Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising.
Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it.
New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable.
Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement.
Quick Send asks for confirmation; confirm-link extended to submit buttons.
Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.
Send Email opens a contact picker instead of hardcoding the primary contact; Mark Sent asks how it went out and takes a note. Both log recipients / method / note to the document history. Handlers moved GET -> POST.
Fixes two pre-existing bugs in the email path: archived contacts were still receiving billing copies, and every copy was addressed to the primary contact by name.
None of the *_client_id columns carried an index, so agent/includes/inc_all_client.php was doing a full table scan per badge count before the page rendered a byte - 27 of them. The main agent context runs 8 counts and the admin context none, which is why the client side nav was the only one that felt slow.
24 indexes, shaped (<entity>_client_id, <entity>_archived_at) where the query pairs the two and the client column alone otherwise. The archived column is always trailing and never an index of its own - on a healthy instance nearly every row has it NULL, so it cannot lead. recurring_tickets, services, invoices, recurring_invoices and calendar_events get a single column because their queries carry no archived filter; invoices is in that group because the money total there spans archived rows on purpose. payments.payment_invoice_id and transfers.transfer_revenue_id are join keys rather than client scoping but sit on the same page's critical path.
Migration checks information_schema.STATISTICS before each ALTER, since MySQL has no ADD INDEX IF NOT EXISTS and re-adding is an error - safe to re-run and safe where an index was added by hand. db.sql carries the same keys so fresh installs skip the update step.
Wider than the side nav: these are the columns clientScopeSql() filters on, so every client-scoped list page was paying for their absence. Expect the ALTERs to be the slow part of the upgrade on a mature instance.
