8 Commits

Author	SHA1	Message	Date
johnnyq	156c51224d	Fix client portal review findings: PIN wipe, log indexing, statement currency (db 2.7.8) ... Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising. Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it. New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable. Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement. Quick Send asks for confirmation; confirm-link extended to submit buttons. Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.	2026-08-28 16:38:42 -04:00
johnnyq	10fb40f36f	Feature: Major spruce up of the client portal profile page, added Department, Location, Title, Phone with Edit, editing Pin, Recent signins and recent activity along with a seperate activity page	2026-08-28 16:08:23 -04:00
johnnyq	a084e37c39	Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5	2026-08-14 13:22:11 -04:00
johnnyq	b3f959ac55	Use Short echo tags across the code	2026-07-28 18:47:52 -04:00
johnnyq	7bc47a58fe	Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout	2026-07-14 17:10:45 -04:00
johnnyq	8de7b20ba1	Add CSRF Checks in the client portal	2026-03-07 13:11:08 -05:00
wrongecho	30499123f1	Bugfix: Portal not showing contact user id in session	2026-01-09 13:50:46 +00:00
johnnyq	5f76a7989b	Move portal to client and rename and reorganize some client portal files	2025-01-23 17:12:11 -05:00