johnnyq
|
cf2c9c2d9b
|
Let clients pay the card fee - turn on Clients pay the card fee on Stripe in Admin > Payment Providers with Stripe's percent and fixed rate, and each card payment in the client portal, through an invoice's link, by autopay or from Charge Saved Card is grossed up so Stripe's fee comes out of it, with one fee per payment shared over its invoices; the fee is shown before paying (Pay invoices, checkout, the guest pay page, invoice pages, autopay and the Charge Saved Card window) and goes on each invoice as a Card Fee line with no tax when the payment is booked, carried in the PaymentIntent's itflow_fees metadata and checked against the amount received to the cent; a client can be let off it with No card fee on their Billing tab, refunding a card payment takes its Card Fee line back off, autopay and Charge Saved Card now compare cents instead of whole dollars, database 3.5.6 adds the provider and client columns, changelog updated
|
2026-11-05 12:47:06 -05:00 |
|
johnnyq
|
359851c876
|
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
|
2026-10-23 12:09:07 -04:00 |
|
johnnyq
|
c51323b88e
|
Rebuild guest sharing as Shared Links (functions/share.php, DB 2.9.0) with one Share window for credentials, documents and files plus secure notes and login requests that clients answer through an encrypted form and agents save to credentials, choices for expiry, view limit, a passphrase or a code emailed to the recipient with lockout after five wrong tries, optional 2FA codes, notify on open, email or copy or QR, the link secret kept after the # and only its hash stored, login, note and request payloads sealed with AES-256-GCM under a key derived from the secret and request keys held under the vault, a rebuilt guest page (guest/share.php, js/guest_share.js, guest/share_ajax.php) with click to reveal so link scanners cannot use up one-time links, copy buttons, rotating 2FA codes limited to the browser that opened it and a destroy button, POST-only file downloads confined to the client folder, a Shared Links page per client and under All Client Docs with open, sent back and ended filters, a quick look with access history by address and browser, turn off one, ticked or every open link for a client, secrets wiped when links end and ended links kept for 90 days, sharing policy under Admin Settings Security, old links still working until they expire, removal of share_modal.php, share_modal.js, credential_share.php, share_generate_link, get_share_totp_token and deactivate_shared_item, and an updated 26.11 changelog
|
2026-10-16 01:33:36 -04:00 |
|
johnnyq
|
fecd1cabff
|
Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change.
|
2026-10-14 23:33:29 -04:00 |
|
Wrongecho
|
c4843095b2
|
Potential fix for Stripe charges being off by a cent
|
2026-09-22 16:01:46 +00:00 |
|
Wrongecho
|
f83dc8a28e
|
Fix idiot copy/paste
|
2026-08-30 12:58:22 +01:00 |
|
Wrongecho
|
9bc0bf0b7b
|
Stripe ID creation/linking for guest flows (wip)
|
2026-08-30 12:42:12 +01:00 |
|
johnnyq
|
b3744e9ed5
|
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
|
2026-08-06 13:10:23 -04:00 |
|
johnnyq
|
8f43b92496
|
Use stripe_init include to init stripe and updated code everywhere
|
2026-07-23 13:00:01 -04:00 |
|
johnnyq
|
7ccdc942fe
|
Bump imapEngine from v1.25.2 to v1.25.3
|
2026-07-23 00:59:07 -04:00 |
|
johnnyq
|
e39ecb7ac9
|
Remove Legacy OTP code and fix guest view credential
|
2026-07-15 22:02:52 -04:00 |
|
johnnyq
|
b57ddc0e5c
|
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
|
2026-07-14 17:17:50 -04:00 |
|
johnnyq
|
7bc47a58fe
|
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
|
2026-07-14 17:10:45 -04:00 |
|
johnnyq
|
8da3a107fb
|
Rename plugins to libs and update all file references
|
2026-07-10 13:24:20 -04:00 |
|
johnnyq
|
0a30300bde
|
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
|
2026-01-14 17:30:23 -05:00 |
|
johnnyq
|
9bc705bfa1
|
Updated Guest pay and Client Add Delete Payments, adjustedsetting saved payment per recurring invoice
|
2025-07-09 01:45:56 -04:00 |
|
johnnyq
|
f75445b4d0
|
Limit Stripe Payments to just Credit Cards
|
2025-05-23 17:18:22 -04:00 |
|
johnnyq
|
f1aa66119a
|
Update pointers to the includes folder
|
2025-03-13 18:12:18 -04:00 |
|
johnnyq
|
6473a84fb2
|
Bump plugin stripe-php from 10.5.0 to 16.4.0 and update links
|
2025-01-25 11:47:58 -05:00 |
|
johnnyq
|
f29d122376
|
Move totp.php out of functions folder into plugins then removed functions folder
|
2025-01-24 21:07:01 -05:00 |
|
johnnyq
|
6733d3cd24
|
Removed unused libs in the vendor folder and moved stripe to the plugins folder then elininated the vendor folder all together, updated all the stripe links
|
2025-01-24 20:44:36 -05:00 |
|
johnnyq
|
8e04e10753
|
Combine base32static.php and rfc6238.php into 1 file called totp.php and place it into the functions folder
|
2025-01-24 20:26:46 -05:00 |
|
johnnyq
|
d80d4803db
|
Moved TOTP dependent files rfc6238.php and base32static.php to /includes folder and updated links in pages
|
2025-01-24 19:20:49 -05:00 |
|
johnnyq
|
2c51289d75
|
Remove mysqli connection vars when passing mail data to addToMailQueue Function
|
2025-01-22 20:56:24 -05:00 |
|
johnnyq
|
7a23cf245d
|
Fix index.php, Move Guest files to /Guest directory, fix adminlte path
|
2025-01-11 15:48:10 -05:00 |
|