27 Commits

Author	SHA1	Message	Date
johnnyq	01fbcda75d	Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated	2026-10-26 19:54:36 -04:00
johnnyq	185129dd72	Payment Methods: rebuilt Admin > Payment Methods with each method's use (payments, income, expenses) linking to Transactions, when it was last used, In use and Archived tabs, search and sorting; a method is for money in, money out or both and each picker offers only the ones that fit, transfers all of them; renaming carries the new name to every payment, income, expense, recurring expense, reimbursement, transfer, autopay and the defaults; payment and expense defaults set from the list; archive and restore; delete only an unused method, a used one is merged into another; methods records use that are not in the list can be added in one click; one New/Edit window with field icons; new functions/payment_method.php with paymentMethods() moved there from functions/billing.php; fixes a rename splitting records under two names, editing a Stripe payment or one whose method is no longer listed, and duplicate names; DB 3.4.1 adds payment_method_use and payment_method_archived_at	2026-10-25 01:03:16 -04:00
johnnyq	ea23a2bad5	Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids	2026-10-18 22:36:25 -04:00
johnnyq	cd565b73c7	Taxes stage 2: Tax Collected report rebuilt for filing with an Invoiced basis (each sent invoice in the month of its date) or Paid basis (each payment carrying its share of its invoice), tax by part of each rate with registration numbers so a state's and a county's parts count apart and parts named alike add up in one row, sales before tax and net of discounts split into taxable, exempt and non-taxable, tax paid on purchases by part and net tax collected less paid, exempt sales by client with certificate and expiry, quarterly or monthly with a chart and CSV export of the tax table or the exempt sales, archived payments left out; expenses and recurring expenses record the tax included in them with a rate worked out from the amount as typed or typed over from the receipt, a tax amount with no rate allowed, refunds giving their tax back, recurring expenses copying it to each expense recorded, vendor defaults filling it in, and the list and quick looks showing it; exports gain invoice subtotal, discount, tax and tax by part, quote and recurring invoice tax, expense before tax, tax and tax rate, and client tax rate and exemption columns; API adds a taxes read endpoint with each rate's parts, subtotal, tax, tax by part and registration numbers on invoice and quote reads, and each line's rate on invoice item reads; Admin > Taxes explains naming parts alike and links the report; demo data names Allegheny County's state part PA Sales Tax and taxes the company's own-use purchases; removes the unused getMonthlyTax and getQuarterlyTax; database 3.1.2 adds expense and recurring expense tax rate and amount; changelog updated	2026-10-17 13:27:53 -04:00
johnnyq	df668d83e6	Accounts Reconcile: reconcile an account against its bank or card statement from the account's menu on Accounts or Transactions - enter the statement's ending date and balance (what is owed, for a card) and notes, starting from where the last statement ended or the opening balance, with lines brought in from bank statements pre-ticked; tick what cleared with the cleared balance and difference updating as you go, each tick saved immediately so a statement can be finished later, pills for money in, money out, not ticked and ticked, search, tick and untick all shown, a bar keeping the difference and Finish in view, and Finish only once the difference is nothing; change the statement, discard it, or add a missing line with New Expense, New Income or New Transfer starting on the account; a history of reconciled statements with ending balance, lines cleared, money in and out and who reconciled it, with Undo on the latest putting it back in progress with its ticks; Transactions marks cleared lines linking to their statement, adds an Uncleared pill and a filter for one statement's lines, the export adds a Cleared column, and Accounts shows where each account is reconciled to; a cleared payment, other income, expense, transfer or reimbursement keeps its amount, date and account and can't be deleted until its statement is undone, which also blocks deleting its invoice or client (including through the API), refunding a cleared Stripe payment, bulk set account and bulk delete on cleared lines, and undoing a cleared reimbursement, with quick looks and edit windows showing where it cleared; the opening balance locks once an account has a reconciled statement and a ticked line moved to another account comes off its statement; reconciling needs write Financial access and undoing full access; new functions/reconcile.php, agent/reconcile.php, agent/post/reconcile.php and js/reconcile.js with ticking through agent/ajax.php; database 3.0.8 adds account_reconciliations and the reconciliation id on payments, revenues and expenses; demo data reconciles Operating Checking and the Business Visa monthly through last month; CHANGELOG updated	2026-10-16 23:12:22 -04:00
johnnyq	53d0f8a841	Expenses stage 4: getting expenses in - Import Statement from the expenses menu brings a card or bank CSV in as expenses, reading lines before the header, commas, semicolons or tabs, Windows text and amounts like (12.00), 12.00 CR or 1.234,56, guessing the date and its format, description, memo, amount or money out and in columns, sign and reference and remembering them per account so the next statement goes straight to the review, matching each line to a vendor from what was picked for that merchant last time or a vendor name in the text (shortened names too) with its last category, suggesting a new vendor named from the line when nothing matches, locking lines imported before so a statement never comes in twice, leaving out lines that look entered by hand within 4 days and linking them, leaving out money in unless ticked, filling in the same merchant's other lines, bulk category and client and billing on, making new vendors once and opening the account's expenses for those dates, with remembered merchants to see or forget; paid personally expenses with who paid them that count as spent on their date but move no balance until paid back, a To reimburse pill with what each agent is owed, Reimburse paying back the ticked expenses from one account on one date as a Reimbursement in Transactions with undo for full financial access, quick look, list, vendor page, bulk, export and dashboard showing who paid and whether they were paid back, database 3.0.2 with expense_import_key, expense_paid_by, expense_reimbursement_id, expense_import_rules, reimbursements and account_import_map, CHANGELOG updated	2026-10-16 19:12:03 -04:00
johnnyq	8d5e5091ad	Expenses stage 3: billable expenses and pass-through costs - mark an expense for a client billable with a markup (default in Admin > Settings > Invoice), expenses to bill sit beside the time in Unbilled Time and go on a new or draft invoice with the tickets as a line each at a price that can be changed, the invoice gets an Expenses card with cost against billed and the margin plus an Add Expenses window, taking one off or deleting its line or invoice makes it to bill again (paid invoices keep it, cancelled ones keep the line), the quick look and list link billed expenses to their invoice with To bill and Billed pills and Bulk Set Billable, recurring expenses can be billed on each time or covered by one of the client's recurring invoices with a Costs card showing the monthly margin, expenses to bill counted in the menu, dashboard and client overview, export Billing and Billed On columns, demo data with recent client expenses to bill, database 3.0.1	2026-10-16 18:36:43 -04:00
johnnyq	c93cb20f14	Expenses stage 1: rebuilt expenses list with this month against the same days last month, year so far with monthly average, recurring cost a month and expenses without a receipt in the last 90 days along the top, pills for client, no receipt and refunds with counts, vendor, category, client, date, account and payment method filters and a total of what the filters leave, an expense quick look showing the receipt inline with attach from the window, who entered it, refunds against it and the stock it paid for, one shared form for New, Edit, Copy and Refund with icons on every field, payment method saved from the default in Settings, vendor picks filling in the category, account and method of the last expense with them, refunds linked to the expense they give back and starting at what has not come back, receipts replaced or removed in Edit and served through agent/expense_receipt.php after the Financial and client checks with uploads/expenses closed to the web, bulk set category, account, payment method or client in one window and a single bulk delete, export with the list filters plus paid by, receipt and entered by columns, expenses in global search with open on load, the vendor page, Transactions and product stock history opening the quick look and Client Profitability linking direct costs to the client's expenses, fixes for the dead bulk delete button, bulk set client ignoring client restrictions, the New Expense window opening without write access, unlink warnings on empty receipts and photo receipts downloading as pdf, functions/expenses.php shared by the list, windows, export and search, database 2.9.9 with expense_created_by backfilled from the audit log and expense_refund_of_id, CHANGELOG updated	2026-10-16 17:43:11 -04:00
johnnyq	cd7ebc0a5f	Security: enforce per-user client restrictions on client, financial and bulk handlers and per-client reports ... Agents restricted from a client could still edit, archive, restore or delete it, run bulk actions on it (edits, tags, archive, email, tickets) and add credits. Every selected client is now checked before anything is written. Expense, trip and recurring expense edits now check the client the record already belongs to, not just the submitted one. Recurring expense delete, revenue edit/delete and task approval handlers gained the same check. Per-client reports and the dashboard payment/ticket lists now hide clients the agent is denied. Company-wide totals are unchanged.	2026-10-08 16:17:46 -04:00
johnnyq	64423cbefa	Fix Client PDF Export	2026-08-06 18:51:09 -04:00
johnnyq	b3744e9ed5	More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time	2026-08-06 13:10:23 -04:00
johnnyq	ddd9c2b56a	clientScopeSql sweep whicn now removed the extra unessesary client joins	2026-08-06 11:45:56 -04:00
johnnyq	c5288f9e30	Fix undefined variables in expense, asset and contact audit/flash messages	2026-08-03 15:34:18 -04:00
johnnyq	e800064202	Fix Expense Description logging spelling	2026-08-03 15:28:36 -04:00
johnnyq	3c8f812a16	Feature: On all export modals added Filter Tab and Selectable Columns tab with default selected, also you can now export to a PDF	2026-07-30 00:46:15 -04:00
johnnyq	5c4805b822	Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function	2026-07-24 18:12:45 -04:00
johnnyq	af51c4316f	Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present	2026-07-24 13:40:37 -04:00
johnnyq	b8873039a4	Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions	2026-07-14 17:41:41 -04:00
johnnyq	f1836c70cd	Replace Function logAction() with logAudit()	2026-07-14 17:35:23 -04:00
johnnyq	b57ddc0e5c	Replace Function sanitizeInput() with just escapeSql() and update all instances throughout	2026-07-14 17:17:50 -04:00
johnnyq	68f705b135	Set EnforceClientAccess Perms throughout expenses, modals and post along with listing	2026-07-09 14:51:51 -04:00
johnnyq	c01645c4e2	Expense: On create enforce client Access only if Client is selected	2026-07-08 18:13:14 -04:00
johnnyq	edad83cc37	Fix Regression of chnage post name from client to client_id Add / Edit Expense	2026-03-08 13:43:46 -04:00
johnnyq	1d5fceeecd	Expenses: Add missing CSRF, Add missing perms	2026-03-02 17:27:56 -05:00
johnnyq	0a30300bde	replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage	2026-01-14 17:30:23 -05:00
johnnyq	13ea48bff8	Seperate out recurring expenses and expenses into their own post file	2025-10-29 16:21:56 -04:00
johnnyq	edabc5c33f	rename /user/ to /agent/ and update links to use agent/ instead	2025-09-23 18:04:23 -04:00