johnnyq
359851c876
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
2026-10-23 12:09:07 -04:00
johnnyq
b5dc8883f1
Tags stage 1: Admin > Tags rebuilt with the seven kinds in a side nav with counts, each tag shown as it looks with its description, how many records have it (and how many of those are archived) linking to the list filtered by it, and the recurring invoice lines that count by it, search by name or description, sort by name or most used, Current and Archived tabs, Edit, Merge into, Archive, Restore and Delete per tag and bulk merge, archive, restore and delete; new shared tag window with live preview, description, color swatches or any color or hex, searchable icon grid or any Font Awesome icon by name, and kind changeable only while unused; merge window that moves records onto the kept tag once each and repoints recurring seat lines; archiving now works, with archived tags kept on their records but left out of record forms, the tag picker and the list and export filters unless already chosen; tag names unique within their kind, though tags that already share a name can still be saved; delete refused while a recurring seat line counts by the tag; record forms let admins type a new tag inline, replacing the + admin window that reloaded the page and failed for non-admins, and every kind now saves through one tagSetForRecord that keeps only its own kind's tags, each once, fixing the error on a tag sent twice for clients, contacts and assets; typing an archived tag's name restores it, and the picker refuses putting an archived tag on more records; recurring line window keeps its tag once archived; pills pick dark or white text by luminance and carry the description; removes the legacy agent tag handler and tag_model files; database 3.1.3 adds tag_description and normalises stored tag colors to hex and icons to bare names; changelog updated
2026-10-17 13:59:13 -04:00
johnnyq
c51323b88e
Rebuild guest sharing as Shared Links (functions/share.php, DB 2.9.0) with one Share window for credentials, documents and files plus secure notes and login requests that clients answer through an encrypted form and agents save to credentials, choices for expiry, view limit, a passphrase or a code emailed to the recipient with lockout after five wrong tries, optional 2FA codes, notify on open, email or copy or QR, the link secret kept after the # and only its hash stored, login, note and request payloads sealed with AES-256-GCM under a key derived from the secret and request keys held under the vault, a rebuilt guest page (guest/share.php, js/guest_share.js, guest/share_ajax.php) with click to reveal so link scanners cannot use up one-time links, copy buttons, rotating 2FA codes limited to the browser that opened it and a destroy button, POST-only file downloads confined to the client folder, a Shared Links page per client and under All Client Docs with open, sent back and ended filters, a quick look with access history by address and browser, turn off one, ticked or every open link for a client, secrets wiped when links end and ended links kept for 90 days, sharing policy under Admin Settings Security, old links still working until they expire, removal of share_modal.php, share_modal.js, credential_share.php, share_generate_link, get_share_totp_token and deactivate_shared_item, and an updated 26.11 changelog
2026-10-16 01:33:36 -04:00
johnnyq
df0c6a5bc8
Review pass over the modernized sections: add icons in front of the fields that were missing them (project form, bulk due and manager, project export; service form, depends-on pickers, bulk edit, review, link tickets and export; calendar event and calendar forms; rack and rack item forms; project template name; location and vendor extension; ticket bulk reply, bulk resolve and edit reply time worked; license renew date; client bulk ticket subject; credential share link), show names with apostrophes and quotes correctly in contact, asset, client, tag, ticket template and vendor template save messages, reword unclear or inconsistent messages and hints (ticket close, reply added, task approvals, bulk contact and asset messages, user and profile hints, VLAN, certificate and vendor PIN hints, with no vendor / location / network), singular and plural in bulk modal titles, US spelling in visible text, make the hidden attribute win over display utilities so the empty credential strength meter stays hidden, wrap pagination on narrow screens, and remove the unused credentialLink, projectLink and linkCounts helpers
2026-10-15 22:20:25 -04:00
johnnyq
ade9d5aac3
Services modernization: new services list with Needs attention, Review due, High importance, No review set, Starred and Archived views, dependency chips, in-place importance, bulk importance/category/review schedule, mark reviewed, star, archive/restore/delete and CSV/PDF export; new service page with service facts, backup and recovery, who to call (vendor and client contact details), auto-saving notes and tabs for the assets it runs on, logins, domains and certificates, documents, tickets and history; compact quick look; shared add/edit form with importance, category suggestions, a review schedule and dependency pickers on add; review modal with checklist and history note; attention flags for expiring or expired domains and certificates, certificate check problems, infrastructure out of warranty or out of action, and archived records still linked; Report a problem opens a prefilled ticket linked to the service, plus a service_tickets table, ticket page services list and link/unlink from both sides; services, domains and certificates added to the generic link system, legacy service link actions routed through it with same-client checks; services shown on the asset, contact and vendor pages, the asset/domain/certificate/credential quick looks, the document Linked card, the client overview (card, attention items, upcoming reviews), the dashboard, calendar, global search, client PDF pack and nightly review notifications; archived services left out of nav counts and lookups; services read endpoint in the API; demo data review schedules; database update 2.8.7 (archive and review columns, wider category and backup, link table dedupe with primary keys, service_domains foreign keys, service_tickets)
2026-10-15 17:32:09 -04:00
johnnyq
fecd1cabff
Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change.
2026-10-14 23:33:29 -04:00
johnnyq
9e55d52432
Vendors overhaul for daily MSP work: new vendor page built around calling them, with Call support (dials the extension), Email, Support site, a star, and a New menu (case/ticket with them, license from them, asset bought from them, portal login, document, upload, or expense and recurring expense for our own vendors), Support card (phone, hours, SLA, email, site), Account card (account number, PIN shown as dots with show and copy, account manager name, direct line and email), blur-to-save notes, an Also used by list of the agent's other clients with the same vendor by name or template, and tabs for Cases (open first, with their ticket number), Licenses (soonest renewal first), Assets (serial, order ref, warranty status), Domains (registrar, web host, DNS, mail), Services, Logins, Documents, Files and History; our own vendors show spend this year, last year and in all, recent expenses and recurring expenses; new vendor quick look; rebuilt vendors list with starred first, initials tiles coloured by vendor name, support line, hours and SLA, account number and PIN, chips for open cases, licenses, assets, domains, services and logins, an Ours / Clients' switch with an all-clients view in All Client Docs, wider search (account manager, emails, tags), tag filter and bulk Tags/Archive/Restore/Delete; shared tabbed vendor form (Details, Support, Account, Notes) with star, tags and start from template that fills every field; Add a Template to Clients to roll one vendor out to many clients, skipping those that have it; Admin Vendor Templates shows how many clients use each template and has Add to clients; vendor tags (tag type 6) with vendor tags in the Tags starter pack; ticket vendor block shows their ticket number, support line, hours, SLA, account number and PIN with copy buttons; vendor tiles in every vendor picker and quick look links across tickets, licenses, assets, domains, services and expense lists; search opens the vendor page; CSV export adds tags, open cases, account manager and PIN; logins, documents and files can be linked to a vendor and ones made from a vendor's page are linked to it; demo vendors get tags, a star and an account manager; database update 2.8.2 adds vendor_tags and vendor_contact_phone_country_code, vendor_contact_phone, vendor_contact_email (db.sql updated) and clears references to vendors that no longer exist; ticket vendor now validated against the ticket's client and removing a vendor from a ticket is logged as such; deleting a vendor from a template no longer unlinks every other vendor from that template; deleting a vendor clears it from assets, licenses, tickets and domains, and vendors with expenses, recurring expenses or payment provider fees are archived rather than deleted; vendor websites without a scheme open correctly; domain form vendor names escaped; new vendor templates keep the phone country code and pushing a template update with nothing ticked no longer errors; vendors API accepts the account manager fields; new functions/vendor.php (VENDOR_USES, vendorCan/vendorEnforce with client vendors on module_client and ours on module_financial, tile, link, website, PIN, form, tags, counts, delete check, reference clearing, also used by, spend, history), credential|vendor and file|vendor link relations, tag module_ours for our own vendors, handlers add_vendor_template_to_clients, favorite_vendor, unfavorite_vendor and ajax vendor_set_notes, vendor_model.php removed
2026-10-14 22:49:05 -04:00
johnnyq
234afd25fb
Contacts overhaul: rebuilt contacts list with role tabs and counts, avatars, flag pills, hover copy on phone/mobile/email, inline location picker, linked asset/credential/license/ticket chips and tag filter; contact page rebuilt to match the asset page with header actions, Reach/Details/Quick notes cards and tabbed Assets, Credentials, Tickets, Recurring, Licenses, Documents, Files, Services and Notes; add and edit contact share one tabbed form (Details, Roles, Access, Notes) with field icons, role switches, password generator, duplicate email check and photo removal; contact quick look redone to match the asset quick look; contact avatars now used everywhere a contact appears - contact pickers, ticket header, contact card, client replies, ticket list, kanban, assets, clients list, client header, overview key contacts, credentials, documents, services, invoice/quote/statement recipients, license users and global search - with each contact keeping the same colour throughout; ticket contact pickers show the name with title and role underneath; fixes: permission checks on the add contact modal and contact page/list actions, contact location limited to the contact's own client on add/edit/bulk assign, contacts list no longer selects user account columns, archived assets and credentials left off the contact page and quick look, saving a contact with the client portal disabled no longer clears their portal login method, replacing a photo no longer tries to delete a directory, sort column whitelisted, list counts and tags batched instead of per row, recurring ticket menu markup, undefined index notices, contacts list no longer scrolls sideways on phones, Edit Service shows avatars on unselected contacts and assets, license user labels toggle their checkbox; new functions/contact.php helpers (contactAvatar, contactLink, contactFlagPills, contactPhoneLink, contactAvatarData, contactOptionDescription), shared contact_form.php, contact_location quick pick, removed unused assetContactAvatar and clientOverviewPersonInitials
2026-10-14 18:33:18 -04:00
johnnyq
032e555f87
Replace copy buttons with hover over copy buttons
2026-10-14 17:27:27 -04:00
johnnyq
67e511a914
Tags everywhere: the same tag pills on every list and detail page, and an inline tag picker that saves as you tick (single records and bulk, with make-a-tag for admins) in place of the Assign Tags modals
2026-10-13 13:22:58 -04:00
johnnyq
69484a8a2e
Replace Tom Select with ITFlow's own select picker: native select stays the source of truth, search, checklists for multi selects, add-your-own for tag fields, phone sheet, and client/agent/contact avatars, tag and category colours, priority dots and asset icons in the options
2026-10-13 12:41:29 -04:00
johnnyq
9bfd26d57b
Add titles to icon-only buttons
...
- title on 294 icon-only buttons, named for what each one does
- aria-label on the 7 show-password buttons (title becomes the popover
header) and the portal mobile nav toggle
- Fix dead add-category button on products filter, credential bulk tag
button now preselects Credential, drop duplicate inner-icon titles
2026-10-08 17:12:21 -04:00
johnnyq
dc6b191eed
Update Font, Migrated away from JQUERY dependent libs: toastr to bootstrap5 toasts, daterangepicker to flatpickr, select2 to Tom Select, InputMask to IMask
2026-08-14 17:08:40 -04:00
johnnyq
a084e37c39
Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5
2026-08-14 13:22:11 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
b8c9d5b4cf
Query Optimization: Select only needed columns instead of SELECT * on looped queries
2026-08-06 12:59:43 -04:00
johnnyq
ddd9c2b56a
clientScopeSql sweep whicn now removed the extra unessesary client joins
2026-08-06 11:45:56 -04:00
johnnyq
89fba247c5
Add some missing maxlength form options to prevent info overflow and result in error 500
2026-08-02 16:08:01 -04:00
johnnyq
3c8f812a16
Feature: On all export modals added Filter Tab and Selectable Columns tab with default selected, also you can now export to a PDF
2026-07-30 00:46:15 -04:00
johnnyq
b3f959ac55
Use Short echo tags across the code
2026-07-28 18:47:52 -04:00
johnnyq
9c65644adc
Update the rest of the PHP functions to use camelCase
2026-07-23 17:39:06 -04:00
johnnyq
2076bb2a93
Added Audit Log on Edit Credential Modal as password can be viewed here
2026-07-15 21:13:07 -04:00
johnnyq
7c9bd77603
Remove unused credential view model, add enforceClient Check on export client pdf
2026-07-15 21:09:11 -04:00
johnnyq
2181e92e44
Removed valueOrDash Function was able to replace with ?: '-'
2026-07-14 18:13:34 -04:00
johnnyq
746e919aff
Replace Function getFallBack with valueOrDash()
2026-07-14 18:00:12 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
8094e6e761
Credentials: Enforce Credential Perm and client perm on credient edit / view modals
2026-05-04 15:37:02 -04:00
johnnyq
7d41782013
Credential: remove client_id post from edit credential modal as it should get the client_id in post, enforceClientAccess
2026-03-06 16:34:01 -05:00
johnnyq
023cb4ff11
credentials: Add missing CSRF checks
2026-03-02 20:11:56 -05:00
johnnyq
10c37946b1
UI: Update icoms for description inputs
2026-02-28 19:14:00 -05:00
johnnyq
97958d5e22
Missing Generate Password js code in Create Credential modal
2026-02-13 14:43:34 -05:00
johnnyq
bdd56c91f7
Update Credential Important to Favorite
2026-02-05 12:24:21 -05:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
johnnyq
e1a579387f
Convert all Import / Export Modals to Ajax and a few other lingering modals that were not converted yet
2025-12-02 15:04:05 -05:00
johnnyq
53178b8d20
Updated bulk action js to pass the checkboxe names into the get array this allows the use of multiple checkbox name arrays to be passed at once instead of just selected_ids had to update each bulk model from selected_ids to to the array that was passed. This was important so we could mix files and documents together
2025-11-27 12:48:59 -05:00
johnnyq
8be0789f25
Converted even more bulk modals to the new ajax-modal
2025-11-06 20:36:30 -05:00
johnnyq
a55dabb1cd
Migrate credemtial, software, network, certificate, domain, service Add modals to the new ajax-modal
2025-11-02 19:39:34 -05:00
wrongecho
99ccb12b8c
Allow importing TOTP credential info
2025-10-15 10:31:59 +01:00
johnnyq
edabc5c33f
rename /user/ to /agent/ and update links to use agent/ instead
2025-09-23 18:04:23 -04:00
