johnnyq
6ecc27e7ca
Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()
2026-11-09 01:22:35 -05:00
johnnyq
53e6564f76
Stop row actions menus being cut off on short lists - a list's table scrolls sideways inside .table-responsive, which also clipped a row's menu at the bottom of the list when it had only a row or two, hiding its last options; new js/bootstrap_defaults.js, loaded right after Bootstrap on agent pages and the client portal, sets Bootstrap's dropdown default to Popper's fixed strategy so menus open over the page and still turn upward when there's no room below, covering every list, the board, modals and the portal, with navbar menus unaffected; changelog updated
2026-11-06 18:51:50 -05:00
johnnyq
2a36534583
Add demo mode for a public demo like demo.itflow.org - $config_demo_mode = true; in config.php puts one-click sign-in buttons for Admin, Technician, Accountant and a client portal contact on the sign-in page and a demo notice on every page, and the new Demo Reset cron job rebuilds the demo nightly at 2:00 AM from db.sql with all starter content, the demo clients and the demo accounts, empties uploads except the logo and signs everyone out, keeping the company details, timezone and cron schedules; visitors can try everything except users and roles, their own sign-in details, mail, payment, AI and texting settings, API keys, backups, updates, cron, log forwarding, company, module and portal settings, custom links, starter content and share links, Debug is closed, guest links open only for someone signed in, queued email is cancelled with the reason, no sign-in alert emails are sent, certificate checks reach only public addresses on port 443, and the domain and certificate refreshers are left out; new functions/demo.php and cron/demo_reset.php, no database change, changelog, CONTRIBUTING and README updated
2026-11-06 17:46:40 -05:00
johnnyq
3b5c11c552
Add managed mode, so one ITFlow can manage others - Admin > Managed Instances adds an instance and gives a one-time connection code (a week) that the other ITFlow pastes into the new Admin > Managed By, after which it checks in every minute from the new Manager Check-in cron job with a health report (versions, update waiting and whether it has security fixes, cron, last backup, errors today, agents against the seat limit, clients, storage) and takes back what the manager sets; the manager lists each instance's version, health, seats and last check-in with a page per instance showing what needs a look, its requests and everything it reported, can update it by hand or automatically after a set number of days (security releases straight away, not retried for six hours after a failure), set its seat limit and white-label key (locked on the instance while set), make it read-only (look, export and download only, across agents, portal, guest links and the API) or suspended (a notice with the manager's message and contact, 503 for the API) with other cron jobs paused until it is active again, sign in to it as support through a signed one-time two-minute link into a two-hour session that takes no seat, can't open the vault and can't set passwords or make API keys, and remove it, while the new Managed Instances job notifies when one stops checking in and closes requests never answered; instances only call the manager, can disconnect unless config.php sets $config_manager_required, and the Update page and queue_update defer to the manager; database 3.5.8 adds managed_instances, managed_instance_commands, settings.config_manager_keys and settings.config_managed, the logic is in the new functions/managed.php with api/managed/enroll.php, api/managed/checkin.php, login_support.php and includes/managed_blocked.php, cronJobClaim() takes a paused reason that leaves a due job due, getAgentUserLimit() and getActiveAgentUserCount() honour the manager's limit and leave out the support user, the vault helpers read a missing session key as empty, the audit log knows the new types and actions, and the email parser no longer logs an App Logs error every minute while parsing is switched off; changelog updated
2026-11-05 15:22:41 -05:00
johnnyq
3143cdb115
Fix phone numbers keeping the 0 dialled at home after the country code (+49 0172 1234567) and click-to-call dialling it - formatPhoneNumber() now writes every country's numbers with Google libphonenumber's rules from the new functions/phone_formats.php, built by scripts/phone_formats_build.php from libphonenumber v9.0.43, taking off the national prefix and a typed-in country code where what is left is still a number of that country, with the international format after the code and the national format without it, German landlines split after their area code, Italy keeping its 0 and North America unchanged; the new phoneDialNumber() gives tel: links +code and the number without its prefix, used by contactPhoneLink(), vendorDialNumber() and every hand-built tel: link on the agent side, the client portal and the guest ticket page, and the ticket quick look now dials the extension after a pause instead of running it into the number; changelog updated
2026-11-05 13:16:06 -05:00
johnnyq
aff6812036
Security: hold an agent who must set up MFA to the set up page on every request, not just at sign in, and fix the client portal two-step gate, which a path added to the URL or a second action sent with the set up one got past - both now go through requestIsMfaSetup(), which checks the script actually running and every key in the request; View as contact is refused while an agent still owes MFA set up, and agents are emailed when MFA is turned on
2026-11-04 14:01:40 -05:00
johnnyq
9b92261e8c
Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id
2026-11-04 13:50:17 -05:00
johnnyq
2b401cb405
Custom Links rebuilt: tabs for the agent menu, top bar, client portal, admin menu and reports menu with counts plus All and Archived, search by name, address or description, sortable columns, each link with its icon, description, address and new-tab marker, links whose address can't work flagged; drag into order on a menu's tab or move up and down, new links at the end of their menu in place of the Order number; one add and edit window with a live preview of the link in its menu, an icon picker with search, a description shown on hover and a new-tab switch that follows the address until changed; copy, open, archive, restore and confirmed delete; addresses limited to web addresses, ITFlow pages, mailto, tel and the remote tool schemes asset links allow, with javascript and data refused and old ones drawn as going nowhere; menus read one shared helper, the agent menu's links sit under Tools even without Reports, the admin menu's get a Links heading, new-tab links get a small arrow, links without an icon get the link arrow and every link shows its description on hover; fixes mailto and tel links showing as unsupported in the side menus, the portal menu taking any address, the delete message missing the name and the new-tab tick never showing; edits audit what changed from what to what; adds functions/custom_link.php and js/custom_link_form.js, no database change; changelog
2026-10-24 14:03:40 -04:00
johnnyq
0b6f002d49
Ticket templates stage 3: request forms in the client portal - a template can be offered there under its own title, description and icon, to everyone with portal access or primary and technical contacts only, at every client or the ones picked (migration 3.2.1 adds the ticket_template_portal columns, ticket_template_portal_clients, and fill_in_client, ticket_fill_in_client and recurring_ticket_fill_in_client); New ticket in the portal starts with a choice of Report a problem or one of the forms, home lists them under Ask for something, and a form asks the fill-ins set to ask the client plus anything else, files and the device when the template mentions [Asset], then raises the ticket set up as the template says with its category, priority, billing, agent (notified), due time, tags and the tasks for those answers, the client's notes first in the details and who asked in its history; fill-ins can be kept for agents to answer, marked on the agent's ticket and left off the client's Request details; the template window gets a Client portal tab, the template page a card showing how and where it is offered and its requests, and the list marks the ones in the portal; a copy starts off not offered; forms a contact may not use are refused by link or post, and View as contact raises nothing; [Agent] is no longer filled with a client's name for a portal ticket with no agent; changelog updated
2026-10-18 01:11:12 -04:00
johnnyq
e29369926f
Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated
2026-10-17 12:05:55 -04:00
johnnyq
5e77edb077
Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated
2026-10-17 02:40:59 -04:00
johnnyq
e84e3e7e49
Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed
2026-10-17 02:12:05 -04:00
johnnyq
c6eadf3fa3
Client portal stage 1, look, home and tickets: a new light shell with the company logo or initials on the theme colour, sections shown by what each contact may open (Home, Tickets, Billing for billing contacts, Your IT for technical contacts, custom links), New ticket and an account menu with a dark mode switch kept in a cookie, a bottom tab bar and slide-in menu on phones, and the welcome banner removed; a rebuilt home showing what needs the contact (tickets waiting on their reply or to confirm, approvals, past-due invoices), open tickets, balance with Pay invoices, renewals in the next 45 days, their devices with warranty status and the company phone and email; tickets rebuilt with Open, Waiting on you, Resolved, Closed and All tabs with counts, search, paging and the whole company's tickets for primary and technical contacts with a Mine filter, the old all-tickets page redirecting there; a ticket page with progress steps, the conversation oldest first, approvals, details alongside, replies with drag and drop attachments, It's fixed, close or reopen and rating; New Ticket with priority, category, device and attachments; fixes downloading files from internal notes, files on closed tickets not downloading, new tickets linking to another client's device or a non-ticket category, empty replies and tickets being accepted, PHP warnings on Pay invoices and Recurring invoices with no payment provider, and Bootstrap icons and the editor setup blocked by the portal CSP, which now allows data: images; new js/portal.js and portal helpers in client/functions.php, ticketPortalStatusHtml removed; changelog updated
2026-10-17 01:28:27 -04:00
johnnyq
69484a8a2e
Replace Tom Select with ITFlow's own select picker: native select stays the source of truth, search, checklists for multi selects, add-your-own for tag fields, phone sheet, and client/agent/contact avatars, tag and category colours, priority dots and asset icons in the options
2026-10-13 12:41:29 -04:00
johnnyq
9bfd26d57b
Add titles to icon-only buttons
...
- title on 294 icon-only buttons, named for what each one does
- aria-label on the 7 show-password buttons (title becomes the popover
header) and the portal mobile nav toggle
- Fix dead add-category button on products filter, credential bulk tag
button now preselects Credential, drop duplicate inner-icon titles
2026-10-08 17:12:21 -04:00
johnnyq
49106e2a80
UI fixes: confirm irreversible actions, keep reply drafts guarded, re-enable CSP on portal recurring invoices
...
- Add confirm-link to 14 one-click delete/disable links (asset, contact,
files, templates, logo, MFA, calendar event, disable user, cancel schedule)
- confirm_modal.js treats btn-danger / btn-outline-danger as destructive
- Replace per-editor window.onbeforeunload with one guard over all editors
- New js/autosubmit.js replaces inline onchange in the portal; CSP back on
recurring_invoices.php
- Fix blank user name in disable_user audit log
2026-10-08 16:47:12 -04:00
wrongecho
fa4beea116
Client Portal - Use flexbox to fix layout breaking
...
Updated header layout to use flexbox for better alignment and spacing thanks to @BoredManCodes
2026-09-06 20:24:05 +01:00
wrongecho
70cb378c12
Client Portal - Fix navbar
...
Thanks to @BoredManCodes
2026-09-06 20:15:29 +01:00
johnnyq
c89e3a90d4
Add Proper footers to Guest Area and client portal
2026-08-31 13:24:32 -04:00
johnnyq
be20810d18
Use Datatables for User Activity on the client portal
2026-08-28 16:19:27 -04:00
johnnyq
10fb40f36f
Feature: Major spruce up of the client portal profile page, added Department, Location, Title, Phone with Edit, editing Pin, Recent signins and recent activity along with a seperate activity page
2026-08-28 16:08:23 -04:00
johnnyq
c10d4eb736
Add Account Statment in Client Portal with option to download as a PDF
2026-08-28 15:22:02 -04:00
johnnyq
93fc6cd2ef
Offset background color fix datepciker empty right column
2026-08-26 22:42:20 -04:00
johnnyq
0843dc94fb
Update AdminLTE from 4.7.0 to 4.8.5 and switched adminlte colors to use min version
2026-08-25 15:52:48 -04:00
johnnyq
f2b2082762
css
2026-08-19 13:48:55 -04:00
johnnyq
fc5dc82c29
Bump AdminLTE to 4.7.0 to fix print issues
2026-08-18 18:16:49 -04:00
johnnyq
858acbcd30
Bump AdminLTE which brings back AdminLTE colors
2026-08-18 12:24:31 -04:00
johnnyq
bcc73737e4
Apply custom css across the board including client portal and guest
2026-08-15 17:53:10 -04:00
johnnyq
2375e69f2d
Update badge classes to bg
2026-08-15 13:00:41 -04:00
johnnyq
73e10e72f2
Update filter bar, increase height on top navbar, primary buttons now inherit theme color
2026-08-15 12:55:24 -04:00
johnnyq
e2512b0f86
Fixed Side nav titles, Fixed ajax on bootstrap modals, fixed pagination all regressions
2026-08-14 18:32:33 -04:00
johnnyq
6fc94d9733
Migrated confirm modal to sweetalert2 lib
2026-08-14 17:38:21 -04:00
johnnyq
bbbfff7413
All Jquery removed replaced with stand JS and non jqery dependent libs
2026-08-14 17:28:06 -04:00
johnnyq
dc6b191eed
Update Font, Migrated away from JQUERY dependent libs: toastr to bootstrap5 toasts, daterangepicker to flatpickr, select2 to Tom Select, InputMask to IMask
2026-08-14 17:08:40 -04:00
johnnyq
a084e37c39
Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5
2026-08-14 13:22:11 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
b8c9d5b4cf
Query Optimization: Select only needed columns instead of SELECT * on looped queries
2026-08-06 12:59:43 -04:00
johnnyq
b3f959ac55
Use Short echo tags across the code
2026-07-28 18:47:52 -04:00
johnnyq
c64c76c577
Rotate session ID on login and fix client portal Entra SSO
2026-07-27 23:49:09 -04:00
johnnyq
497ea3b669
Centralize client portal access checks through contactCan()
...
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
2026-07-25 17:55:30 -04:00
johnnyq
565aff35f6
Set SameSite=Lax on the session cookie
...
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
2026-07-24 14:09:52 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
8da3a107fb
Rename plugins to libs and update all file references
2026-07-10 13:24:20 -04:00
johnnyq
38b4ed4b96
Tidy check_login for client portal
2026-01-30 14:24:34 -05:00
johnnyq
34308a5f9a
check if archived and active for client login as well along with loading extended client user session vars in /client/includes/check_login.php
2026-01-30 14:10:59 -05:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
johnnyq
871ad2ea7e
Update legacy client login links to use the new unified login method
2025-12-10 12:21:12 -05:00
johnnyq
16242be74e
Update Client Nav to use Absolute links and updated more of the inc_alls to use Document Server Root
2025-10-07 13:44:08 -04:00
johnnyq
6c6a988c2b
Fix custom Favicon
2025-10-02 11:42:30 -04:00
