johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
d62b6e2ae7
Update comment
2026-07-14 16:58:16 -04:00
johnnyq
5eb9f6b6d5
Fix weak RNG in key32gen (TOTP secret generation)
...
Replace srand()/rand() with random_int() for cryptographically secure,
unbiased key generation. The previous implementation seeded rand() from
microtime(), making TOTP secrets predictable if the generation time
could be approximated. Also removes modulo bias and dead while(1)
wrapper.
Output format is unchanged: 32 chars from the base32 alphabet (A-Z,
2-7), so existing TOTP enrollments are unaffected.
2026-07-14 16:57:16 -04:00
johnnyq
bf0d799caf
Remove old function comment
2026-07-14 16:51:34 -04:00
johnnyq
29bea9517d
Removed the last of legacy validate functions and replaced with the new enforce fumctions.
2026-07-14 16:49:14 -04:00
johnnyq
a2a96f9752
Removed unused legacy functions and split the functions into their own file and use function.php to call them
2026-07-14 16:32:45 -04:00
johnnyq
c1447f5bad
Bump TinyMCE from 8.6.0 to 8.7.0
2026-07-14 16:08:05 -04:00
johnnyq
79032de032
Certificates: Allow to search by description
2026-07-14 11:23:54 -04:00
johnnyq
b81e57db28
Show Invoice Stats in Invoice only for user permissable clients
2026-07-13 17:19:32 -04:00
johnnyq
95441dc3bb
Show 7 Characters of client name in client side nav instead of Abbreviation
2026-07-13 13:29:24 -04:00
johnnyq
fe7e9b2398
Main Side Nav: Only shows counts to the user who has permission to see
2026-07-13 13:08:03 -04:00
johnnyq
91e9f6097b
Client Overview Side Nav: Only shows counts to the user who has permission to see
2026-07-13 12:45:59 -04:00
johnnyq
0f0aa89f75
Bump ImapEngine from 1.25.0 to 1.25.1
2026-07-10 18:37:16 -04:00
johnnyq
8da3a107fb
Rename plugins to libs and update all file references
2026-07-10 13:24:20 -04:00
johnnyq
7ba1571400
Revert Billable placement in tickets, create CONTRIBUTING.md file
2026-07-10 12:32:46 -04:00
johnnyq
d2026a417f
Add Client to top of the modals trips, ticket, recurring ticket, invoice, recurring invoice, quote and rework the UI for Ticket/Recurring ticket create Put Billable beside subject so it doesnt take up a whole row
2026-07-09 18:50:31 -04:00
johnnyq
fc59481476
Enforce Client Access in client selectbox
2026-07-09 16:17:00 -04:00
johnnyq
21328c2dee
clientEnforcement on Recurring Invoices and payments listings
2026-07-09 16:13:39 -04:00
johnnyq
317fe91359
Add Missing clientEnforcement in various modals, already handled on POST also add client selection in edit trip and enforce client permissions on trips
2026-07-09 16:07:54 -04:00
johnnyq
68f705b135
Set EnforceClientAccess Perms throughout expenses, modals and post along with listing
2026-07-09 14:51:51 -04:00
johnnyq
c01645c4e2
Expense: On create enforce client Access only if Client is selected
2026-07-08 18:13:14 -04:00
johnnyq
ae5c9fe8ec
Mail Parser: Add logic when creating ITFlow folder to determine if the namespace is INBOX. or can be created in root directory. Fixes issue with CPanel Dovecot Maildir++ configuration where their namespace is just INBOX
2026-07-08 15:58:00 -04:00
johnnyq
de6d2b1595
OAUTH Send Quote Fix: was reading smtp host var needed to read smtp provider as smtp host is not filled in when OAUTH2 is selected
2026-07-07 16:20:21 -04:00
johnnyq
47a5825d3e
OAUTH Send Invoice Fix: was reading smtp host var needed to read smtp provider as smtp host is not filled in when OAUTH2 is selected
2026-07-07 15:04:48 -04:00
johnnyq
78c3dd0eed
Remove Dig and Whois binary requirements, revert fetchUpdates function
2026-07-05 16:05:19 -04:00
johnnyq
d1e1609b8a
Right — same commit or separate, here's the combined version covering both:
...
Remove exec/shell_exec from update checker and domain lookups
Update checker (fetchUpdates) no longer shells out to git:
- Current commit read directly from .git/HEAD, following the branch
ref through loose refs with a packed-refs fallback (survives git gc);
detached HEAD handled
- Latest commit fetched from the GitHub API via curl using the
Accept: application/vnd.github.sha header (returns bare SHA, no
JSON parsing)
- Repo owner/name derived from the origin remote in .git/config so
forks check against their own remote, falling back to
itflow-org/itflow
- Failures now distinguish unreadable .git (permissions) from API
errors (network/rate limit) instead of silently returning empty
Domain lookups no longer shell out to dig and whois:
- DNS records (A/NS/MX/TXT) via dns_get_record()
- Registration data via RDAP (JSON over HTTPS, curl), the ICANN
successor to port-43 whois; RDAP server per TLD resolved from
IANA's bootstrap registry, cached locally for a week, rdap.org as
secondary lookup
- Expiration date from RDAP's structured expiration event, replacing
regex/date-format guessing for RDAP-covered TLDs
- Port-43 whois retained as socket-based fallback (fsockopen) for
ccTLDs without RDAP, with IANA server discovery and one registrar
referral follow
- RDAP responses cached per-run: getDomainRecords() and
getDomainExpirationDate() on the same domain = one HTTP request
Fixes whois rate limiting, removes the exec dependency for hardened
hosts (Snuffleupagus etc.), and eliminates the shell injection
surface - no shell, nothing to escape.
2026-07-05 15:33:51 -04:00
johnnyq
a32c4b5172
Update Changelog
2026-07-03 12:29:10 -04:00
johnnyq
c34e4f5ff0
EnforceClientAccess on Generating Guest Share Links
2026-07-03 12:27:46 -04:00
johnnyq
aab8b34970
Bump ITFlow Version and changelog
2026-07-03 12:15:05 -04:00
johnnyq
1a1f6d80a1
Possible Fix for OAUTH2 M365
2026-07-02 16:08:59 -04:00
johnnyq
fe9e3274fe
Fix missing )
2026-07-01 11:11:30 -04:00
johnnyq
9f14e97d58
Update changelog
2026-06-29 19:04:59 -04:00
johnnyq
fab5dbea04
Don't set Theme to Gray amd blue when in client section always Keep configured theme
2026-06-29 18:52:56 -04:00
johnnyq
1bcc535e99
Updated Changelog and Bump ITFlow version and update logs timestamp fields to use monospace font
2026-06-27 21:52:02 -04:00
johnnyq
6a448668ad
Clients: Only show 3 tags per line
2026-06-26 13:28:03 -04:00
johnnyq
166a606ba9
Remove client counts on clients listing page
2026-06-26 13:26:25 -04:00
johnnyq
48c33ae1ab
Enforce Client Access and Role Access for AI Ticket Summary
2026-06-26 12:40:47 -04:00
johnnyq
e7b53388a0
Check CSRF and Enforce ClientAccess when deactivating Shared Items
2026-06-26 12:17:38 -04:00
johnnyq
f14fa22222
USe enforceClientAccess and enforceUserPermissions on Client related edit / view modals as we do with credential edit modal
2026-06-26 12:05:11 -04:00
johnnyq
c16a1753a5
Add text MonoSpace in places where it needs to be, reduced info icon size in clients, Fixed navigation highlight for files when in document details and is asset details
2026-06-25 18:06:39 -04:00
johnnyq
a53d828a73
MAil Settings: Further UI Sprucing added more placeholder text field with only number input for ports etc
2026-06-25 16:01:11 -04:00
johnnyq
298569a2c2
Mail Setting UI: Rework the entire Mail Configuration
2026-06-25 15:49:09 -04:00
johnnyq
8e9cd7a8a5
Bump Sortablejs from 1.15.6 to 1.15.7
2026-06-24 14:28:21 -04:00
johnnyq
2010acaaa2
Bump TinyMCE from 8.5.0 to 8.6.0
2026-06-24 14:26:03 -04:00
johnnyq
ceec38d3f1
Bump Fullcalendar from 6.1.20 to 7.0.0 amd convert existing code to comply with 7.0, also make calendar more printable
2026-06-24 14:22:56 -04:00
johnnyq
bd310d1e5d
Bump PHPMailer from 7.0.2 to 7.1.1
2026-06-24 13:53:50 -04:00
johnnyq
3d858eb761
Update to latest version of imapengine 1.25.0
2026-06-24 13:48:26 -04:00
johnnyq
171a0d38f8
Mail Parser: Completely remove Webklex IMAP and all dependcies
2026-06-24 13:39:07 -04:00
johnnyq
63ad3256ee
CLI Setup: Add repo_branch option defaults to master
2026-06-24 13:18:01 -04:00
johnnyq
6e7d2b2d6a
Invoice Late Overdue notices shows correct balance when late fees are attached and if partial invoice was paid
2026-06-24 13:07:52 -04:00
