johnnyq
a26ac2c4fc
Fixed adding saved credit cards in stipe due to API change
2026-07-25 18:47:13 -04:00
johnnyq
497ea3b669
Centralize client portal access checks through contactCan()
...
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
2026-07-25 17:55:30 -04:00
johnnyq
887063394a
Prevent client portal contacts from editing their own contact record
2026-07-25 17:28:57 -04:00
johnnyq
565aff35f6
Set SameSite=Lax on the session cookie
...
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
2026-07-24 14:09:52 -04:00
johnnyq
af51c4316f
Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present
2026-07-24 13:40:37 -04:00
johnnyq
9c65644adc
Update the rest of the PHP functions to use camelCase
2026-07-23 17:39:06 -04:00
johnnyq
8f43b92496
Use stripe_init include to init stripe and updated code everywhere
2026-07-23 13:00:01 -04:00
johnnyq
8ee780566e
Cleanup Expense Code in post blocks and remove single use function since stripe payments get reconciled during nightly cron
2026-07-22 17:06:10 -04:00
johnnyq
66b38b7f19
Get Expense from Stripe instead of Static Entry
2026-07-22 16:07:39 -04:00
johnnyq
9cc7e5ff3c
Move Guest Function formatBytes to root shared functions and use in files and files section in contact
2026-07-16 20:25:18 -04:00
johnnyq
3838d052f0
Add secure file handler for client ticket attachment and file view along with client and contact permission isolation, add the handler links in asset and contact
2026-07-15 18:35:32 -04:00
johnnyq
9d540f4bfe
Replace Function customAction() with triggerCustomAction()
2026-07-14 17:43:55 -04:00
johnnyq
b8873039a4
Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions
2026-07-14 17:41:41 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
8da3a107fb
Rename plugins to libs and update all file references
2026-07-10 13:24:20 -04:00
johnnyq
d2d1a75448
Generate CSRF Token during Client Portal login when using Entra
2026-06-12 17:38:58 -04:00
wrongecho
bd15cbe375
- Stripe saved cards - lock down invoice and client IDs
...
- Stop app log handling from breaking due to quotes
2026-05-20 17:51:54 +01:00
johnnyq
90232c82c0
Fix broken add saved card, by commenting CSRF Check on add saved card in client post
2026-05-04 12:59:01 -04:00
johnnyq
726b1cd42b
Fix Stripe Add Payment in client portal regression on CSRF check
2026-03-07 13:17:24 -05:00
johnnyq
8de7b20ba1
Add CSRF Checks in the client portal
2026-03-07 13:11:08 -05:00
johnnyq
38b4ed4b96
Tidy check_login for client portal
2026-01-30 14:24:34 -05:00
johnnyq
34308a5f9a
check if archived and active for client login as well along with loading extended client user session vars in /client/includes/check_login.php
2026-01-30 14:10:59 -05:00
johnnyq
ae1d71dcd7
append client_id to the uri for agent ticket links so that the when clicked will take them to the client section and show client header along with the bread crumbs link of client tickets
2026-01-19 16:24:31 -05:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
wrongecho
58bcb38617
Add task approval system (tidy)
2026-01-12 12:21:10 +00:00
wrongecho
77e4d2b566
Add task approval system
2026-01-09 17:14:44 +00:00
wrongecho
30499123f1
Bugfix: Portal not showing contact user id in session
2026-01-09 13:50:46 +00:00
johnnyq
a79ce23ae5
Fix randomString() to generate cryptographically secure URL-safe tokens, reduced url keys to 32 Characters for performance and easy copy and paste and compatibility while still mainitaining ubreakable cryptographic keys
2025-12-18 14:24:53 -05:00
johnnyq
871ad2ea7e
Update legacy client login links to use the new unified login method
2025-12-10 12:21:12 -05:00
johnnyq
99e2487d2b
Fix dupe race condition with ticket, invoice, quote, project, recurring ticket numbering when being created in parallel Atomically update and get the next ticket number in one SQL query everywhere.
2025-11-28 14:14:46 -05:00
johnnyq
1a9a36829b
Process base64 Images for document creation and editing for the API and Client Portal
2025-11-24 00:14:27 -05:00
johnnyq
02694f6720
Fix Broken Links in Email to Agent via Client Portal Ticket Update, update changelog
2025-11-17 12:10:10 -05:00
johnnyq
efcc0fd5cb
Add Where clause to only accept saved payment by logged in session_client_id in Client Portal
2025-11-16 15:33:45 -05:00
johnnyq
a3b0fce961
Fix login_microsoft
2025-10-08 17:19:17 -04:00
johnnyq
16242be74e
Update Client Nav to use Absolute links and updated more of the inc_alls to use Document Server Root
2025-10-07 13:44:08 -04:00
johnnyq
956f18430b
Fix Microsoft SSO Login in Client Portal, fix ticket templates due to regression from changing from user to agent
2025-10-03 11:12:48 -04:00
johnnyq
6c6a988c2b
Fix custom Favicon
2025-10-02 11:42:30 -04:00
johnnyq
0e401df3c0
Setting 0 for the Payment Provider threshold disables the invoice amount check
2025-10-01 15:23:00 -04:00
johnnyq
71d30ff95f
Enforce Payment Provider Max Threshold for Stripe Paymented in Guest Invoice and Unpaid Invoices
2025-09-30 12:14:24 -04:00
johnnyq
00f5198bed
Update appNotidfy links to use Absolute paths, updated gitignore
2025-09-25 13:31:16 -04:00
johnnyq
690007be5c
More Relative to Absolute web asset paths updates
2025-09-24 13:09:25 -04:00
wrongecho
ca6a903b8f
Keepalive
...
- Fix directory path
- Remove duplicate file
- Add to client portal
2025-09-24 08:39:45 +01:00
johnnyq
5c448c05a9
Update .gitignore and add custom directories to /admin /client /guest /user Example Documentation coming soon
2025-09-22 19:33:40 -04:00
wrongecho
6d3351b2f7
Payment providers bug-fixing
2025-09-22 11:53:49 +01:00
johnnyq
c26ce4b7dc
Spruced up UI and eliminated checkbox to grant consent on Stripe consent in client Portal instead button acts a consent
2025-09-08 17:36:09 -04:00
johnnyq
5960e7cbd9
Fix Broken Add Payment link in reccuring invoice in the client portal
2025-09-08 17:23:51 -04:00
johnnyq
46d93f986e
Further enhanced the Saved Payments Section by splitting cards and add card into 2 columns
2025-09-03 17:45:11 -04:00
johnnyq
2549a97a7e
Added card icons to Saved Payments in Client Portal and spruced up ui
2025-09-03 17:40:09 -04:00
