johnnyq
ff4b69b511
Client Enforcement via function on client edit instad of in sql query
2026-07-25 00:35:47 -04:00
johnnyq
761b2a7af4
Module permissions modal enforcement sweep to match its post counterpart
2026-07-25 00:28:42 -04:00
johnnyq
7a793cbbcc
Add more enforceClientAccess to agent ajax gets
2026-07-24 22:51:57 -04:00
johnnyq
113ef4b9a4
Add more enforceClientAccess
2026-07-24 22:49:18 -04:00
johnnyq
3524010d7a
Add enforceClientAccess to 4 bulk modals initially missing
2026-07-24 22:06:42 -04:00
johnnyq
8993bce53f
Force No Indexes of empty directories even if enabled using .htaccess in uploads
2026-07-24 20:52:35 -04:00
johnnyq
8813b2c066
Use imapEngine lib for testing imap connection
2026-07-24 18:56:16 -04:00
johnnyq
5c4805b822
Neutralize CSV formula injection in generated exports using the new created escapeCsvFormula Function
2026-07-24 18:12:45 -04:00
johnnyq
28f1a965b8
Remove dead code
2026-07-24 17:33:09 -04:00
johnnyq
565aff35f6
Set SameSite=Lax on the session cookie
...
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
2026-07-24 14:09:52 -04:00
johnnyq
3549c2ef2a
Harden CSRF handling and session cookies
...
Return 403 on CSRF failure instead of a 302, which anything following
redirects records as a 200. Set SameSite=Lax at every session_start;
keepalive.php and guest_post.php had no cookie flags at all.
2026-07-24 14:06:04 -04:00
johnnyq
8afc5aea89
Typo fix
2026-07-24 13:45:52 -04:00
johnnyq
af51c4316f
Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present
2026-07-24 13:40:37 -04:00
johnnyq
dd358da65d
Update missing CSRF endpoint checks missed update_db
2026-07-24 13:22:17 -04:00
johnnyq
91a1676e89
Update missing CSRF endpoint checks
2026-07-24 13:16:51 -04:00
johnnyq
e7698f15bd
Make better use of formatAddress function for clients listing
2026-07-24 12:22:15 -04:00
johnnyq
c7b34fe107
Remove leftover getFallBack in client pdf export in favor of ?: '-'
2026-07-23 18:29:11 -04:00
johnnyq
5846119ec9
remove duplicate formatAddress
2026-07-23 18:16:57 -04:00
johnnyq
41b118ab87
Add formatAddress function and replace all addresses with it
2026-07-23 18:10:39 -04:00
johnnyq
9c65644adc
Update the rest of the PHP functions to use camelCase
2026-07-23 17:39:06 -04:00
johnnyq
3d94846a61
Fix broken link to service modal in services
2026-07-23 13:48:00 -04:00
johnnyq
90bc8ed029
Fix broken links to modals and remove _details from service
2026-07-23 13:43:04 -04:00
johnnyq
40be80981d
Fix vendor modal link in service details
2026-07-23 13:34:08 -04:00
johnnyq
b853c24c96
Remove a few more unused vendor contact modals and update the escaping in rename modal vendor_details.php to vendor.php
2026-07-23 13:26:06 -04:00
johnnyq
5f26d75e18
Update Functions in ticket_edit_vendor and document link vendor and deleted legacy code unused that had legacy functions tied to them
2026-07-23 13:17:41 -04:00
johnnyq
8f43b92496
Use stripe_init include to init stripe and updated code everywhere
2026-07-23 13:00:01 -04:00
johnnyq
7ccdc942fe
Bump imapEngine from v1.25.2 to v1.25.3
2026-07-23 00:59:07 -04:00
johnnyq
2b756f6ea4
Split DB Updates into seperate files, with the cutoff being 2.0.0
2026-07-22 18:43:11 -04:00
johnnyq
17e4c61067
Spelling Fix
2026-07-22 17:40:30 -04:00
johnnyq
fad62ca045
Remove custom_hosting tables
2026-07-22 17:36:55 -04:00
johnnyq
5402578ce6
Remove Static payment processing fees from database and update field hints with useful info when adding / editing payment provider
2026-07-22 17:32:01 -04:00
johnnyq
8ee780566e
Cleanup Expense Code in post blocks and remove single use function since stripe payments get reconciled during nightly cron
2026-07-22 17:06:10 -04:00
johnnyq
08334b22c3
Add Stripe fee reconciliation to cron
...
Balance transactions aren't always attached when a payment completes,
so the fee expense can be skipped at payment time. Daily cron pass now
finds recent Stripe payments with no matching fee expense and records
the actual fee once available. Dedupes by expense reference prefix,
30-day lookback.
2026-07-22 16:47:28 -04:00
johnnyq
f4b1b6585b
Move Expense block for Stripe after intent
2026-07-22 16:16:40 -04:00
johnnyq
66b38b7f19
Get Expense from Stripe instead of Static Entry
2026-07-22 16:07:39 -04:00
johnnyq
54e2005224
Icon change for Mail Queue
2026-07-21 14:18:33 -04:00
johnnyq
d5a1305192
Reorg Admin Side nav menu
2026-07-21 14:17:16 -04:00
johnnyq
4bb497ea9c
Reorganize Client Side nav and the renamed Client overview to All Client Docs side nav
2026-07-21 13:43:56 -04:00
johnnyq
97ab1df762
Feature: Add Transactions, reorg Main side nav
2026-07-21 13:21:23 -04:00
johnnyq
058e31c290
Fix Truncated Client name in side nav needs to be truncated before escaped
2026-07-20 19:31:31 -04:00
johnnyq
d173357b51
Add Bulk and Single Refresh certificate Actions
2026-07-20 19:14:38 -04:00
johnnyq
e134c89c3a
Add Bulk and Single Refresh Domain Actions
2026-07-20 18:54:01 -04:00
johnnyq
a35ef025dc
Add Expiring in Filter Field to assets, licenses, domains and certificate and wire that into the dashboard as well
2026-07-20 18:25:44 -04:00
johnnyq
ce0a62b0c3
Add Expiring Asset Warranties and Liceneses to the Dashboard
2026-07-20 17:45:03 -04:00
johnnyq
1a3d7a1e0d
Bump ImapEngine from 1.25.1 to 1.25.2
2026-07-18 11:17:53 -04:00
johnnyq
9cc7e5ff3c
Move Guest Function formatBytes to root shared functions and use in files and files section in contact
2026-07-16 20:25:18 -04:00
johnnyq
113d6220bb
Add back missing function call
2026-07-16 19:32:52 -04:00
johnnyq
e40926c08d
Restore native DNS/RDAP domain lookups (lost in functions.php split)
...
getDnsRecords and getDomainExpirationDate had regressed to shell_exec
(dig/whois) when domain code was moved into functions/domain.php; the
RDAP helper stack was dropped entirely. Restores the dns_get_record +
RDAP + port-43-socket-whois implementation from d1e1609b
2026-07-16 19:30:38 -04:00
johnnyq
e11d8f3252
Harden checkFileUpload: drop content hashing for random storage names
...
Replace md5(file_contents)+randomString(2) naming with randomString(32).
No longer reads the file into memory (removes file_get_contents), so
validation is O(1) regardless of size or upload count. Add is_uploaded_file()
and UPLOAD_ERR_OK checks, use pathinfo() for extension extraction, and
return false consistently on all failures (oversize previously returned a
truthy error string that callers treated as a valid filename).
2026-07-16 19:18:08 -04:00
johnnyq
41d029937a
More Client Scoping fixes
2026-07-16 14:29:23 -04:00
