AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-11-11 15:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,491 Commits 8 Branches 25 Tags
develop
Commit Graph

42 Commits

Author SHA1 Message Date
johnnyq
294352fd8b Let the API raise a ticket from a ticket template - tickets/create takes ticket_template_id, giving the ticket the template's subject and details when none are sent, its category, priority, billing and agent unless sent, and its tags, due time and tasks (the ones the answers call for), with the template's fill-ins answered from ticket_fill_ins and its placeholders filled in, and a missing or archived template, fill-ins that aren't an object, a required fill-in left out or a choice not on a list refused with 400 and the reason; ticket_notify sends the contact and watchers the Ticket Created email when Email clients about their tickets is on, tells the new-ticket address and notifies the assigned agent in the app and by email; the answer now includes ticket_reference, ticket_url (the contact's link to the ticket) and, from a template, ticket_tasks; canned responses now fill in a ticket's template fill-in answers such as [Hostname] alongside [Contact] and [Ticket], never over a built-in placeholder of the same name, and the canned response form says so; contacts/create and locations/create no longer write a PHP warning for each field left out; the new-ticket agent email reads raised through the API; changelog updated 2026-11-05 17:39:22 -05:00
johnnyq
01fbcda75d Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated 2026-10-26 19:54:36 -04:00
johnnyq
359851c876 Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty 2026-10-23 12:09:07 -04:00
johnnyq
ea23a2bad5 Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids 2026-10-18 22:36:25 -04:00
johnnyq
95dd3ef9c5 Tags stage 2: tags on five more record kinds (tickets, documents, [kind], [kind], [kind]) working like the other seven with tag pills and + picker on list, page and quick look, Tags field in New and Edit, list tag filter and tag-name search, Bulk Action Tags, export tag filter and Tags column; tickets list shows + only once a ticket has a tag, Tags under More filters with its own chip, board cards show tags, tag changes written to ticket history and merging moves non-archived tags; document tag filter in client Files and at top level across all folders excluding uploads, bulk Tags only tags ticked documents, cross-client document tags open a global search; global search matches tag names, shows the matching tag on each result and adds a Tags group; API tags read, update and create endpoints plus a tags list on every record read, per-kind permission checks and tag creation limited to admin keys; Tags starter pack and demo data cover the new kinds; changelog breaking change for tag-name matching in searches and upgrade note now 2.7.9 to 3.1.4; stage 1 tag test updated for twelve kinds 2026-10-17 15:17:14 -04:00
johnnyq
fecd1cabff Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change. 2026-10-14 23:33:29 -04:00
Wrongecho
70216f97b9 Contacts API - Contact must be archived before deletion 2026-09-02 07:45:39 +00:00
johnnyq
68f18064c6 Fix Syntax error in name, update contributing 2026-08-31 16:27:30 -04:00
johnnyq
b3744e9ed5 More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time 2026-08-06 13:10:23 -04:00
johnnyq
49a3c2d266 Enforce client scoping on API expense reads and record updates 
Fixes (expenses/read.php missing apiClientScopeSql), plus an unscoped UPDATE in contacts/update.php and follow-up writes firing on zero-row updates in assets/credentials.
 2026-08-06 11:00:49 -04:00
johnnyq
c509b7f693 Add user-based RBAC for API keys 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
 2026-07-25 16:50:58 -04:00
johnnyq
f1836c70cd Replace Function logAction() with logAudit() 2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c Replace Function sanitizeInput() with just escapeSql() and update all instances throughout 2026-07-14 17:17:50 -04:00
wrongecho
4617f44cda - Prevent error 500s when existing data can't be cleanly re-inserted to database 2026-04-04 11:01:34 +01:00
wrongecho
650a099e19 Contacts API - Prevent more than 1 primary contact being set per client 2025-11-06 16:00:21 +00:00
wrongecho
9d3a44d110 Contacts API - Archiving & Un-archiving 2025-11-06 15:10:25 +00:00
wrongecho
873dc1f76d Fix contact location if not provided in api call 2025-07-01 11:50:20 +01:00
johnnyq
e9f023f0c7 Updated all API functions to use the new logAction Function 2024-11-14 18:27:31 -05:00
johnnyq
1df98166bd Fix issue with Contacts API - Removed contact_auth from Contacts call to the API 2024-10-30 19:35:26 -04:00
wrongecho
f3e9c9c867 API Tidy 
- Remove old client ID queries, these are now built into the API keys. If a key has access to all clients, a client ID can be provided in the query.
- Small fixes to assets URI lookup
- Add read endpoint for vendors
 2024-09-11 18:06:45 +01:00
johnnyq
3e7f57f64a Add contact primary to the API edit ^Cd create 2024-05-10 14:27:04 -04:00
Marcus Hill
f45a5e0b51 Contacts API 
Allow looking up contacts via mobile / phone number
 2023-12-24 20:05:04 +00:00
o-psi
53c11edc8c Update constructs to not have parenthesis. 2023-10-20 15:25:52 -05:00
johnnyq
48fe49cf77 BREAKING CHANGES - MAKE FULL BACKUP BEFORE PROCEEDING - Requires Manual Intervention on files see Forum Post Make sure you run the Database update directly after update. This Removes Multi-Company Functionality. Fixes issues with Reponsive tables and bunch of other UI and small Fixes 2023-03-11 16:16:46 -05:00
johnnyq
5640a22c18 Remove some more log created at and updated at as the DB does this for us 2023-03-04 16:17:29 -05:00
johnnyq
cdfb61b294 Added a helper if no tags exist when attempting to add them to a client, Added some santizeInput tags to API 2023-02-28 11:58:08 -05:00
Marcus Hill
68005723e6 API 
- Refactor comments/client id var
- Add basic read endpoint for docs, products, expenses, quotes and invoices
 2023-02-12 15:50:45 +00:00
Marcus Hill
b36719eb99 General cleanup/tidying 2023-02-09 11:32:40 +00:00
Marcus Hill
f3456ead67 API 
- Add PHP logging when API queries fail because of SQL errors
- Add user agent to logging
- Enhance asset update endpoint
 2023-02-05 15:07:41 +00:00
Marcus Hill
d7085c4790 Touch ups 2023-01-26 14:41:24 +00:00
Marcus Hill
5d269368f6 Update contact API to support contact_import, contact_billing, contact_technical 2023-01-26 13:34:13 +00:00
Marcus Hill
5a35f508c6 Remove unrequired trim & strip tags - only needs sql escape 2023-01-02 14:32:17 +00:00
Marcus Hill
ff741c223e API code style tidy 2023-01-01 16:00:07 +00:00
Marcus Hill
b23359ff38 Adjust contact API to allow department to be text rather than int due to db schema change 2022-09-11 11:08:48 +01:00
Marcus Hill
3f3854e8c3 Add contact delete endpoint 2022-05-11 20:41:19 +01:00
Marcus Hill
25c610e963 Rename update_id to update_count - as it's a count, not the insert ID 2022-05-01 10:34:21 +01:00
Marcus Hill
467784cb2a Define the number regex as a constant and use that instead 2022-04-17 23:30:10 +01:00
Marcus Hill
e55622827d Add support for client-specific API keys 
Refactoring API. Added a contact update endpoint.
Small misc changes.
 2022-04-15 17:43:06 +01:00
Marcus Hill
17f97ff7bc Deduplicate API GET check into single file 2022-04-14 20:05:15 +01:00
Marcus Hill
816ba87485 SQL Injection / XSS fixes 2022-03-27 20:02:16 +01:00
Marcus Hill
09b4eab1c3 Correct insert ID for create endpoint. Add contact create API endpoint 2022-03-26 13:39:43 +00:00
Marcus Hill
fe5635f1dc Add contact read to api 2022-02-12 17:37:56 +00:00