AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-11-11 07:01:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,491 Commits 8 Branches 25 Tags
develop
Commit Graph

824 Commits

Author SHA1 Message Date
johnnyq
359851c876 Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty 2026-10-23 12:09:07 -04:00
johnnyq
c51323b88e Rebuild guest sharing as Shared Links (functions/share.php, DB 2.9.0) with one Share window for credentials, documents and files plus secure notes and login requests that clients answer through an encrypted form and agents save to credentials, choices for expiry, view limit, a passphrase or a code emailed to the recipient with lockout after five wrong tries, optional 2FA codes, notify on open, email or copy or QR, the link secret kept after the # and only its hash stored, login, note and request payloads sealed with AES-256-GCM under a key derived from the secret and request keys held under the vault, a rebuilt guest page (guest/share.php, js/guest_share.js, guest/share_ajax.php) with click to reveal so link scanners cannot use up one-time links, copy buttons, rotating 2FA codes limited to the browser that opened it and a destroy button, POST-only file downloads confined to the client folder, a Shared Links page per client and under All Client Docs with open, sent back and ended filters, a quick look with access history by address and browser, turn off one, ticked or every open link for a client, secrets wiped when links end and ended links kept for 90 days, sharing policy under Admin Settings Security, old links still working until they expire, removal of share_modal.php, share_modal.js, credential_share.php, share_generate_link, get_share_totp_token and deactivate_shared_item, and an updated 26.11 changelog 2026-10-16 01:33:36 -04:00
johnnyq
fecd1cabff Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change. 2026-10-14 23:33:29 -04:00
johnnyq
bab3d73c86 Rebuild notifications: bell panel and full page 
- Bell opens a dropdown panel instead of a modal: Unread/All tabs, grouped
  by day, type icons, relative times, click-through marks read, per-row
  read/unread, mark all as read
- Unread badge refreshes every minute while the tab is visible
- Notifications page rebuilt on the same backend: search, type filter,
  date range, read/unread toggles, proper empty states
- Hide notifications for clients/modules the user cannot access
- Normalise relative notification links so they work from /admin pages
- Remove the old notifications modal and dismiss handlers
 2026-10-09 15:52:40 -04:00
johnnyq
b3744e9ed5 More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time 2026-08-06 13:10:23 -04:00
johnnyq
af51c4316f Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present 2026-07-24 13:40:37 -04:00
johnnyq
f1836c70cd Replace Function logAction() with logAudit() 2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c Replace Function sanitizeInput() with just escapeSql() and update all instances throughout 2026-07-14 17:17:50 -04:00
johnnyq
e7b53388a0 Check CSRF and Enforce ClientAccess when deactivating Shared Items 2026-06-26 12:17:38 -04:00
johnnyq
30357b9cf7 Add CSRF Checks to notifications and ensure the user dismissing the notification is their own notification 2026-03-05 17:51:20 -05:00
johnnyq
0a30300bde replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage 2026-01-14 17:30:23 -05:00
johnnyq
9fcaf9f5cc [Feature] Updated Invoice Ticket to include more details in the description, predefined along with optional Invoice Title, helper texts below qty and price to show how it gets its information, fixed ticket number not showing in ticket reply when adding ticket to an existing invoice. Add to Existing Invoice is default if open invoices exist, migrated many more ticket related modals to use ajax-modal 2025-11-04 17:48:21 -05:00
johnnyq
50f790dd6c Fix MFA Enforcement 2025-09-23 20:30:25 -04:00
johnnyq
9210734911 Also take in consideration of the ticket source, category and priority 2025-09-06 19:41:16 -04:00
johnnyq
ebae80bb7e Ticket Summeries are now in HTML form wit ha breakdown of the Main Issue, Actions Taken and Resolution or Next Steps. It also takes into consideration of the current ticket status and Who replyied for the ticket replys / comments 2025-09-06 19:31:44 -04:00
johnnyq
dcade3a5c7 Update the AI Ticket Summary Prompt 2025-09-06 17:57:58 -04:00
johnnyq
d2dac1915d Update admin, user, guest and client post to use new redirect function 2025-08-01 15:25:52 -04:00
johnnyq
95950700d8 Moved user items to user directory 2025-07-28 17:57:06 -04:00
johnnyq
0494bfc1cf Moved admin_ to /admin, user_ to user report_ to /reports each have their own post includes modals directories created seperate headers and footer. Also did the same for xcustom, more work to me done 2025-07-28 13:32:28 -04:00
johnnyq
699546f531 In Client Import Clarify CSV as Primary Contact Name instead of just Contact Name same with Location name use Primary Location Name, makes it much clearer when importing clients 2025-07-25 14:21:55 -04:00
johnnyq
e014e516e6 Beta Support for Dark Mode has been added to the theme options 2025-07-24 14:58:06 -04:00
johnnyq
4d71eb5de0 Remove Credit once Applied, also get total credits applied 2025-07-24 13:24:59 -04:00
johnnyq
197dd9f299 Initial Work on Client Account Credit System, DB Structure, Credit Balance Calculation, added Apply Credit and add Credit with Expire dates, Added DB Structure for Discount Codes, UI Rewrite on client top header now using grouped cards, more dark mode work as well 2025-07-24 11:31:45 -04:00
johnnyq
719a0e5efa Also Apply previous commit it editing recurring expenses 2025-07-23 13:20:06 -04:00
johnnyq
6221fd67e1 Fix recurring expense next run date logic for monthly and annual frequencies 2025-07-23 11:47:31 -04:00
johnnyq
4c031c8f83 Increase the width for totals on invoices and Quotes PDF Exports 2025-07-21 21:31:39 -04:00
johnnyq
b100498dd7 Add Client Bulk Actions: Edit Tags, Referral, Industry, Set Hourly Rate, Send Bulk Email, Archive. Also added restore option to restore a client 2025-07-21 18:27:31 -04:00
wrongecho
dfe0a0b1c7 Add default netid for asset int csv import to prevent errors 2025-07-21 09:18:30 +01:00
wrongecho
52dac2252a Add default purchase date for csv import to prevent error when undefined 2025-07-21 08:11:57 +01:00
johnnyq
184aba4de4 Finished UI work for AI Providers and Models, AI is set to use the new AI Provider and Models 2025-07-15 16:19:23 -04:00
johnnyq
f72b7763c1 Added Bulk Actions to Invoices Assign Income Category 2025-07-15 13:24:28 -04:00
wrongecho
da3a1d2ce4 Allow linking closed tickets to a project 2025-07-14 15:13:36 +01:00
johnnyq
467c681117 Add Saved Payment Options to recurring invoices and details for agents 2025-07-09 19:23:12 -04:00
johnnyq
9bc705bfa1 Updated Guest pay and Client Add Delete Payments, adjustedsetting saved payment per recurring invoice 2025-07-09 01:45:56 -04:00
johnnyq
307d9892b2 No need for a sql delete on recurring payments when deleting a saved payment method as SQL cascadely deletes the recurring payment if saved payment method is deleted 2025-07-08 14:10:27 -04:00
johnnyq
93f4ea51fd Rework Payment Provider AI Provider Tables and logic add cascading deletes 2025-07-08 14:07:10 -04:00
johnnyq
7e17fdf851 Add new UI for Saved Payments for payment providers 2025-07-07 18:25:23 -04:00
johnnyq
c76da10747 Add Payment Method to UI and switch Add Payment modals to use the new table 2025-07-07 16:37:51 -04:00
johnnyq
a011dc4dea POST code for AI and Payment Providers 2025-07-06 17:01:28 -04:00
johnnyq
fa9acef279 Fixed IMAP test button with error details 2025-07-06 12:47:26 -04:00
johnnyq
e0364183e2 Disable Certain Bulk Actions that are directly related to a client in client overview section instead are shown in the client section 2025-07-03 16:03:57 -04:00
Johnny
6af61cbb3c Merge pull request #1225 from itflow-org/bulk-assign-phyloc 
Add physical location modal - not working
 2025-07-03 15:11:42 -04:00
Marcus Hill
eb11e5b2f8 Bugfix: Company logo not being removed properly from db 2025-06-28 14:27:51 +01:00
Marcus Hill
b85137096d Add physical location modal - not working 2025-06-28 13:42:00 +01:00
Marcus Hill
77e9d72f92 Add physical location modal - not working 2025-06-28 13:37:44 +01:00
Marcus Hill
ec344cbaa7 Allow entering multiple ticket watchers at once 2025-06-28 12:30:42 +01:00
johnnyq
4cb2f42d71 Added Bulk Action Set IP to DHCP in Asset Interface 2025-06-27 01:45:25 -04:00
johnnyq
98723b76cf Added Bulk Actions Set Network, Type and Delete to Asset Interfaces 2025-06-27 01:31:23 -04:00
johnnyq
45ac7f084b Add Bulk Delete Function Also when deletign a ticket delete the watchers and attachments and remove the ticket id from uploads/tickets/ticket_id 2025-06-26 23:16:08 -04:00
johnnyq
3626777bd1 Fix Item name and Description Alignment in PDF Exports 2025-06-26 19:12:25 -04:00