johnnyq
9ba21cf352
Assets: add NAS, UPS, PDU, Modem/ONT and NVR/DVR types from a new registry in functions/asset_type.php that sets each type's icon, tone, group, fields and details; the asset form shows only the fields a type uses (fields that already hold a value stay shown) and adds a Details section per type (CPU/RAM/storage, VM host/vCPUs, switch ports/SFP/PoE/management, NAS drives/capacity/RAID, UPS capacity/output/runtime/outlets/battery dates, PDU kind/outlets/input, modem circuit ID/ISP account, printer, phone, mobile, display, camera and NVR details) stored in a new asset_specs table (database 3.4.9); new or changed port and SFP counts add the missing interfaces, continuing the asset's numbering, skipping Wi-Fi, VLAN and management ports and never deleting any; the asset page and quick look show the details, a server or NAS lists the VMs that run on it, and Assigned and Warranty show only on types that use them; the list gets Servers & NAS and Power tabs, an optional Details column, a UPS battery badge, an Assigned picker only on assigned types, and New buttons named for what they add; nightly UPS Battery Due notifications at 45, 7 and 1 days as a Support notification; copy leaves out per-unit details, Transfer to Client carries details and interface types, export adds per-detail columns, import reads detail columns after the standard twelve (VM hosts by name, resolved after every row is in) and reports values it could not keep, and the API reads and writes asset_specs; racks, client portal, client export, overview, document templates and AI lists group the new types; fix asset import carrying physical location and notes into the next row, saving 0000-00-00 for a missing purchase date and warning on an unknown contact or location, save API and import types in the list's spelling, and keep interface types on transfer; changelog updated
2026-10-27 15:59:03 -04:00
johnnyq
01fbcda75d
Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated
2026-10-26 19:54:36 -04:00
johnnyq
359851c876
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
2026-10-23 12:09:07 -04:00
johnnyq
95dd3ef9c5
Tags stage 2: tags on five more record kinds (tickets, documents, [kind], [kind], [kind]) working like the other seven with tag pills and + picker on list, page and quick look, Tags field in New and Edit, list tag filter and tag-name search, Bulk Action Tags, export tag filter and Tags column; tickets list shows + only once a ticket has a tag, Tags under More filters with its own chip, board cards show tags, tag changes written to ticket history and merging moves non-archived tags; document tag filter in client Files and at top level across all folders excluding uploads, bulk Tags only tags ticked documents, cross-client document tags open a global search; global search matches tag names, shows the matching tag on each result and adds a Tags group; API tags read, update and create endpoints plus a tags list on every record read, per-kind permission checks and tag creation limited to admin keys; Tags starter pack and demo data cover the new kinds; changelog breaking change for tag-name matching in searches and upgrade note now 2.7.9 to 3.1.4; stage 1 tag test updated for twelve kinds
2026-10-17 15:17:14 -04:00
johnnyq
fecd1cabff
Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change.
2026-10-14 23:33:29 -04:00
johnnyq
2d6e40bcf6
Racks makeover: rack page with to-scale front/rear elevation (click an empty U to add), front/rear mounting and full/half depth, non-asset items (patch panel, cable management, shelf, PDU, UPS, KVM, blanking panel), item edit/move, U and power capacity with largest free gap, front/rear photos, U1 top/bottom numbering, print view, Not racked yet list, rack cards with mini elevation and usage, Racks under All Client Docs, rack position on asset views. Fixes model wiped on every rack save, archive denied for non-admins, item edits taking the rack from the form instead of the item, no bounds check on positions, orphaned rack items on asset delete/transfer and orphaned racks on client delete. DB 2.8.0
2026-10-14 15:14:11 -04:00
wrongecho
7442e0c2c8
Move interface deletion inside delete check otherwise the count is of the interfaces not the asset
2026-08-31 21:42:07 +01:00
johnnyq
68f18064c6
Fix Syntax error in name, update contributing
2026-08-31 16:27:30 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
49a3c2d266
Enforce client scoping on API expense reads and record updates
...
Fixes (expenses/read.php missing apiClientScopeSql), plus an unscoped UPDATE in contacts/update.php and follow-up writes firing on zero-row updates in assets/credentials.
2026-08-06 11:00:49 -04:00
johnnyq
c509b7f693
Add user-based RBAC for API keys
...
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
2026-07-25 16:50:58 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
wrongecho
5efdfc53ff
Asset API - History
2026-04-09 15:25:21 +01:00
wrongecho
0ae4c2fac9
- Prevent error 500s when existing data can't be cleanly re-inserted to database
...
- Full support for asset_uri_2
2026-04-04 10:52:32 +01:00
wrongecho
8591758cd7
Fix asset read api - uri_2
2026-04-04 10:18:21 +01:00
johnnyq
fe762ef926
Asset Interfaces: Renamed Port to Description, added Interface Type
2025-02-12 17:13:39 -05:00
johnnyq
ba5e2b216b
Updated asset API to use new logAction function
2024-11-14 17:42:01 -05:00
wrongecho
f3e9c9c867
API Tidy
...
- Remove old client ID queries, these are now built into the API keys. If a key has access to all clients, a client ID can be provided in the query.
- Small fixes to assets URI lookup
- Add read endpoint for vendors
2024-09-11 18:06:45 +01:00
johnnyq
b37cfdf677
Fix API Asset interface relationship
2024-06-12 18:06:04 -04:00
johnnyq
836e1a3199
Updated Asset API to include its assets
2024-06-11 23:00:57 -04:00
o-psi
53c11edc8c
Update constructs to not have parenthesis.
2023-10-20 15:25:52 -05:00
johnnyq
cea210bcea
Added asset_uri field to the API
2023-09-20 16:39:55 -04:00
johnnyq
d1876e829c
Added asset description to the API for create and update
2023-06-19 16:34:44 -04:00
johnnyq
427c51b728
Bump phpMailer from 6.7.1 to 6.8.0
2023-03-18 12:44:55 -04:00
johnnyq
a889f7d879
Add back api/v1/assets/read.php somehow got wiped during the big update also added the ability to query asset by MAC address
2023-03-11 17:15:46 -05:00
johnnyq
48fe49cf77
BREAKING CHANGES - MAKE FULL BACKUP BEFORE PROCEEDING - Requires Manual Intervention on files see Forum Post Make sure you run the Database update directly after update. This Removes Multi-Company Functionality. Fixes issues with Reponsive tables and bunch of other UI and small Fixes
2023-03-11 16:16:46 -05:00
johnnyq
c0af8e8eab
Add '' to the date vars under API assets if not empty so they dont error out when inserted into the DB
2023-03-04 16:13:38 -05:00
johnnyq
e01dea2fd0
Fix Assets API Missing $ on var and use NULL instead of 0000-00-00 when inserting into the DB similar to POST
2023-03-04 15:58:34 -05:00
johnnyq
cdfb61b294
Added a helper if no tags exist when attempting to add them to a client, Added some santizeInput tags to API
2023-02-28 11:58:08 -05:00
Marcus Hill
6374524cfb
Prevent 'Undefined variable: asset_row' errors when adding/updating assets via API
2023-02-26 21:55:24 +00:00
Marcus Hill
68005723e6
API
...
- Refactor comments/client id var
- Add basic read endpoint for docs, products, expenses, quotes and invoices
2023-02-12 15:50:45 +00:00
Marcus Hill
85c28f889b
Allow setting asset status via API
2023-02-11 14:22:35 +00:00
Marcus Hill
f3456ead67
API
...
- Add PHP logging when API queries fail because of SQL errors
- Add user agent to logging
- Enhance asset update endpoint
2023-02-05 15:07:41 +00:00
Marcus Hill
d34c26d176
Tidy
2023-01-21 17:49:10 +00:00
Marcus Hill
ff741c223e
API code style tidy
2023-01-01 16:00:07 +00:00
Johnny
44f8569b50
Merge pull request #455 from wrongecho/api
...
Add delete asset API endpoint
2022-05-02 11:30:02 -04:00
Marcus Hill
25c610e963
Rename update_id to update_count - as it's a count, not the insert ID
2022-05-01 10:34:21 +01:00
Marcus Hill
69c1fc6cae
Add asset API delete endpoint
2022-05-01 10:30:04 +01:00
Marcus Hill
917377ed17
Remove meshcentral references in api
2022-04-28 21:46:41 +01:00
Marcus Hill
2d6e7dbb37
Add clients/read.php API endpoint.
...
Adjust asset create/update so that they function without all attributes being provided. Update will default to using the value currently in the database, rather than overwriting blank.
2022-04-18 15:59:09 +01:00
Marcus Hill
e55622827d
Add support for client-specific API keys
...
Refactoring API. Added a contact update endpoint.
Small misc changes.
2022-04-15 17:43:06 +01:00
Marcus Hill
17f97ff7bc
Deduplicate API GET check into single file
2022-04-14 20:05:15 +01:00
Marcus Hill
09b4eab1c3
Correct insert ID for create endpoint. Add contact create API endpoint
2022-03-26 13:39:43 +00:00
Marcus Hill
4b077cf6e0
Add create asset functionality to API
2022-02-27 16:09:21 +00:00
Marcus Hill
b9bbc75ce3
Add/update READ endpoints for assets, certs, domains, networks & software
2022-02-05 14:20:20 +00:00
Marcus Hill
d4ea0c984d
id > asset_id
2022-02-05 13:34:33 +00:00
Marcus Hill
6e4025dc58
Initial new api
2022-02-02 22:16:08 +00:00
