14 Commits

Author	SHA1	Message	Date
johnnyq	359851c876	Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty	2026-10-23 12:09:07 -04:00
johnnyq	95dd3ef9c5	Tags stage 2: tags on five more record kinds (tickets, documents, [kind], [kind], [kind]) working like the other seven with tag pills and + picker on list, page and quick look, Tags field in New and Edit, list tag filter and tag-name search, Bulk Action Tags, export tag filter and Tags column; tickets list shows + only once a ticket has a tag, Tags under More filters with its own chip, board cards show tags, tag changes written to ticket history and merging moves non-archived tags; document tag filter in client Files and at top level across all folders excluding uploads, bulk Tags only tags ticked documents, cross-client document tags open a global search; global search matches tag names, shows the matching tag on each result and adds a Tags group; API tags read, update and create endpoints plus a tags list on every record read, per-kind permission checks and tag creation limited to admin keys; Tags starter pack and demo data cover the new kinds; changelog breaking change for tag-name matching in searches and upgrade note now 2.7.9 to 3.1.4; stage 1 tag test updated for twelve kinds	2026-10-17 15:17:14 -04:00
johnnyq	a96324628a	Fix broken cron page due to the select * sweep, note thi sdid not break cron itself	2026-08-09 13:27:51 -04:00
johnnyq	b8c9d5b4cf	Query Optimization: Select only needed columns instead of SELECT * on looped queries	2026-08-06 12:59:43 -04:00
johnnyq	04bf3c234f	Read API credential decrypt password from body instead of query string ... Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.	2026-07-25 17:08:22 -04:00
johnnyq	c509b7f693	Add user-based RBAC for API keys ... API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.	2026-07-25 16:50:58 -04:00
johnnyq	0a30300bde	replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage	2026-01-14 17:30:23 -05:00
johnnyq	c8c1155c9c	Update the API for the new cred var names	2025-03-12 22:33:06 -04:00
wrongecho	ec0e1c395c	Tweak credentials read api	2024-08-25 20:29:14 +01:00
wrongecho	9ef3099495	WIP: Allow decrypting logins/credentials via the API	2024-08-25 12:32:21 +01:00
wrongecho	d37bdcdbcb	WIP: Allow decrypting logins/credentials via the API	2024-08-25 12:31:15 +01:00
wrongecho	a6113dc371	WIP: Allow decrypting logins/credentials via the API	2024-08-22 18:22:20 +01:00
wrongecho	0c60ecc329	WIP: Allow decrypting logins/credentials via the API	2024-08-22 17:46:58 +01:00
wrongecho	63feff03d2	Initial WIP: Allow decrypting logins/credentials via the API	2024-08-19 21:23:43 +01:00