johnnyq
|
aff6812036
|
Security: hold an agent who must set up MFA to the set up page on every request, not just at sign in, and fix the client portal two-step gate, which a path added to the URL or a second action sent with the set up one got past - both now go through requestIsMfaSetup(), which checks the script actually running and every key in the request; View as contact is refused while an agent still owes MFA set up, and agents are emailed when MFA is turned on
|
2026-11-04 14:01:40 -05:00 |
|
johnnyq
|
9b92261e8c
|
Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id
|
2026-11-04 13:50:17 -05:00 |
|
johnnyq
|
0e272910fb
|
Client portal: invite people by email from a client's Contacts (Invites tab with send again, cancel, search and sorting) or by the primary contact in the portal, several at once with optional names and roles, each joining from the emailed link with their own name, title, phone and password or Microsoft 365 and becoming a contact then, an existing contact with that address being given access instead; self sign-up from Create an account on the sign-in page for addresses at a client's Domains when it is on in Admin > Settings > Client portal and for that client, verified by an emailed link and joining as a plain contact with agents and the primary contact told; the same answer whatever address is entered, per address and per IP limits and a hidden field for bots; nightly clean-up of unused links; six new email previews; new functions/portal_invite.php, client/invite.php, client/join.php and client/signup.php, replacing the unused contact_invite modal; DB 3.4.6 adds portal_invites, client_portal_signup and config_client_portal_signup
|
2026-10-25 01:07:53 -04:00 |
|
johnnyq
|
9457442804
|
Emails stage 3: every email now goes through emailQueue and the shared layout - the client portal invite sends a link to set a password (or to sign in with Microsoft) instead of the password itself, offered on New Contact as well as Edit through portalMailInvite, with Forgot password, password changed and two-step sign-in emails through portalMailPasswordReset and portalMailAccountChange; shared link and code emails with the note quoted and the whole link printed under the button, replacing shareMailHtml and shareQueueMail; calendar invitations, updates and cancellations with when, repeats, where, the description and a join button; Email on the contacts and clients lists in the layout from one of the configured mailboxes with an optional greeting and send time, leaving out archived contacts and contacts without an address, each address once, nothing queued without mail set up, through emailBulkSend and emailBulkPost with a shared bulk_email_fields window; Admin > Mail > Previews shows all 52 emails built by their real senders on sample records inside a rolled-back transaction with emailQueue capturing and custom actions off, with computer and phone widths and Send me a copy; emailHtml gains content and button show_url, emailQueue gains queued_at and always so billing still queues as before, plus emailMailboxes and emailTestSend; ticketMailCreated, ticketMailReply, ticketMailWatchersAdded, ticketMailTaskApproval, ticketMailClosedReply, ticketSlaAlert and billingMailCardSaved moved into functions; fixes Email on the contacts list queuing mail to contacts with no address, the clients list including archived contacts, and both taking any From address posted; changelog updated
|
2026-10-17 23:26:25 -04:00 |
|
johnnyq
|
e29369926f
|
Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated
|
2026-10-17 12:05:55 -04:00 |
|