johnnyq
cd7ebc0a5f
Security: enforce per-user client restrictions on client, financial and bulk handlers and per-client reports
...
Agents restricted from a client could still edit, archive, restore or delete it, run bulk actions on it (edits, tags, archive, email, tickets) and add credits. Every selected client is now checked before anything is written.
Expense, trip and recurring expense edits now check the client the record already belongs to, not just the submitted one. Recurring expense delete, revenue edit/delete and task approval handlers gained the same check.
Per-client reports and the dashboard payment/ticket lists now hide clients the agent is denied. Company-wide totals are unchanged.
2026-10-08 16:17:46 -04:00
johnnyq
64423cbefa
Fix Client PDF Export
2026-08-06 18:51:09 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
ddd9c2b56a
clientScopeSql sweep whicn now removed the extra unessesary client joins
2026-08-06 11:45:56 -04:00
johnnyq
c5288f9e30
Fix undefined variables in expense, asset and contact audit/flash messages
2026-08-03 15:34:18 -04:00
johnnyq
e800064202
Fix Expense Description logging spelling
2026-08-03 15:28:36 -04:00
johnnyq
3c8f812a16
Feature: On all export modals added Filter Tab and Selectable Columns tab with default selected, also you can now export to a PDF
2026-07-30 00:46:15 -04:00
johnnyq
5c4805b822
Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function
2026-07-24 18:12:45 -04:00
johnnyq
af51c4316f
Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present
2026-07-24 13:40:37 -04:00
johnnyq
b8873039a4
Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions
2026-07-14 17:41:41 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
68f705b135
Set EnforceClientAccess Perms throughout expenses, modals and post along with listing
2026-07-09 14:51:51 -04:00
johnnyq
c01645c4e2
Expense: On create enforce client Access only if Client is selected
2026-07-08 18:13:14 -04:00
johnnyq
edad83cc37
Fix Regression of chnage post name from client to client_id Add / Edit Expense
2026-03-08 13:43:46 -04:00
johnnyq
1d5fceeecd
Expenses: Add missing CSRF, Add missing perms
2026-03-02 17:27:56 -05:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
johnnyq
13ea48bff8
Seperate out recurring expenses and expenses into their own post file
2025-10-29 16:21:56 -04:00
johnnyq
edabc5c33f
rename /user/ to /agent/ and update links to use agent/ instead
2025-09-23 18:04:23 -04:00
