johnnyq
359851c876
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
2026-10-23 12:09:07 -04:00
johnnyq
81c80d8965
Canned responses stages 3 and 4: agents keep canned responses of their own in Your account > Canned Responses (on the standard list with Yours and Shared tabs, how often they used each, change, copy, archive and delete their own, Copy to yours from a shared one), offered to them alone and first in the picker as Yours; Save your reply as a canned response at the foot of the picker opens the draft with the ticket's contact, first name, client, ticket number, subject, link and agent swapped back to placeholders (canned_response_unfill, text only, a one-word subject left alone), offered on the ticket's category with a switch to put it back as written, and saves it in JSON without leaving the ticket so the reply stays and the new one goes straight into the picker; Admin > Canned Responses gains an Agents' own tab showing whose each is with Share with everyone, copies made there are shared, and admins can share their own or tick Share when saving a reply; files go with a response (Files tab, up to ten of the ticket attachment kinds, kept in uploads/canned_responses/<id>/, streamed by agent/canned_response_file.php to those who may use it), shown as chips under the picker with an x to leave one off, copied onto the ticket with the reply and sent with its email on a ticket and in Update & Reply; migration 3.2.4 adds canned_response_user_id and canned_response_created_by and the canned_response_files table, existing responses staying shared; the response window moves to includes/canned_response_form.php for the admin and account windows; export and import (functions/canned_response_transfer.php) of one, some or every shared response as a versioned JSON file with categories by name, what it sets up, status by name and files as base64, importing as shared with categories matched or made and leave, add as well or replace (keeping use and archived state), everything made safe and refused files named; an MSP starter pack of 27 canned responses in Starter Content loaded through the same import, with Update for the ones already added, and the Update button now driven by the pack registry; new Canned Responses report under Service Desk by response and by agent, filtered by client and by the agent who used it, admins seeing every agent's own; changelog updated
2026-10-18 15:36:00 -04:00
johnnyq
c93cb20f14
Expenses stage 1: rebuilt expenses list with this month against the same days last month, year so far with monthly average, recurring cost a month and expenses without a receipt in the last 90 days along the top, pills for client, no receipt and refunds with counts, vendor, category, client, date, account and payment method filters and a total of what the filters leave, an expense quick look showing the receipt inline with attach from the window, who entered it, refunds against it and the stock it paid for, one shared form for New, Edit, Copy and Refund with icons on every field, payment method saved from the default in Settings, vendor picks filling in the category, account and method of the last expense with them, refunds linked to the expense they give back and starting at what has not come back, receipts replaced or removed in Edit and served through agent/expense_receipt.php after the Financial and client checks with uploads/expenses closed to the web, bulk set category, account, payment method or client in one window and a single bulk delete, export with the list filters plus paid by, receipt and entered by columns, expenses in global search with open on load, the vendor page, Transactions and product stock history opening the quick look and Client Profitability linking direct costs to the client's expenses, fixes for the dead bulk delete button, bulk set client ignoring client restrictions, the New Expense window opening without write access, unlink warnings on empty receipts and photo receipts downloading as pdf, functions/expenses.php shared by the list, windows, export and search, database 2.9.9 with expense_created_by backfilled from the audit log and expense_refund_of_id, CHANGELOG updated
2026-10-16 17:43:11 -04:00
wrongecho
5ee1c9580f
Enhance .htaccess rules
2026-08-03 17:51:04 +01:00
johnnyq
ae468d6cee
Encrypted backups with types, scheduling and CLI restore
...
Backups are now AES-256 encrypted zips in three types (full, database
only, master key), catalogued in a new backups table, built by cron rather
than the web request, and kept under uploads/backups with retention in the
nightly job. The encryption key is one value per install held in config.php,
never in the database and never in the file name.
Restore is shared by the setup wizard and the new scripts/restore_cli.php,
which is the only path without an upload size limit. It verifies the key and
unpacks the archive before dropping anything, and dumps the current database
first so a failed import is rolled back.
A backup dumps, zips and encrypts for minutes without issuing a query, so on
a server with a short wait_timeout the connection is closed underneath it and
the UPDATE marking the backup complete is what fails - long after the archive
was written correctly. The connection is now held open for the job and
re-established before any write that follows long file work, including the
database phase of a restore. Retention recovers rows a dropped connection
left behind: still Running after six hours becomes Complete if the archive is
on disk, Failed if it is not.
cron.php's own failure path is hardened to match. It recorded job failures
through the same connection the failing job had just killed, so an uncaught
exception ended the dispatch and no trace of the original error survived.
Failures now also echo to stdout, so cron mails something useful when the
database is unreachable.
Security: the setup wizard's restore step is now closed on any install that
has users, whatever config.php says. $config_enable_setup defaulted to
enabled when the flag was absent, and the flag is only written at the end of
a successful install, so an install abandoned partway left an unauthenticated
endpoint that would drop every table, import an attacker-supplied archive,
and overwrite uploads/ including the .htaccess that stops PHP running there.
Affects 26.07 and earlier. Restoring over a live install is now CLI only.
2026-07-31 16:18:20 -04:00
johnnyq
f129311b2e
Remove patch and update gitignore
2026-07-27 21:02:13 -04:00
johnnyq
c1ff22298f
Remove xcustom from .gitignore as its been superceded by custom
2026-01-15 13:13:15 -05:00
johnnyq
5ef53b569c
Create upload folders for recurring tickets and ticket_templates
2025-11-24 13:09:01 -05:00
johnnyq
435da991ec
Add custom folder to uploads for custom uploading for custom modules
2025-11-23 14:32:57 -05:00
johnnyq
ebd9aae924
Add Document Templates to uploads dir
2025-11-23 14:30:50 -05:00
johnnyq
48719ce29c
Add Exclude uploads/documents to gitignore
2025-11-23 13:05:56 -05:00
johnnyq
35a7506c26
Copy crons from /scripts to /cron, added custom directories for api/v1/, /setup, /cron and /scripts
2025-10-07 13:55:54 -04:00
johnnyq
00f5198bed
Update appNotidfy links to use Absolute paths, updated gitignore
2025-09-25 13:31:16 -04:00
johnnyq
5c448c05a9
Update .gitignore and add custom directories to /admin /client /guest /user Example Documentation coming soon
2025-09-22 19:33:40 -04:00
johnnyq
27b3124f77
Update .gitignore to ignore the new custom/*
2025-09-05 12:57:19 -04:00
johnnyq
c2664a2888
Add .zed to the .gitignore
2025-02-27 11:46:29 -05:00
johnnyq
a3a0a3e8c6
Add xcustom and /post/xcustom to the git ignore list so git doesnt overwrite them except for the readme.php inside them
2024-11-04 22:03:57 -05:00
johnnyq
4f4bb56820
update .gitignore to include custom favicon
2024-02-03 14:33:48 -05:00
o-psi
86d836f3d3
Add vscode to .gitignore
2023-12-19 23:18:11 +00:00
johnnyq
8213ef1e24
Updated .gitignore added .gitkeep files to HTMLPurifier Cache Directories as git ignore empty folders - fixes https://forum.itflow.org/d/197-actual-answer-to-customer-in-email-is-missing/6
2023-07-07 18:57:45 -04:00
Marcus Hill
a3d8f5ab48
Ticket attachments (email)
...
Email to ticket parser: Add support for email attachments
2023-04-30 10:52:15 +01:00
johnnyq
e1cbd12f2e
Updated Git Ignore to ignore HTMLPurify cache Remove HTMLPurify generated Cruft
2023-03-12 11:31:10 -04:00
johnnyq
8c98163e1c
DB Structure Updated 2 new settings config_backup_enable and config_backup_path. This is to fix an issue where not specifying the full backup path would cause cron to error out and not run completely
2022-03-29 12:59:42 -04:00
Marcus Hill
21a22cb309
Ignore
2022-01-04 03:33:47 +00:00
johnny@pittpc.com
67a0c8bfbf
Created a tmp directory, added states array to setup add localhost default database host value to setup, added inputmask to setup
2019-08-22 13:24:36 -04:00
johnny@pittpc.com
c2786d42ff
even more gitignore fixes
2019-08-05 17:39:19 -04:00
johnny@pittpc.com
3770e8bdc5
more gitignore fixes
2019-08-05 17:34:24 -04:00
johnny@pittpc.com
235ae1c7eb
Added transfer_id to both payments and expenses tables, updated gitignore to include config.php and files in uploads folder
2019-08-05 17:26:07 -04:00
root
ef9c61c1cf
Added Folders
2019-07-02 23:50:50 -04:00
root
f9d6f4d316
Added badge count to client side nav, switched from js active nav to using php
2019-05-10 18:04:03 -04:00
root
d2c5544785
First commit
2019-03-13 17:40:00 +00:00
