Commit Graph

3 Commits

Author SHA1 Message Date
johnnyq
497ea3b669 Centralize client portal access checks through contactCan()
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
2026-07-25 17:55:30 -04:00
johnnyq
8de7b20ba1 Add CSRF Checks in the client portal 2026-03-07 13:11:08 -05:00
johnnyq
5f76a7989b Move portal to client and rename and reorganize some client portal files 2025-01-23 17:12:11 -05:00