johnnyq
e29369926f
Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated
2026-10-17 12:05:55 -04:00
johnnyq
5e77edb077
Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated
2026-10-17 02:40:59 -04:00
johnnyq
e84e3e7e49
Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed
2026-10-17 02:12:05 -04:00
johnnyq
c6eadf3fa3
Client portal stage 1, look, home and tickets: a new light shell with the company logo or initials on the theme colour, sections shown by what each contact may open (Home, Tickets, Billing for billing contacts, Your IT for technical contacts, custom links), New ticket and an account menu with a dark mode switch kept in a cookie, a bottom tab bar and slide-in menu on phones, and the welcome banner removed; a rebuilt home showing what needs the contact (tickets waiting on their reply or to confirm, approvals, past-due invoices), open tickets, balance with Pay invoices, renewals in the next 45 days, their devices with warranty status and the company phone and email; tickets rebuilt with Open, Waiting on you, Resolved, Closed and All tabs with counts, search, paging and the whole company's tickets for primary and technical contacts with a Mine filter, the old all-tickets page redirecting there; a ticket page with progress steps, the conversation oldest first, approvals, details alongside, replies with drag and drop attachments, It's fixed, close or reopen and rating; New Ticket with priority, category, device and attachments; fixes downloading files from internal notes, files on closed tickets not downloading, new tickets linking to another client's device or a non-ticket category, empty replies and tickets being accepted, PHP warnings on Pay invoices and Recurring invoices with no payment provider, and Bootstrap icons and the editor setup blocked by the portal CSP, which now allows data: images; new js/portal.js and portal helpers in client/functions.php, ticketPortalStatusHtml removed; changelog updated
2026-10-17 01:28:27 -04:00
johnnyq
15844faa9b
Rebuild all reports on a shared framework (functions/reports.php, inc_report.php, inc_report_layout.php, js/reports.js) with period, client and agent filters, sortable tables, CSV export of any table and clean print layouts, add Client Review (QBR), Renewals & Expirations, Asset Lifecycle, Documentation Coverage, Customer Satisfaction, Open Ticket Aging, Client Profitability, Quotes Pipeline and Mileage reports, make Budget vs Actual editable with save and copy-last-year, rename reports to say what they show, enforce module and feature access on every report page, exclude transfers from income via dashboardRevenueSql, limit portal ticket ratings to Good or Bad, seed ratings and Windows 10 holdouts in demo data, link Client Review from the client menu, and update the 26.11 changelog
2026-10-16 00:04:40 -04:00
johnnyq
5acb1802bb
Security: scope set_recurring_payment to the client's own invoice and payment method
2026-10-08 16:02:21 -04:00
Wrongecho
c4843095b2
Potential fix for Stripe charges being off by a cent
2026-09-22 16:01:46 +00:00
johnnyq
bcdfab996c
Fix approval Syntax
2026-08-31 17:52:44 -04:00
johnnyq
156c51224d
Fix client portal review findings: PIN wipe, log indexing, statement currency (db 2.7.8)
...
Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising.
Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it.
New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable.
Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement.
Quick Send asks for confirmation; confirm-link extended to submit buttons.
Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.
2026-08-28 16:38:42 -04:00
johnnyq
10fb40f36f
Feature: Major spruce up of the client portal profile page, added Department, Location, Title, Phone with Edit, editing Pin, Recent signins and recent activity along with a seperate activity page
2026-08-28 16:08:23 -04:00
johnnyq
c10d4eb736
Add Account Statment in Client Portal with option to download as a PDF
2026-08-28 15:22:02 -04:00
johnnyq
bf04d6a757
Ticket default to Medium Priority unless specified, as this is just good practice
2026-08-27 13:04:19 -04:00
johnnyq
5c7f641635
Fix Ticket Notification in Portal was calling a function that was removed causing it to 500 error out
2026-08-17 12:39:29 -04:00
johnnyq
d484629ebc
do not update ticket status in history if it is the same
2026-08-08 12:41:34 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
75028ba09a
Fix some Ticket History gaps
2026-08-01 14:33:37 -04:00
johnnyq
7c8c93c01c
Feature allow agents to attach files to tickets in the app
2026-07-29 17:58:04 -04:00
johnnyq
162a597da9
Add SLA pausing, SLA reports, SLA filtering and kanban SLA state (phase 3)
...
Statuses can be flagged to pause the resolution clock; sla_history records the intervals a ticket's clock actually ran and the deadline is re-based on remaining budget when it resumes. Adds SLA Summary and SLA by Client reports, an SLA state filter on the ticket list, SLA colouring on kanban cards, and an Urgent column on the Tickets by Client report. DB update 2.5.1. Also fixes resolution SLA verdicts being skipped when resolving via kanban or the client portal.
2026-07-29 13:02:27 -04:00
johnnyq
07c73a6a04
Add Urgent Priority, move Per Client SLA Settings to notes tab in client add / edit modal remove unnessesary sla admin setting for client overide
2026-07-29 00:49:31 -04:00
johnnyq
d08ef6184a
Add optional ticket SLAs
...
Response/resolution targets stamped at creation from per-client/priority assignments, business-hours due date math, warn/breach alert stages via cron/ticket_sla.php, ticket list coloring, per-ticket SLA override, admin page for plans/assignments/business hours. DB update 2.5.0. No behavior change unless SLAs are assigned. Bulk reply now only counts Public replies as first response.
2026-07-29 00:00:42 -04:00
johnnyq
cd34236716
Fix saved-payment setup Checkout: embedded_page ui_mode + attach existing Stripe customer
2026-07-25 19:00:06 -04:00
johnnyq
a26ac2c4fc
Fixed adding saved credit cards in stipe due to API change
2026-07-25 18:47:13 -04:00
johnnyq
497ea3b669
Centralize client portal access checks through contactCan()
...
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
2026-07-25 17:55:30 -04:00
johnnyq
887063394a
Prevent client portal contacts from editing their own contact record
2026-07-25 17:28:57 -04:00
johnnyq
af51c4316f
Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present
2026-07-24 13:40:37 -04:00
johnnyq
8f43b92496
Use stripe_init include to init stripe and updated code everywhere
2026-07-23 13:00:01 -04:00
johnnyq
8ee780566e
Cleanup Expense Code in post blocks and remove single use function since stripe payments get reconciled during nightly cron
2026-07-22 17:06:10 -04:00
johnnyq
66b38b7f19
Get Expense from Stripe instead of Static Entry
2026-07-22 16:07:39 -04:00
johnnyq
9d540f4bfe
Replace Function customAction() with triggerCustomAction()
2026-07-14 17:43:55 -04:00
johnnyq
b8873039a4
Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions
2026-07-14 17:41:41 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
8da3a107fb
Rename plugins to libs and update all file references
2026-07-10 13:24:20 -04:00
wrongecho
bd15cbe375
- Stripe saved cards - lock down invoice and client IDs
...
- Stop app log handling from breaking due to quotes
2026-05-20 17:51:54 +01:00
johnnyq
90232c82c0
Fix broken add saved card, by commenting CSRF Check on add saved card in client post
2026-05-04 12:59:01 -04:00
johnnyq
726b1cd42b
Fix Stripe Add Payment in client portal regression on CSRF check
2026-03-07 13:17:24 -05:00
johnnyq
8de7b20ba1
Add CSRF Checks in the client portal
2026-03-07 13:11:08 -05:00
johnnyq
ae1d71dcd7
append client_id to the uri for agent ticket links so that the when clicked will take them to the client section and show client header along with the bread crumbs link of client tickets
2026-01-19 16:24:31 -05:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
wrongecho
77e4d2b566
Add task approval system
2026-01-09 17:14:44 +00:00
johnnyq
a79ce23ae5
Fix randomString() to generate cryptographically secure URL-safe tokens, reduced url keys to 32 Characters for performance and easy copy and paste and compatibility while still mainitaining ubreakable cryptographic keys
2025-12-18 14:24:53 -05:00
johnnyq
871ad2ea7e
Update legacy client login links to use the new unified login method
2025-12-10 12:21:12 -05:00
johnnyq
99e2487d2b
Fix dupe race condition with ticket, invoice, quote, project, recurring ticket numbering when being created in parallel Atomically update and get the next ticket number in one SQL query everywhere.
2025-11-28 14:14:46 -05:00
johnnyq
1a9a36829b
Process base64 Images for document creation and editing for the API and Client Portal
2025-11-24 00:14:27 -05:00
johnnyq
02694f6720
Fix Broken Links in Email to Agent via Client Portal Ticket Update, update changelog
2025-11-17 12:10:10 -05:00
johnnyq
efcc0fd5cb
Add Where clause to only accept saved payment by logged in session_client_id in Client Portal
2025-11-16 15:33:45 -05:00
johnnyq
00f5198bed
Update appNotidfy links to use Absolute paths, updated gitignore
2025-09-25 13:31:16 -04:00
johnnyq
ef1ec56270
Allow the Client to easily Pay an invoice from the client portal with a saved card
2025-09-03 17:09:17 -04:00
johnnyq
7f49ecefb1
Flash alert if no comment was entered in a ticket reply via the client portal
2025-08-21 18:35:16 -04:00
