19 Commits

Author	SHA1	Message	Date
johnnyq	01fbcda75d	Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated	2026-10-26 19:54:36 -04:00
johnnyq	359851c876	Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty	2026-10-23 12:09:07 -04:00
johnnyq	afaaa5fc32	Taxes stage 1: Admin > Taxes rebuilt (renamed from Tax Rates) listing each rate with its whole percent, parts, description, registration number and usage (invoices, quotes, recurring invoices, products, clients), Current and Archived tabs showing what replaced a rate, Restore, Make default, and Delete only for a rate never used; rates made of parts (state and county, GST and QST) with parts charged on top of the ones above, the whole rate shown as typed, four decimal places and a registration number per rate or part printed with the company details on invoices, quotes and PDFs; changing the percent or parts of a rate on a sent invoice or quote makes a new rate of the same name and archives the old one, so billed lines keep the old rate while products, client rates, the default, recurring invoices and optionally drafts move to the new one, and archiving offers to move whatever still uses it; How lines are taxed settings for the default rate, taxing billed time, trips and expenses, and discounts taken off before tax (on by default, shared across lines by amount, paid, cancelled and answered documents never recalculated); clients get their own tax rate and tax exempt with certificate number and expiry on the Billing tab, new lines defaulting to the client's rate then the product's then the default and to no tax for exempt clients, exempt badge on the client header and overview, a warning with Take the tax off on open documents that still carry taxed lines for an exempt client, and Tax exempt with the certificate under the client on untaxed documents; totals, PDFs, guest and portal views show tax by part; Unbilled Time can bill at each client's usual rate and the ticket, Add Tickets, Add Expenses and Add Trips windows start on it; API client fields for rate and exemption and tax_id default on invoice item create; Tax Collected shows exact percents; demo taxes get parts and registration numbers, demo clients their rates and two nonprofits exemptions; database 3.1.1 makes tax_percent decimal(9,4) and adds tax description, registration and replaced-by, tax_components, client rate and exemption columns and the tax settings; new functions/tax.php and js/tax_form.js; changelog updated	2026-10-17 13:00:54 -04:00
johnnyq	001cd9c658	Products makeover stage 4: price changes reach recurring invoices, drafts and quotes - every change to a product's price or cost kept with its source (edited, imported or from received stock) and who made it, on a Prices tab with the last change on the Pricing card, lines on recurring invoices, draft invoices and draft quotes still at an old price flagged on the product page, the Products page, each document and the dashboard Needs attention with what updating them adds a month, a new Update Prices page by product, client or document that picks lines at an old price, marks prices the product never had as their own and leaves them unpicked with the last change applied as the suggestion, Catalog price and same percent fills, editable new prices and a running monthly total, sent invoices and quotes left alone, changed lines recalculated with their tax and document total and noted in each document's history, saving a new price or importing a price list says how many lines are behind, deleting a product removes its price history, database 2.9.7 with the product_prices table, CHANGELOG updated	2026-10-16 16:35:29 -04:00
johnnyq	e2431748fa	Products makeover stage 3: sold hardware becomes client assets - products take an asset type, make, model and warranty in months, invoices with hardware get a Hardware card showing how many units are on the client's assets with their serials, an Add to Assets window with a row per unit for name, serial and assigned contact (Enter between serials for barcode scanning), make, model and warranty from the product counted from the invoice date, status and location for all, linking an asset the client already has or leaving rows for later, assets made this way are bought on the invoice date with its number as the order reference and link back to the invoice and product, a Client asset card and Assets tab on the product page, a Hardware tab and asset type on the products list, a dashboard Needs attention item for hardware sold in the last 90 days not yet on assets linking to a new invoices hardware filter, serials on the packing slip, asset type, make, model and warranty in product import and export, starter and demo hardware seeded with asset types, deleting a line or invoice unlinks its assets without removing them, database 2.9.6 with product asset columns and asset product, invoice and line links, CHANGELOG updated	2026-10-16 16:13:36 -04:00
johnnyq	d6e6bd146b	Products makeover stage 2: inventory ledger and alerts - every stock change recorded through productStockMove as received, sold, returned, counted or written off with unit cost, invoice or expense, note and agent, one Stock window to Receive, Count or Write off replacing Add Stock, a Stock tab on the product page with a running balance, Reorder at and Order per product with a To reorder tab, list and side nav badges, a dashboard Needs attention item and Low Stock notifications, a Count Stock page with live differences and a printable count sheet, an Inventory report with CSV exports, reorder columns and stock value in import and export, cancelling or deleting an invoice returns its stock from the net of its moves, copying an invoice or invoicing a quote carries the product link and is refused when tracked stock is short, recurring generated invoices link their products without moving stock, decimal stock quantities, database 2.9.5 with stock type, unit cost, invoice and user columns backfilled from existing notes, CHANGELOG updated	2026-10-16 15:48:29 -04:00
johnnyq	775edc53d8	Products makeover stage 1: products and services with cost and margin, the vendor they are bought from with its part number, internal notes and default billing of one time, monthly, quarterly or yearly per user or per device that fills in Billed on quotes and Counted on recurring invoices, a per-product Track stock switch so only tracked items move stock and refuse to be invoiced past the shelf while untracked ones are ordered as needed, rebuilt Products list with what catalog lines bring in each month on recurring, sales over 90 days with the top seller and stock value at cost, tabs for Services, Products, Recurring and Stocked, a vendor filter and part number search, a new product page with price, margin, 12 month sales, monthly recurring, stock with recent moves, recurring invoices, open quotes, invoices and history tabs, inline notes and Copy, one New and Edit window with live margin, rebuilt Add Stock, import by column heading with update by code for price lists, export with cost, margin, billing, vendor, part number and stock, agent-only margin on invoices, quotes and recurring invoices, a Products tab on our vendors' pages, search results opening the product page, billing defaults in the starter catalog and costs and vendors in the demo data. Fixes bulk Restore of archived products doing nothing, deleted products leaving stock behind, Add Stock recording zero units or a missing expense, and a backslash before an apostrophe in agent names in billing history. Adds DB 2.9.4 with product cost, vendor, part number, notes, frequency, seat source and track stock set for products with stock history plus product keys on line and stock tables, functions/products.php with productSave() as the one write path, productUsage() and billingMargin(), agent/product.php, a shared product_form.php, copy_product and product_set_notes handlers, removes product_model.php, and updates the 26.11 changelog	2026-10-16 15:23:05 -04:00
johnnyq	64423cbefa	Fix Client PDF Export	2026-08-06 18:51:09 -04:00
wrongecho	f87d43881e	Add very basic product import via CSV	2026-08-03 18:58:53 +01:00
johnnyq	3c8f812a16	Feature: On all export modals added Filter Tab and Selectable Columns tab with default selected, also you can now export to a PDF	2026-07-30 00:46:15 -04:00
johnnyq	556ab22c79	Enfoce Sales Permission Read on products export	2026-07-28 17:53:13 -04:00
johnnyq	5c4805b822	Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function	2026-07-24 18:12:45 -04:00
johnnyq	af51c4316f	Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present	2026-07-24 13:40:37 -04:00
johnnyq	91a1676e89	Update missing CSRF endpoint checks	2026-07-24 13:16:51 -04:00
johnnyq	b8873039a4	Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions	2026-07-14 17:41:41 -04:00
johnnyq	f1836c70cd	Replace Function logAction() with logAudit()	2026-07-14 17:35:23 -04:00
johnnyq	b57ddc0e5c	Replace Function sanitizeInput() with just escapeSql() and update all instances throughout	2026-07-14 17:17:50 -04:00
johnnyq	36ac006438	Products: Add missing CSRF checks change wording from unarchive to restore	2026-03-01 22:50:04 -05:00
johnnyq	edabc5c33f	rename /user/ to /agent/ and update links to use agent/ instead	2025-09-23 18:04:23 -04:00