17 Commits

Author	SHA1	Message	Date
johnnyq	c51323b88e	Rebuild guest sharing as Shared Links (functions/share.php, DB 2.9.0) with one Share window for credentials, documents and files plus secure notes and login requests that clients answer through an encrypted form and agents save to credentials, choices for expiry, view limit, a passphrase or a code emailed to the recipient with lockout after five wrong tries, optional 2FA codes, notify on open, email or copy or QR, the link secret kept after the # and only its hash stored, login, note and request payloads sealed with AES-256-GCM under a key derived from the secret and request keys held under the vault, a rebuilt guest page (guest/share.php, js/guest_share.js, guest/share_ajax.php) with click to reveal so link scanners cannot use up one-time links, copy buttons, rotating 2FA codes limited to the browser that opened it and a destroy button, POST-only file downloads confined to the client folder, a Shared Links page per client and under All Client Docs with open, sent back and ended filters, a quick look with access history by address and browser, turn off one, ticked or every open link for a client, secrets wiped when links end and ended links kept for 90 days, sharing policy under Admin Settings Security, old links still working until they expire, removal of share_modal.php, share_modal.js, credential_share.php, share_generate_link, get_share_totp_token and deactivate_shared_item, and an updated 26.11 changelog	2026-10-16 01:33:36 -04:00
johnnyq	fecd1cabff	Credentials makeover: rebuilt credentials list with kind icons, username copy, password show/copy and live 2FA code buttons fetched on demand, where it opens, what it is for (asset, contact, vendors, licenses, services), password age pills and last used, filters for Starred, With 2FA, No 2FA, Not changed in 90 days and Shared with counts, search across notes, second link, tags, asset and contact, open straight to a credential with ?open=ID; new credential quick look with login, age, last viewed by, links with unlink, notes, open share links with turn off, and history; tabbed new/edit form with password generator (passphrase or random), strength meter, 2FA secret that accepts spaces or an otpauth:// link and shows the current code to check, copy buttons on both links, prefill from asset, contact or vendor; new Change password window that dates and logs the change; new Share window from anywhere (contact or email, 1 hour to 1 month, gone after opened once by default, link copied); same login controls on asset and contact pages and quick looks, vendor Logins tab, license page and quick look, service quick look, client overview favourites and search; credential pickers show icons and say when a credential moves from another asset or contact; client overview Passwords due for a change attention item and Active share links limited to live links; rotation report with selectable span, per client counts and oldest first; more export columns; demo data gets 2FA secrets, varied password ages and logins attached to their assets. Fixes passwords being blanked when the vault session had expired, other clients' assets, contacts and tags accepted on save, bulk star using the wrong permission, credential links to assets and contacts not checking the client, the edit or link permission, or which asset or contact an unlink was for, credentials left pointing at deleted assets and contacts, share links left open after a credential was deleted, import carrying values between rows and accepting any file type, 2FA secrets saved with spaces or lowercase giving no code, the service quick look listing credentials without credential access and repeating assets, an asset login with only a username being lost, and the API not dating new passwords. Adds functions/credential.php and js/credentials.js; removes credential_model.php and the old credential show password/OTP scripts. No DB change.	2026-10-14 23:33:29 -04:00
johnnyq	bab3d73c86	Rebuild notifications: bell panel and full page ... - Bell opens a dropdown panel instead of a modal: Unread/All tabs, grouped by day, type icons, relative times, click-through marks read, per-row read/unread, mark all as read - Unread badge refreshes every minute while the tab is visible - Notifications page rebuilt on the same backend: search, type filter, date range, read/unread toggles, proper empty states - Hide notifications for clients/modules the user cannot access - Normalise relative notification links so they work from /admin pages - Remove the old notifications modal and dismiss handlers	2026-10-09 15:52:40 -04:00
johnnyq	b3744e9ed5	More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time	2026-08-06 13:10:23 -04:00
johnnyq	af51c4316f	Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present	2026-07-24 13:40:37 -04:00
johnnyq	f1836c70cd	Replace Function logAction() with logAudit()	2026-07-14 17:35:23 -04:00
johnnyq	b57ddc0e5c	Replace Function sanitizeInput() with just escapeSql() and update all instances throughout	2026-07-14 17:17:50 -04:00
johnnyq	e7b53388a0	Check CSRF and Enforce ClientAccess when deactivating Shared Items	2026-06-26 12:17:38 -04:00
johnnyq	30357b9cf7	Add CSRF Checks to notifications and ensure the user dismissing the notification is their own notification	2026-03-05 17:51:20 -05:00
johnnyq	0a30300bde	replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage	2026-01-14 17:30:23 -05:00
johnnyq	d2dac1915d	Update admin, user, guest and client post to use new redirect function	2025-08-01 15:25:52 -04:00
johnnyq	a69b60703b	Dedup Notications code and move to a modal instead of a drop menu	2025-02-08 19:54:49 -05:00
johnnyq	a81bcf350c	When Dismiss all notifications are clicked only dismiss the notificaitons of the logged in user only	2024-11-17 15:03:05 -05:00
johnnyq	77aede8bab	Updated the remaining posts except ticket to use new logAction function, tidy and added more details to logging	2024-11-14 17:32:26 -05:00
johnnyq	1218094270	When deactivating Shared Link delete it	2023-09-23 19:16:19 -04:00
johnnyq	ce2ba6d3d2	Feature: Records per page is now user specific and persists with logout/login sessions	2023-08-17 19:42:42 -04:00
Marcus Hill	ebecdd3da2	Post.php - Separate 9k lines into separate files by sub-modules (e.g. ticket, invoice, expense) for easier development and troubleshooting	2023-07-02 14:56:12 +01:00