19 Commits

Author	SHA1	Message	Date
johnnyq	01fbcda75d	Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated	2026-10-26 19:54:36 -04:00
johnnyq	a2a0823163	Trips stage 2: mileage money - Trips and Mileage in Admin > Settings > Invoice with miles or kilometers, the rate an agent is paid back for their own vehicle and the expense category it goes under, and what a trip bills a client as a trip charge, a rate a mile beyond the distance the charge covers and the invoice line name; the trip form has In their own vehicle starting as the driver's latest trip and Bill the client starting as the ticket is billable, each showing what it pays back or bills; the list gets To pay back and To bill pills, an owed card (Owed to you for agents without financial access), who is owed what and marks on each row; Pay Mileage pays one driver for the ticked trips at the usual or a past rate as a mileage expense per client paid personally by them under the mileage category to a Mileage vendor made on first use, paid back there and then from an account or later with Reimburse; Unbilled Time has Travel to bill beside the expenses at an editable price going on the client's invoice with their tickets and expenses, billing every client includes trips and Not billable writes them off; the invoice gets a Travel card with Add Trips and Take off Invoice, and deleting the line or invoice makes a trip to bill again; paid back and billed trips keep their distance, driver, vehicle, client and billable and can't be deleted, and deleting the mileage expense puts its trips back to pay; bulk Set Vehicle, Set Billable and Pay Mileage; the trip quick look shows what it pays back and bills and the mileage expense lists its trips; dashboard Trips to bill and Mileage to pay back, client overview Trips to bill and the Unbilled Time count include trips; export Vehicle, Paid Back and Billing columns; the Mileage report and dashboard chart follow the unit and the report rate starts at the mileage rate; demo data with recent trips in own vehicles and billable when trips bill; database 3.0.4 with trip_own_vehicle, trip_expense_id, trip_billable, trip_invoice_id, trip_invoice_item_id and the mileage and trip billing settings; CHANGELOG updated	2026-10-16 20:35:51 -04:00
johnnyq	9ff206af3d	Trips modernized for MSP use: rebuilt trips list with stat cards, pills (mine, for a client, for a ticket, our own), driver/client/date filters, search across site and ticket, footer total, bulk Set Driver/Set Client/Delete and export with driver, round trip, one way, site, ticket and odometer columns; new trip quick look with route, Google Maps directions, driver, client, site and ticket links, odometer, logged by and trips to the site, with Edit, Copy, Return Trip and Delete; one shared form for New, Edit, Copy and Return Trip with client sites and tickets, site address as destination, ticket fills purpose and site, known routes fill miles, one way miles with round trip total and optional odometer readings; Log a trip and a Trips card on tickets, a Trips tab on locations, Mileage report rows open the trip and show site and ticket with Site and Ticket CSV columns; every agent can log and manage their own trips while others' trips need Financial write and deleting them Financial full; trips follow ticket merge, client move and ticket or location delete; new functions/trips.php and handlers rewritten around tripSave and tripDelete, trip_model.php removed; demo data links trips to sites and onsite tickets; database 3.0.3 adds trip_location_id, trip_ticket_id and trip_created_by with backfill, makes trip_miles decimal and renames trip_end_odmeter to trip_end_odometer; CHANGELOG updated	2026-10-16 19:48:32 -04:00
johnnyq	cd7ebc0a5f	Security: enforce per-user client restrictions on client, financial and bulk handlers and per-client reports ... Agents restricted from a client could still edit, archive, restore or delete it, run bulk actions on it (edits, tags, archive, email, tickets) and add credits. Every selected client is now checked before anything is written. Expense, trip and recurring expense edits now check the client the record already belongs to, not just the submitted one. Recurring expense delete, revenue edit/delete and task approval handlers gained the same check. Per-client reports and the dashboard payment/ticket lists now hide clients the agent is denied. Company-wide totals are unchanged.	2026-10-08 16:17:46 -04:00
johnnyq	64423cbefa	Fix Client PDF Export	2026-08-06 18:51:09 -04:00
johnnyq	b3744e9ed5	More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time	2026-08-06 13:10:23 -04:00
johnnyq	ddd9c2b56a	clientScopeSql sweep whicn now removed the extra unessesary client joins	2026-08-06 11:45:56 -04:00
johnnyq	3c8f812a16	Feature: On all export modals added Filter Tab and Selectable Columns tab with default selected, also you can now export to a PDF	2026-07-30 00:46:15 -04:00
johnnyq	5c4805b822	Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function	2026-07-24 18:12:45 -04:00
johnnyq	af51c4316f	Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present	2026-07-24 13:40:37 -04:00
johnnyq	b8873039a4	Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions	2026-07-14 17:41:41 -04:00
johnnyq	f1836c70cd	Replace Function logAction() with logAudit()	2026-07-14 17:35:23 -04:00
johnnyq	b57ddc0e5c	Replace Function sanitizeInput() with just escapeSql() and update all instances throughout	2026-07-14 17:17:50 -04:00
johnnyq	317fe91359	Add Missing clientEnforcement in various modals, already handled on POST also add client selection in edit trip and enforce client permissions on trips	2026-07-09 16:07:54 -04:00
johnnyq	fcf098f494	use client_id as post var name not client	2026-03-06 18:33:25 -05:00
johnnyq	74ce8f4e98	Trips: enforceClientAccess only if client is referenced	2026-03-06 18:26:14 -05:00
johnnyq	8a1335174d	Trips: Add missing CSRF checks, we may need another permission module check for trips for now only admin and financial lv3 can delete a trip	2026-03-02 17:50:04 -05:00
johnnyq	e1a579387f	Convert all Import / Export Modals to Ajax and a few other lingering modals that were not converted yet	2025-12-02 15:04:05 -05:00
johnnyq	edabc5c33f	rename /user/ to /agent/ and update links to use agent/ instead	2025-09-23 18:04:23 -04:00