9 Commits

Author	SHA1	Message	Date
johnnyq	e29369926f	Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated	2026-10-17 12:05:55 -04:00
johnnyq	156c51224d	Fix client portal review findings: PIN wipe, log indexing, statement currency (db 2.7.8) ... Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising. Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it. New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable. Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement. Quick Send asks for confirmation; confirm-link extended to submit buttons. Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.	2026-08-28 16:38:42 -04:00
johnnyq	10fb40f36f	Feature: Major spruce up of the client portal profile page, added Department, Location, Title, Phone with Edit, editing Pin, Recent signins and recent activity along with a seperate activity page	2026-08-28 16:08:23 -04:00
johnnyq	a084e37c39	Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5	2026-08-14 13:22:11 -04:00
johnnyq	b3f959ac55	Use Short echo tags across the code	2026-07-28 18:47:52 -04:00
johnnyq	7bc47a58fe	Replace Function nullable_htmlentities() with just escapeHtml() and update all instances throughout	2026-07-14 17:10:45 -04:00
johnnyq	8de7b20ba1	Add CSRF Checks in the client portal	2026-03-07 13:11:08 -05:00
wrongecho	30499123f1	Bugfix: Portal not showing contact user id in session	2026-01-09 13:50:46 +00:00
johnnyq	5f76a7989b	Move portal to client and rename and reorganize some client portal files	2025-01-23 17:12:11 -05:00