johnnyq
53842a50d2
Add URI Tabs to mail settings keeps the tab active upon saving
2026-07-26 01:52:25 -04:00
johnnyq
5fc2f93b38
Allow negative numbers in add expense
2026-07-26 01:40:11 -04:00
johnnyq
32be252261
Remove patch file
2026-07-26 01:11:27 -04:00
johnnyq
04014da21f
Combined Payments and Revenues as one View called income keeps all income in one place and still can add revenue not related to invoice
2026-07-26 01:10:52 -04:00
johnnyq
276e84ad0b
Expenses: Set Current Date in new expense
2026-07-25 20:38:58 -04:00
johnnyq
cd34236716
Fix saved-payment setup Checkout: embedded_page ui_mode + attach existing Stripe customer
2026-07-25 19:00:06 -04:00
johnnyq
a26ac2c4fc
Fixed adding saved credit cards in stipe due to API change
2026-07-25 18:47:13 -04:00
johnnyq
497ea3b669
Centralize client portal access checks through contactCan()
...
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
2026-07-25 17:55:30 -04:00
johnnyq
887063394a
Prevent client portal contacts from editing their own contact record
2026-07-25 17:28:57 -04:00
johnnyq
04bf3c234f
Read API credential decrypt password from body instead of query string
...
Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.
2026-07-25 17:08:22 -04:00
johnnyq
e6daf00528
Fix some broken API calls after RBAC update
2026-07-25 16:59:03 -04:00
johnnyq
c509b7f693
Add user-based RBAC for API keys
...
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
2026-07-25 16:50:58 -04:00
johnnyq
8d46e2a7db
Fix Client Permission overides to include deny allow list in projects prohect and edit ticket
2026-07-25 13:28:47 -04:00
johnnyq
3756561458
Feature: Add Deny Client Access to Client Access Permssions - BREAKS UI, MUST UPDATE DB USING php scripts/cli_update.php --db_update
2026-07-25 13:22:52 -04:00
johnnyq
ff4b69b511
Client Enforcement via function on client edit instad of in sql query
2026-07-25 00:35:47 -04:00
johnnyq
761b2a7af4
Module permissions modal enforcement sweep to match its post counterpart
2026-07-25 00:28:42 -04:00
johnnyq
7a793cbbcc
Add more enforceClientAccess to agent ajax gets
2026-07-24 22:51:57 -04:00
johnnyq
113ef4b9a4
Add more enforceClientAccess
2026-07-24 22:49:18 -04:00
johnnyq
3524010d7a
Add enforceClientAccess to 4 bulk modals initially missing
2026-07-24 22:06:42 -04:00
johnnyq
8993bce53f
Force No Indexes of empty directories even if enabled using .htaccess in uploads
2026-07-24 20:52:35 -04:00
johnnyq
8813b2c066
Use imapEngine lib for testing imap connection
2026-07-24 18:56:16 -04:00
johnnyq
5c4805b822
Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function
2026-07-24 18:12:45 -04:00
johnnyq
28f1a965b8
Remove dead code
2026-07-24 17:33:09 -04:00
johnnyq
565aff35f6
Set SameSite=Lax on the session cookie
...
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
2026-07-24 14:09:52 -04:00
johnnyq
3549c2ef2a
Harden CSRF handling and session cookies
...
Return 403 on CSRF failure instead of a 302, which anything following
redirects records as a 200. Set SameSite=Lax at every session_start;
keepalive.php and guest_post.php had no cookie flags at all.
2026-07-24 14:06:04 -04:00
johnnyq
8afc5aea89
Typo fix
2026-07-24 13:45:52 -04:00
johnnyq
af51c4316f
Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present
2026-07-24 13:40:37 -04:00
johnnyq
dd358da65d
Update missing CSRF endpoint checks missed update_db
2026-07-24 13:22:17 -04:00
johnnyq
91a1676e89
Update missing CSRF endpoint checks
2026-07-24 13:16:51 -04:00
johnnyq
e7698f15bd
Make better use of formatAddress function for clients listing
2026-07-24 12:22:15 -04:00
johnnyq
c7b34fe107
Remove leftover getFallBack in client pdf export in favor of ?: '-'
2026-07-23 18:29:11 -04:00
johnnyq
5846119ec9
remove duplicate formatAddress
2026-07-23 18:16:57 -04:00
johnnyq
41b118ab87
Add formatAddress function and replace all addresses with it
2026-07-23 18:10:39 -04:00
johnnyq
9c65644adc
Update the rest of the PHP functions to use camelCase
2026-07-23 17:39:06 -04:00
johnnyq
3d94846a61
Fix broken link to service modal in services
2026-07-23 13:48:00 -04:00
johnnyq
90bc8ed029
Fix broken links to modals and remove _details from service
2026-07-23 13:43:04 -04:00
johnnyq
40be80981d
Fix vendor modal link in service details
2026-07-23 13:34:08 -04:00
johnnyq
b853c24c96
Remove a few more unused vendor contact modals and update the escaping in rename modal vendor_details.php to vendor.php
2026-07-23 13:26:06 -04:00
johnnyq
5f26d75e18
Update Functions in ticket_edit_vendor and document link vendor and deleted legacy code unused that had legacy functions tied to them
2026-07-23 13:17:41 -04:00
johnnyq
8f43b92496
Use stripe_init include to init stripe and updated code everywhere
2026-07-23 13:00:01 -04:00
johnnyq
7ccdc942fe
Bump imapEngine from v1.25.2 to v1.25.3
2026-07-23 00:59:07 -04:00
johnnyq
2b756f6ea4
Split DB Updates into seperate files, with the cutoff being 2.0.0
2026-07-22 18:43:11 -04:00
johnnyq
17e4c61067
Spelling Fix
2026-07-22 17:40:30 -04:00
johnnyq
fad62ca045
Remove custom_hosting tables
2026-07-22 17:36:55 -04:00
johnnyq
5402578ce6
Remove Static payment processing fees from database and update field hints with useful info when adding / editing payment provider
2026-07-22 17:32:01 -04:00
johnnyq
8ee780566e
Cleanup Expense Code in post blocks and remove single use function since stripe payments get reconciled during nightly cron
2026-07-22 17:06:10 -04:00
johnnyq
08334b22c3
Add Stripe fee reconciliation to cron
...
Balance transactions aren't always attached when a payment completes,
so the fee expense can be skipped at payment time. Daily cron pass now
finds recent Stripe payments with no matching fee expense and records
the actual fee once available. Dedupes by expense reference prefix,
30-day lookback.
2026-07-22 16:47:28 -04:00
johnnyq
f4b1b6585b
Move Expense block for Stripe after intent
2026-07-22 16:16:40 -04:00
johnnyq
66b38b7f19
Get Expense from Stripe instead of Static Entry
2026-07-22 16:07:39 -04:00
johnnyq
54e2005224
Icon change for Mail Queue
2026-07-21 14:18:33 -04:00
