johnnyq
|
359851c876
|
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
|
2026-10-23 12:09:07 -04:00 |
|
johnnyq
|
a5a43e37ac
|
Audit logs stage 3: failed sign-ins say why and are logged against the account they were for - wrong password, no account with that email, disabled, archived or invited account, client archived, portal turned off, a wrong MFA or two-step code after the right password - with failed Microsoft 365 portal sign-ins logged too and marked Their account in the audit log; the IP lockout counts portal failures as well; the first sign-in from an IP address is badged New IP in the audit lists and quick look; new Admin > Sign-ins under Access with People and IP addresses views, search, date filter, sortable columns and paging; admins get a notification and an email on a run of failed sign-ins or turned-away API calls from one address or against one account, set in Settings > Security (10 to start, 5, 20, 50 or never), each in the audit log Security view and in Mail > Previews; API calls counted per key, day and endpoint, with a 30-day calls column and last IP on API Keys and a usage window, expired-key calls logged against the key, and usage deleted with the key and after the log retention; database 3.3.2 drops the unused auth_logs table and adds settings.config_login_alert_failures and api_key_usage; new functions/sign_in.php, admin/sign_ins.php and admin/modals/api/api_key_usage.php; the license template page no longer warns when view is missing
|
2026-10-19 00:56:52 -04:00 |
|
johnnyq
|
f43d4a9127
|
Audit logs stage 2: record history and a client Audit Log for agents, scoped to their role; auditLogKinds() gives each kind the module that shows it, with new auditLogRoleSql() (everything for an admin, otherwise the kinds the role reads and never Denied), auditLogHistory(), auditLogHistoryUrl(), auditLogHistoryHtml(), auditLogHistoryCard() and auditLogHistorySection(); a History tab on contacts, assets, networks and projects, a History card on racks, documents and the ticket, project, document and license template pages, and a folded History on the file, expense, recurring expense and trip quick looks, each newest first with who, when and the IP for an admin, the latest 50 with how many more and a link to all of them; vendors, locations, licenses, services and products use the shared list, and vendorHistory(), locationHistory(), softwareHistory(), serviceHistory() and productHistory() are removed; new agent/audit_log.php in the client nav after Calendar, with search, who, type, action, one record by name, dates, sortable columns, paging and Changes, Deletions, Sign-ins and Data out views, plus the quick look and a link to Admin > Audit Logs for admins; the client overview's Recent activity is role-scoped and links there for everyone; Your account > Activity rebuilt as the same list over the agent's own entries; the document versions card is now called Versions; the admin audit log quick look links to itself absolutely so it opens from agent pages
|
2026-10-19 00:13:28 -04:00 |
|
johnnyq
|
99ecc2d4a4
|
Modernize Administration > Users and the agent Account pages: new users list with Users/Admins/No MFA/Disabled/Archived views, role filter, status and MFA pills, remembered browsers, client access summary, last successful sign in with device and IP, seat badge, quick look modal, bulk role/require MFA/forget browsers/activate/disable, shared New/Edit user form with Details/Sign in/Client access tabs (icon prefixed inputs, picture preview, generated passwords, Only/Never client rules with search and set all), archive modal with ticket hand-over, restore requiring a new password, incident response limited to agents and forgetting remembered browsers, export role filter and MFA/last sign in/client access columns; Account pages reworked into Profile/Security/Preferences/Activity with current password required to change email, password or turn MFA off, inline SVG MFA QR code, remembered browser list with forget one/all, rows per page preference; adds functions/user.php shared helpers, validates email format and uniqueness, sets password hash and vault key from the exact typed password, purifies signatures, fixes Activity showing other agents' sign ins, removes dead user invite modal and user_model, and fixes the networks export link from All Clients with no filter
|
2026-10-15 21:29:40 -04:00 |
|
johnnyq
|
a084e37c39
|
Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5
|
2026-08-14 13:22:11 -04:00 |
|
johnnyq
|
b3744e9ed5
|
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
|
2026-08-06 13:10:23 -04:00 |
|
johnnyq
|
b3f959ac55
|
Use Short echo tags across the code
|
2026-07-28 18:47:52 -04:00 |
|
johnnyq
|
dae7f09650
|
Remove _details, fix plural and singular file naming in admin, update admin post to match agent post
|
2026-07-15 00:38:34 -04:00 |
|
johnnyq
|
7bc47a58fe
|
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
|
2026-07-14 17:10:45 -04:00 |
|
johnnyq
|
0a30300bde
|
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
|
2026-01-14 17:30:23 -05:00 |
|
johnnyq
|
ed6aa843b7
|
Fix Activity log link
|
2025-09-23 19:41:02 -04:00 |
|
johnnyq
|
dba08714bf
|
moved user preferences and user settings into /agent/user/ directory
|
2025-09-23 19:17:14 -04:00 |
|