AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-11-11 15:07:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,432 Commits 8 Branches 25 Tags
01fbcda75d462ae15da337100116c88dbb6f5789
Commit Graph

32 Commits

Author SHA1 Message Date
johnnyq
01fbcda75d Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated 2026-10-26 19:54:36 -04:00
johnnyq
359851c876 Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty 2026-10-23 12:09:07 -04:00
johnnyq
dfc708145d Vendor templates stage 1: Admin > Vendor Templates rebuilt on the standard list with Active and Archived tabs, support line, hours and SLA, how many clients have a vendor from each, last used and changed by, sortable and searchable including by support line; new template page with what a vendor starts with, the clients with it and their account numbers, the license templates that use it, made and changed by, and history; shared New/Edit window on the vendor window's tabs with per-field push to the vendors made from it, each logged on the vendor; copy, archive, restore and delete with vendors and license templates unlinked on delete; Make a template from a client's vendor, linking the vendor to it, and the vendor page linking its template for admins; Delete offered to every admin role, not only the built-in Administrator; the admin handler no longer includes the agent vendor handler; database 3.3.4 adds vendor_template_created_by and vendor_template_updated_by, backfilled from the audit log 2026-10-19 12:34:53 -04:00
johnnyq
a5a43e37ac Audit logs stage 3: failed sign-ins say why and are logged against the account they were for - wrong password, no account with that email, disabled, archived or invited account, client archived, portal turned off, a wrong MFA or two-step code after the right password - with failed Microsoft 365 portal sign-ins logged too and marked Their account in the audit log; the IP lockout counts portal failures as well; the first sign-in from an IP address is badged New IP in the audit lists and quick look; new Admin > Sign-ins under Access with People and IP addresses views, search, date filter, sortable columns and paging; admins get a notification and an email on a run of failed sign-ins or turned-away API calls from one address or against one account, set in Settings > Security (10 to start, 5, 20, 50 or never), each in the audit log Security view and in Mail > Previews; API calls counted per key, day and endpoint, with a 30-day calls column and last IP on API Keys and a usage window, expired-key calls logged against the key, and usage deleted with the key and after the log retention; database 3.3.2 drops the unused auth_logs table and adds settings.config_login_alert_failures and api_key_usage; new functions/sign_in.php, admin/sign_ins.php and admin/modals/api/api_key_usage.php; the license template page no longer warns when view is missing 2026-10-19 00:56:52 -04:00
johnnyq
be002b6f29 Roles stage 4: the money on invoices goes by Financial with Sales at Read through billingMoneyCan and enforceBillingMoney, so taking payments one at a time, by saved card or as a batch, changing them and emailing receipts, reminders and statements need write access to Financial, and deleting or refunding a payment needs full access, with the old Sales rules for reminders, statements and receipts still accepted; invoice, invoice list, Income and payment quick looks offer only what the role can do, the reminder window offers only the reminder to a role that cannot send the invoice, a reminder for a draft or with nothing owed still needs Sales, and Income bulk Set Category on payments needs Sales as it changes the invoice; database 3.1.8 gives the built-in Accountant full access to Financial when it still has its shipped levels, and new installs seed it that way; calendar events for a client follow the role's Clients level through calendarEventCan, Read to see, Modify to add, change, move, skip or send, Full to delete or Modify for the agent who added it, events an agent is on always show, events with no client stay open to everyone, and the calendar, dashboard and calendar links leave out other agents' client events for roles without Clients, with New event, the client picker and dragging following the same rule; the API now sets PHP and MySQL to ITFlow's timezone so what it creates, API ticket SLA times and key expiry go by local time, and inc_set_timezone.php only writes the session when one is open and no longer leaves its result and row variables behind; changelog updated 2026-10-17 21:52:10 -04:00
johnnyq
2a5533ea2b Roles stage 3: roles and agents in the API and Admin > API Keys rebuilt; new api/v1/roles/read.php where an admin key reads every role with its level per module and agent count, archived on request, and any other key reads only its own user's role, and new api/v1/technicians/read.php listing agents with their role under Support at Read; API role refusals now say what the call needs and what the key's user has, naming the module, level and role, and technicians/time.php needs Read instead of Modify; Admin > API Keys shows each key's agent and role, what it can open and for which clients, whether it works (works until, expires in N days, expired, or won't work with the reason when its agent is disabled, archived, has no role or is missing) and when it was last used, with search by key or agent name; New and Edit windows show the picked agent's access as they are picked and offer only active agents, Create before ticking the copied box opens the Key tab, new keys default to a year and must end after today, and an expired key can be renamed and stay expired; handlers moved to functions/api_keys.php with validation, escaped messages and audit entries naming the agent and what an edit changed, fixing empty names on revoke, delete and bulk delete, a backslash shown for apostrophes in names, the bulk count of keys ticked rather than deleted, keys created already expired and expired keys that could not be renamed; database 3.1.7 adds api_keys.api_key_last_used_at, set at most once a minute in the configured timezone; changelog updated 2026-10-17 21:10:48 -04:00
johnnyq
b3744e9ed5 More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time 2026-08-06 13:10:23 -04:00
johnnyq
c509b7f693 Add user-based RBAC for API keys 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
 2026-07-25 16:50:58 -04:00
johnnyq
b57ddc0e5c Replace Function sanitizeInput() with just escapeSql() and update all instances throughout 2026-07-14 17:17:50 -04:00
johnnyq
0a30300bde replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage 2026-01-14 17:30:23 -05:00
wrongecho
2f28f96f8d Log the API endpoint/URL path for API auth failures to assist with debugging 2025-11-06 14:43:32 +00:00
johnnyq
bfffec7363 Temp added vars session_ip and session_user_agent to validate_api_key so IP and User agent is logged with the new logAction function 2024-11-14 17:55:35 -05:00
wrongecho
c65db3431d Tidying 2024-09-14 23:43:54 +01:00
wrongecho
a6113dc371 WIP: Allow decrypting logins/credentials via the API 2024-08-22 18:22:20 +01:00
johnnyq
3f028e8560 Fix Broken API due to incorrect named function https://forum.itflow.org/d/119-api-broken 2023-03-14 18:59:43 -04:00
johnnyq
48fe49cf77 BREAKING CHANGES - MAKE FULL BACKUP BEFORE PROCEEDING - Requires Manual Intervention on files see Forum Post Make sure you run the Database update directly after update. This Removes Multi-Company Functionality. Fixes issues with Reponsive tables and bunch of other UI and small Fixes 2023-03-11 16:16:46 -05:00
Marcus Hill
b36719eb99 General cleanup/tidying 2023-02-09 11:32:40 +00:00
Marcus Hill
f3456ead67 API 
- Add PHP logging when API queries fail because of SQL errors
- Add user agent to logging
- Enhance asset update endpoint
 2023-02-05 15:07:41 +00:00
Marcus Hill
531bd25f27 Convert custom function names to camelCase 2023-01-26 22:03:31 +00:00
Marcus Hill
10362f86ef Convert custom function names to camelCase 2023-01-26 21:58:27 +00:00
Marcus Hill
447f20c91c Escape potential HTML characters in the API Key name, as this is used in logs 2023-01-02 14:38:52 +00:00
Marcus Hill
1aa87ccaeb API Key error wording 2023-01-02 14:37:56 +00:00
Marcus Hill
ff741c223e API code style tidy 2023-01-01 16:00:07 +00:00
Marcus Hill
e55622827d Add support for client-specific API keys 
Refactoring API. Added a contact update endpoint.
Small misc changes.
 2022-04-15 17:43:06 +01:00
Marcus Hill
a3ca268fcf Small code cleanups 2022-04-14 07:54:40 +01:00
Marcus Hill
9040fdf847 Misc small changes/fixes 2022-03-27 22:26:22 +01:00
Marcus Hill
09b4eab1c3 Correct insert ID for create endpoint. Add contact create API endpoint 2022-03-26 13:39:43 +00:00
Marcus Hill
4b077cf6e0 Add create asset functionality to API 2022-02-27 16:09:21 +00:00
johnnyq
be0778ab84 Strip slashes on user agent and ip to prevent user header modification for XSS attack in API logging 2022-02-04 16:55:45 -05:00
johnnyq
338c991d21 Updated Logging in both APIs 2022-02-04 16:51:56 -05:00
johnnyq
b8e5d5844d Updated new API Validation with api-keys table and added some additonal log fields 2022-02-04 16:37:19 -05:00
Marcus Hill
6e4025dc58 Initial new api 2022-02-02 22:16:08 +00:00