johnnyq
6ecc27e7ca
Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()
2026-11-09 01:22:35 -05:00
johnnyq
aff6812036
Security: hold an agent who must set up MFA to the set up page on every request, not just at sign in, and fix the client portal two-step gate, which a path added to the URL or a second action sent with the set up one got past - both now go through requestIsMfaSetup(), which checks the script actually running and every key in the request; View as contact is refused while an agent still owes MFA set up, and agents are emailed when MFA is turned on
2026-11-04 14:01:40 -05:00
johnnyq
359851c876
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
2026-10-23 12:09:07 -04:00
johnnyq
928fc5f10a
Settings stage 2: move Tickets, Projects, Quotes, Invoices and billing and Defaults onto the settings frame with sections and live next-number previews that refuse a number already in use, validate email addresses instead of blanking them, check the ticket close time and stop its PHP warnings, warn when late fees are on but reminders are off, limit the start page to real ITFlow pages and escape it where shown, keep archived default accounts, rename the Defaults fields to their columns, and keep the reminder, billing time, expense and mileage anchors
2026-10-20 11:29:58 -04:00
johnnyq
1b0169f421
Settings stage 1: add a Settings overview with a tile and current summary for every page, attention items for problems and a Find a setting search that opens the setting highlighted, add a shared settings frame with described sections, a save bar with unsaved state and Undo, a leave-page warning, server-side validation that keeps typed values and audit entries listing each change from old to new, and move Company details, Localization, Theme, Modules and Telemetry onto it with logo and favicon previews, the company phone following the country, a localization sample, a live theme preview, white-label key checks and Telemetry as a single switch
2026-10-20 11:29:24 -04:00
johnnyq
a5a43e37ac
Audit logs stage 3: failed sign-ins say why and are logged against the account they were for - wrong password, no account with that email, disabled, archived or invited account, client archived, portal turned off, a wrong MFA or two-step code after the right password - with failed Microsoft 365 portal sign-ins logged too and marked Their account in the audit log; the IP lockout counts portal failures as well; the first sign-in from an IP address is badged New IP in the audit lists and quick look; new Admin > Sign-ins under Access with People and IP addresses views, search, date filter, sortable columns and paging; admins get a notification and an email on a run of failed sign-ins or turned-away API calls from one address or against one account, set in Settings > Security (10 to start, 5, 20, 50 or never), each in the audit log Security view and in Mail > Previews; API calls counted per key, day and endpoint, with a 30-day calls column and last IP on API Keys and a usage window, expired-key calls logged against the key, and usage deleted with the key and after the log retention; database 3.3.2 drops the unused auth_logs table and adds settings.config_login_alert_failures and api_key_usage; new functions/sign_in.php, admin/sign_ins.php and admin/modals/api/api_key_usage.php; the license template page no longer warns when view is missing
2026-10-19 00:56:52 -04:00
johnnyq
f43d4a9127
Audit logs stage 2: record history and a client Audit Log for agents, scoped to their role; auditLogKinds() gives each kind the module that shows it, with new auditLogRoleSql() (everything for an admin, otherwise the kinds the role reads and never Denied), auditLogHistory(), auditLogHistoryUrl(), auditLogHistoryHtml(), auditLogHistoryCard() and auditLogHistorySection(); a History tab on contacts, assets, networks and projects, a History card on racks, documents and the ticket, project, document and license template pages, and a folded History on the file, expense, recurring expense and trip quick looks, each newest first with who, when and the IP for an admin, the latest 50 with how many more and a link to all of them; vendors, locations, licenses, services and products use the shared list, and vendorHistory(), locationHistory(), softwareHistory(), serviceHistory() and productHistory() are removed; new agent/audit_log.php in the client nav after Calendar, with search, who, type, action, one record by name, dates, sortable columns, paging and Changes, Deletions, Sign-ins and Data out views, plus the quick look and a link to Admin > Audit Logs for admins; the client overview's Recent activity is role-scoped and links there for everyone; Your account > Activity rebuilt as the same list over the agent's own entries; the document versions card is now called Versions; the admin audit log quick look links to itself absolutely so it opens from agent pages
2026-10-19 00:13:28 -04:00
johnnyq
81c80d8965
Canned responses stages 3 and 4: agents keep canned responses of their own in Your account > Canned Responses (on the standard list with Yours and Shared tabs, how often they used each, change, copy, archive and delete their own, Copy to yours from a shared one), offered to them alone and first in the picker as Yours; Save your reply as a canned response at the foot of the picker opens the draft with the ticket's contact, first name, client, ticket number, subject, link and agent swapped back to placeholders (canned_response_unfill, text only, a one-word subject left alone), offered on the ticket's category with a switch to put it back as written, and saves it in JSON without leaving the ticket so the reply stays and the new one goes straight into the picker; Admin > Canned Responses gains an Agents' own tab showing whose each is with Share with everyone, copies made there are shared, and admins can share their own or tick Share when saving a reply; files go with a response (Files tab, up to ten of the ticket attachment kinds, kept in uploads/canned_responses/<id>/, streamed by agent/canned_response_file.php to those who may use it), shown as chips under the picker with an x to leave one off, copied onto the ticket with the reply and sent with its email on a ticket and in Update & Reply; migration 3.2.4 adds canned_response_user_id and canned_response_created_by and the canned_response_files table, existing responses staying shared; the response window moves to includes/canned_response_form.php for the admin and account windows; export and import (functions/canned_response_transfer.php) of one, some or every shared response as a versioned JSON file with categories by name, what it sets up, status by name and files as base64, importing as shared with categories matched or made and leave, add as well or replace (keeping use and archived state), everything made safe and refused files named; an MSP starter pack of 27 canned responses in Starter Content loaded through the same import, with Update for the ones already added, and the Update button now driven by the pack registry; new Canned Responses report under Service Desk by response and by agent, filtered by client and by the agent who used it, admins seeing every agent's own; changelog updated
2026-10-18 15:36:00 -04:00
johnnyq
df0c6a5bc8
Review pass over the modernized sections: add icons in front of the fields that were missing them (project form, bulk due and manager, project export; service form, depends-on pickers, bulk edit, review, link tickets and export; calendar event and calendar forms; rack and rack item forms; project template name; location and vendor extension; ticket bulk reply, bulk resolve and edit reply time worked; license renew date; client bulk ticket subject; credential share link), show names with apostrophes and quotes correctly in contact, asset, client, tag, ticket template and vendor template save messages, reword unclear or inconsistent messages and hints (ticket close, reply added, task approvals, bulk contact and asset messages, user and profile hints, VLAN, certificate and vendor PIN hints, with no vendor / location / network), singular and plural in bulk modal titles, US spelling in visible text, make the hidden attribute win over display utilities so the empty credential strength meter stays hidden, wrap pagination on narrow screens, and remove the unused credentialLink, projectLink and linkCounts helpers
2026-10-15 22:20:25 -04:00
johnnyq
99ecc2d4a4
Modernize Administration > Users and the agent Account pages: new users list with Users/Admins/No MFA/Disabled/Archived views, role filter, status and MFA pills, remembered browsers, client access summary, last successful sign in with device and IP, seat badge, quick look modal, bulk role/require MFA/forget browsers/activate/disable, shared New/Edit user form with Details/Sign in/Client access tabs (icon prefixed inputs, picture preview, generated passwords, Only/Never client rules with search and set all), archive modal with ticket hand-over, restore requiring a new password, incident response limited to agents and forgetting remembered browsers, export role filter and MFA/last sign in/client access columns; Account pages reworked into Profile/Security/Preferences/Activity with current password required to change email, password or turn MFA off, inline SVG MFA QR code, remembered browser list with forget one/all, rows per page preference; adds functions/user.php shared helpers, validates email format and uniqueness, sets password hash and vault key from the exact typed password, purifies signatures, fixes Activity showing other agents' sign ins, removes dead user invite modal and user_model, and fixes the networks export link from All Clients with no filter
2026-10-15 21:29:40 -04:00
johnnyq
032e555f87
Replace copy buttons with hover over copy buttons
2026-10-14 17:27:27 -04:00
johnnyq
9bfd26d57b
Add titles to icon-only buttons
...
- title on 294 icon-only buttons, named for what each one does
- aria-label on the 7 show-password buttons (title becomes the popover
header) and the portal mobile nav toggle
- Fix dead add-category button on products filter, credential bulk tag
button now preselects Credential, drop duplicate inner-icon titles
2026-10-08 17:12:21 -04:00
johnnyq
49106e2a80
UI fixes: confirm irreversible actions, keep reply drafts guarded, re-enable CSP on portal recurring invoices
...
- Add confirm-link to 14 one-click delete/disable links (asset, contact,
files, templates, logo, MFA, calendar event, disable user, cancel schedule)
- confirm_modal.js treats btn-danger / btn-outline-danger as destructive
- Replace per-editor window.onbeforeunload with one guard over all editors
- New js/autosubmit.js replaces inline onchange in the portal; CSP back on
recurring_invoices.php
- Fix blank user name in disable_user audit log
2026-10-08 16:47:12 -04:00
johnnyq
6d043948b4
Updated Adminlte from 4.8.5 to 4.9.1 to fix print issues
2026-08-26 12:24:16 -04:00
johnnyq
bcc73737e4
Apply custom css across the board including client portal and guest
2026-08-15 17:53:10 -04:00
johnnyq
e2512b0f86
Fixed Side nav titles, Fixed ajax on bootstrap modals, fixed pagination all regressions
2026-08-14 18:32:33 -04:00
johnnyq
6fc94d9733
Migrated confirm modal to sweetalert2 lib
2026-08-14 17:38:21 -04:00
johnnyq
bbbfff7413
All Jquery removed replaced with stand JS and non jqery dependent libs
2026-08-14 17:28:06 -04:00
johnnyq
dc6b191eed
Update Font, Migrated away from JQUERY dependent libs: toastr to bootstrap5 toasts, daterangepicker to flatpickr, select2 to Tom Select, InputMask to IMask
2026-08-14 17:08:40 -04:00
johnnyq
0fe6d51bdb
Theme Fixes for adminlte 4
2026-08-14 14:11:13 -04:00
johnnyq
a084e37c39
Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5
2026-08-14 13:22:11 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
89fba247c5
Add some missing maxlength form options to prevent info overflow and result in error 500
2026-08-02 16:08:01 -04:00
johnnyq
23a09f54fc
Reworked getFieldById to remove escaping and and reworked everything that uses the function to also escape, was causing double escaping in many places this standardizes the function
2026-08-01 15:33:48 -04:00
johnnyq
cdb4a43b89
Major UI/UX overhaul on Tickets listing / Kanban and ticket details
2026-08-01 14:12:03 -04:00
johnnyq
b3f959ac55
Use Short echo tags across the code
2026-07-28 18:47:52 -04:00
johnnyq
a4fdced10f
Rate limit 2FA code attempts and narrow the TOTP acceptance window
2026-07-27 18:36:43 -04:00
johnnyq
af51c4316f
Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present
2026-07-24 13:40:37 -04:00
johnnyq
dae7f09650
Remove _details, fix plural and singular file naming in admin, update admin post to match agent post
2026-07-15 00:38:34 -04:00
johnnyq
b8873039a4
Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions
2026-07-14 17:41:41 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
8de3cd300d
Replace Function key32gen() with generateTotpSecret()
2026-07-14 17:27:02 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
8da3a107fb
Rename plugins to libs and update all file references
2026-07-10 13:24:20 -04:00
johnnyq
6532c2dde4
User Preferences Avatar: Fix creating user upload directory if doesnt exist, and remove Avatar now properly deletes the old avatar image
2026-06-24 12:04:19 -04:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
johnnyq
f2d4eb0486
Fix Ticket Template auto filling
2025-12-29 17:46:23 -05:00
johnnyq
a79ce23ae5
Fix randomString() to generate cryptographically secure URL-safe tokens, reduced url keys to 32 Characters for performance and easy copy and paste and compatibility while still mainitaining ubreakable cryptographic keys
2025-12-18 14:24:53 -05:00
johnnyq
9fcaf9f5cc
[Feature] Updated Invoice Ticket to include more details in the description, predefined along with optional Invoice Title, helper texts below qty and price to show how it gets its information, fixed ticket number not showing in ticket reply when adding ticket to an existing invoice. Add to Existing Invoice is default if open invoices exist, migrated many more ticket related modals to use ajax-modal
2025-11-04 17:48:21 -05:00
johnnyq
c66aa92365
Update All Side Nav Links to be absolute so the side bar includes can be navigatable when navs are included in custom code
2025-10-23 13:07:02 -04:00
johnnyq
16242be74e
Update Client Nav to use Absolute links and updated more of the inc_alls to use Document Server Root
2025-10-07 13:44:08 -04:00
johnnyq
fd93ee3263
Allow HTML for signatures
2025-10-04 19:20:34 -04:00
johnnyq
e6bcf0e12f
Started updating href paths to absolute paths instead of relative paths as itflow should be installed in document root anyway and not a sub-directory
2025-09-24 12:56:01 -04:00
johnnyq
50f790dd6c
Fix MFA Enforcement
2025-09-23 20:30:25 -04:00
johnnyq
ed6aa843b7
Fix Activity log link
2025-09-23 19:41:02 -04:00
johnnyq
52a27699f1
fix mfa model
2025-09-23 19:39:49 -04:00
johnnyq
dba08714bf
moved user preferences and user settings into /agent/user/ directory
2025-09-23 19:17:14 -04:00
