johnnyq
565aff35f6
Set SameSite=Lax on the session cookie
...
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
2026-07-24 14:09:52 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
8da3a107fb
Rename plugins to libs and update all file references
2026-07-10 13:24:20 -04:00
johnnyq
a819dff19a
Mail: Update mail configuration check to use smtp_provider instead of smtp_host as host is blank upon using oath2
2026-06-24 12:47:41 -04:00
johnnyq
300a1aff9f
Login: Uodate Email text field to email type
2026-06-07 13:01:28 -04:00
johnnyq
c1f0b63101
Fix login not passing master key if agent is client and agent and if MFA is enabled
2026-01-17 17:07:22 -05:00
johnnyq
687920743d
Fix user_id not being set in audit logs for agent and client logins, also fix issie where user_id wasnt being set in client portal.
2026-01-15 12:28:20 -05:00
johnnyq
e02a6fc5e6
Use mysqli_fetch_assoc in login
2026-01-12 12:30:12 -05:00
johnnyq
78040573d1
Fix Remove Powered by ITFlow on Login Screen when WhiteLabel is enabled
2026-01-12 12:27:44 -05:00
wrongecho
30499123f1
Bugfix: Portal not showing contact user id in session
2026-01-09 13:50:46 +00:00
johnnyq
f784b659e8
Remove extra agent client wording
2025-12-20 15:05:47 -05:00
johnnyq
e60a7a59f9
Fix Login flow where user agent and client exists and agent has MFA but will not let them continue, also update some wording and button colors. Also dont show email password fields again after success and login as agent and client is shown.
2025-12-20 14:30:57 -05:00
johnnyq
a79ce23ae5
Fix randomString() to generate cryptographically secure URL-safe tokens, reduced url keys to 32 Characters for performance and easy copy and paste and compatibility while still mainitaining ubreakable cryptographic keys
2025-12-18 14:24:53 -05:00
johnnyq
32f996d034
If login key is set and it is not provided show Client Email instead of just Email for placeholder
2025-12-14 13:42:38 -05:00
johnnyq
312eb4dffc
Allow use of login key only for agents
2025-12-14 13:16:54 -05:00
johnnyq
1916456c84
Fix White Label not displaying on the login page
2025-12-14 13:04:53 -05:00
johnnyq
871ad2ea7e
Update legacy client login links to use the new unified login method
2025-12-10 12:21:12 -05:00
johnnyq
58d6ab7342
Unify Agent and Client login, if same user exists as a client and an agent then offer a selection of client portal or agent portal
2025-12-09 13:39:16 -05:00
johnnyq
416a8d9a94
Fix to properly redirect to the setup page if config_enable_setup is not set or is 1
2025-10-06 14:19:49 -04:00
wrongecho
d8803aaac2
prevent open redirects upon agent login
2025-10-06 16:32:42 +01:00
johnnyq
e6bcf0e12f
Started updating href paths to absolute paths instead of relative paths as itflow should be installed in document root anyway and not a sub-directory
2025-09-24 12:56:01 -04:00
johnnyq
50f790dd6c
Fix MFA Enforcement
2025-09-23 20:30:25 -04:00
johnnyq
edabc5c33f
rename /user/ to /agent/ and update links to use agent/ instead
2025-09-23 18:04:23 -04:00
johnnyq
7e55808a05
add some redirect to login.php, fix ticket post
2025-08-04 18:16:13 -04:00
johnnyq
95950700d8
Moved user items to user directory
2025-07-28 17:57:06 -04:00
johnnyq
7150b1545a
Moved files check_login.php, get_settings.php, settings_localization_array.php, inc_set_timezone.php into the includes folder, we also moved /client/check_login.php into client/includes/
2025-03-13 17:55:31 -04:00
johnnyq
9b6ea851e7
Removed the prepended user_ from the fields in the user_roles table, moved user_role_id from user_settings directly to users table, rename table user_permissions to user_client_permissions, removed unused Sessions vars in login. This upedate will require to update using update_cli.php --db_update
2025-03-10 15:57:16 -04:00
johnnyq
22a5c90d21
Reworked MFA Enforcement page to use login page style for smoother transition
2025-01-29 11:35:14 -05:00
johnnyq
033a5d1f4f
Remove comment
2025-01-28 19:25:29 -05:00
johnnyq
52ad2ba322
Reworked the MFA Enforcement
2025-01-28 18:57:04 -05:00
wrongecho
20a862f020
Fix redirect to /client if no login key is set
2025-01-28 11:24:08 +00:00
johnnyq
f29d122376
Move totp.php out of functions folder into plugins then removed functions folder
2025-01-24 21:07:01 -05:00
johnnyq
8e04e10753
Combine base32static.php and rfc6238.php into 1 file called totp.php and place it into the functions folder
2025-01-24 20:26:46 -05:00
johnnyq
d80d4803db
Moved TOTP dependent files rfc6238.php and base32static.php to /includes folder and updated links in pages
2025-01-24 19:20:49 -05:00
johnnyq
5f76a7989b
Move portal to client and rename and reorganize some client portal files
2025-01-23 17:12:11 -05:00
johnnyq
2c51289d75
Remove mysqli connection vars when passing mail data to addToMailQueue Function
2025-01-22 20:56:24 -05:00
wrongecho
54dde984ac
nullable_htmlentities - prevent Passing null to parameter error
2025-01-14 15:37:24 +00:00
johnnyq
98f9083bcb
Structure rework: Moved most php files that are included to /includes renamed pagination.php to filter_footer.php, updated all file to reference new filter_footer and includes
2025-01-11 14:47:32 -05:00
Marcus Hill
fcfc6ff5e2
Stop using Source Sans Pro for some pages, we seem to use Sans Serif everywhere else
2024-12-27 23:02:24 +00:00
johnnyq
53c888c4b8
Add User Type to session, along with user type check
2024-11-27 11:50:45 -05:00
johnnyq
20a24b6ec6
Fix PHP error on login check if Array last_visited is set
2024-11-16 16:33:23 -05:00
johnnyq
278ba079c3
Updated cron mail queue and cron email ticket parser to use new logAction and tidy up code
2024-11-15 13:40:04 -05:00
johnnyq
bc5e089e95
Updated login to use new logAction and tidy up code
2024-11-15 13:07:38 -05:00
wrongecho
334829c23e
Force setup of MFA on login
2024-10-28 21:01:55 +00:00
johnnyq
ee19e1b967
Check for user type of during login and set a temp if condition on check_login.php to see if user_type field exists and query user based off that result, the condition will be removed at a later date
2024-10-22 17:06:18 -04:00
wrongecho
19dc33a836
Show a 429 header when logins are blocked
2024-09-21 13:08:30 +01:00
wrongecho
4458c87463
Initial implementation of whitelabelling
2024-09-05 10:31:18 +01:00
wrongecho
3f772f5a2f
Bugfix: credentials
...
Fix an edge-case bug causing the user_encryption_session_key session cookie to not be set due to error output (when display PHP errors in browser is enabled). This means login credentials are still encrypted but cannot be decrypted properly by other users.
Prevent users creating new credentials if they do not have the correct cookie set.
2024-08-19 19:56:12 +01:00
