johnnyq
e11d8f3252
Harden checkFileUpload: drop content hashing for random storage names
...
Replace md5(file_contents)+randomString(2) naming with randomString(32).
No longer reads the file into memory (removes file_get_contents), so
validation is O(1) regardless of size or upload count. Add is_uploaded_file()
and UPLOAD_ERR_OK checks, use pathinfo() for extension extraction, and
return false consistently on all failures (oversize previously returned a
truthy error string that callers treated as a valid filename).
2026-07-16 19:18:08 -04:00
johnnyq
41d029937a
More Client Scoping fixes
2026-07-16 14:29:23 -04:00
johnnyq
1251944dcc
More Client Enforcement in modals across the app
2026-07-16 13:33:17 -04:00
johnnyq
2c09ce097c
More Client Enforcement in modals across the app
2026-07-16 13:10:02 -04:00
johnnyq
9e84ce4c07
Ticket Merge: EnforceClientAccess on modal and ticket list
2026-07-16 12:14:36 -04:00
johnnyq
a8ad16758c
Update Contributing
2026-07-16 00:44:51 -04:00
johnnyq
9f11af0d4d
Update Contributing
2026-07-16 00:42:10 -04:00
johnnyq
906f58473d
Fix guest view credential totp
2026-07-16 00:26:25 -04:00
johnnyq
e39ecb7ac9
Remove Legacy OTP code and fix guest view credential
2026-07-15 22:02:52 -04:00
johnnyq
86b0e11e95
Enforce ClientAccess in asset modal
2026-07-15 21:37:48 -04:00
johnnyq
2076bb2a93
Added Audit Log on Edit Credential Modal as password can be viewed here
2026-07-15 21:13:07 -04:00
johnnyq
7c9bd77603
Remove unused credential view model, add enforceClient Check on export client pdf
2026-07-15 21:09:11 -04:00
johnnyq
b1c57fc5c7
Feature: Add new js function to retrieve and Audit log Password reveals, still need to get the edit modals
2026-07-15 20:32:50 -04:00
johnnyq
89cb9074ab
UI: Add Monospace font to timestamps in notifications listing
2026-07-15 18:59:05 -04:00
johnnyq
590bad3bcc
Global Search: use secure file handler on files in global search
2026-07-15 18:55:40 -04:00
johnnyq
60bae12024
Clean up admin post handler to match agent
...
- Anchor includes and glob to __DIR__ so loading doesn't depend on CWD
- Replace _model.php regex check with str_ends_with()
2026-07-15 18:48:40 -04:00
johnnyq
e48ea57db9
Clean up agent post handler
...
- Remove dead referer/module parsing (unused since modules are glob-loaded)
- Anchor includes and glob to __DIR__ so loading doesn't depend on CWD
- Replace _model.php regex check with str_ends_with()
2026-07-15 18:45:27 -04:00
johnnyq
3838d052f0
Add secure file handler for client ticket attachment and file view along with client and contact permission isolation, add the handler links in asset and contact
2026-07-15 18:35:32 -04:00
johnnyq
c8f616ebee
Ticket UI: Migrated ticket Attachments to a small table class
2026-07-15 13:52:52 -04:00
johnnyq
33a2929ab6
Feature: Secure File Download Handler for ticket attachments Implemented
2026-07-15 13:42:19 -04:00
johnnyq
df3a24eab7
Feature: Secure File Download Handler Implemented
2026-07-15 13:11:02 -04:00
johnnyq
6dbe84dee4
Update admin/ breadcrumbs to match plural file names
2026-07-15 00:48:16 -04:00
johnnyq
6e20800a98
Update Tax to Tax Rate in headr title for tax rates
2026-07-15 00:44:32 -04:00
johnnyq
dfedc31c04
Update Tax to Tax Rates in admin side nav
2026-07-15 00:43:09 -04:00
johnnyq
dae7f09650
Remove _details, fix plural and singular file naming in admin, update admin post to match agent post
2026-07-15 00:38:34 -04:00
johnnyq
38a042d435
Remove _details and use singular filename for certain objects
2026-07-15 00:12:27 -04:00
johnnyq
c3a438ee59
Replace the rest of the getFallBack Functions with simple ?: '-'
2026-07-14 19:17:26 -04:00
johnnyq
bcb244c245
Update skipped function renames in anything named vendor
2026-07-14 19:09:32 -04:00
johnnyq
cddcedbf1c
Cleanup format Functions
2026-07-14 18:28:53 -04:00
johnnyq
eac913eb07
Remove function removeEmoji() as this is no longer needed as the DB Charset is set to the standard utf8mb4 across the board
2026-07-14 18:27:02 -04:00
johnnyq
ee7ef71855
Correct plugins to libs path for zapCal library in functions
2026-07-14 18:15:32 -04:00
johnnyq
2181e92e44
Removed valueOrDash Function was able to replace with ?: '-'
2026-07-14 18:13:34 -04:00
johnnyq
746e919aff
Replace Function getFallBack with valueOrDash()
2026-07-14 18:00:12 -04:00
johnnyq
71f7299337
Replace Function roundToNearest15() with roundToNearest15Min()
2026-07-14 17:55:59 -04:00
johnnyq
21a23e79b0
Replace Function getSSL() with getSslCertificate()
2026-07-14 17:54:31 -04:00
johnnyq
52b5063066
Replace Function getDomainRecords() with getDnsRecords()
2026-07-14 17:53:16 -04:00
johnnyq
8f824a1868
Replace Function shortenClient() with shortenClientName()
2026-07-14 17:46:25 -04:00
johnnyq
9d540f4bfe
Replace Function customAction() with triggerCustomAction()
2026-07-14 17:43:55 -04:00
johnnyq
b8873039a4
Rename Functions: flash_alert, sanitizeFilename and display_folder_options using camelCase instead to match other custom php functions
2026-07-14 17:41:41 -04:00
johnnyq
f1836c70cd
Replace Function logAction() with logAudit()
2026-07-14 17:35:23 -04:00
johnnyq
29a0b3ead8
Replace Function fetchUpdates() with checkForUpdates()
2026-07-14 17:31:54 -04:00
johnnyq
31cc3f3ac3
Replace Function strtoAZaz09() with toAlphanumeric()
2026-07-14 17:30:13 -04:00
johnnyq
8de3cd300d
Replace Function key32gen() with generateTotpSecret()
2026-07-14 17:27:02 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
7bc47a58fe
Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout
2026-07-14 17:10:45 -04:00
johnnyq
d62b6e2ae7
Update comment
2026-07-14 16:58:16 -04:00
johnnyq
5eb9f6b6d5
Fix weak RNG in key32gen (TOTP secret generation)
...
Replace srand()/rand() with random_int() for cryptographically secure,
unbiased key generation. The previous implementation seeded rand() from
microtime(), making TOTP secrets predictable if the generation time
could be approximated. Also removes modulo bias and dead while(1)
wrapper.
Output format is unchanged: 32 chars from the base32 alphabet (A-Z,
2-7), so existing TOTP enrollments are unaffected.
2026-07-14 16:57:16 -04:00
johnnyq
bf0d799caf
Remove old function comment
2026-07-14 16:51:34 -04:00
johnnyq
29bea9517d
Removed the last of legacy validate functions and replaced with the new enforce fumctions.
2026-07-14 16:49:14 -04:00
johnnyq
a2a96f9752
Removed unused legacy functions and split the functions into their own file and use function.php to call them
2026-07-14 16:32:45 -04:00
