johnnyq
|
aff6812036
|
Security: hold an agent who must set up MFA to the set up page on every request, not just at sign in, and fix the client portal two-step gate, which a path added to the URL or a second action sent with the set up one got past - both now go through requestIsMfaSetup(), which checks the script actually running and every key in the request; View as contact is refused while an agent still owes MFA set up, and agents are emailed when MFA is turned on
|
2026-11-04 14:01:40 -05:00 |
|
johnnyq
|
9b92261e8c
|
Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id
|
2026-11-04 13:50:17 -05:00 |
|
johnnyq
|
01fbcda75d
|
Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated
|
2026-10-26 19:54:36 -04:00 |
|
johnnyq
|
359851c876
|
Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty
|
2026-10-23 12:09:07 -04:00 |
|
johnnyq
|
b3744e9ed5
|
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
|
2026-08-06 13:10:23 -04:00 |
|
johnnyq
|
eb2cc3d653
|
Update Contributing with the new clientScopeSql function
|
2026-08-06 11:55:39 -04:00 |
|
johnnyq
|
ddd9c2b56a
|
clientScopeSql sweep whicn now removed the extra unessesary client joins
|
2026-08-06 11:45:56 -04:00 |
|
johnnyq
|
3756561458
|
Feature: Add Deny Client Access to Client Access Permssions - BREAKS UI, MUST UPDATE DB USING php scripts/cli_update.php --db_update
|
2026-07-25 13:22:52 -04:00 |
|
johnnyq
|
b57ddc0e5c
|
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
|
2026-07-14 17:17:50 -04:00 |
|
johnnyq
|
2349ef33d1
|
Remove 0 in access_permission_query
|
2026-02-14 15:07:42 -05:00 |
|
johnnyq
|
ccaf15268c
|
Add a 0 IN ticket_client_id for no client tickets so agents that are restricted to certain clients and still view no clients in tickets list by using a , also restrict change clients on tickets for restricted agents
|
2026-02-14 15:06:17 -05:00 |
|
johnnyq
|
118cc10804
|
During load user session check if user is archived and active, prevents users from making further actions if they are disabled or archived but are still logged in
|
2026-01-30 13:36:18 -05:00 |
|
johnnyq
|
0a30300bde
|
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
|
2026-01-14 17:30:23 -05:00 |
|
johnnyq
|
e6bcf0e12f
|
Started updating href paths to absolute paths instead of relative paths as itflow should be installed in document root anyway and not a sub-directory
|
2025-09-24 12:56:01 -04:00 |
|
johnnyq
|
9caa42975d
|
rename get_settings.php to load_global_settings.php and update all requires
|
2025-08-06 17:48:23 -04:00 |
|
johnnyq
|
44fdb6c24f
|
Broke up the check_login.php require into several files seperated by function and then required them in the check_login
|
2025-08-06 17:16:30 -04:00 |
|