendor['vendor_id'])); + } + + logAudit("Vendor Template", "Create", "$session_name created vendor template " . escapeSql($name) . ($from_vendor ? " from vendor " . escapeSql($from_vendor['vendor_name']) . ($from_vendor['client_name'] !== null ? " of " . escapeSql($from_vendor['client_name']) : '') : ''), 0, $vendor_template_id); + + flashAlert("Vendor template " . escapeHtml($name) . " created"); + + // A new one opens on its page + redirect("vendor_template.php?vendor_template_id=$vendor_template_id"); } -if (isset($_POST['edit_vendor_template'])) { +if (isset($_GET['copy_vendor_template'])) { validateCSRFToken(); - $vendor_template_id = intval($_POST['vendor_template_id']); - $name = escapeSql($_POST['name']); - $description = escapeSql($_POST['description']); - $account_number = escapeSql($_POST['account_number']); - $contact_name = escapeSql($_POST['contact_name']); - $phone_country_code = preg_replace("/[^0-9]/", '', $_POST['phone_country_code']); - $phone = preg_replace("/[^0-9]/", '', $_POST['phone']); - $extension = preg_replace("/[^0-9]/", '', $_POST['extension']); - $email = escapeSql($_POST['email']); - $website = preg_replace("(^https?://)", "", escapeSql($_POST['website'])); - $hours = escapeSql($_POST['hours']); - $sla = escapeSql($_POST['sla']); - $code = escapeSql($_POST['code']); - $notes = escapeSql($_POST['notes']); + $row = vendorTemplateForRequest($_GET['copy_vendor_template']); + $new_id = vendorTemplateCopy($row['vendor_template_id']); + $new_name = (string) vendorTemplateInfo($new_id)['vendor_template_name']; - if ($_POST['global_update_vendor_name'] == 1 ?? 0) { - $sql_global_update_vendor_name = ", vendor_name = '$name'"; - } else { - $sql_global_update_vendor_name = ""; - } + logAudit("Vendor Template", "Create", "$session_name copied vendor template " . escapeSql($row['vendor_template_name']) . " as " . escapeSql($new_name), 0, $new_id); - if ($_POST['global_update_vendor_description'] == 1) { - $sql_global_update_vendor_description = ", vendor_description = '$description'"; - } else { - $sql_global_update_vendor_description = ""; - } + flashAlert("Vendor template " . escapeHtml($row['vendor_template_name']) . " copied as " . escapeHtml($new_name) . ""); - if ($_POST['global_update_vendor_account_number'] == 1) { - $sql_global_update_vendor_account_number = ", vendor_account_number = '$account_number'"; - } else { - $sql_global_update_vendor_account_number = ""; - } + redirect("vendor_template.php?vendor_template_id=$new_id"); - if ($_POST['global_update_vendor_contact_name'] == 1) { - $sql_global_update_vendor_contact_name = ", vendor_contact_name = '$contact_name'"; - } else { - $sql_global_update_vendor_contact_name = ""; - } +} - if ($_POST['global_update_vendor_phone'] == 1) { - $sql_global_update_vendor_phone = ", vendor_phone_country_code = '$phone_country_code', vendor_phone = '$phone', vendor_extension = '$extension'"; - } else { - $sql_global_update_vendor_phone = ""; - } +if (isset($_GET['archive_vendor_template']) || isset($_GET['restore_vendor_template'])) { - if ($_POST['global_update_vendor_hours'] == 1) { - $sql_global_update_vendor_hours = ", vendor_hours = '$hours'"; - } else { - $sql_global_update_vendor_hours = ""; - } + validateCSRFToken(); - if ($_POST['global_update_vendor_email'] == 1) { - $sql_global_update_vendor_email = ", vendor_email = '$email'"; - } else { - $sql_global_update_vendor_email = ""; - } + $archive = isset($_GET['archive_vendor_template']); + $row = vendorTemplateForRequest($archive ? $_GET['archive_vendor_template'] : $_GET['restore_vendor_template']); + $vendor_template_id = intval($row['vendor_template_id']); - if ($_POST['global_update_vendor_website'] == 1) { - $sql_global_update_vendor_website = ", vendor_website = '$website'"; - } else { - $sql_global_update_vendor_website = ""; - } + // Archived, it isn't offered for new vendors; the ones made from it stay + mysqli_query($mysqli, "UPDATE vendor_templates SET vendor_template_archived_at = " . ($archive ? 'NOW()' : 'NULL') . ", vendor_template_updated_at = vendor_template_updated_at + WHERE vendor_template_id = $vendor_template_id"); - if ($_POST['global_update_vendor_sla'] == 1) { - $sql_global_update_vendor_sla = ", vendor_sla = '$sla'"; - } else { - $sql_global_update_vendor_sla = ""; - } + logAudit("Vendor Template", $archive ? "Archive" : "Restore", "$session_name " . ($archive ? 'archived' : 'restored') . " vendor template " . escapeSql($row['vendor_template_name']), 0, $vendor_template_id); - if ($_POST['global_update_vendor_code'] == 1) { - $sql_global_update_vendor_code = ", vendor_code = '$code'"; - } else { - $sql_global_update_vendor_code = ""; - } - - if ($_POST['global_update_vendor_notes'] == 1) { - $sql_global_update_vendor_notes = ", vendor_notes = '$notes'"; - } else { - $sql_global_update_vendor_notes = ""; - } - - // Update just the template - mysqli_query($mysqli,"UPDATE vendor_templates SET vendor_template_name = '$name', vendor_template_description = '$description', vendor_template_contact_name = '$contact_name', vendor_template_phone_country_code = '$phone_country_code', vendor_template_phone = '$phone', vendor_template_extension = '$extension', vendor_template_email = '$email', vendor_template_website = '$website', vendor_template_hours = '$hours', vendor_template_sla = '$sla', vendor_template_code = '$code', vendor_template_account_number = '$account_number', vendor_template_notes = '$notes' WHERE vendor_template_id = $vendor_template_id"); - - if ($_POST['update_base_vendors'] == 1) { - // Update client related vendors if anything is checked - $sql = "$sql_global_update_vendor_name $sql_global_update_vendor_description $sql_global_update_vendor_account_number $sql_global_update_vendor_contact_name $sql_global_update_vendor_phone $sql_global_update_vendor_hours $sql_global_update_vendor_email $sql_global_update_vendor_website $sql_global_update_vendor_sla $sql_global_update_vendor_code $sql_global_update_vendor_notes"; - - // Remove the first comma to prevent MySQL error - $sql = preg_replace('/,/', '', $sql, 1); - - // Nothing ticked to push - nothing to update, rather than an empty SET - if (trim($sql) !== '') { - mysqli_query($mysqli,"UPDATE vendors SET $sql WHERE vendor_template_id = $vendor_template_id"); - } - } - - logAudit("Vendor Template", "Edit", "$session_name edited vendor template $name", 0, $vendor_template_id); - - flashAlert("Vendor template " . stripslashes($name) . " saved"); + flashAlert("Vendor template " . escapeHtml($row['vendor_template_name']) . " " . ($archive ? 'archived' : 'restored'), $archive ? 'error' : 'success'); redirect(); @@ -150,22 +112,16 @@ if (isset($_GET['delete_vendor_template'])) { validateCSRFToken(); - $vendor_template_id = intval($_GET['delete_vendor_template']); + $row = vendorTemplateForRequest($_GET['delete_vendor_template']); - $vendor_template_name = escapeSql(getFieldById('vendor_templates', $vendor_template_id, 'vendor_template_name')); + // The vendors made from it stay, no longer linked to it + vendorTemplateDelete($row['vendor_template_id']); - // If its a template reset all vendors based off this template to no template base - mysqli_query($mysqli,"UPDATE vendors SET vendor_template_id = 0 WHERE vendor_template_id = $vendor_template_id"); + logAudit("Vendor Template", "Delete", "$session_name deleted vendor template " . escapeSql($row['vendor_template_name']), 0, intval($row['vendor_template_id'])); - // License templates that took their vendor from it no longer have one - mysqli_query($mysqli, "UPDATE software_templates SET software_template_vendor_template_id = 0, software_template_updated_at = software_template_updated_at WHERE software_template_vendor_template_id = $vendor_template_id"); + flashAlert("Vendor template " . escapeHtml($row['vendor_template_name']) . " deleted", 'error'); - mysqli_query($mysqli,"DELETE FROM vendor_templates WHERE vendor_template_id = $vendor_template_id"); - - logAudit("Vendor Template", "Delete", "$session_name deleted vendor template $vendor_template_name"); - - flashAlert("Vendor template " . stripslashes($vendor_template_name) . " deleted", 'error'); - - redirect(); + // From its own page, back to the list + redirect(!empty($_GET['from_page']) ? 'vendor_templates.php' : null); } diff --git a/admin/settings_logs.php b/admin/settings_logs.php new file mode 100644 index 000000000..823111ace --- /dev/null +++ b/admin/settings_logs.php @@ -0,0 +1,239 @@ + Settings > Logs - how long the audit log (with API key use) and + * the app logs are kept, each its own number of days or forever, and sending + * their entries on to a syslog server or SIEM as they are written + * (functions/log_forward.php). Saved by edit_log_settings, or + * test_log_forward, which saves and sends a test message + * (admin/post/settings_logs.php). + */ + +require_once "includes/inc_all_admin.php"; + +// Read here rather than with every page's settings, so the page still opens before the update that adds them +$retention = appLogRetention(); +$forward = logForwardSettings(); +$audit_size = appLogSize('logs'); +$app_size = appLogSize('app_logs'); + +// The last time sending failed, in the last day +$forward_failure = null; +if ($forward['enabled']) { + $forward_failure = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT app_log_id, app_log_details, app_log_created_at FROM app_logs + WHERE app_log_category = '" . escapeSql(LOG_FORWARD_CATEGORY) . "' AND app_log_type = 'error' AND app_log_created_at > NOW() - INTERVAL 1 DAY + ORDER BY app_log_id DESC LIMIT 1")); +} + +// What an entry looks like as it is sent - the latest audit log entry, in the format picked +$sample_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT log_id, log_type, log_action, log_description, log_ip, log_user_agent, log_created_at, log_client_id, log_user_id, log_entity_id, + user_name, user_email, user_type, client_name + FROM logs LEFT JOIN users ON user_id = log_user_id AND log_user_id > 0 LEFT JOIN clients ON client_id = log_client_id AND log_client_id > 0 + ORDER BY log_id DESC LIMIT 1")); +$samples = []; +if ($sample_row) { + foreach (array_keys(LOG_FORWARD_FORMATS) as $format) { + $samples[$format] = logForwardAuditMessage($sample_row, $format); + } +} + +$size_line = function ($size, $url) { + if (!$size['count']) { + return 'Nothing in it yet.'; + } + return '' . number_format($size['count']) . ' entr' . ($size['count'] === 1 ? 'y' : 'ies') . ', the oldest from ' . escapeHtml(date('M j, Y', strtotime($size['oldest']))) . '.'; +}; + +// The days field and its keep forever switch, for one log +$retention_field = function ($name, $forever_name, $days, $label, $help) { + $id = preg_replace('/[^a-z_]/', '', $name); + ob_start(); ?> +
    + +
    +
    +
    + + 0 ? 'required' : 'disabled' ?>> + days +
    +
    +
    +
    + 0 ? '' : 'checked' ?>> + +
    +
    +
    +
    +
    + + +
    +
    +

    Logs

    +
    +
    +
    + + +

    Keeping logs

    +

    Each night, entries older than this are deleted for good. Keep the audit log as long as your clients or insurers ask you to be able to say who did what.

    + + + + + +
    + +

    Sending logs on

    +

    Each entry can also go to a syslog server or SIEM - Graylog, Splunk, Wazuh, Microsoft Sentinel and the like - as it is written, as a syslog message (RFC 5424, facility local0). A server that can't be reached doesn't slow ITFlow down: it is tried again a minute later, and the entries in between stay in ITFlow's own logs.

    + +
    +
    + > + +
    +
    + + +
    + Sending failed : + See it +
    + +
    + Sending to as . +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    +
    + > + +
    +
    Turn off only for a server on your own network with a certificate it made itself - anyone in between could otherwise read the entries.
    +
    + +
    +
    + +
    + + +
    +
    +
    + +
    + + +
    +
    +
    + +
    +
    + > + +
    +
    + + +
    + What an entry looks like +
    The latest audit log entry, as it would be sent:
    + $sample) { ?> +
    + +
    + +
    + +
    + + + + +
    +
    +
    + + + +
    -
    - -
    - - -
    -
    -
    diff --git a/admin/vendor_template.php b/admin/vendor_template.php new file mode 100644 index 000000000..e41511101 --- /dev/null +++ b/admin/vendor_template.php @@ -0,0 +1,255 @@ + 'vendor templates', 'title' => 'That vendor template is gone', 'text' => 'It may have been deleted.', 'icon' => 'fa-building', 'filtered' => false, + 'actions' => [['label' => 'Vendor Templates', 'href' => 'vendor_templates.php']]]); + require_once "../includes/footer.php"; + exit(); +} + +$vendor_template_id = intval($template['vendor_template_id']); +$name = escapeHtml($template['vendor_template_name']); +// Tab title - used raw, the footer encodes it +$page_title = $template['vendor_template_name']; +$archived = !empty($template['vendor_template_archived_at']); +$usage = vendorTemplateUsage([$vendor_template_id])[$vendor_template_id] ?? ['clients' => 0, 'vendors' => 0, 'ours' => 0, 'last' => null]; +$csrf = $_SESSION['csrf_token']; + +// Its vendors - the current ones for current clients listed, the rest counted +$all_vendors = vendorTemplateVendors($vendor_template_id); +$vendors = array_filter($all_vendors, function ($vendor) { + return !$vendor['archived'] && !$vendor['client_archived']; +}); +$set_up = count(array_filter($vendors, function ($vendor) { + return $vendor['client_id'] && $vendor['account_number'] !== ''; +})); +$client_vendors = count(array_filter($vendors, function ($vendor) { + return $vendor['client_id'] > 0; +})); +$others = count($all_vendors) - count($vendors); +$license_templates = vendorTemplateLicenseTemplates($vendor_template_id); + +$edit_url = "modals/vendor_template/vendor_template_edit.php?id=$vendor_template_id"; +$clients_url = "/agent/modals/vendor/vendor_template_clients.php?template_id=$vendor_template_id"; + +// What a vendor from it starts with - the ones it has +$t = $template; +$website = vendorWebsiteLabel($t['vendor_template_website']); +$facts = array_filter([ + 'What they are' => escapeHtml((string) $t['vendor_template_description']), + 'Support line' => vendorTemplatePhoneHtml($t['vendor_template_phone'], $t['vendor_template_phone_country_code'], $t['vendor_template_extension']), + 'Support hours' => escapeHtml((string) $t['vendor_template_hours']), + 'SLA' => escapeHtml((string) $t['vendor_template_sla']), + 'Support email' => trim((string) $t['vendor_template_email']) !== '' ? '' . escapeHtml($t['vendor_template_email']) . '' : '', + 'Support site' => $website !== '' ? '' . escapeHtml($website) . '' : '', + 'Account number' => escapeHtml(trim((string) $t['vendor_template_account_number'])), + 'PIN' => vendorSecretHtml($t['vendor_template_code']), + 'Account manager' => escapeHtml(trim((string) $t['vendor_template_contact_name'])), +], function ($value) { + return trim($value) !== ''; +}); +$icons = []; +foreach (vendorTemplateFieldLabels() as $field) { + $icons[$field['label']] = $field['icon']; +} + +?> + +
      +
    1. Home
      2. +
    2. Admin
      3. +
    3. Vendor Templates
      4. +
      5. +
    + +
    +
    + +
    +

    + +
    + + +
    Archived - not offered for new vendors
    + +
    +
    + + + + +
    + +
    + Copy + + Restore + + Archive + +
    + Delete +
    +
    +
    +
    +
    + +
    +
    + +
    +
    +

    What a vendor starts with

    + +
    +
    +
    +
    Name
    +
    + $value) { ?> +
    +
    + +
    Notes
    +
    + +
    + + None - what every client's vendor should say: the escalation path, what they ask for before they help, how to open a case online. + +
    +
    + +
    No way to reach their support yet - give it their support line, email or site, so every client's vendor has it.
    + +
    +
    + +
    +
    +

    Clients with it

    + + + +
    + +
    + + + + + + $vendor) { + $client_id = $vendor['client_id']; + $vendor_url = '/agent/vendor.php?' . ($client_id ? "client_id=$client_id&" : '') . "vendor_id=$vendor_id"; + ?> + + + + + + + + + +
    ClientTheir vendorAccountAdded
    + + + + Ours + + + + + + + No account number + + - + +
    +
    + +
    And archived, or for an archived client.
    + + +
    No client has a vendor made from it yet. Agents add one from New Vendor on a client's Vendors.
    + +
    + +
    + +
    + +
    +

    Used

    +
    + +
    + client a vendor from it + + - last added +
    + +
    + + +
    No vendors made from it yet.
    + +
    +
    + + +
    +

    License templates

    +
    + $license_template) { ?> + + + + Archived + + +
    +
    Licenses made from these get the client's vendor from this template.
    +
    + + +
    +

    Details

    +
    +
    +
    Made
    +
    ' . escapeHtml($template['created_by_name']) . '
    ' : '' ?> + +
    Last changed
    +
    ' . escapeHtml($template['updated_by_name']) . '
    ' : '' ?> + + +
    +
    + + + + +
    +
    + + Vendor Templates - the vendors an MSP's clients use again and + * again, set up once: the ISPs, the hardware makers, the distributors, the + * line-of-business software. Each row shows what it is, its support line, + * hours and SLA, how many clients have a vendor made from it, when one was + * last added and when it last changed, and by whom. Each opens its page + * (vendor_template.php). A template can be added to several clients at once, + * changed, copied as the start of another, archived - not offered for new + * vendors, while the vendors made from it stay - or deleted. The work is in + * functions/vendor_template.php; the handlers are + * admin/post/vendor_template.php. + */ + // Default Column Sortby Filter $sort = "vendor_template_name"; $order = "ASC"; require_once "includes/inc_all_admin.php"; -$sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS vendor_template_account_number, vendor_template_code, vendor_template_contact_name, - vendor_template_description, vendor_template_email, vendor_template_extension, - vendor_template_hours, vendor_template_id, vendor_template_name, vendor_template_notes, - vendor_template_phone, vendor_template_sla, vendor_template_website FROM vendor_templates - WHERE vendor_template_name LIKE '%$q%' OR vendor_template_description LIKE '%$q%' OR vendor_template_account_number LIKE '%$q%' OR vendor_template_website LIKE '%$q%' OR vendor_template_contact_name LIKE '%$q%' OR vendor_template_email LIKE '%$q%' OR vendor_template_phone LIKE '%$phone_query%' ORDER BY $sort $order LIMIT $record_from, $record_to" -); +// '' current, 'archived' +$show_archived = ($_GET['show'] ?? '') === 'archived' || ($_GET['archived'] ?? '') === '1'; +$show_where = $show_archived ? 'vendor_template_archived_at IS NOT NULL' : 'vendor_template_archived_at IS NULL'; + +// Tab title - the file is named for the table, the page for what it holds +$page_title = 'Vendor Templates'; + +// Only these sort - an unknown column would take the page down +$sortable_columns = [ + 'vendor_template_name' => "vendor_template_name $order", + 'used_count' => "used_count $order, vendor_template_name ASC", + 'last_used' => "last_used IS NULL, last_used $order, vendor_template_name ASC", + 'changed_at' => "changed_at $order, vendor_template_name ASC", +]; +if (!isset($sortable_columns[$sort])) { + $sort = 'vendor_template_name'; +} + +$phone_search = preg_replace('/[^0-9]/', '', (string) ($_GET['q'] ?? '')); +$search = "(vendor_template_name LIKE '%$q%' OR vendor_template_description LIKE '%$q%' OR vendor_template_website LIKE '%$q%' OR vendor_template_email LIKE '%$q%' + OR vendor_template_hours LIKE '%$q%' OR vendor_template_sla LIKE '%$q%' OR vendor_template_contact_name LIKE '%$q%' OR vendor_template_account_number LIKE '%$q%' + OR vendor_template_notes LIKE '%$q%'" . ($phone_search !== '' ? " OR vendor_template_phone LIKE '%$phone_search%'" : '') . ")"; + +// Its use is the current vendors made from it for current clients - as vendorTemplateUsage() counts them +$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS vendor_templates.vendor_template_id, vendor_template_name, vendor_template_description, vendor_template_phone_country_code, + vendor_template_phone, vendor_template_extension, vendor_template_email, vendor_template_website, vendor_template_hours, vendor_template_sla, + vendor_template_created_at, vendor_template_updated_at, vendor_template_archived_at, + COALESCE(vendor_template_updated_at, vendor_template_created_at) AS changed_at, COALESCE(updater.user_name, creator.user_name) AS changed_by, + COALESCE(used.used_count, 0) AS used_count, used.last_used + FROM vendor_templates + LEFT JOIN users creator ON creator.user_id = vendor_template_created_by AND vendor_template_created_by > 0 + LEFT JOIN users updater ON updater.user_id = vendor_template_updated_by AND vendor_template_updated_by > 0 + LEFT JOIN ( + SELECT vendor_template_id AS used_template_id, COUNT(DISTINCT vendor_client_id) AS used_count, MAX(vendor_created_at) AS last_used + FROM vendors JOIN clients ON client_id = vendor_client_id AND client_archived_at IS NULL + WHERE vendor_template_id > 0 AND vendor_archived_at IS NULL GROUP BY vendor_template_id + ) used ON used.used_template_id = vendor_templates.vendor_template_id + WHERE $search AND $show_where + ORDER BY {$sortable_columns[$sort]}, vendor_templates.vendor_template_id ASC + LIMIT $record_from, $record_to"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); -// How many clients have a vendor made from each template -$template_use = []; -$sql_template_use = mysqli_query($mysqli, "SELECT vendor_template_id, COUNT(DISTINCT vendor_client_id) FROM vendors WHERE vendor_template_id > 0 AND vendor_client_id > 0 AND vendor_archived_at IS NULL GROUP BY vendor_template_id"); -while ($use_row = mysqli_fetch_row($sql_template_use)) { - $template_use[intval($use_row[0])] = intval($use_row[1]); +$rows = []; +while ($row = mysqli_fetch_assoc($sql)) { + $rows[intval($row['vendor_template_id'])] = $row; } +$usage = vendorTemplateUsage(array_keys($rows)); + +$counts = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COALESCE(SUM(vendor_template_archived_at IS NULL), 0), COALESCE(SUM(vendor_template_archived_at IS NOT NULL), 0) + FROM vendor_templates WHERE $search")); + +$sort_link = function ($column, $label) use ($url_query_strings_sort, $sort, $disp, $order_icon) { + return '' + . $label . ($sort === $column ? " $order_icon" : '') . ''; +}; +$pill_url = function ($show) { + return '?' . http_build_query(array_filter(['q' => $_GET['q'] ?? '', 'show' => $show])); +}; + +$add_url = 'modals/vendor_template/vendor_template_add.php'; +$clients_url = '/agent/modals/vendor/vendor_template_clients.php'; +$csrf = $_SESSION['csrf_token']; ?>
    -

    - Vendor Templates -

    +

    Vendor Templates

    - +
    + + +
    + + Add one to clients + +
    + + Starter vendor templates + +
    +
    +
    - -
    +
    - - + +
    -
    +
    - - "> +
    + "> - - - - - + + + + + + - $row) { + $name = escapeHtml($row['vendor_template_name']); + $use = $usage[$template_id] ?? null; + $used_clients = $use['clients'] ?? 0; + $used_text = $used_clients ? $used_clients . ' client' . ($used_clients === 1 ? '' : 's') : ''; + if ($use && $use['ours']) { + $used_text = trim($used_text . ($used_text !== '' ? ' and ours' : 'Ours')); } - $vendor_template_account_number = escapeHtml($row['vendor_template_account_number']); - $vendor_template_contact_name = escapeHtml($row['vendor_template_contact_name']); - if (empty($vendor_template_contact_name)) { - $vendor_template_contact_name_display = "-"; - } else { - $vendor_template_contact_name_display = $vendor_template_contact_name; - } - $vendor_template_phone = formatPhoneNumber($row['vendor_template_phone']); - $vendor_template_extension = escapeHtml($row['vendor_template_extension']); - $vendor_template_email = escapeHtml($row['vendor_template_email']); - $vendor_template_website = escapeHtml($row['vendor_template_website']); - $vendor_template_hours = escapeHtml($row['vendor_template_hours']); - $vendor_template_sla = escapeHtml($row['vendor_template_sla']); - $vendor_template_code = escapeHtml($row['vendor_template_code']); - $vendor_template_notes = escapeHtml($row['vendor_template_notes']); - + $summary = trim((string) $row['vendor_template_description']); + $page_url = "vendor_template.php?vendor_template_id=$template_id"; + $phone = vendorTemplatePhoneHtml($row['vendor_template_phone'], $row['vendor_template_phone_country_code'], $row['vendor_template_extension']); + $website = vendorWebsiteLabel($row['vendor_template_website']); + // How to reach their support + $support = array_filter([ + $phone !== '' ? '' . $phone : '', + trim((string) $row['vendor_template_hours']) !== '' ? '' . escapeHtml($row['vendor_template_hours']) : '', + trim((string) $row['vendor_template_sla']) !== '' ? '' . escapeHtml($row['vendor_template_sla']) : '', + ]); ?> - - - - + - - + + + - - - +
    - - Vendor - - - - Description - - ContactUsed byActionSupport
    - - - - -
    - - -     		- - -
    - - -
    - - -
    - - +
    +
    + +
    + + +
    + + +
    + + +
    + + +
    Archived
    + + +
    +
    +
    +
    		- - - client + + +
    - - + -     		-
    - +
    		+ + + + Not yet + + > + +
    +     		+
    +
    - - Edit + + Edit - - Add to clients - - -
    - - Delete + + + Add to clients + + Copy + +
    + + + Restore + + + + Archive + + + + Delete +
    @@ -183,11 +237,14 @@ while ($use_row = mysqli_fetch_row($sql_template_use)) { $empty_state = [ 'thing' => 'vendor templates', 'icon' => 'fa-building', - 'text' => 'A vendor set up once - its support numbers and site - to add to any client.', - 'actions' => [['label' => 'New Vendor Template', 'modal' => 'modals/vendor_template/vendor_template_add.php']], + 'filtered' => $q !== '', + 'archived' => $show_archived, + 'views' => ['show'], + 'text' => 'A vendor your clients use again and again - an ISP, a hardware maker, the software they run - set up once with its support line, hours and site, ready to add to any client. Agents start one from New Vendor on a client\'s Vendors.', + 'actions' => [['label' => 'New Vendor Template', 'modal' => $add_url, 'size' => 'lg'], ['label' => 'Starter vendor templates', 'href' => 'starter_content.php', 'icon' => 'fa-seedling']], ]; + require_once "../includes/filter_footer.php"; ?> -
    $views['changes']['where'], + 'deletions' => $views['deletions']['where'], + 'data' => $views['data']['where'], + 'passwords' => "log_type = 'Credential' AND log_action IN ('View', 'View TOTP')", + 'exports' => "log_action IN ('Export', 'Download')", + 'signins' => "$signins AND log_action = 'Success'", + 'failed' => "$signins AND log_action IN ('" . implode("', '", SIGN_IN_FAILED) . "')", +]; +$sums = function ($alias = '') use ($parts) { + $out = []; + foreach ($parts as $key => $where) { + $out[] = "COALESCE(SUM($where), 0) AS {$alias}$key"; + } + return implode(', ', $out); +}; + +// Across the period, and the one before +$overall = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS entries, COUNT(DISTINCT NULLIF(log_user_id, 0)) AS people, " . $sums() . " + FROM logs WHERE $scope AND $in_period")); +$before = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS entries, " . $sums() . " + FROM logs WHERE $scope AND " . reportRangeSql('log_created_at', $period, true))); +$overall = array_map('intval', $overall); +$before = array_map('intval', $before); + +// Over time - changes, data out and, for an admin, sign-ins and failures +$buckets = reportBuckets($period); +$series = array_fill_keys(['changes', 'data', 'signins', 'failed'], array_fill_keys($buckets['keys'], 0)); +$sql = mysqli_query($mysqli, "SELECT " . reportBucketSql('log_created_at', $buckets['unit']) . " AS b, " . $sums() . " + FROM logs WHERE $scope AND $in_period GROUP BY b"); +while ($row = mysqli_fetch_assoc($sql)) { + foreach (array_keys($series) as $key) { + if (isset($series[$key][$row['b']])) { + $series[$key][$row['b']] = intval($row[$key]); + } + } +} + +// When people were at it - the hour of the week, ITFlow itself left out +$heat = []; +$sql = mysqli_query($mysqli, "SELECT WEEKDAY(log_created_at) + 1 AS d, HOUR(log_created_at) AS h, COUNT(*) AS n + FROM logs WHERE $scope AND $in_period AND log_user_id > 0 GROUP BY d, h"); +while ($row = mysqli_fetch_assoc($sql)) { + $heat[intval($row['d'])][intval($row['h'])] = intval($row['n']); +} +// Out of hours - outside the business days and hours set for SLAs (Admin > SLA), else 9 to 5 on weekdays +$sla = getSlaSettings(); +$work_days = $sla['business_days'] ?: [1, 2, 3, 4, 5]; +$work_start = preg_match('/^\d{2}:\d{2}(:\d{2})?$/', (string) $sla['business_hours_start']) ? substr($sla['business_hours_start'] . ':00', 0, 8) : '09:00:00'; +$work_end = preg_match('/^\d{2}:\d{2}(:\d{2})?$/', (string) $sla['business_hours_end']) ? substr($sla['business_hours_end'] . ':00', 0, 8) : '17:00:00'; +if ($work_end <= $work_start) { + [$work_start, $work_end] = ['09:00:00', '17:00:00']; +} +$out_of_hours = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE $scope AND $in_period AND log_user_id > 0 + AND (WEEKDAY(log_created_at) + 1 NOT IN (" . implode(',', array_map('intval', $work_days)) . ") OR TIME(log_created_at) < '$work_start' OR TIME(log_created_at) >= '$work_end')"))[0]); +$by_people = intval(mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*) FROM logs WHERE $scope AND $in_period AND log_user_id > 0"))[0]); + +// The audit log, for these entries - an admin's, or the client's when one is picked +$period_query = ['canned_date' => 'custom', 'dtf' => $period['start'], 'dtt' => $period['end']]; +$log_url = function (array $filters) use ($admin, $client_id, $period_query) { + if ($admin) { + return '/admin/audit_logs.php?' . http_build_query(array_merge($filters, $client_id && !isset($filters['client']) ? ['client' => $client_id] : [], $period_query)); + } + $client = intval($filters['client'] ?? $client_id); + if (!$client) { + return ''; + } + unset($filters['client']); + return '/agent/audit_log.php?' . http_build_query(array_merge(['client_id' => $client], $filters, $period_query)); +}; + +// By person - ITFlow itself last +$people = []; +$sql = mysqli_query($mysqli, "SELECT log_user_id AS id, user_name, user_avatar, user_type, COUNT(*) AS entries, " . $sums() . ", + COUNT(DISTINCT NULLIF(log_ip, '')) AS ips, COUNT(DISTINCT NULLIF(log_client_id, 0)) AS clients, MAX(log_created_at) AS last + FROM logs LEFT JOIN users ON user_id = log_user_id AND log_user_id > 0 + WHERE $scope AND $in_period GROUP BY log_user_id"); +// People since deleted are one row, -1, before ITFlow itself +$gone_ids = []; +while ($row = mysqli_fetch_assoc($sql)) { + $id = intval($row['id']); + if ($id > 0 && $row['user_name'] === null) { + $gone_ids[$id] = true; + $id = -1; + } + if (!isset($people[$id])) { + $people[$id] = ['id' => $id, 'person' => $id > 0 ? $row['user_name'] : ($id === 0 ? 'ITFlow itself' : 'People since deleted'), 'avatar' => (string) $row['user_avatar'], + 'kind' => $id === 0 ? 'system' : ($id < 0 ? 'gone' : (intval($row['user_type']) === 2 ? 'portal' : 'agent')), 'entries' => 0, 'prev' => 0, + 'ips' => 0, 'clients' => 0, 'last' => null, 'count' => 0] + array_fill_keys(array_keys($parts), 0); + } + $people[$id]['count']++; + foreach (array_merge(['entries', 'ips', 'clients'], array_keys($parts)) as $key) { + $people[$id][$key] += intval($row[$key]); + } + $people[$id]['last'] = max((string) $people[$id]['last'], (string) $row['last']); +} +if (isset($people[-1])) { + $people[-1]['person'] = $people[-1]['count'] . ' ' . ($people[-1]['count'] === 1 ? 'person' : 'people') . ' since deleted'; +} +if ($people) { + $sql = mysqli_query($mysqli, "SELECT log_user_id AS id, COUNT(*) AS n FROM logs WHERE $scope AND " . reportRangeSql('log_created_at', $period, true) . " GROUP BY log_user_id"); + while ($row = mysqli_fetch_assoc($sql)) { + $id = isset($gone_ids[intval($row['id'])]) ? -1 : intval($row['id']); + if (isset($people[$id])) { + $people[$id]['prev'] += intval($row['n']); + } + } +} +foreach ($people as &$row) { + $row['change'] = reportChange($row['entries'], $row['prev']); +} +unset($row); +uasort($people, function ($a, $b) { + $order = ['agent' => 0, 'portal' => 0, 'gone' => 1, 'system' => 2]; + return $order[$a['kind']] <=> $order[$b['kind']] ?: $b['entries'] <=> $a['entries'] ?: strcasecmp($a['person'], $b['person']); +}); +$people = array_values($people); + +// By client +$clients = []; +$sql = mysqli_query($mysqli, "SELECT log_client_id AS id, client_name, client_abbreviation, COUNT(*) AS entries, " . $sums() . ", + COUNT(DISTINCT NULLIF(log_user_id, 0)) AS people, MAX(log_created_at) AS last + FROM logs LEFT JOIN clients ON client_id = log_client_id + WHERE $scope AND $in_period AND log_client_id > 0 GROUP BY log_client_id ORDER BY entries DESC, client_name ASC"); +// Clients since deleted are one row, last +$gone_clients = null; +while ($row = mysqli_fetch_assoc($sql)) { + $client = ['id' => intval($row['id']), 'client' => (string) $row['client_name'], 'abbr' => (string) $row['client_abbreviation'], 'gone' => $row['client_name'] === null, + 'entries' => intval($row['entries']), 'changes' => intval($row['changes']), 'deletions' => intval($row['deletions']), 'data' => intval($row['data']), + 'people' => intval($row['people']), 'last' => $row['last'], 'count' => 1]; + if (!$client['gone']) { + $clients[] = $client; + } elseif ($gone_clients === null) { + $gone_clients = $client; + } else { + foreach (['entries', 'changes', 'deletions', 'data', 'people', 'count'] as $key) { + $gone_clients[$key] += $client[$key]; + } + $gone_clients['last'] = max($gone_clients['last'], $client['last']); + } +} +if ($gone_clients) { + $gone_clients['client'] = $gone_clients['count'] . ' client' . ($gone_clients['count'] === 1 ? '' : 's') . ' since deleted'; + $clients[] = $gone_clients; +} + +// By kind of record +$kinds = []; +$sql = mysqli_query($mysqli, "SELECT log_type AS type, COUNT(*) AS entries, SUM(log_action IN ('Create', 'Bulk Create', 'Import', 'Upload')) AS created, + SUM(log_action IN ('Edit', 'Bulk Edit', 'Update', 'Modify', 'Rename', 'Move', 'Merge')) AS edited, " . $sums() . ", + COUNT(DISTINCT NULLIF(log_entity_id, 0)) AS records, MAX(log_created_at) AS last + FROM logs WHERE $scope AND $in_period GROUP BY log_type ORDER BY entries DESC, log_type ASC"); +while ($row = mysqli_fetch_assoc($sql)) { + $kinds[] = ['type' => (string) $row['type'], 'entries' => intval($row['entries']), 'created' => intval($row['created']), 'edited' => intval($row['edited']), + 'deletions' => intval($row['deletions']), 'data' => intval($row['data']), 'records' => intval($row['records']), 'last' => $row['last']]; +} + +// The security events - for an admin +$security = []; +if ($admin) { + $sql = mysqli_query($mysqli, "SELECT log_type AS type, log_action AS action, COUNT(*) AS n, COUNT(DISTINCT NULLIF(log_ip, '')) AS ips, MAX(log_created_at) AS last + FROM logs WHERE $scope AND $in_period AND {$views['security']['where']} GROUP BY log_type, log_action ORDER BY n DESC, log_type ASC, log_action ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $security[] = ['type' => (string) $row['type'], 'action' => (string) $row['action'], 'n' => intval($row['n']), 'ips' => intval($row['ips']), 'last' => $row['last']]; + } +} + +$zero = function ($value, $tone = '') { + return $value ? '' . reportCount($value) . '' : '0'; +}; +$last_cell = function ($row) { + return $row['last'] ? '' . escapeHtml(timeAgo($row['last'])) . '' : ''; +}; + +$people_columns = [ + 'person' => ['label' => 'Who', 'html' => function ($row) use ($log_url) { + if ($row['kind'] === 'system') { + $cell = 'ITFlow itselfcron, the API, the email parser'; + } elseif ($row['kind'] === 'gone') { + return '' . escapeHtml($row['person']) . ''; + } else { + $cell = reportAgentCell($row['id'], $row['person'], $row['avatar'], 'Someone since deleted') + . ($row['kind'] === 'portal' ? ' Portal' : ''); + } + $url = $log_url(['user' => $row['id'] ?: 'system']); + return $url !== '' ? '' . $cell . '' : $cell; + }, 'csv' => function ($row) { + return $row['person'] . ($row['kind'] === 'portal' ? ' (portal)' : ''); + }], + 'entries' => ['label' => 'Entries', 'type' => 'count', 'class' => 'fw-semibold'], + 'change' => ['label' => 'Change', 'type' => 'percent', 'csv' => false, 'html' => function ($row) { + return $row['change'] === null ? '–' : '' . reportChangeHtml($row['entries'], $row['prev'], 'up') . ''; + }], + 'changes' => ['label' => 'Changes', 'type' => 'count', 'title' => 'Records made, changed, archived, restored and deleted'], + 'deletions' => ['label' => 'Deleted', 'type' => 'count', 'title' => 'Records deleted for good', 'html' => function ($row) use ($zero) { + return $zero($row['deletions'], 'danger'); + }], + 'passwords' => ['label' => 'Passwords seen', 'type' => 'count', 'title' => 'Passwords and 2FA codes looked at', 'html' => function ($row) use ($zero) { + return $zero($row['passwords'], 'warning'); + }], + 'exports' => ['label' => 'Exports', 'type' => 'count', 'title' => 'Exports and downloads', 'html' => function ($row) use ($zero) { + return $zero($row['exports'], 'warning'); + }], + 'clients' => ['label' => 'Clients', 'type' => 'count', 'title' => 'Clients they did something for'], +]; +if ($admin) { + $people_columns['signins'] = ['label' => 'Sign-ins', 'type' => 'count']; + $people_columns['failed'] = ['label' => 'Failed', 'type' => 'count', 'title' => 'Failed sign-ins against the account - not always them', 'html' => function ($row) use ($zero) { + return $zero($row['failed'], 'danger'); + }]; + $people_columns['ips'] = ['label' => 'IP addresses', 'type' => 'count', 'title' => 'Places it was done from']; +} +$people_columns['last'] = ['label' => 'Last', 'type' => 'date', 'html' => $last_cell]; + +$client_columns = [ + 'client' => ['label' => 'Client', 'html' => function ($row) use ($log_url) { + if ($row['gone']) { + return '' . escapeHtml($row['client']) . ''; + } + $url = $log_url(['client' => $row['id']]); + return reportClientCell($row['id'], $row['client'], $row['abbr'], 'client_overview.php') + . ($url !== '' ? ' ' : ''); + }], + 'entries' => ['label' => 'Entries', 'type' => 'count', 'class' => 'fw-semibold'], + 'changes' => ['label' => 'Changes', 'type' => 'count'], + 'deletions' => ['label' => 'Deleted', 'type' => 'count', 'html' => function ($row) use ($zero) { + return $zero($row['deletions'], 'danger'); + }], + 'data' => ['label' => 'Data out', 'type' => 'count', 'title' => 'Passwords looked at, exports, downloads and shared links', 'html' => function ($row) use ($zero) { + return $zero($row['data'], 'warning'); + }], + 'people' => ['label' => 'People', 'type' => 'count', 'title' => 'Agents and portal contacts'], + 'last' => ['label' => 'Last', 'type' => 'date', 'html' => $last_cell], +]; + +$kind_columns = [ + 'type' => ['label' => 'What', 'html' => function ($row) use ($log_url) { + $url = $log_url(['type' => $row['type']]); + $label = '' . escapeHtml($row['type']); + return $url !== '' ? '' . $label . '' : $label; + }], + 'entries' => ['label' => 'Entries', 'type' => 'count', 'class' => 'fw-semibold'], + 'records' => ['label' => 'Records', 'type' => 'count', 'title' => 'Different records'], + 'created' => ['label' => 'Made', 'type' => 'count'], + 'edited' => ['label' => 'Changed', 'type' => 'count'], + 'deletions' => ['label' => 'Deleted', 'type' => 'count', 'html' => function ($row) use ($zero) { + return $zero($row['deletions'], 'danger'); + }], + 'data' => ['label' => 'Data out', 'type' => 'count', 'html' => function ($row) use ($zero) { + return $zero($row['data'], 'warning'); + }], + 'last' => ['label' => 'Last', 'type' => 'date', 'html' => $last_cell], +]; + +$security_columns = [ + 'what' => ['label' => 'What', 'html' => function ($row) use ($log_url) { + $url = $log_url(['view' => 'security', 'type' => $row['type'], 'action' => $row['action']]); + return '' . escapeHtml($row['type']) . ' ' . auditLogActionPill($row['action']); + }, 'csv' => function ($row) { + return $row['type'] . ' ' . $row['action']; + }], + 'n' => ['label' => 'Times', 'type' => 'count', 'class' => 'fw-semibold'], + 'ips' => ['label' => 'IP addresses', 'type' => 'count'], + 'last' => ['label' => 'Last', 'type' => 'date', 'html' => $last_cell], +]; + +$sum = function (array $rows, $key) { + return array_sum(array_column($rows, $key)); +}; +$people_totals = ['person' => 'Total', 'entries' => $overall['entries']] + array_intersect_key($overall, $parts); +$client_totals = ['client' => 'Total', 'entries' => $sum($clients, 'entries'), 'changes' => $sum($clients, 'changes'), 'deletions' => $sum($clients, 'deletions'), 'data' => $sum($clients, 'data')]; +$kind_totals = ['type' => 'Total', 'entries' => $overall['entries'], 'created' => $sum($kinds, 'created'), 'edited' => $sum($kinds, 'edited'), 'deletions' => $overall['deletions'], 'data' => $overall['data']]; + +$name = $period['start'] . ' to ' . $period['end']; +if (reportExporting('clients')) { + reportCsv("Audit Activity by Client $name", $client_columns, $clients, $client_totals); +} +if (reportExporting('kinds')) { + reportCsv("Audit Activity by Kind $name", $kind_columns, $kinds, $kind_totals); +} +if ($admin && reportExporting('security')) { + reportCsv("Audit Activity Security $name", $security_columns, $security, ['what' => 'Total', 'n' => $sum($security, 'n')]); +} +if (reportExporting()) { + reportCsv("Audit Activity by Person $name", $people_columns, $people, $people_totals); +} + +require_once "includes/inc_report_layout.php"; + +// Years with entries, back to the oldest kept +$past_years = []; +$oldest = mysqli_fetch_row(mysqli_query($mysqli, "SELECT YEAR(MIN(log_created_at)) FROM logs"))[0] ?? null; +for ($y = intval(date('Y')) - 2; $oldest && $y >= intval($oldest); $y--) { + $past_years[] = $y; +} +$retention = appLogRetention(); + +$exports = ['' => 'By person', 'clients' => 'By client', 'kinds' => 'By kind'] + ($admin ? ['security' => 'Security events'] : []); +$stats = [ + ['label' => 'Changes', 'value' => reportCount($overall['changes']), + 'sub' => ($before['changes'] || $overall['changes'] ? reportChangeHtml($overall['changes'], $before['changes'], 'up', 'the period before') . ' · ' : '') + . $overall['people'] . ' ' . ($overall['people'] === 1 ? 'person' : 'people') . ''], + ['label' => 'Deleted', 'value' => reportCount($overall['deletions']), 'tone' => $overall['deletions'] ? 'danger' : '', + 'sub' => $before['deletions'] || $overall['deletions'] ? reportChangeHtml($overall['deletions'], $before['deletions'], 'down', 'the period before') : 'Nothing deleted'], + ['label' => 'Data out', 'value' => reportCount($overall['data']), 'tone' => $overall['data'] ? 'warning' : '', + 'sub' => reportCount($overall['passwords']) . ' password' . ($overall['passwords'] === 1 ? '' : 's') . ' seen · ' + . reportCount($overall['exports']) . ' export' . ($overall['exports'] === 1 ? '' : 's') . ''], +]; +if ($admin) { + $stats[] = ['label' => 'Sign-ins', 'value' => reportCount($overall['signins']), 'tone' => $overall['failed'] > $overall['signins'] ? 'danger' : '', + 'sub' => $overall['failed'] ? '' . reportCount($overall['failed']) . ' failed' : 'None failed']; +} else { + $stats[] = ['label' => 'Out of hours', 'value' => $by_people ? reportPercent(reportShare($out_of_hours, $by_people)) : '-', + 'sub' => reportCount($out_of_hours) . ' of ' . reportCount($by_people) . ' entries']; +} + +$chart_series = [ + ['label' => 'Changes', 'tone' => 'accent', 'data' => array_values($series['changes']), 'stack' => 'a'], + ['label' => 'Data out', 'tone' => 'warning', 'data' => array_values($series['data']), 'stack' => 'a'], +]; +if ($admin) { + $chart_series[] = ['label' => 'Sign-ins', 'tone' => 'info', 'data' => array_values($series['signins']), 'stack' => 'a']; + $chart_series[] = ['label' => 'Failed sign-ins', 'tone' => 'danger', 'data' => array_values($series['failed']), 'stack' => 'a']; +} + +?> + +
    + + $period, + 'years' => $past_years, + 'client' => $client_id, + 'agent' => $agent_id, + 'export' => $exports, + 'print_meta' => implode(' · ', array_filter([$client_id ? reportClientName($client_id) : '', $agent_id ? getFieldById('users', $agent_id, 'user_name') : ''])), + 'note' => escapeHtml(reportFind('audit_activity')['description']) . ($admin ? '' : ' You see the kinds of entry your role covers.') + . ($retention['audit'] ? ' The audit log keeps ' . escapeHtml(strtolower(appLogRetentionText($retention['audit']))) . ', so a period before that is empty.' : ''), + ]); ?> + + + + +
    + + + +
    + 'bar', 'labels' => $buckets['labels'], 'series' => $chart_series, 'stacked' => true, 'format' => 'count'], '', 'Entries by ' . $buckets['unit']) ?> +
    +
    + + +
    + +
    +
    + + + 'Nobody did anything in this period.', 'totals' => $people_totals]) ?> +
    + Changes are records made, changed, archived, restored and deleted. Failed sign-ins are against the account, so they may be someone else trying it. Each person opens their entries in the audit log. +
    +
    • + + + + '']) ?> +
    + + + + 'Nothing was done for a client in this period.', 'totals' => $client_totals]) ?> +
    + + + 'Nothing in this period.', 'totals' => $kind_totals]) ?> + + + + + + + + diff --git a/agent/vendor.php b/agent/vendor.php index cf4df5b9f..1082654a2 100644 --- a/agent/vendor.php +++ b/agent/vendor.php @@ -249,7 +249,13 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie
    - + + + + + + +
    @@ -316,6 +322,12 @@ if (!$vendor || (isset($_GET['client_id']) && $vendor_client_id !== intval($clie
    + + + Make a template from it + +
    + Restore diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index b0beaf6fa..51974797c 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -89,6 +89,7 @@ if (isset($api_key)) { } mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = '$failed_description', log_ip = '$ip', log_user_agent = '$user_agent', log_entity_id = " . intval($expired_key['api_key_id'] ?? 0)); + logForwardQueue('audit', mysqli_insert_id($mysqli)); apiKeyWatch(); $return_arr['success'] = "False"; diff --git a/client/login_reset.php b/client/login_reset.php index 07ccccfe4..ca6cf2f3a 100644 --- a/client/login_reset.php +++ b/client/login_reset.php @@ -42,6 +42,7 @@ $link = ['email' => '', 'token' => '', 'client' => 0]; $reset_log = function ($action, $description, $user_id, $client_id) use ($mysqli, $ip, $user_agent) { mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Client Login', log_action = '" . escapeSql($action) . "', log_description = '" . escapeSql($description) . "', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = " . intval($client_id) . ", log_user_id = " . intval($user_id)); + logForwardQueue('audit', mysqli_insert_id($mysqli)); }; if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['password_reset_email_request']) && $can_email) { diff --git a/cron/nightly_tasks.php b/cron/nightly_tasks.php index 3d925da68..f89449f94 100644 --- a/cron/nightly_tasks.php +++ b/cron/nightly_tasks.php @@ -30,7 +30,7 @@ $sql_companies = mysqli_query($mysqli, "SELECT company_city, company_country, co company_name, company_phone, company_phone_country_code, company_state, company_website, config_enable_alert_domain_expire, config_enable_cron, config_invoice_from_email, config_invoice_from_name, config_invoice_late_fee_enable, config_invoice_late_fee_percent, - config_invoice_prefix, config_log_retention, config_login_remember_me_expire, + config_invoice_prefix, config_login_remember_me_expire, config_mail_from_email, config_mail_from_name, config_module_enable_accounting, config_module_enable_itdoc, config_module_enable_ticketing, config_recurring_auto_send_invoice, config_send_invoice_reminders, config_smtp_encryption, @@ -96,9 +96,6 @@ $config_send_invoice_reminders = intval($row['config_send_invoice_reminders']); // Remember-me Token Expiry $config_login_remember_me_expire = intval($row['config_login_remember_me_expire']); -// Log retention -$config_log_retention = intval($row['config_log_retention']); - // Set Currency Format $currency_format = numfmt_create($company_locale, NumberFormatter::CURRENCY); @@ -179,14 +176,19 @@ mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_created_ // delete the archive it was supposed to replace. backupRunRetention($mysqli); -// Cleanup old audit logs -mysqli_query($mysqli, "DELETE FROM logs WHERE log_created_at < CURDATE() - INTERVAL $config_log_retention DAY"); +// Cleanup old logs - each kept for its own number of days, 0 for keep forever (Admin > Settings > Logs, functions/app_log.php) +$log_retention = appLogRetention(); -// Cleanup old app/debug logs -mysqli_query($mysqli, "DELETE FROM app_logs WHERE app_log_created_at < CURDATE() - INTERVAL $config_log_retention DAY"); +// The audit log, and API key use with it +if ($log_retention['audit'] > 0) { + mysqli_query($mysqli, "DELETE FROM logs WHERE log_created_at < CURDATE() - INTERVAL {$log_retention['audit']} DAY"); + mysqli_query($mysqli, "DELETE FROM api_key_usage WHERE api_key_usage_date < CURDATE() - INTERVAL {$log_retention['audit']} DAY"); +} -// Cleanup old API key use - the days kept as long as the audit log -mysqli_query($mysqli, "DELETE FROM api_key_usage WHERE api_key_usage_date < CURDATE() - INTERVAL $config_log_retention DAY"); +// The app logs +if ($log_retention['app'] > 0) { + mysqli_query($mysqli, "DELETE FROM app_logs WHERE app_log_created_at < CURDATE() - INTERVAL {$log_retention['app']} DAY"); +} // CLeanup old domain history $sql = mysqli_query($mysqli, "SELECT domain_id FROM domains"); diff --git a/db.sql b/db.sql index b6da257fb..51853ca81 100644 --- a/db.sql +++ b/db.sql @@ -155,7 +155,8 @@ CREATE TABLE `app_logs` ( `app_log_type` enum('info','warning','error','debug') NOT NULL DEFAULT 'info', `app_log_details` varchar(1000) DEFAULT NULL, `app_log_created_at` datetime NOT NULL DEFAULT current_timestamp(), - PRIMARY KEY (`app_log_id`) + PRIMARY KEY (`app_log_id`), + KEY `app_log_created_at` (`app_log_created_at`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; @@ -2945,6 +2946,15 @@ CREATE TABLE `settings` ( `config_share_max_hours` int(11) NOT NULL DEFAULT 720, `config_share_require_protection` tinyint(1) NOT NULL DEFAULT 0, `config_login_alert_failures` int(11) NOT NULL DEFAULT 10, + `config_app_log_retention` int(11) NOT NULL DEFAULT 90, + `config_log_forward_enabled` tinyint(1) NOT NULL DEFAULT 0, + `config_log_forward_host` varchar(200) DEFAULT NULL, + `config_log_forward_port` int(11) NOT NULL DEFAULT 514, + `config_log_forward_protocol` varchar(10) NOT NULL DEFAULT 'udp', + `config_log_forward_format` varchar(10) NOT NULL DEFAULT 'json', + `config_log_forward_audit` tinyint(1) NOT NULL DEFAULT 1, + `config_log_forward_app_level` varchar(10) NOT NULL DEFAULT 'warning', + `config_log_forward_tls_verify` tinyint(1) NOT NULL DEFAULT 1, PRIMARY KEY (`company_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; @@ -4003,6 +4013,8 @@ CREATE TABLE `vendor_templates` ( `vendor_template_created_at` datetime NOT NULL DEFAULT current_timestamp(), `vendor_template_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(), `vendor_template_archived_at` datetime DEFAULT NULL, + `vendor_template_created_by` int(11) NOT NULL DEFAULT 0, + `vendor_template_updated_by` int(11) NOT NULL DEFAULT 0, PRIMARY KEY (`vendor_template_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; diff --git a/functions.php b/functions.php index 217d18abb..ca2437a74 100644 --- a/functions.php +++ b/functions.php @@ -30,12 +30,15 @@ require_once __DIR__ . '/functions/software.php'; require_once __DIR__ . '/functions/software_template.php'; require_once __DIR__ . '/functions/location.php'; require_once __DIR__ . '/functions/vendor.php'; +require_once __DIR__ . '/functions/vendor_template.php'; require_once __DIR__ . '/functions/credential.php'; require_once __DIR__ . '/functions/links.php'; require_once __DIR__ . '/functions/auth.php'; require_once __DIR__ . '/functions/logging.php'; +require_once __DIR__ . '/functions/log_forward.php'; require_once __DIR__ . '/functions/audit_log.php'; require_once __DIR__ . '/functions/sign_in.php'; +require_once __DIR__ . '/functions/app_log.php'; require_once __DIR__ . '/functions/app.php'; require_once __DIR__ . '/functions/email.php'; require_once __DIR__ . '/functions/email_preview.php'; diff --git a/functions/app_log.php b/functions/app_log.php new file mode 100644 index 000000000..facc6be5a --- /dev/null +++ b/functions/app_log.php @@ -0,0 +1,188 @@ + App Logs lists them (admin/app_logs.php) + * by level, searched and filtered by category and date, the same way they + * are exported and cleared (appLogFiltersSql()), each with a quick look + * (admin/modals/app_log/app_log.php). Nightly keeps them for their own number + * of days (Admin > Settings > Logs, appLogRetention()). + */ + +/** The levels, worst first - each with its label, the word for one, icon and tone. */ +function appLogLevels() { + return [ + 'error' => ['label' => 'Errors', 'one' => 'Error', 'icon' => 'fa-times-circle', 'tone' => 'danger', 'title' => 'Something failed'], + 'warning' => ['label' => 'Warnings', 'one' => 'Warning', 'icon' => 'fa-exclamation-triangle', 'tone' => 'warning', 'title' => 'Something to look at, that carried on'], + 'info' => ['label' => 'Info', 'one' => 'Info', 'icon' => 'fa-info-circle', 'tone' => 'info', 'title' => 'What was done - a cron run, mail sent'], + 'debug' => ['label' => 'Debug', 'one' => 'Debug', 'icon' => 'fa-bug', 'tone' => 'secondary', 'title' => 'Detail for tracking a problem down'], + ]; +} + +/** A level, as one of appLogLevels() - 'info' for anything else. */ +function appLogLevel($level) { + $level = strtolower((string) $level); + return isset(appLogLevels()[$level]) ? $level : 'info'; +} + +/** A level as a soft pill, in its tone. */ +function appLogLevelPill($level) { + $level = appLogLevel($level); + $style = appLogLevels()[$level]; + $tone = $style['tone']; + return '' + . '' . $style['one'] . ''; +} + +/* + * A category's icon, as the full class - by its name, or the part before a + * dash (Cron-Mail-Queue is mail, Cron-Domain-Refresher a domain). + */ +function appLogCategoryIcon($category) { + $icons = [ + 'Cron-Email-Parser' => 'fa-inbox', 'Cron-Mail-Queue' => 'fa-paper-plane', 'Cron-Ticket-SLA' => 'fa-stopwatch', + 'Cron-Domain-Refresher' => 'fa-globe', 'Cron-Certificate-Refresher' => 'fa-lock', 'Cron' => 'fa-clock', + 'Stripe' => 'fa-credit-card', 'Mail' => 'fa-envelope', 'API' => 'fa-plug', 'AI' => 'fa-robot', 'Request' => 'fa-exchange-alt', + 'Quote' => 'fa-comment-dollar', 'Invoice' => 'fa-file-invoice', 'Guest' => 'fa-user', 'Backup' => 'fa-cloud-upload-alt', + 'Update' => 'fa-download', LOG_FORWARD_CATEGORY => 'fa-share-square', 'Database' => 'fa-database', + ]; + $category = (string) $category; + $icon = $icons[$category] ?? $icons[strtok($category, '-')] ?? 'fa-clipboard-list'; + return "fas $icon"; +} + +/* + * The list's views - one a level, and All - key => label, icon, title and + * the SQL on app_logs that picks them. + */ +function appLogViews() { + $views = ['' => ['label' => 'All', 'icon' => 'fa-list', 'title' => 'Everything', 'where' => '', 'tone' => '']]; + foreach (appLogLevels() as $level => $style) { + $views[$level] = ['label' => $style['label'], 'icon' => $style['icon'], 'title' => $style['title'], 'where' => "app_log_type = '$level'", 'tone' => $style['tone']]; + } + return $views; +} + +/* + * The app logs' filters as SQL on app_logs - from the list page's GET, or + * the export and clear windows' POST: q (the category or details), category, + * view (a level, appLogViews()) and dtf / dtt. $summary gets them in words, + * for an export or the audit log entry for a clear. + */ +function appLogFiltersSql(array $src, &$summary = []) { + $summary = []; + $sql = '1 = 1'; + // One value each - anything else (a list in the query string) is no filter + $src = array_map(function ($value) { + return is_scalar($value) ? trim((string) $value) : ''; + }, $src); + + $q = $src['q'] ?? ''; + if ($q !== '') { + $like = escapeSql($q); + $sql .= " AND (app_log_category LIKE '%$like%' OR app_log_details LIKE '%$like%')"; + $summary['Search'] = $q; + } + $category = $src['category'] ?? ''; + if ($category !== '') { + $sql .= " AND app_log_category = '" . escapeSql($category) . "'"; + $summary['Category'] = $category; + } + $views = appLogViews(); + $view = $src['view'] ?? ''; + if (isset($views[$view]) && $views[$view]['where'] !== '') { + $sql .= " AND {$views[$view]['where']}"; + $summary['Showing'] = $views[$view]['label']; + } + // A half-open range on the column itself, so KEY app_log_created_at serves it + $dtf = $src['dtf'] ?? ''; + $dtt = $src['dtt'] ?? ''; + $dtf = appLogDate($dtf) ? $dtf : '1970-01-01'; + $dtt = appLogDate($dtt) ? $dtt : '2099-12-31'; + if ($dtf !== '1970-01-01' || $dtt !== '2099-12-31') { + $sql .= " AND app_log_created_at >= '$dtf 00:00:00' AND app_log_created_at < '$dtt' + INTERVAL 1 DAY"; + $range = formatExportDateRange($dtf, $dtt); + if ($range) { + $summary['Dated'] = $range; + } + } + return $sql; +} + +/** The filters' summary (appLogFiltersSql()) in a phrase - "Errors from Stripe matching "card", 2026-10-01 to 2026-10-19". */ +function appLogFiltersText(array $summary) { + $text = isset($summary['Showing']) ? $summary['Showing'] : 'Entries'; + if (isset($summary['Category'])) { + $text .= ' from ' . $summary['Category']; + } + if (isset($summary['Search'])) { + $text .= ' matching "' . $summary['Search'] . '"'; + } + if (isset($summary['Dated'])) { + $text .= ', ' . $summary['Dated']; + } + return $text; +} + +/** Is this a real Y-m-d date? */ +function appLogDate($value) { + $date = DateTime::createFromFormat('!Y-m-d', (string) $value); + return $date && $date->format('Y-m-d') === (string) $value; +} + +/** The categories there are, with how many entries each has: name => count. */ +function appLogCategories() { + global $mysqli; + $categories = []; + $sql = mysqli_query($mysqli, "SELECT app_log_category, COUNT(*) FROM app_logs WHERE app_log_category IS NOT NULL AND app_log_category <> '' GROUP BY app_log_category ORDER BY app_log_category ASC"); + while ($row = mysqli_fetch_row($sql)) { + $categories[$row[0]] = intval($row[1]); + } + return $categories; +} + +/* + * How many days each log is kept - 'audit' (and API key use) and 'app' - 0 + * for keep forever. Read apart from the settings every page loads, so a + * page still opens before the update that adds the app logs' own. + */ +function appLogRetention() { + global $mysqli; + $row = []; + try { + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT config_log_retention, config_app_log_retention FROM settings WHERE company_id = 1")) ?: []; + } catch (Throwable $e) { + $result = mysqli_query($mysqli, "SELECT config_log_retention FROM settings WHERE company_id = 1"); + $row = $result ? (mysqli_fetch_assoc($result) ?: []) : []; + $row['config_app_log_retention'] = $row['config_log_retention'] ?? 90; + } + return [ + 'audit' => max(0, intval($row['config_log_retention'] ?? 90)), + 'app' => max(0, intval($row['config_app_log_retention'] ?? 90)), + ]; +} + +/** A retention in words - "90 days", "Forever". */ +function appLogRetentionText($days) { + $days = intval($days); + if ($days <= 0) { + return 'Forever'; + } + if ($days % 365 === 0) { + return ($days / 365) . ' year' . ($days === 365 ? '' : 's'); + } + return number_format($days) . ' day' . ($days === 1 ? '' : 's'); +} + +/** How much a log holds - its entries and the oldest one: ['count', 'oldest']. */ +function appLogSize($table) { + global $mysqli; + $columns = ['logs' => 'log_created_at', 'app_logs' => 'app_log_created_at']; + if (!isset($columns[$table])) { + return ['count' => 0, 'oldest' => null]; + } + $row = mysqli_fetch_row(mysqli_query($mysqli, "SELECT COUNT(*), MIN({$columns[$table]}) FROM $table")); + return ['count' => intval($row[0] ?? 0), 'oldest' => $row[1] ?? null]; +} diff --git a/functions/audit_log.php b/functions/audit_log.php index c7a02a3b7..9b86dd28f 100644 --- a/functions/audit_log.php +++ b/functions/audit_log.php @@ -57,6 +57,7 @@ function auditLogKinds() { 'Project Template' => ['icon' => 'fa-project-diagram', 'table' => 'project_templates', 'id' => 'project_template_id', 'name' => 'project_template_name', 'url' => '/admin/project_template.php?project_template_id={id}'], 'Document Template' => ['icon' => 'fa-file-alt', 'table' => 'document_templates', 'id' => 'document_template_id', 'name' => 'document_template_name', 'url' => '/admin/document_template.php?document_template_id={id}'], 'Software Template' => ['icon' => 'fa-cube', 'table' => 'software_templates', 'id' => 'software_template_id', 'name' => 'software_template_name', 'url' => '/admin/software_template.php?software_template_id={id}'], + 'Vendor Template' => ['icon' => 'fa-building', 'table' => 'vendor_templates', 'id' => 'vendor_template_id', 'name' => 'vendor_template_name', 'url' => '/admin/vendor_template.php?vendor_template_id={id}'], // Not one record to open, or nothing to open it with - just an icon 'Login' => ['icon' => 'fa-sign-in-alt'], @@ -92,7 +93,7 @@ function auditLogKinds() { 'Reconciliation' => ['icon' => 'fa-balance-scale', 'module' => 'module_financial'], 'Budget' => ['icon' => 'fa-chart-pie', 'module' => 'module_financial'], 'Tax' => ['icon' => 'fa-percent'], - 'Stripe' => ['icon' => 'fa-stripe-s', 'module' => 'module_financial'], + 'Stripe' => ['icon' => 'fa-credit-card', 'module' => 'module_financial'], 'Payment Provider' => ['icon' => 'fa-credit-card'], 'Payment Method' => ['icon' => 'fa-credit-card', 'module' => 'module_financial'], 'Email' => ['icon' => 'fa-envelope'], @@ -105,7 +106,6 @@ function auditLogKinds() { 'SLA' => ['icon' => 'fa-stopwatch'], 'Canned Response' => ['icon' => 'fa-comment-dots'], 'Contract Template' => ['icon' => 'fa-file-contract'], - 'Vendor Template' => ['icon' => 'fa-building'], 'Custom Field' => ['icon' => 'fa-th-list'], 'Custom Link' => ['icon' => 'fa-external-link-alt'], 'AI Provider' => ['icon' => 'fa-robot'], @@ -115,6 +115,7 @@ function auditLogKinds() { 'Report' => ['icon' => 'fa-chart-bar', 'module' => 'module_reporting'], 'Sharing' => ['icon' => 'fa-share-alt'], 'Audit Log' => ['icon' => 'fa-history'], + 'App Log' => ['icon' => 'fa-clipboard-list'], ]; } @@ -165,9 +166,9 @@ function auditLogActionPill($action) { * them. Sign-ins are agents and portal contacts signing in and out; security * is the sign-ins that failed or were turned away and the admins told about * them, API calls turned away, access denied, the portal viewed as a contact, - * and changes to users, roles, API keys, the master key, settings and - * backups; data out is passwords looked at, exports, downloads and shared - * links. + * app log entries cleared, and changes to users, roles, API keys, the master + * key, settings and backups; data out is passwords looked at, exports, + * downloads and shared links. */ function auditLogViews() { $signins = "log_type IN ('Login', 'Login 2FA', 'Logout', 'Client Login')"; @@ -177,8 +178,8 @@ function auditLogViews() { 'changes' => ['label' => 'Changes', 'icon' => 'fa-pen', 'title' => 'Records made, changed, archived, restored and deleted', 'where' => "NOT $signins AND NOT $data_out"], 'deletions' => ['label' => 'Deletions', 'icon' => 'fa-trash-alt', 'title' => 'Records deleted for good', 'where' => "log_action IN ('Delete', 'Bulk Delete')"], 'signins' => ['label' => 'Sign-ins', 'icon' => 'fa-sign-in-alt', 'title' => 'Agents and portal contacts signing in and out', 'where' => $signins], - 'security' => ['label' => 'Security', 'icon' => 'fa-shield-alt', 'title' => 'Failed and turned away sign-ins and the alerts about them, API calls turned away, access denied, the portal viewed as a contact, and changes to users, roles, API keys, the master key, settings and backups', - 'where' => "(($signins AND log_action IN ('Failed', 'MFA Failed', 'Blocked', 'Alert')) OR (log_type = 'API' AND log_action = 'Failed') OR log_action IN ('Denied', 'View As') OR log_type IN ('User', 'User Account', 'User Role', 'API Key', 'Master Key', 'Settings', 'Backup', 'Identity Provider'))"], + 'security' => ['label' => 'Security', 'icon' => 'fa-shield-alt', 'title' => 'Failed and turned away sign-ins and the alerts about them, API calls turned away, access denied, the portal viewed as a contact, app logs cleared, and changes to users, roles, API keys, the master key, settings and backups', + 'where' => "(($signins AND log_action IN ('Failed', 'MFA Failed', 'Blocked', 'Alert')) OR (log_type = 'API' AND log_action = 'Failed') OR log_action IN ('Denied', 'View As') OR (log_type = 'App Log' AND log_action = 'Delete') OR log_type IN ('User', 'User Account', 'User Role', 'API Key', 'Master Key', 'Settings', 'Backup', 'Identity Provider'))"], 'data' => ['label' => 'Data out', 'icon' => 'fa-file-export', 'title' => 'Passwords looked at, exports, downloads and shared links', 'where' => $data_out], ]; } diff --git a/functions/export.php b/functions/export.php index 67e8eeea8..1eccdf1ba 100644 --- a/functions/export.php +++ b/functions/export.php @@ -494,6 +494,14 @@ function getExportColumns($export_type) { 'log_id' => ['label' => 'Entry', 'default' => false], ], + 'app_logs' => [ + 'app_log_created_at' => ['label' => 'When'], + 'app_log_type' => ['label' => 'Level'], + 'app_log_category' => ['label' => 'Category'], + 'app_log_details' => ['label' => 'Details', 'weight' => 4], + 'app_log_id' => ['label' => 'Entry', 'default' => false], + ], + ]; return $registry[$export_type] ?? []; diff --git a/functions/log_forward.php b/functions/log_forward.php new file mode 100644 index 000000000..3b9d70c7b --- /dev/null +++ b/functions/log_forward.php @@ -0,0 +1,588 @@ + Settings > Logs). Each audit log entry - from logAudit() + * and the few places that write to logs themselves - and each app log entry + * at or above the level picked (logApp()) goes out as an RFC 5424 syslog + * message, over UDP, TCP or TLS, with the entry as JSON, CEF or plain text. + * + * Entries are queued as they are written (logForwardQueue()) and sent when + * the request ends (logForwardFlush()), over one connection - so an entry + * written in a transaction that is then rolled back is never sent, as it is + * no longer there to read. Sending never gets in the way: a server that + * can't be reached is tried once, the failure goes in the app log under Log + * Forwarding, and nothing more is sent for a minute, so a dead server doesn't + * slow every page down. The entries in between are only in ITFlow's own logs. + */ + +const LOG_FORWARD_PROTOCOLS = ['udp' => 'UDP', 'tcp' => 'TCP', 'tls' => 'TLS']; +const LOG_FORWARD_FORMATS = ['json' => 'JSON', 'cef' => 'CEF', 'plain' => 'Plain text']; +const LOG_FORWARD_TIMEOUT = 2; // seconds to connect, or to write +const LOG_FORWARD_BACKOFF = 60; // seconds nothing is sent after a failure +const LOG_FORWARD_BATCH = 50; // entries queued before they are sent anyway, for a long cron run +const LOG_FORWARD_FACILITY = 16; // local0 +const LOG_FORWARD_CATEGORY = 'Log Forwarding'; + +/** Which app log entries go out - the level and the ones above it, '' for none. */ +function logForwardAppLevels() { + return [ + '' => 'None', + 'error' => 'Errors', + 'warning' => 'Warnings and errors', + 'info' => 'Info, warnings and errors', + 'debug' => 'Everything, debug too', + ]; +} + +/** What each protocol is, in a line. */ +function logForwardProtocolHelp() { + return [ + 'udp' => 'Fast, and nothing waits for the server - but nothing says whether it got there.', + 'tcp' => 'Each entry arrives, in order, one a line.', + 'tls' => 'TCP, encrypted - for a server outside your network.', + ]; +} + +/** What each format is, in a line. */ +function logForwardFormatHelp() { + return [ + 'json' => 'One JSON object an entry - Graylog, Splunk, Elastic, Wazuh and most others read it as it is.', + 'cef' => 'Common Event Format - for Microsoft Sentinel, QRadar, ArcSight and other SIEMs that take it.', + 'plain' => 'A line of text an entry, as a person would read it.', + ]; +} + +/* + * The forwarding settings, tidied: enabled, host, port, protocol, format, + * audit, app_level and tls_verify. Read once a request, apart from the + * settings every page loads, so a page still opens before the update that + * adds them - all off until then. $fresh reads them again, after a save. + */ +function logForwardSettings($fresh = false) { + global $mysqli; + static $settings = null; + if ($settings !== null && !$fresh) { + return $settings; + } + $row = []; + try { + $result = mysqli_query($mysqli, "SELECT config_log_forward_enabled, config_log_forward_host, config_log_forward_port, config_log_forward_protocol, + config_log_forward_format, config_log_forward_audit, config_log_forward_app_level, config_log_forward_tls_verify + FROM settings WHERE company_id = 1"); + $row = $result ? (mysqli_fetch_assoc($result) ?: []) : []; + } catch (Throwable $e) { + $row = []; + } + $settings = logForwardTidy([ + 'enabled' => $row['config_log_forward_enabled'] ?? 0, + 'host' => $row['config_log_forward_host'] ?? '', + 'port' => $row['config_log_forward_port'] ?? 514, + 'protocol' => $row['config_log_forward_protocol'] ?? 'udp', + 'format' => $row['config_log_forward_format'] ?? 'json', + 'audit' => $row['config_log_forward_audit'] ?? 1, + 'app_level' => $row['config_log_forward_app_level'] ?? 'warning', + 'tls_verify' => $row['config_log_forward_tls_verify'] ?? 1, + ]); + return $settings; +} + +/** Settings from the database or the form, each made one of what it can be. */ +function logForwardTidy(array $src) { + // One value each - a list from a form is nothing + $src = array_map(function ($value) { + return is_scalar($value) || $value === null ? $value : ''; + }, $src); + $host = trim((string) ($src['host'] ?? '')); + $port = intval($src['port'] ?? 514); + // A name or IPv4 address typed with its port - logs.example.com:1514 - is the two + if (preg_match('/^([A-Za-z0-9._-]+):(\d{1,5})$/', $host, $match)) { + $host = $match[1]; + $port = intval($match[2]); + } + // A name or an address, IPv6 in brackets or not - nothing that could break out of the address it is put in + if (!preg_match('/^\[?[A-Za-z0-9.:_-]{1,200}\]?$/', $host)) { + $host = ''; + } + $protocol = (string) ($src['protocol'] ?? 'udp'); + $format = (string) ($src['format'] ?? 'json'); + $app_level = (string) ($src['app_level'] ?? ''); + return [ + 'enabled' => intval($src['enabled'] ?? 0) ? 1 : 0, + 'host' => trim($host, '[]'), + 'port' => $port >= 1 && $port <= 65535 ? $port : 514, + 'protocol' => isset(LOG_FORWARD_PROTOCOLS[$protocol]) ? $protocol : 'udp', + 'format' => isset(LOG_FORWARD_FORMATS[$format]) ? $format : 'json', + 'audit' => intval($src['audit'] ?? 0) ? 1 : 0, + 'app_level' => isset(logForwardAppLevels()[$app_level]) ? $app_level : '', + 'tls_verify' => intval($src['tls_verify'] ?? 0) ? 1 : 0, + ]; +} + +/** Is anything being sent? */ +function logForwardOn(?array $settings = null) { + $settings = $settings ?? logForwardSettings(); + return $settings['enabled'] && $settings['host'] !== '' && ($settings['audit'] || $settings['app_level'] !== ''); +} + +/** Where they go, in words - "logs.example.com:514 over UDP". */ +function logForwardTarget(array $settings) { + $host = strpos($settings['host'], ':') !== false ? '[' . $settings['host'] . ']' : $settings['host']; + return $host . ':' . $settings['port'] . ' over ' . LOG_FORWARD_PROTOCOLS[$settings['protocol']]; +} + +/** Does an app log entry at this level go out, by the setting? */ +function logForwardAppLevelSent($level, $threshold) { + $order = ['error' => 1, 'warning' => 2, 'info' => 3, 'debug' => 4]; + $level = strtolower((string) $level); + return $threshold !== '' && isset($order[$level], $order[$threshold]) && $order[$level] <= $order[$threshold]; +} + +/* + * The entries waiting to go, by log - 'audit' and 'app' ids. Called with + * ['audit', 12] it adds one; with false it hands them over and starts again. + */ +function logForwardPending($add = null) { + static $pending = ['audit' => [], 'app' => []]; + if ($add === false) { + $taken = $pending; + $pending = ['audit' => [], 'app' => []]; + return $taken; + } + if (is_array($add)) { + $pending[$add[0]][] = intval($add[1]); + } + return $pending; +} + +/* + * An entry just written, to send - 'audit' with its log_id, or 'app' with its + * app_log_id, level and category. Nothing when forwarding is off, for that + * log or level, for the forwarding's own failures, or for an email preview, + * whose sample records are thrown away again (functions/email_preview.php). + */ +function logForwardQueue($log, $id, $level = '', $category = '') { + static $registered = false; + $id = intval($id); + if ($id <= 0 || (function_exists('emailCapturing') && emailCapturing())) { + return; + } + $settings = logForwardSettings(); + if (!logForwardOn($settings)) { + return; + } + if ($log === 'audit' && !$settings['audit']) { + return; + } + if ($log === 'app' && ((string) $category === LOG_FORWARD_CATEGORY || !logForwardAppLevelSent($level, $settings['app_level']))) { + return; + } + if ($log !== 'audit' && $log !== 'app') { + return; + } + logForwardPending([$log, $id]); + if (!$registered) { + $registered = true; + register_shutdown_function('logForwardFlush'); + } + $pending = logForwardPending(); + if (count($pending['audit']) + count($pending['app']) >= LOG_FORWARD_BATCH) { + logForwardFlush(); + } +} + +/* + * Sends what is waiting - read back from the database, so it is what was + * kept - over one connection, kept open for the rest of the request. Runs + * when the request ends, and on the way for a long cron run. Never throws. + */ +function logForwardFlush() { + global $mysqli; + $pending = logForwardPending(false); + if (!$pending['audit'] && !$pending['app']) { + return; + } + try { + $settings = logForwardSettings(); + if (!logForwardOn($settings) || logForwardBackingOff($settings)) { + return; + } + $messages = []; + if ($pending['audit']) { + $sql = mysqli_query($mysqli, "SELECT log_id, log_type, log_action, log_description, log_ip, log_user_agent, log_created_at, log_client_id, log_user_id, log_entity_id, + user_name, user_email, user_type, client_name + FROM logs LEFT JOIN users ON user_id = log_user_id AND log_user_id > 0 LEFT JOIN clients ON client_id = log_client_id AND log_client_id > 0 + WHERE log_id IN (" . implode(',', array_unique($pending['audit'])) . ") ORDER BY log_id"); + while ($row = mysqli_fetch_assoc($sql)) { + $messages[] = [strtotime($row['log_created_at']), logForwardAuditMessage($row, $settings['format'])]; + } + } + if ($pending['app']) { + $sql = mysqli_query($mysqli, "SELECT app_log_id, app_log_category, app_log_type, app_log_details, app_log_created_at FROM app_logs + WHERE app_log_id IN (" . implode(',', array_unique($pending['app'])) . ") ORDER BY app_log_id"); + while ($row = mysqli_fetch_assoc($sql)) { + $messages[] = [strtotime($row['app_log_created_at']), logForwardAppMessage($row, $settings['format'])]; + } + } + if (!$messages) { + return; + } + // In the order they happened, the two logs together + usort($messages, function ($a, $b) { + return $a[0] <=> $b[0]; + }); + $error = ''; + if (!logForwardSend($settings, array_column($messages, 1), $error)) { + logForwardFailed($settings, count($messages), $error); + } + } catch (Throwable $e) { + error_log('ITFlow log forwarding: ' . $e->getMessage()); + } +} + +/* + * Sends lines over the connection this request keeps open to the server, + * opening it the first time - true when every one was written. TCP and TLS + * end each with a newline (RFC 6587 non-transparent framing); UDP sends one + * datagram each. $keep false closes it after, for a one-off like the test. + */ +function logForwardSend(array $settings, array $lines, &$error = '', $keep = true) { + static $socket = null; + static $socket_target = ''; + $error = ''; + $target = logForwardTarget($settings) . ($settings['protocol'] === 'tls' ? ($settings['tls_verify'] ? ' verified' : ' unverified') : ''); + if ($socket && ($socket_target !== $target || !$keep)) { + @fclose($socket); + $socket = null; + } + if (!$socket) { + $socket = logForwardConnect($settings, $error); + $socket_target = $target; + if (!$socket) { + return false; + } + } + foreach ($lines as $line) { + $data = $settings['protocol'] === 'udp' ? $line : $line . "\n"; + if (!logForwardWrite($socket, $data, $error)) { + @fclose($socket); + $socket = null; + return false; + } + } + if (!$keep) { + // A UDP port nothing listens on answers with "port unreachable", which only shows on the next + // read - it fails at once, where a port something listens on just has nothing to read in time + if ($settings['protocol'] === 'udp') { + stream_set_timeout($socket, 0, 300000); + $read = @fread($socket, 1); + if ($read === false && empty(stream_get_meta_data($socket)['timed_out'])) { + $error = 'the server said nothing is listening on that port'; + @fclose($socket); + $socket = null; + return false; + } + } + @fclose($socket); + $socket = null; + } + return true; +} + +/** Opens the connection - null, with why in $error, when it can't. */ +function logForwardConnect(array $settings, &$error) { + $host = strpos($settings['host'], ':') !== false ? '[' . $settings['host'] . ']' : $settings['host']; + $options = []; + if ($settings['protocol'] === 'tls') { + $verify = (bool) $settings['tls_verify']; + $options['ssl'] = [ + 'verify_peer' => $verify, + 'verify_peer_name' => $verify, + 'allow_self_signed' => !$verify, + 'peer_name' => $settings['host'], + 'SNI_enabled' => true, + 'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT | (defined('STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT') ? STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT : 0), + ]; + } + // A TLS failure says why only in the warnings on the way, not in $errstr - so they are kept + $warnings = []; + set_error_handler(function ($severity, $message) use (&$warnings) { + $warnings[] = $message; + return true; + }); + $errno = 0; + $errstr = ''; + try { + $socket = stream_socket_client($settings['protocol'] . "://$host:" . $settings['port'], $errno, $errstr, LOG_FORWARD_TIMEOUT, STREAM_CLIENT_CONNECT, stream_context_create($options)); + } finally { + restore_error_handler(); + } + if (!$socket) { + $error = logForwardReason(array_merge($warnings, [$errstr])); + return null; + } + stream_set_timeout($socket, LOG_FORWARD_TIMEOUT); + return $socket; +} + +/** Writes all of it - false, with why in $error, when it can't. */ +function logForwardWrite($socket, $data, &$error) { + $length = strlen($data); + $written = 0; + while ($written < $length) { + error_clear_last(); + $sent = @fwrite($socket, substr($data, $written)); + if ($sent === false || $sent === 0) { + $meta = stream_get_meta_data($socket); + $error = !empty($meta['timed_out']) ? 'the server stopped taking them' : logForwardReason([error_get_last()['message'] ?? '', 'the connection was closed']); + return false; + } + $written += $sent; + } + return true; +} + +/* + * Why a connection or write failed, in words - from the messages PHP gave on + * the way (one, or several), without its own wording around them. + */ +function logForwardReason($messages) { + $messages = array_values(array_filter(array_map(function ($message) { + $message = trim(preg_replace('/^.*?(stream_socket_client|fwrite|fread)\(\):\s*/', '', (string) $message)); + return trim(preg_replace('/^Unable to connect to \S+ \((.*)\)$/', '$1', $message)); + }, (array) $messages), function ($message) { + return $message !== '' && strcasecmp($message, 'Unknown error') !== 0; + })); + $all = implode(' ', $messages); + if (stripos($all, 'certificate verify failed') !== false) { + return "the server's certificate couldn't be checked - it isn't from an authority this server trusts, has run out, or is for another name"; + } + if (stripos($all, 'did not match expected CN') !== false || stripos($all, 'peer certificate CN') !== false) { + return "the server's certificate is for another name"; + } + if (stripos($all, 'getaddrinfo') !== false || stripos($all, 'php_network_getaddresses') !== false) { + return "that server's name couldn't be found"; + } + if (stripos($all, 'Connection refused') !== false) { + return 'the server refused the connection - nothing is listening on that port'; + } + if (stripos($all, 'timed out') !== false) { + return 'the server did not answer in ' . LOG_FORWARD_TIMEOUT . ' seconds'; + } + if (stripos($all, 'crypto') !== false || stripos($all, 'SSL') !== false) { + return "it couldn't start TLS with the server - " . ($messages[0] ?? 'it may not take TLS on that port'); + } + return $messages[0] ?? 'it could not be reached'; +} + +/** The file that says when sending last failed, so the minute after is skipped. */ +function logForwardBackoffFile(array $settings) { + return rtrim(sys_get_temp_dir(), '/\\') . '/itflow-log-forward-' . substr(md5(__DIR__ . '|' . logForwardTarget($settings)), 0, 16); +} + +/** Did sending to this server fail in the last minute? */ +function logForwardBackingOff(array $settings) { + $file = logForwardBackoffFile($settings); + $at = @filemtime($file); + return $at !== false && $at > time() - LOG_FORWARD_BACKOFF; +} + +/** Sending failed - wait a minute before trying again, and say so in the app log. */ +function logForwardFailed(array $settings, $count, $error) { + @touch(logForwardBackoffFile($settings)); + $what = $count === 1 ? '1 log entry' : "$count log entries"; + logApp(LOG_FORWARD_CATEGORY, 'error', "Couldn't send $what to " . logForwardTarget($settings) . " - $error. Nothing more is sent for a minute; the entries are still here."); +} + +/** Sending works again - forget the last failure. */ +function logForwardRecovered(array $settings) { + @unlink(logForwardBackoffFile($settings)); +} + +/* + * ---------- the messages ---------- + */ + +/** How serious an audit log entry is, as a syslog severity: a failure or something turned away is a warning, a deletion a notice, the rest information. */ +function logForwardAuditSeverity($action) { + if (in_array((string) $action, ['Failed', 'MFA Failed', 'Failure', 'Blocked', 'Denied', 'Alert', 'Error'], true)) { + return 4; + } + if (in_array((string) $action, ['Delete', 'Bulk Delete', 'Revoke', 'Discard'], true)) { + return 5; + } + return 6; +} + +/** An app log level as a syslog severity. */ +function logForwardAppSeverity($level) { + return ['error' => 3, 'warning' => 4, 'info' => 6, 'debug' => 7][strtolower((string) $level)] ?? 6; +} + +/** The name ITFlow sends as - its address, else the server's name. */ +function logForwardHostname() { + global $config_base_url; + $host = (string) parse_url('https://' . preg_replace('#^https?://#i', '', (string) ($config_base_url ?? '')), PHP_URL_HOST); + if ($host === '') { + $host = (string) gethostname(); + } + $host = preg_replace('/[^\x21-\x7e]/', '', $host); + return $host !== '' ? substr($host, 0, 255) : '-'; +} + +/** A time from the database as RFC 3339, in ITFlow's timezone. */ +function logForwardTime($datetime) { + try { + return (new DateTime((string) $datetime))->format('Y-m-d\TH:i:sP'); + } catch (Throwable $e) { + return date('Y-m-d\TH:i:sP'); + } +} + +/** The RFC 5424 line around a message. */ +function logForwardSyslog($severity, $msgid, $time, $message) { + $message = str_replace(["\r\n", "\r", "\n"], ' ', $message); + return '<' . (LOG_FORWARD_FACILITY * 8 + $severity) . '>1 ' . logForwardTime($time) . ' ' . logForwardHostname() . " itflow - $msgid - $message"; +} + +/** A CEF header field - | and \ escaped. */ +function logForwardCefHeader($value) { + return str_replace(['\\', '|', "\r", "\n"], ['\\\\', '\\|', ' ', ' '], (string) $value); +} + +/** CEF extensions, from key => value, the empty ones left out - \ and = escaped, line breaks as \n. */ +function logForwardCefExtensions(array $fields) { + $out = []; + foreach ($fields as $key => $value) { + if ($value === null || $value === '') { + continue; + } + $out[] = $key . '=' . str_replace(['\\', '=', "\r\n", "\n", "\r"], ['\\\\', '\\=', '\\n', '\\n', '\\n'], (string) $value); + } + return implode(' ', $out); +} + +/** CEF's severity, 0 to 10, from a syslog one. */ +function logForwardCefSeverity($severity) { + return [0 => 10, 1 => 10, 2 => 9, 3 => 8, 4 => 6, 5 => 4, 6 => 3, 7 => 1][$severity] ?? 3; +} + +/** The start of a CEF message. */ +function logForwardCefStart($signature, $name, $severity) { + require_once __DIR__ . '/../includes/app_version.php'; + return 'CEF:0|ITFlow|ITFlow|' . logForwardCefHeader(defined('APP_VERSION') ? APP_VERSION : '') . '|' . logForwardCefHeader($signature) . '|' . logForwardCefHeader($name) . '|' . logForwardCefSeverity($severity) . '|'; +} + +/** An audit log entry (with user_name, user_email, user_type and client_name) as a syslog line. */ +function logForwardAuditMessage(array $row, $format) { + $severity = logForwardAuditSeverity($row['log_action']); + $user_id = intval($row['log_user_id']); + $who = $user_id ? (string) ($row['user_name'] ?? '') : 'ITFlow'; + $who_kind = !$user_id ? 'system' : (intval($row['user_type'] ?? 1) === 2 ? 'portal' : 'agent'); + $ip = trim((string) $row['log_ip']); + if ($format === 'cef') { + $message = logForwardCefStart($row['log_type'] . ':' . $row['log_action'], $row['log_type'] . ' ' . $row['log_action'], $severity) . logForwardCefExtensions([ + 'rt' => strtotime($row['log_created_at']) * 1000, + 'externalId' => intval($row['log_id']), + 'cat' => $row['log_type'], + 'act' => $row['log_action'], + 'msg' => trim((string) $row['log_description']), + 'suid' => $user_id ?: null, + 'suser' => $who, + 'src' => filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null, + 'requestClientApplication' => $row['log_user_agent'], + 'cs1Label' => $row['client_name'] !== null ? 'Client' : null, + 'cs1' => $row['client_name'], + 'cn1Label' => intval($row['log_client_id']) ? 'Client ID' : null, + 'cn1' => intval($row['log_client_id']) ?: null, + 'cn2Label' => intval($row['log_entity_id']) ? 'Record ID' : null, + 'cn2' => intval($row['log_entity_id']) ?: null, + 'cs2Label' => 'Who', + 'cs2' => $who_kind, + 'dvchost' => logForwardHostname(), + ]); + } elseif ($format === 'plain') { + $details = array_filter([ + $user_id ? "by $who" . ($who_kind === 'portal' ? ' (portal)' : '') : 'by ITFlow', + $row['client_name'] !== null ? 'for ' . $row['client_name'] : '', + $ip !== '' ? "from $ip" : '', + 'entry ' . intval($row['log_id']), + ]); + $message = $row['log_type'] . ' ' . $row['log_action'] . ': ' . trim((string) $row['log_description']) . ' (' . implode(', ', $details) . ')'; + } else { + $message = json_encode([ + 'log' => 'audit', + 'id' => intval($row['log_id']), + 'time' => logForwardTime($row['log_created_at']), + 'type' => (string) $row['log_type'], + 'action' => (string) $row['log_action'], + 'description' => trim((string) $row['log_description']), + 'severity' => ['', '', '', 'error', 'warning', 'notice', 'info'][$severity], + 'who' => $who_kind, + 'user_id' => $user_id, + 'user' => $who, + 'user_email' => $user_id ? (string) ($row['user_email'] ?? '') : '', + 'client_id' => intval($row['log_client_id']), + 'client' => (string) ($row['client_name'] ?? ''), + 'record_id' => intval($row['log_entity_id']), + 'ip' => $ip, + 'user_agent' => (string) $row['log_user_agent'], + 'host' => logForwardHostname(), + ], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_INVALID_UTF8_SUBSTITUTE); + } + return logForwardSyslog($severity, 'audit', $row['log_created_at'], $message); +} + +/** An app log entry as a syslog line. */ +function logForwardAppMessage(array $row, $format) { + $level = strtolower((string) $row['app_log_type']); + $severity = logForwardAppSeverity($level); + $category = (string) $row['app_log_category']; + if ($format === 'cef') { + $message = logForwardCefStart('app:' . $category, $category . ' ' . $level, $severity) . logForwardCefExtensions([ + 'rt' => strtotime($row['app_log_created_at']) * 1000, + 'externalId' => intval($row['app_log_id']), + 'cat' => $category, + 'msg' => trim((string) $row['app_log_details']), + 'cs1Label' => 'Level', + 'cs1' => $level, + 'dvchost' => logForwardHostname(), + ]); + } elseif ($format === 'plain') { + $message = "$level $category: " . trim((string) $row['app_log_details']) . ' (app log entry ' . intval($row['app_log_id']) . ')'; + } else { + $message = json_encode([ + 'log' => 'app', + 'id' => intval($row['app_log_id']), + 'time' => logForwardTime($row['app_log_created_at']), + 'level' => $level, + 'category' => $category, + 'details' => trim((string) $row['app_log_details']), + 'host' => logForwardHostname(), + ], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_INVALID_UTF8_SUBSTITUTE); + } + return logForwardSyslog($severity, 'app', $row['app_log_created_at'], $message); +} + +/* + * Sends one test message with these settings, now, and says how it went: + * ['ok', 'error']. Over UDP it can only say a closed port was turned away - + * the message going out is no sign it arrived. + */ +function logForwardTest(array $settings, $by = '') { + $now = date('Y-m-d H:i:s'); + $text = 'Test message from ITFlow' . ($by !== '' ? " - sent by $by" : '') . ' from Admin > Settings > Logs'; + if ($settings['format'] === 'cef') { + $message = logForwardCefStart('test', 'Test message', 6) . logForwardCefExtensions(['rt' => time() * 1000, 'msg' => $text, 'dvchost' => logForwardHostname()]); + } elseif ($settings['format'] === 'plain') { + $message = $text; + } else { + $message = json_encode(['log' => 'test', 'time' => logForwardTime($now), 'message' => $text, 'host' => logForwardHostname()], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_INVALID_UTF8_SUBSTITUTE); + } + $error = ''; + $ok = logForwardSend($settings, [logForwardSyslog(6, 'test', $now, $message)], $error, false); + if ($ok) { + logForwardRecovered($settings); + } + return ['ok' => $ok, 'error' => $error]; +} diff --git a/functions/logging.php b/functions/logging.php index 36046c406..068c9ad5d 100644 --- a/functions/logging.php +++ b/functions/logging.php @@ -86,6 +86,9 @@ function logAudit($type, $action, $description, $client_id = 0, $entity_id = 0) } mysqli_query($mysqli, "INSERT INTO logs SET log_type = '$type', log_action = '$action', log_description = '$description', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $entity_id"); + + // On to a syslog server or SIEM, when that is set up (functions/log_forward.php) + logForwardQueue('audit', mysqli_insert_id($mysqli)); } /* @@ -164,11 +167,29 @@ function logHistory($status, $description, $invoice_id = 0, $quote_id = 0, $recu mysqli_query($mysqli, "INSERT INTO history SET history_status = '$status', history_description = '$description', history_invoice_id = $invoice_id, history_quote_id = $quote_id, history_recurring_invoice_id = $recurring_invoice_id"); } +/* + * Writes an app log entry - what ITFlow itself does: cron runs, mail, payment + * providers, the API, errors (Admin > App Logs, functions/app_log.php). + * Unlike logAudit(), it takes plain text and escapes it here. $type is the + * level - info, warning, error or debug; anything else is put to the nearest, + * as the column takes only those. + */ function logApp($category, $type, $details) { global $mysqli; - $category = mysqli_real_escape_string($mysqli, substr($category, 0, 200)); - $details = mysqli_real_escape_string($mysqli, substr($details, 0, 1000)); + $type = strtolower(trim((string) $type)); + if (!in_array($type, ['info', 'warning', 'error', 'debug'], true)) { + $type = in_array($type, ['critical', 'fatal', 'alert', 'emergency'], true) ? 'error' : ($type === 'warn' ? 'warning' : 'info'); + } - mysqli_query($mysqli, "INSERT INTO app_logs SET app_log_category = '$category', app_log_type = '$type', app_log_details = '$details'"); + // Cut by character, so a name or message with accents isn't cut through the middle of one + $category = mb_substr((string) $category, 0, 200); + $details = mb_substr((string) $details, 0, 1000); + $category_sql = mysqli_real_escape_string($mysqli, $category); + $details_sql = mysqli_real_escape_string($mysqli, $details); + + mysqli_query($mysqli, "INSERT INTO app_logs SET app_log_category = '$category_sql', app_log_type = '$type', app_log_details = '$details_sql'"); + + // On to a syslog server or SIEM, from the level picked (functions/log_forward.php) + logForwardQueue('app', mysqli_insert_id($mysqli), $type, $category); } diff --git a/functions/reports.php b/functions/reports.php index da3271216..bae80395a 100644 --- a/functions/reports.php +++ b/functions/reports.php @@ -190,6 +190,15 @@ function reportCatalog() { ], ], ], + 'activity' => [ + 'label' => 'Activity', + 'reports' => [ + 'audit_activity' => [ + 'title' => 'Audit Activity', 'icon' => 'fa-history', 'module' => 'module_client', 'feature' => [], + 'description' => 'What was done in ITFlow - changes, deletions, passwords looked at, exports and sign-ins - over time, out of hours, and by person, client and kind of record.', + ], + ], + ], ]; } diff --git a/functions/vendor_template.php b/functions/vendor_template.php new file mode 100644 index 000000000..e3d832f9a --- /dev/null +++ b/functions/vendor_template.php @@ -0,0 +1,321 @@ + Vendor Templates): the vendors an MSP's + * clients use again and again - the ISPs, the hardware makers, the + * distributors, the line-of-business software - set up once with their + * support line, hours, SLA, support email and site, ready to add to any + * client. A vendor made from one gets its fields and remembers which template + * it came from (vendors.vendor_template_id), so each template's use is + * counted: how many clients have a vendor from it, and when one was last + * added. License templates take their vendor from one + * (software_templates.software_template_vendor_template_id). + * + * From database 3.3.4 on a template says who made it and last changed it. + * + * Shared by admin/vendor_templates.php, admin/vendor_template.php, + * admin/modals/vendor_template/* and admin/post/vendor_template.php. A + * vendor is made from one on the agent side by add_vendor, + * add_vendor_from_template and add_vendor_template_to_clients + * (agent/post/vendor.php, with vendorTemplateRow() and + * vendorTemplateFormFields() in functions/vendor.php). + */ + +/* + * What a template carries, as it shows on its page and in the window - key + * => label and icon, in order. 'phone' is the support line with its country + * code and extension. + */ +function vendorTemplateFieldLabels() { + return [ + 'name' => ['label' => 'Name', 'icon' => 'fa-building'], + 'description' => ['label' => 'What they are', 'icon' => 'fa-align-left'], + 'phone' => ['label' => 'Support line', 'icon' => 'fa-phone'], + 'hours' => ['label' => 'Support hours', 'icon' => 'fa-clock'], + 'sla' => ['label' => 'SLA', 'icon' => 'fa-handshake'], + 'email' => ['label' => 'Support email', 'icon' => 'fa-envelope'], + 'website' => ['label' => 'Support site', 'icon' => 'fa-globe'], + 'account_number' => ['label' => 'Account number', 'icon' => 'fa-fingerprint'], + 'code' => ['label' => 'PIN', 'icon' => 'fa-key'], + 'contact_name' => ['label' => 'Account manager', 'icon' => 'fa-user-tie'], + 'notes' => ['label' => 'Notes', 'icon' => 'fa-sticky-note'], + ]; +} + +/* + * Each field's columns - on the template, and on a vendor made from it. The + * support line is three: country code, number and extension. + */ +function vendorTemplateColumns() { + return [ + 'name' => [['vendor_template_name', 'vendor_name']], + 'description' => [['vendor_template_description', 'vendor_description']], + 'phone' => [['vendor_template_phone_country_code', 'vendor_phone_country_code'], ['vendor_template_phone', 'vendor_phone'], ['vendor_template_extension', 'vendor_extension']], + 'hours' => [['vendor_template_hours', 'vendor_hours']], + 'sla' => [['vendor_template_sla', 'vendor_sla']], + 'email' => [['vendor_template_email', 'vendor_email']], + 'website' => [['vendor_template_website', 'vendor_website']], + 'account_number' => [['vendor_template_account_number', 'vendor_account_number']], + 'code' => [['vendor_template_code', 'vendor_code']], + 'contact_name' => [['vendor_template_contact_name', 'vendor_contact_name']], + 'notes' => [['vendor_template_notes', 'vendor_notes']], + ]; +} + +/** One template, archived or not, with who made it and last changed it - raw, or null. */ +function vendorTemplateInfo($vendor_template_id) { + global $mysqli; + $vendor_template_id = intval($vendor_template_id); + if ($vendor_template_id <= 0) { + return null; + } + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT vendor_templates.*, creator.user_name AS created_by_name, updater.user_name AS updated_by_name + FROM vendor_templates + LEFT JOIN users creator ON creator.user_id = vendor_template_created_by AND vendor_template_created_by > 0 + LEFT JOIN users updater ON updater.user_id = vendor_template_updated_by AND vendor_template_updated_by > 0 + WHERE vendor_template_id = $vendor_template_id")); + return $row ?: null; +} + +/* + * How the templates are used - template id => clients (current clients with a + * current vendor from it), vendors (those vendors), ours (our own vendors from + * it) and last (when the latest was added). Ones not used aren't in it. + */ +function vendorTemplateUsage(array $vendor_template_ids) { + global $mysqli; + $ids = array_values(array_filter(array_map('intval', $vendor_template_ids))); + $usage = []; + if (!$ids) { + return $usage; + } + $sql = mysqli_query($mysqli, "SELECT vendor_template_id, COUNT(DISTINCT NULLIF(vendor_client_id, 0)) AS clients, SUM(vendor_client_id > 0) AS vendors, + SUM(vendor_client_id = 0) AS ours, MAX(vendor_created_at) AS last + FROM vendors LEFT JOIN clients ON client_id = vendor_client_id AND vendor_client_id > 0 + WHERE vendor_template_id IN (" . implode(',', $ids) . ") AND vendor_archived_at IS NULL AND (vendor_client_id = 0 OR client_archived_at IS NULL AND client_id IS NOT NULL) + GROUP BY vendor_template_id"); + while ($row = mysqli_fetch_assoc($sql)) { + $usage[intval($row['vendor_template_id'])] = ['clients' => intval($row['clients']), 'vendors' => intval($row['vendors']), 'ours' => intval($row['ours']), 'last' => $row['last']]; + } + return $usage; +} + +/* + * The window's fields, checked - or null with $error saying why. Raw values: + * name, description, phone_country_code, phone and extension (digits), + * hours, sla, email, website (without its scheme), account_number, code, + * contact_name and notes - as vendorFormSet() reads a vendor's. + */ +function vendorTemplateFields(array $post, &$error = '') { + $error = ''; + $line = function ($key, $length = 200) use ($post) { + $value = is_scalar($post[$key] ?? null) ? trim(preg_replace('/\s+/u', ' ', (string) $post[$key])) : ''; + return mb_substr($value, 0, $length); + }; + $digits = function ($key, $length = 200) use ($post) { + return substr(preg_replace('/[^0-9]/', '', is_scalar($post[$key] ?? null) ? (string) $post[$key] : ''), 0, $length); + }; + $name = is_scalar($post['name'] ?? null) ? trim(preg_replace('/\s+/u', ' ', (string) $post['name'])) : ''; + if ($name === '') { + $error = 'A vendor template needs a name'; + return null; + } + if (mb_strlen($name) > 200) { + $error = 'Keep the name to 200 characters'; + return null; + } + $email = $line('email'); + if ($email !== '' && !filter_var($email, FILTER_VALIDATE_EMAIL)) { + $error = "The support email isn't an email address"; + return null; + } + $phone = $digits('phone'); + return [ + 'name' => $name, + 'description' => $line('description'), + 'phone_country_code' => $phone !== '' ? $digits('phone_country_code', 10) : '', + 'phone' => $phone, + 'extension' => $digits('extension'), + 'hours' => $line('hours'), + 'sla' => $line('sla'), + 'email' => $email, + 'website' => mb_substr(rtrim(preg_replace('#^https?://#i', '', $line('website')), '/'), 0, 200), + 'account_number' => $line('account_number'), + 'code' => $line('code'), + 'contact_name' => $line('contact_name'), + 'notes' => is_scalar($post['notes'] ?? null) ? trim((string) $post['notes']) : '', + ]; +} + +/** A template's fields as vendorTemplateFields() gives them - from its row, for comparing and copying. */ +function vendorTemplateRowFields(array $row) { + return [ + 'name' => (string) $row['vendor_template_name'], + 'description' => (string) $row['vendor_template_description'], + 'phone_country_code' => (string) $row['vendor_template_phone_country_code'], + 'phone' => (string) $row['vendor_template_phone'], + 'extension' => (string) $row['vendor_template_extension'], + 'hours' => (string) $row['vendor_template_hours'], + 'sla' => (string) $row['vendor_template_sla'], + 'email' => (string) $row['vendor_template_email'], + 'website' => (string) $row['vendor_template_website'], + 'account_number' => (string) $row['vendor_template_account_number'], + 'code' => (string) $row['vendor_template_code'], + 'contact_name' => (string) $row['vendor_template_contact_name'], + 'notes' => (string) $row['vendor_template_notes'], + ]; +} + +/* Save a template's fields (vendorTemplateFields()) - a new one with $vendor_template_id 0. Its id. */ +function vendorTemplateSave($vendor_template_id, array $f) { + global $mysqli, $session_user_id; + $vendor_template_id = intval($vendor_template_id); + $user_id = intval($session_user_id ?? 0); + $set = []; + foreach (vendorTemplateColumns() as $key => $pairs) { + foreach ($pairs as [$template_column]) { + $field = substr($template_column, strlen('vendor_template_')); + $set[] = "$template_column = '" . escapeSql((string) ($f[$field] ?? '')) . "'"; + } + } + $set = implode(', ', $set); + if ($vendor_template_id) { + mysqli_query($mysqli, "UPDATE vendor_templates SET $set, vendor_template_updated_by = $user_id WHERE vendor_template_id = $vendor_template_id"); + return $vendor_template_id; + } + mysqli_query($mysqli, "INSERT INTO vendor_templates SET $set, vendor_template_created_by = $user_id"); + return intval(mysqli_insert_id($mysqli)); +} + +/** What changed between two sets of fields - the labels, in order: ['Support line', 'Support hours']. */ +function vendorTemplateChanged(array $before, array $after) { + $changed = []; + foreach (vendorTemplateColumns() as $key => $pairs) { + foreach ($pairs as [$template_column]) { + $field = substr($template_column, strlen('vendor_template_')); + if ((string) ($before[$field] ?? '') !== (string) ($after[$field] ?? '')) { + $changed[$key] = vendorTemplateFieldLabels()[$key]['label']; + break; + } + } + } + return $changed; +} + +/* A new template starting from this one - "Copy of". Its id, or 0. */ +function vendorTemplateCopy($vendor_template_id) { + $row = vendorTemplateInfo($vendor_template_id); + if (!$row) { + return 0; + } + $fields = vendorTemplateRowFields($row); + $fields['name'] = mb_substr('Copy of ' . $fields['name'], 0, 200); + return vendorTemplateSave(0, $fields); +} + +/* + * Delete a template. The vendors made from it stay, no longer linked to it, + * and license templates that took their vendor from it have none. + */ +function vendorTemplateDelete($vendor_template_id) { + global $mysqli; + $vendor_template_id = intval($vendor_template_id); + mysqli_query($mysqli, "UPDATE vendors SET vendor_template_id = 0, vendor_updated_at = vendor_updated_at WHERE vendor_template_id = $vendor_template_id"); + mysqli_query($mysqli, "UPDATE software_templates SET software_template_vendor_template_id = 0, software_template_updated_at = software_template_updated_at WHERE software_template_vendor_template_id = $vendor_template_id"); + mysqli_query($mysqli, "DELETE FROM vendor_templates WHERE vendor_template_id = $vendor_template_id"); +} + +/* + * Put the template's fields picked ($keys, from vendorTemplateColumns()) on + * every vendor made from it - for Change them on the client vendors too. + * The vendors changed: vendor id => ['name', 'client_id']. + */ +function vendorTemplatePush($vendor_template_id, array $keys) { + global $mysqli; + $vendor_template_id = intval($vendor_template_id); + $row = vendorTemplateInfo($vendor_template_id); + $columns = vendorTemplateColumns(); + $keys = array_values(array_intersect(array_keys($columns), $keys)); + if (!$row || !$keys) { + return []; + } + $set = []; + foreach ($keys as $key) { + foreach ($columns[$key] as [$template_column, $vendor_column]) { + $set[] = "$vendor_column = '" . escapeSql((string) $row[$template_column]) . "'"; + } + } + $vendors = []; + $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name, vendor_client_id FROM vendors WHERE vendor_template_id = $vendor_template_id"); + while ($vendor = mysqli_fetch_assoc($sql)) { + $vendors[intval($vendor['vendor_id'])] = ['name' => $vendor['vendor_name'], 'client_id' => intval($vendor['vendor_client_id'])]; + } + if ($vendors) { + mysqli_query($mysqli, "UPDATE vendors SET " . implode(', ', $set) . " WHERE vendor_template_id = $vendor_template_id"); + } + return $vendors; +} + +/* + * The vendors made from a template, for its page - current ones first, by + * client: vendor id => vendor_id, vendor_name, client_id (0 for ours), + * client_name, client_abbreviation, account_number, code, created_at, + * archived (the vendor), client_archived. + */ +function vendorTemplateVendors($vendor_template_id) { + global $mysqli; + $vendor_template_id = intval($vendor_template_id); + $vendors = []; + $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name, vendor_client_id, vendor_account_number, vendor_code, vendor_created_at, vendor_archived_at, + client_name, client_abbreviation, client_archived_at + FROM vendors LEFT JOIN clients ON client_id = vendor_client_id AND vendor_client_id > 0 + WHERE vendor_template_id = $vendor_template_id + ORDER BY vendor_archived_at IS NOT NULL, client_archived_at IS NOT NULL, vendor_client_id = 0, client_name ASC, vendor_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $vendors[intval($row['vendor_id'])] = [ + 'vendor_id' => intval($row['vendor_id']), + 'vendor_name' => (string) $row['vendor_name'], + 'client_id' => intval($row['vendor_client_id']), + 'client_name' => (string) $row['client_name'], + 'client_abbreviation' => (string) $row['client_abbreviation'], + 'account_number' => trim((string) $row['vendor_account_number']), + 'code' => trim((string) $row['vendor_code']), + 'created_at' => $row['vendor_created_at'], + 'archived' => !empty($row['vendor_archived_at']), + 'client_archived' => !empty($row['client_archived_at']), + ]; + } + return $vendors; +} + +/** The license templates that take their vendor from it - id => name, archived. */ +function vendorTemplateLicenseTemplates($vendor_template_id) { + global $mysqli; + $vendor_template_id = intval($vendor_template_id); + $templates = []; + $sql = mysqli_query($mysqli, "SELECT software_template_id, software_template_name, software_template_archived_at FROM software_templates + WHERE software_template_vendor_template_id = $vendor_template_id ORDER BY software_template_archived_at IS NOT NULL, software_template_name ASC"); + while ($row = mysqli_fetch_assoc($sql)) { + $templates[intval($row['software_template_id'])] = ['name' => $row['software_template_name'], 'archived' => !empty($row['software_template_archived_at'])]; + } + return $templates; +} + +/** A template's tile - its initials on the grey of the other template lists. $size as vendorTile(). */ +function vendorTemplateTile($name, $size = '') { + $size_class = in_array($size, ['xs', 'sm', 'lg'], true) ? " itflow-asset-icon-$size itflow-vendor-tile-$size" : ''; + return ''; +} + +/** The support line as it reads - "(412) 555-0100, then 2" - or ''. Raw in, escaped out. */ +function vendorTemplatePhoneHtml($phone, $country_code, $extension) { + if (preg_replace('/[^0-9]/', '', (string) $phone) === '') { + return ''; + } + $html = escapeHtml(formatPhoneNumber($phone, $country_code)); + $dial = vendorDialNumber($phone, $country_code); + if ($dial !== '') { + $html = '' . $html . ''; + } + return $html . (trim((string) $extension) !== '' ? ' then ' . escapeHtml($extension) . '' : ''); +} diff --git a/guest/guest_pay_invoice_stripe.php b/guest/guest_pay_invoice_stripe.php index db7797e7f..a0693b198 100644 --- a/guest/guest_pay_invoice_stripe.php +++ b/guest/guest_pay_invoice_stripe.php @@ -251,6 +251,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $extended_log_desc = '(DEV MODE)'; } mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Payment', log_action = 'Create', log_description = 'Stripe payment of $pi_currency $pi_amount_paid against invoice $invoice_prefix$invoice_number - $pi_id $extended_log_desc', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $pi_client_id"); + logForwardQueue('audit', mysqli_insert_id($mysqli)); // The client's receipt, and the paid notification address - functions/billing_email.php $config_smtp_host = mysqli_fetch_row(mysqli_query($mysqli, "SELECT config_smtp_host FROM settings WHERE company_id = 1"))[0] ?? '';