Merge pull request #1263 from itflow-org/develop

Develop to Master for 26.02 Release Take 2

.gitignore

@@ -4,8 +4,16 @@ config.php
 uploads/favicon.ico
 uploads/clients/*
 !uploads/clients/index.php
+uploads/custom/*
+!uploads/custom/index.php
+uploads/documents/*
+!uploads/documents/index.php
+uploads/document_templates/*
+!uploads/document_templates/index.php
 uploads/expenses/*
 !uploads/expenses/index.php
+uploads/recurring_tickets/*
+!uploads/recurring_tickets/index.php
 uploads/settings/*
 !uploads/settings/index.php
 uploads/users/*
@@ -14,6 +22,8 @@ uploads/tmp/*
 !uploads/tmp/index.php
 uploads/tickets/*
 !uploads/tickets/index.php
+uploads/ticket_templates/*
+!uploads/ticket_templates/index.php
 .idea/*
 plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/HTML/*
 !plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/HTML/.gitkeep
@@ -22,9 +32,20 @@ plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/URI/*
 plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/*
 !plugins/htmlpurifier/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/.gitkeep
 .vscode/settings.json
-xcustom/*
+admin/custom/*
-!xcustom/readme.php
+!admin/custom/readme.php
-post/xcustom
+agent/custom/*
-custom/*
+!agent/custom/readme.php
-!post/xcustom/readme.php
+client/custom/*
+!client/custom/readme.php
+guest/custom/*
+!guest/custom/readme.php
+cron/custom/*
+!cron/custom/readme.php
+scripts/custom/*
+!scripts/custom/readme.php
+setup/custom/*
+!setup/custom/readme.php
+api/v1/custom/*
+!api/v1/custom/readme.php
 .zed

CHANGELOG.md

@@ -2,6 +2,329 @@
 
 This file documents all notable changes made to ITFlow.
 
+## [26.02] Stable Release
+### Bug Fixes
+- Mail Parser - Do not automatically send new ticket notifications to noreply/donotreply addresses.
+- Ticket: removed newline \n on Parsed emails.
+- Show Trips for everyone if accounting module is enabled.
+- Fix Invoice Exporting.
+- Fix Billable Column not sorting correctly in tickets.
+- Fix Login flow where user agent and client user exists and agent has MFA but will not let them continue.
+- Fix passing missing user_id var in client portal.
+- Fix Ticket Templates not auto filling when selected.
+- Fix Invoices not being sent to all billings contacts when manaully sent.
+- Fix Documents and Files not able to be bulk deleted.
+- Fix Role Archiving, can be archived as long as no users are assigned to the role.
+- Fix showing Powered By ITFlow visibility on the login screen when Whitelabel is enabled.
+- Missing username in audit log on successful login due to missing passed user_id to logging.
+- API: Fix updating all documents instead of the intended document.
+- Documents: Fix Document created at not showing the correct creation date of the master document.
+- Ticket: Fixed Using edit ticket modal agent was not able to be set.
+- Always check if a user is archived and or disabled instead of just during login.
+- Report: Fix Collected tax report not totalling all tax categories.
+
+### New Features & Updates 
+- Task Approval System for ticket tasks: Once an approval is requested, the task cannot be marked as complete until approved. Internal Approvals Any other technician, or Specific technician, Client Approvals Anyone (usually the requestor) Tech contacts Billing contacts.
+- Printable Invoice Packing Slips now available.
+- Drastic Performance Bump: Up to 50% faster queries accross the board and reduced server memory usage by 40% by switching Database Query method from mysqli_fetch_array to mysqli_fetch_assoc.
+- Added Connect to Microsoft 365 Button to mail settings.
+- OAUTH2 support for Microsoft 365 and Google Workspaces is now considered stable and working.
+- Favorites: Assets and Credentials now can be favorited singly or by Bulk action. Favorited items appear in the client overview now.
+- Files/Documents: Collapsable folders feature, collapsed by default with a button to expand all.
+- URL Keys and such are now set to a more manageable 32 Characters by default.
+- Various UI/UX Updates throughout the app, with focus oin ticket details, contact details modal etc.
+- Added Show Archived files and documents to the files section.
+- Added Bulk Archive and restore options to files and documents.
+- Rewrite of the Kanban Ticket view to match our procedural style of coding.
+- All options are available in TinyMCE now in Mobile mode.
+- Agent names appear now in Invoice History section.
+- Mail Parser: Support flowed text.
+- Assets: Keep Purchase reference when copying.
+- Assets: Add basic tracking history: Archiving, restoring, name changes, transferimg to new clients.
+- Mail Parser: NDR Parsing.
+- Allow SVG files in mail attachments.
+- Tickets: Use a more friendly time worked instead of 02:41:00 translates to 2h 41m.
+- Update wording on ticket to invoice item details.
+- Merge Tickets: Now wth a ticket merge dropdown list of tickets instead of a text field.
+- Role Permissions can now be set during role creation, update Permission UI to use radio buttons instead of select boxes.
+- Bump TinyMCE 8.2.2 to 8.3.2.
+- Bump PHPMailer from 7.0.1 to 7.0.2.
+- Bump Datatables from 2.3.4 to 2.3.7.
+
+## [25.12.1] Maint Release
+
+### Major Changes
+- Unified the Client/Agent Login and process (Note only Client Users can Reset passwords from the login page, does not apply to agent users).
+
+### Bug Fixes
+- Fix Payment Provider not adding an account.
+- Fix New ticket button in contact details in the related tickets section.
+
+### New Features & Updates
+- You can now Set Payment Provider income/expense account, expense vendor and expense category upond creation or editing.
+- Moved Saved Payment Provider Methods away from admin side nav to the count link within Payment Providers page.
+- Moved AI Models from the admin side nav to the model count link within AI Providers.
+- Add Favicon Reset.
+
+## [25.12] Stable Release
+
+### Breaking Changes ###
+- For Existing installs: **php-xml** extension needs to be installed for document creation and editing, new install script does this for you as of Dec 6th 2025. To install php-xml: `sudo apt install php-xml`
+
+### Major Changes
+- Consolidated "Files" and "Documents" into a single section called **Files**.
+
+### Bug Fixes
+- Resolved issue with updating asset notes in asset details.
+- Fixed problem with bulk ticket merging.
+- Corrected issue where decimal inputs (e.g., price, cost) weren’t displaying on iPhones in certain forms.
+- Added CSV escaping to the sample export data in areas where a sample CSV template is provided.
+- Fix a race condition where dupe tickets, invoices, recurring invoices, recurring tickets, quotes will be created using the same number if created in parallel espcecially when using the API.
+
+### New Features & Updates
+- Introduced automatic subject-based ticket merging/reply detection. Now, if an email comes from a known contact or domain and the subject matches 95% of a ticket opened in the last 7 days, it will be merged automatically.
+- Added `cleanInput` function to sanitize data before inserting it into the database when using MySQLi prepared statements.
+- Migrated client post functionality to use MySQLi prepared statements.
+- Updated payment method post functionality to use MySQLi prepared statements.
+- Implemented `saveBase64Images()` to convert base64-encoded `<img>` tags into actual image files stored under `/uploads/<module>/<id>/` with secure filenames. Added wrapper functions, and updated document creation to use processed image paths.
+- For new documents and document templates, images are now stored in `/uploads/documents/$document_id` instead of being stored as base64 in the database, using the `saveBase64Images()` function.
+- UI/UX improvements made to the document details page.
+- Removed sidebar quick-add options.
+- Created new folders in the uploads directory: `documents`, `document_templates`, and `recurring_tickets`.
+- Reworked the bulk action function to pass the name arrays, instead of a generic `selected_ids` array. This allows multiple bulk name arrays to be passed at once, currently used for the new file-document merge.
+- Big task: Converted the remaining modals to use the new `ajax-modal` system, enabling more flexible flow expansion going forward.
+- Mail queue: Added a `--no-mx-validation` flag to bypass recipient domain MX validation.
+- Bump PHPMailer from 7.0.0 to 7.0.1.
+- Bump stripe-php from 18.1.0 to 19.0.0.
+- Bump TCPDF from 6.10.0 to 6.10.1.
+- Bump TinyMCE from 8.2.0 to 8.2.2.
+
+## [25.11.1] Maint Release
+
+### Fixes
+- Fix broken edit Payment Method.
+- Fix unable to delete Vendor Template.
+- Fix Mail Queue link in flash alert for testing email and sending a quote.
+- Add Show Category Type select if not defined.
+- Add Show Product Type select if not defined.
+- Fix add ticket watcher.
+- Fix if Client isn't assigned to a ticket dont show client view.
+- Fix missing session client id check when paying an invoice from client portal.
+- Update Composer Webklex-IMAP library dependency symfony/http-foundation from 7.3.3 to 7.3.7 to fix security related issues.
+- Add back delete Payment provider the database will handle cascade deletes to saved cards, recurring payments and client payment provider reference.
+- Don't show Client Tickets Breadcrumb if no client is assigned to a ticket.
+- Don't Show Contact or Assignment Tab in edit ticket if no Client is Assigned.
+- Don't Show add contact, asset, vendor, watcher if not client is assigned to a ticket.
+- Don't Show Public Comment & Email if contact email doesn't exist.
+- Fixed IMAP Test whicn now uses RAW TCP Connection instead of the depracated php-imap extension.
+- Fix Broken Link in Ticket Updates via Client Portal to agent.
+
+### Added / Changed
+- [Feature] Added Asset Tags.
+- [Feature] Added Quick Add Links to most side bar navs example quickly add a client from sidebar.
+- Migrate ticket template add to ajax modal.
+- Add TOTP secret to Client Export PDF in Credential section.
+- Add UserID on hover in users listing.
+- Merge ticket now redirects to the new ticket details page.
+- [Feature] Add Pay via saved card under invoice Listings.
+- Ticket Related Side Items UI Cleanup to use btn-tool class. 
+
+## [25.11] Stable
+
+### Deprecation Notice:
+- **Outdated CRON Scripts**: The following scripts are removed.
+  - `/scripts/cron_mail_queue.php`
+  - `/scripts/cron_ticket_email_parser.php`
+  - `/scripts/cron.php`
+  - `/scripts/cron_domain_refresher.php`
+  - `/scripts/cron_certificate_refresher.php`
+  
+  **Action Required**: Transition to the new versions:
+  - `/cron/mail_queue.php`
+  - `/cron/ticket_email_parser.php`
+  - `/cron/cron.php`
+  - `/cron/domain_refresher.php`
+  - `/cron/certificate_refresher.php`
+
+- PHP Extensions php-imap and php-mime-mail-parser are no longer required.
+---
+
+### Fixes
+- **Ticket Listing**: Resolved issue where the “Check All” checkbox was visible even when ticket status wasn’t set. Now hidden for closed tickets only.
+- **Timer Auto-Start**: Show H/M/S placeholders when timer auto-start is disabled.
+- **Ticket Guest URL**: Fixed email not including the ticket guest URL key.
+- **EML Generation**: Resolved issue with EML not being generated in the new ticket parser.
+- **New Ticket Mail Notification**: Included message when notifying the tech of a reply in the new ticket mail parser.
+- **Advanced Filter Collapse**: Added clause to prevent collapse of advanced filters when the “from” date is set to the default (1970-01-01).
+- **Recurring Invoice**: Fixed issue where email was marked as sent but not actually sent when forcing a recurring invoice to an invoice.
+- **CSRF Token**: Fixed issue with deleting recurring ticket from asset details page due to missing CSRF check token.
+- **Vendor Website Link**: Fixed missing `https://` prefix in the vendor website link on the vendor details modal.
+- **Agent Select Box**: Resolved issue where agents sometimes didn’t appear in the agent select boxes.
+- **TinyMCE**: Fixed TinyMCE editor issue on Bulk Create Ticket in Assets.
+- **Ticket Timer**: Fixed ticket timer initialization after reload and when the tab is put to sleep (background tab).
+- **Client Deletion**: Fixed issue with client deletion.
+- **Domain Records**: Added flag for missing SOA record when adding a domain (prevents subdomain creation).
+- **Domain Fetching**: Quits domain record fetching if no SOA record exists (prevents subdomains).
+- **Domain Expiry**: Only show time to expiry when there’s an expiry date set; otherwise, display a dash.
+- **Certificates**: Improved handling of empty date in the agent UI.
+- **Certificates API**: Fixed bug with missing JS to fetch certificate details.
+- **API Updates**:
+  - Clients API: Added support for archiving/un-archiving clients, updating client data, and abbreviation support.
+  - Contacts API: Added archiving/un-archiving and restriction to only allow one primary contact per client.
+  - Mail Queue: Added recipient domain MX validation before sending emails.
+
+---
+
+### Added / Changed
+- **Backup / Restore**: Improved backup and restore by streaming data to disk (to prevent memory issues), setting unlimited timeouts, checking for bad backup contents, and using PHP for DB import instead of shell exec. Added `.htaccess` to prevent PHP execution in `/uploads/` directory.
+- **Ajax Modals**: Migrated all Add and Bulk modals to the new Ajax Modal for improved performance.
+- **Recurring Ticket Sorting**: Default sorting of recurring tickets by `RunDate` instead of subject.
+- **Recurring Ticket Enhancements**:
+  - Added Billable column.
+  - Added bulk actions for setting priority, agent, billable status, and next run dates.
+  - Added filters for category, assigned agent, and billable status.
+  - Added new frequency options: 3-day and biweekly.
+- **Asset Select**: Updated asset select dropdown to separate asset types using opt groups (planned for wider use).
+- **Expiring Domains & Certificates**: Added "30 Day" warning for expiring domains and certificates in the dashboard.
+- **Ticket Search**: Allowed search using both ticket prefix and number.
+- **Recurring Invoice**: Cancel recurring invoices when the associated client is archived.
+- **Credentials Import/Export**: Now includes TOTP secrets when importing/exporting credentials.
+- **Asset Notes Import**: Allowed importing of asset notes.
+- **Ticket View**: Added a "View HTML Code" button in all ticket views for TinyMCE.
+- **Date Range Picker**: Updated all date filters to use the improved DateRangePicker JS.
+- **Bulk Ticket Creation**: Added bulk ticket creation for clients.
+- **Sidebar Updates**: Updated all sidebars to use absolute paths for easier integration with custom code.
+- **Document Actions**: Added Archive and Delete buttons to the Document Details view with improved redirect behavior.
+- **Ticket Template Sorting**: Allowed sorting by task count in ticket templates.
+- **Contact Modal UI**: Updated contact details modal to display contact information at the top.
+- **API & Code Updates**: 
+  - Separated out post files for recurring tickets, invoices, expenses, and payments.
+  - Removed unused budget code.
+- **Invoice Product Autocomplete**: Now allows searching for product codes as well as names.
+- **Client Duplicate Check**: Flags duplicate clients or leads when using the client add modal.
+- **Recurring Invoice Reference**: Added a column to invoices indicating if they were created from a recurring invoice.
+- **Global Search Enhancements**: 
+  - Allowed ticket details to be searchable in global search.
+  - Allowed searching for quotes in global search.
+- **UI/UX Improvements**:
+  - Spruced up the ticket details page UI.
+  - Added contact email validation to flag duplicates or invalid addresses.
+- **API Debugging**: Log API endpoint/URL path for authentication failures to aid in debugging.
+- **Image Upload Optimization**: Removed image optimization from uploads (this will be handled by a cron job in the future).
+- **View Behavior Change**: Updated ticket/invoice/quote views to always be in the Client section, showing client-side navigation and top info bar.
+
+---
+
+### Library Updates:
+- **DataTable**: Bumped from 2.3.3 to 2.3.4.
+- **TinyMCE**: Bumped from 8.0.2 to 8.2.0.
+- **Stripe-PHP**: Bumped from 17.6.0 to 18.1.0.
+- **PHPMailer**: Bumped from 6.10.0 to 7.0.0.
+- **Chart.js**: Bumped from 4.5.0 to 4.5.1.
+
+
+
+
+## [25.10.1]
+- Deprecation Notice: `/scripts/cron_mail_queue.php` , `/scripts/cron_ticket_email_parser.php` , `/scripts/cron.php` `/scripts/cron_domain_refresher.php`, `/scripts/cron_certificate_refresher.php` are being phased out. Please transition to `/cron/mail_queue.php` , `/cron/ticket_email_parser.php`, `/cron/cron.php`, `/cron/domain_refresher.php`, `/cron/certificate_refresher.php` These older scripts will be removed in the November 25.11 release—update accordingly. 25.10.1 installs have the script already configured.
+
+### Fixes
+- Fix regression missing custom Favicon.
+- Update SMTP and IMAP provider to allow for empty strings, empty means disabled.
+- Fix Client portal Microsoft SSO Logins.
+- Fix regression in Vendor Templates.
+- Fix refression in some broken links from user to agent.
+- Fix Project edit.
+- Prevent open redirects upon agent login.
+- Fix regression on switching to Webklex IMAP to allow for no SSL/TLS in IMAP.
+- Fix Setup Redirect not behaving properly when setup hasnt been performed.
+- Added Server Document Root Var to several includes, headers, footers files to allow includes from deeper directory strutures such as the new custom directories.
+- Fix edit contact in contact details.
+- Add .htaccess to /cron/.
+
+### Added / Changed
+- Support for HTML Signatures.
+- Add Edit Project Functionality in a ticket.
+- Added more custom locations: /cron/custom/, /scripts/custom/, /api/v1/custom/, /setup/custom/.
+- Copied `/scripts/cron.php` `/scripts/cron_domain_refresher.php`, `/scripts/cron_certificate_refresher.php` to `/cron/cron.php`, `/cron/domain_refresher.php`, `/cron/certificate_refresher.php`. See Above!
+- Signatures is now handled in post ticket reply on Public Comments only.
+
+## [25.10]
+
+### Breaking Changes
+- Renamed `/user/` directory to `/agent/`.
+- Deprecation Notice: `/scripts/cron_mail_queue.php` and `/scripts/cron_ticket_email_parser.php` are being phased out. Please transition to `/cron/mail_queue.php` and `/cron/ticket_email_parser.php`. These older scripts will be removed in the November release—update accordingly. New Installs via the script will have this already configured.
+- Custom is working now. Custom code should be placed in /admin/custom/ , /agent/custom/ , /client/custom/ /guest/custom/
+We will provide example code with directory structure for each custom directory a week after this release.
+
+### Fixes
+- Resolved issue with "Restore from Setup" not functioning correctly.
+- Corrected asset name display in logs and flash messages when editing an asset in a ticket.
+- Fixed Payment Provider Threshold not being applied.
+- Fixed issue where Threshold setting was not saving properly.
+- Various minor fixes for Payment Provider issues.
+- Removed leads from the client selection list in the "New Ticket" modal.
+- Fixed issues with the MFA modal.
+- Resolved MFA enforcement bugs.
+- Fixed KeepAlive functionality to maintain user sessions longer.
+- Fixed multiple broken links caused by the `/user/` to `/agent/` path migration.
+- Fixed Custom code directories.
+
+### Added / Changed
+- Removed "ACH" as a payment method; added "Bank Transfer" instead.
+- Replaced relative paths with absolute paths for web assets.
+- Tickets can now be resolved via the API.
+- Added a filter for Archived Users and an option to restore them.
+- Introduced a modal when archiving users, allowing reassignment of open and recurring tickets to another agent.
+- Improved logic for determining the index/root page.
+- Added "Assigned Agent" column for recurring tickets.
+- Introduced "Additional Assets" option when editing assets in tickets; modal now uses the updated AJAX method.
+- Added Gibraltar to the list of supported countries.
+- Added Custom Link Option for the Admin Nav.
+- Added Custom Link Option for the Reports Nav.
+
+### Other notes
+- Major releases will happen on the first week of every Month.
+
+
+## [25.09.2]
+
+### Fixes
+- Fix Payment Method Select box in Revenue.
+- Remove Extra Feeback Wording When Invoice Sends.
+- Updated all CSV exports to use escape parameters.
+- Fix Missing First row on Asset interface export.
+- Fix Edit User not working due to incorrect modal footer path.
+- Fix Add Certificate breaking due spelling on function.
+- Update all CSV Exports to include company name or client name depending on when its being exported from.
+- Introduced new function sanitize_filename and implmented it in all exports.
+- Spruced up UI/UX Saved Paymented section in Client Portal.
+- Fix add Payment Link in client portal recurring invoice section.
+- Better Logic handling for default page redirect.
+
+### Features
+- Introduced new Beta mail parser cron using webklex imap library instead of php-imap as this is deprecated --Not Enabled on existing installs, only new installs.
+- Introduced Beta support for OAUTH2 Authentication for Microsoft 365 and Google Workspaces for both incoming ticket parsing and outgoing email but must use new mail parser and mail queue for this to work, and requires changing the cron jobs: scripts/cron_mail_queue.php to cron/mail_queue.php and scripts/cron_ticket_email_parser.php to cron/ticket_email_parser.php.
+
+---
+
+## [25.09.1]
+
+### Fixes
+- **Web Installer**: Resolved issue with broken installer caused by incorrect database schema file name.
+- Hide the "Add Credit" button as the feature is not fully implemented yet.
+- Corrected long invoice/quote notes that were overlapping with the footer in PDF exports.
+- Fixed AI settings not appearing in the Admin Menu when the Billing module was disabled.
+- Enabled wrapping of client tags when they are too long.
+- Fixed an issue where AI was not functioning correctly.
+- Removed extra spacing between the contact name and icon in the Ticket Details contact card.
+
+### Features
+- Redesigned **AI Ticket Summary**, now divided into 3 sections: Main Issue, Actions Taken, and Resolution/Next Steps.
+- Updated the **AI Ticket Summary** prompt to include ticket status, reply author, source, category, and priority.
+
+---
+
 ## [25.09]
 
 ***BACK UP*** before updating.
@@ -60,7 +383,7 @@ This file documents all notable changes made to ITFlow.
 ---
 
 ### Fixed
-- Several security vulnerabilities patched.
+- Several security vulnerabilities patched (with thanks to www.helx.io).
 - Ticket status is no longer updated when scheduling.
 - Client Portal: Tech contacts can no longer edit their own details.
 - Fixed overlapping logo issue in Invoice/Quote PDF exports.

README.md

@@ -16,7 +16,7 @@
     <br />
     <a href="https://demo.itflow.org"><strong>View demo</strong></a>
     <br />
-    Username: <b>demo@demo</b> | Password: <b>demo</b>
+    Username: <b>demo@demo.com</b> | Password: <b>demo</b>
     <br />
     <br />
     <a href="https://itflow.org/#about">About</a>
@@ -93,6 +93,7 @@ If you want to improve ITFlow, feel free to fork the repo and create a pull requ
 We’re incredibly grateful to the organizations and individuals who support the project - a big thank you to:
 - CompuMatter
 - F1 for HELP
+- digiBandit
 - JetBrains (PhpStorm)
 
 ## License

SECURITY.md

@@ -13,7 +13,7 @@ We operate a rolling release model. Any bug fixes will be released into latest v
 
 | Version | Supported          |
 |---------| ------------------ |
-| 25.05   | :white_check_mark: |
+| 25.12   | :white_check_mark: |
 
 ## Reporting a Vulnerability via GitHub Security Advisories
 

admin/ai_model.php

@@ -12,11 +12,21 @@ $num_rows = mysqli_num_rows($sql);
 
 ?>
 
+<ol class="breadcrumb d-print-none">
+    <li class="breadcrumb-item">
+        <a href="/admin">Admin</a>
+    </li>
+    <li class="breadcrumb-item">
+        <a href="ai_provider.php">AI Providers</a>
+    </li>
+    <li class="breadcrumb-item active">AI Models</li>
+</ol>
+
 <div class="card card-dark">
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-robot mr-2"></i>AI Models</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addAIModelModal"><i class="fas fa-plus mr-2"></i>Add Model</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/ai/ai_model_add.php"><i class="fas fa-plus mr-2"></i>Add Model</button>
         </div>
     </div>
     <div class="card-body">
@@ -48,7 +58,7 @@ $num_rows = mysqli_num_rows($sql);
                 <tbody>
                 <?php
 
-                while ($row = mysqli_fetch_array($sql)) {
+                while ($row = mysqli_fetch_assoc($sql)) {
                     $provider_id = intval($row['ai_provider_id']);
                     $provider_name = nullable_htmlentities($row['ai_provider_name']);
                     $model_id = intval($row['ai_model_id']);
@@ -104,5 +114,4 @@ $num_rows = mysqli_num_rows($sql);
 </div>
 
 <?php
-require_once "modals/ai/ai_model_add.php";
 require_once "../includes/footer.php";

admin/ai_provider.php

@@ -16,7 +16,7 @@ $num_rows = mysqli_num_rows($sql);
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-robot mr-2"></i>AI Providers</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addAIProviderModal"><i class="fas fa-plus mr-2"></i>Add Provider</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/ai/ai_provider_add.php"><i class="fas fa-plus mr-2"></i>Add Provider</button>
         </div>
     </div>
     <div class="card-body">
@@ -39,7 +39,7 @@ $num_rows = mysqli_num_rows($sql);
                             Key <?php if ($sort == 'ai_provider_api_key') { echo $order_icon; } ?>
                         </a>
                     </th>
-                    <th>
+                    <th class="text-center">
                         <a class="text-dark">Models</a>
                     </th>
                     <th class="text-center">Action</th>
@@ -48,7 +48,7 @@ $num_rows = mysqli_num_rows($sql);
                 <tbody>
                 <?php
 
-                while ($row = mysqli_fetch_array($sql)) {
+                while ($row = mysqli_fetch_assoc($sql)) {
                     $provider_id = intval($row['ai_provider_id']);
                     $provider_name = nullable_htmlentities($row['ai_provider_name']);
                     $url = nullable_htmlentities($row['ai_provider_api_url']);
@@ -67,7 +67,8 @@ $num_rows = mysqli_num_rows($sql);
                         </td>
                         <td><?php echo $url; ?></td>
                         <td><?php echo $key; ?></td>
-                        <td><?php echo $ai_model_count; ?></td>
+                        <td class="text-center">
+                            <a class="badge badge-dark badge-pill p-2" href="ai_model.php"><?= $ai_model_count ?></a>
                         <td>
                             <div class="dropdown dropleft text-center">
                                 <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
@@ -105,5 +106,4 @@ $num_rows = mysqli_num_rows($sql);
 </div>
 
 <?php
-require_once "modals/ai/ai_provider_add.php";
 require_once "../includes/footer.php";

admin/api_keys.php

@@ -18,11 +18,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
 ?>
 
-    <div class="card card-dark">
+<div class="card card-dark">
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-key mr-2"></i>API Keys</h3>
         <div class="card-tools">
-                <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addApiKeyModal"><i class="fas fa-plus mr-2"></i>Create</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/api/api_key_add.php"><i class="fas fa-plus mr-2"></i>New API Key</button>
         </div>
     </div>
 
@@ -49,7 +49,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             <div class="dropdown-menu">
                                 <button class="dropdown-item text-danger text-bold"
                                         type="submit" form="bulkActions" name="bulk_delete_api_keys">
-                                        <i class="fas fa-fw fa-trash mr-2"></i>Revoke
+                                    <i class="fas fa-fw fa-trash mr-2"></i>Delete
                                 </button>
                             </div>
                         </div>
@@ -105,7 +105,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     <tbody>
                     <?php
 
-                        while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $api_key_id = intval($row['api_key_id']);
                         $api_key_name = nullable_htmlentities($row['api_key_name']);
                         $api_key_secret = nullable_htmlentities("************" . substr($row['api_key_secret'], -4));
@@ -128,26 +128,27 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                     <input class="form-check-input bulk-select" type="checkbox" name="api_key_ids[]" value="<?php echo $api_key_id ?>">
                                 </div>
                             </td>
-
                             <td class="text-bold"><?php echo $api_key_name; ?></td>
-
                             <td><?php echo $api_key_client; ?></td>
-
                             <td><?php echo $api_key_secret; ?></td>
-
                             <td><?php echo $api_key_created_at; ?></td>
-
                             <td><?php echo $api_key_expire; ?></td>
-
                             <td>
                                 <div class="dropdown dropleft text-center">
                                     <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
                                         <i class="fas fa-ellipsis-h"></i>
                                     </button>
                                     <div class="dropdown-menu">
-                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                        <?php if ($api_key_expire > date("Y-m-d H:i:s")) { ?>
+                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?revoke_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
                                                 <i class="fas fa-fw fa-times mr-2"></i>Revoke
                                             </a>
+                                        <?php } ?>
+                                        <?php if ($api_key_expire < date("Y-m-d H:i:s")) { ?>
+                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                                <i class="fas fa-fw fa-times mr-2"></i>Delete
+                                            </a>
+                                        <?php } ?>
                                     </div>
                                 </div>
                             </td>
@@ -162,15 +163,11 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
             </form>
 
         </div>
-            <?php require_once "../includes/filter_footer.php";
+        <?php require_once "../includes/filter_footer.php"; ?>
- ?>
-        </div>
     </div>
+</div>
 
-    <script src="../js/bulk_actions.js"></script>
+<script src="../js/bulk_actions.js"></script>
 
 <?php
-require_once "modals/api/api_key_add.php";
-
 require_once "../includes/footer.php";
-

admin/app_log.php

@@ -66,7 +66,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                                 <?php
                                 $sql_types_filter = mysqli_query($mysqli, "SELECT DISTINCT app_log_type FROM app_logs ORDER BY app_log_type ASC");
-                                while ($row = mysqli_fetch_array($sql_types_filter)) {
+                                while ($row = mysqli_fetch_assoc($sql_types_filter)) {
                                     $log_type = nullable_htmlentities($row['app_log_type']);
                                 ?>
                                     <option <?php if ($type_filter == $log_type) { echo "selected"; } ?>><?php echo $log_type; ?></option>
@@ -85,7 +85,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                                 <?php
                                 $sql_categories_filter = mysqli_query($mysqli, "SELECT DISTINCT app_log_category FROM app_logs ORDER BY app_log_category ASC");
-                                while ($row = mysqli_fetch_array($sql_categories_filter)) {
+                                while ($row = mysqli_fetch_assoc($sql_categories_filter)) {
                                     $log_category = nullable_htmlentities($row['app_log_category']);
                                 ?>
                                     <option <?php if ($category_filter == $log_category) { echo "selected"; } ?>><?php echo $log_category; ?></option>
@@ -97,34 +97,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         </div>
                     </div>
                 </div>
-                <div class="collapse mt-3 <?php if (!empty($_GET['dtf']) || $_GET['canned_date'] !== "custom" ) { echo "show"; } ?>" id="advancedFilter">
+                <div class="collapse mt-3 <?php if (isset($_GET['dtf']) && $_GET['dtf'] !== '1970-01-01') { echo "show"; } ?>" id="advancedFilter">
                     <div class="row">
-                        <div class="col-md-2">
+                        <div class="col-md-3">
                             <div class="form-group">
-                                <label>Canned Date</label>
+                                <label>Date range</label>
-                                <select onchange="this.form.submit()" class="form-control select2" name="canned_date">
+                                <input type="text" id="dateFilter" class="form-control" autocomplete="off">
-                                    <option <?php if ($_GET['canned_date'] == "custom") { echo "selected"; } ?> value="">Custom</option>
+                                <input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
-                                    <option <?php if ($_GET['canned_date'] == "today") { echo "selected"; } ?> value="today">Today</option>
+                                <input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
-                                    <option <?php if ($_GET['canned_date'] == "yesterday") { echo "selected"; } ?> value="yesterday">Yesterday</option>
+                                <input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
-                                    <option <?php if ($_GET['canned_date'] == "thisweek") { echo "selected"; } ?> value="thisweek">This Week</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastweek") { echo "selected"; } ?> value="lastweek">Last Week</option>
-                                    <option <?php if ($_GET['canned_date'] == "thismonth") { echo "selected"; } ?> value="thismonth">This Month</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastmonth") { echo "selected"; } ?> value="lastmonth">Last Month</option>
-                                    <option <?php if ($_GET['canned_date'] == "thisyear") { echo "selected"; } ?> value="thisyear">This Year</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastyear") { echo "selected"; } ?> value="lastyear">Last Year</option>
-                                </select>
-                            </div>
-                        </div>
-                        <div class="col-md-2">
-                            <div class="form-group">
-                                <label>Date From</label>
-                                <input onchange="this.form.submit()" type="date" class="form-control" name="dtf" max="2999-12-31" value="<?php echo nullable_htmlentities($dtf); ?>">
-                            </div>
-                        </div>
-                        <div class="col-md-2">
-                            <div class="form-group">
-                                <label>Date To</label>
-                                <input onchange="this.form.submit()" type="date" class="form-control" name="dtt" max="2999-12-31" value="<?php echo nullable_htmlentities($dtt); ?>">
                             </div>
                         </div>
                     </div>
@@ -160,7 +141,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $log_id = intval($row['app_log_id']);
                         $log_type = nullable_htmlentities($row['app_log_type']);
                         $log_category = nullable_htmlentities($row['app_log_category']);

admin/audit_log.php

@@ -88,7 +88,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                                 <?php
                                 $sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
-                                while ($row = mysqli_fetch_array($sql_clients_filter)) {
+                                while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
                                     $client_id = intval($row['client_id']);
                                     $client_name = nullable_htmlentities($row['client_name']);
                                 ?>
@@ -108,7 +108,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                                 <?php
                                 $sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
-                                while ($row = mysqli_fetch_array($sql_users_filter)) {
+                                while ($row = mysqli_fetch_assoc($sql_users_filter)) {
                                     $user_id = intval($row['user_id']);
                                     $user_name = nullable_htmlentities($row['user_name']);
                                 ?>
@@ -128,7 +128,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                                 <?php
                                 $sql_types_filter = mysqli_query($mysqli, "SELECT DISTINCT log_type FROM logs ORDER BY log_type ASC");
-                                while ($row = mysqli_fetch_array($sql_types_filter)) {
+                                while ($row = mysqli_fetch_assoc($sql_types_filter)) {
                                     $log_type = nullable_htmlentities($row['log_type']);
                                 ?>
                                     <option <?php if ($type_filter == $log_type) { echo "selected"; } ?>><?php echo $log_type; ?></option>
@@ -147,7 +147,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                                 <?php
                                 $sql_actions_filter = mysqli_query($mysqli, "SELECT DISTINCT log_action FROM logs ORDER BY log_action ASC");
-                                while ($row = mysqli_fetch_array($sql_actions_filter)) {
+                                while ($row = mysqli_fetch_assoc($sql_actions_filter)) {
                                     $log_action = nullable_htmlentities($row['log_action']);
                                 ?>
                                     <option <?php if ($action_filter == $log_action) { echo "selected"; } ?>><?php echo $log_action; ?></option>
@@ -159,34 +159,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         </div>
                     </div>
                 </div>
-                <div class="collapse mt-3 <?php if (!empty($_GET['dtf']) || $_GET['canned_date'] !== "custom" ) { echo "show"; } ?>" id="advancedFilter">
+                <div class="collapse mt-3 <?php if (isset($_GET['dtf']) && $_GET['dtf'] !== '1970-01-01') { echo "show"; } ?>" id="advancedFilter">
                     <div class="row">
-                        <div class="col-md-2">
+                        <div class="col-md-3">
                             <div class="form-group">
-                                <label>Canned Date</label>
+                                <label>Date range</label>
-                                <select onchange="this.form.submit()" class="form-control select2" name="canned_date">
+                                <input type="text" id="dateFilter" class="form-control" autocomplete="off">
-                                    <option <?php if ($_GET['canned_date'] == "custom") { echo "selected"; } ?> value="">Custom</option>
+                                <input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
-                                    <option <?php if ($_GET['canned_date'] == "today") { echo "selected"; } ?> value="today">Today</option>
+                                <input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
-                                    <option <?php if ($_GET['canned_date'] == "yesterday") { echo "selected"; } ?> value="yesterday">Yesterday</option>
+                                <input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
-                                    <option <?php if ($_GET['canned_date'] == "thisweek") { echo "selected"; } ?> value="thisweek">This Week</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastweek") { echo "selected"; } ?> value="lastweek">Last Week</option>
-                                    <option <?php if ($_GET['canned_date'] == "thismonth") { echo "selected"; } ?> value="thismonth">This Month</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastmonth") { echo "selected"; } ?> value="lastmonth">Last Month</option>
-                                    <option <?php if ($_GET['canned_date'] == "thisyear") { echo "selected"; } ?> value="thisyear">This Year</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastyear") { echo "selected"; } ?> value="lastyear">Last Year</option>
-                                </select>
-                            </div>
-                        </div>
-                        <div class="col-md-2">
-                            <div class="form-group">
-                                <label>Date From</label>
-                                <input onchange="this.form.submit()" type="date" class="form-control" name="dtf" max="2999-12-31" value="<?php echo nullable_htmlentities($dtf); ?>">
-                            </div>
-                        </div>
-                        <div class="col-md-2">
-                            <div class="form-group">
-                                <label>Date To</label>
-                                <input onchange="this.form.submit()" type="date" class="form-control" name="dtt" max="2999-12-31" value="<?php echo nullable_htmlentities($dtt); ?>">
                             </div>
                         </div>
                     </div>
@@ -244,7 +225,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $log_id = intval($row['log_id']);
                         $log_type = nullable_htmlentities($row['log_type']);
                         $log_action = nullable_htmlentities($row['log_action']);
@@ -266,7 +247,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         if (empty($client_name)) {
                             $client_name_display = "-";
                         } else {
-                            $client_name_display = "<a href='../user/client_overview.php?client_id=$client_id'>$client_name</a>";
+                            $client_name_display = "<a href='../agent/client_overview.php?client_id=$client_id'>$client_name</a>";
                         }
                         $log_entity_id = intval($row['log_entity_id']);
 
@@ -299,4 +280,3 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
 <?php
 require_once "../includes/footer.php";
-

admin/category.php

@@ -111,7 +111,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                 <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $category_id = intval($row['category_id']);
                         $category_name = nullable_htmlentities($row['category_name']);
                         $category_color = nullable_htmlentities($row['category_color']);

admin/contract_template.php

@@ -0,0 +1,125 @@
+<?php
+
+// Default Column Sort by Filter
+$sort = "contract_template_name";
+$order = "ASC";
+
+require_once "includes/inc_all_admin.php";
+
+// Search query
+$sql = mysqli_query(
+    $mysqli,
+    "SELECT SQL_CALC_FOUND_ROWS * FROM contract_templates
+    WHERE contract_template_name LIKE '%$q%' OR contract_template_type LIKE '%$q%' OR contract_template_name LIKE '%$q%'
+    ORDER BY $sort $order LIMIT $record_from, $record_to"
+);
+
+$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
+?>
+
+<div class="card card-dark">
+    <div class="card-header py-2">
+        <h3 class="card-title mt-2"><i class="fa fa-fw fa-file-contract mr-2"></i>Contract Templates</h3>
+        <div class="card-tools">
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/contract_template/contract_template_add.php" data-modal-size="lg">
+                <i class="fas fa-plus mr-2"></i>New Template
+            </button>
+        </div>
+    </div>
+    <div class="card-body">
+
+        <form autocomplete="off">
+            <div class="input-group">
+                <input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search templates">
+                <div class="input-group-append">
+                    <button class="btn btn-secondary"><i class="fa fa-search"></i></button>
+                </div>
+            </div>
+        </form>
+        <hr>
+
+        <div class="table-responsive-sm">
+            <table class="table table-striped table-borderless table-hover">
+                <thead class="text-dark <?php if ($num_rows[0] == 0) { echo "d-none"; } ?>">
+                    <tr>
+                        <th>Template Name</th>
+                        <th>Type</th>
+                        <th>Update Frequency</th>
+                        <th>SLA (L/M/H Response)</th>
+                        <th>SLA (L/M/H Resolution)</th>
+                        <th>Hourly Rate</th>
+                        <th>After Hours Rate</th>
+                        <th>Support Hours</th>
+                        <th>Net Terms</th>
+                        <th>Created</th>
+                        <th>Updated</th>
+                        <th class="text-center">Action</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php
+                        while ($row = mysqli_fetch_assoc($sql)) {
+                            $id = intval($row['contract_template_id']);
+                            $name = nullable_htmlentities($row['contract_template_name']);
+                            $type = nullable_htmlentities($row['contract_template_type']);
+                            $freq = nullable_htmlentities($row['contract_template_update_frequency']);
+                            $sla_low_resp = nullable_htmlentities($row['sla_low_response_time']);
+                            $sla_med_resp = nullable_htmlentities($row['sla_medium_response_time']);
+                            $sla_high_resp = nullable_htmlentities($row['sla_high_response_time']);
+                            $sla_low_res = nullable_htmlentities($row['sla_low_resolution_time']);
+                            $sla_med_res = nullable_htmlentities($row['sla_medium_resolution_time']);
+                            $sla_high_res = nullable_htmlentities($row['sla_high_resolution_time']);
+                            $hourly_rate = nullable_htmlentities($row['contract_template_hourly_rate']);
+                            $after_hours = nullable_htmlentities($row['contract_template_after_hours_hourly_rate']);
+                            $support_hours = nullable_htmlentities($row['contract_template_support_hours']);
+                            $net_terms = nullable_htmlentities($row['contract_template_net_terms']);
+                            $created = nullable_htmlentities($row['contract_template_created_at']);
+                            $updated = nullable_htmlentities($row['contract_template_updated_at']);
+                    ?>
+                    <tr>
+                        <td>
+                            <a class="text-bold" href="contract_template_details.php?contract_template_id=<?php echo $id; ?>">
+                                <i class="fas fa-fw fa-file-alt text-dark"></i> <?php echo $name; ?>
+                            </a>
+                            <div class="mt-1 text-secondary"><?php echo nullable_htmlentities($row['contract_template_description']); ?></div>
+                        </td>
+                        <td><?php echo $type; ?></td>
+                        <td><?php echo $freq; ?></td>
+                        <td><?php echo "$sla_low_resp / $sla_med_resp / $sla_high_resp"; ?></td>
+                        <td><?php echo "$sla_low_res / $sla_med_res / $sla_high_res"; ?></td>
+                        <td><?php echo $hourly_rate; ?></td>
+                        <td><?php echo $after_hours; ?></td>
+                        <td><?php echo $support_hours; ?></td>
+                        <td><?php echo $net_terms; ?></td>
+                        <td><?php echo $created; ?></td>
+                        <td><?php echo $updated; ?></td>
+                        <td>
+                            <div class="dropdown dropleft text-center">
+                                <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
+                                    <i class="fas fa-ellipsis-h"></i>
+                                </button>
+                                <div class="dropdown-menu">
+                                    <a class="dropdown-item ajax-modal" href="#"
+                                        data-modal-size="xl"
+                                        data-modal-url="modals/contract_template/contract_template_edit.php?id=<?= $id ?>">
+                                        <i class="fas fa-fw fa-edit mr-2"></i>Edit
+                                    </a>
+                                    <div class="dropdown-divider"></div>
+                                    <a class="dropdown-item text-danger text-bold" href="post.php?delete_contract_template=<?php echo $id; ?>">
+                                        <i class="fas fa-fw fa-trash mr-2"></i>Delete
+                                    </a>
+                                </div>
+                            </div>
+                        </td>
+                    </tr>
+                    <?php } ?>
+                </tbody>
+            </table>
+            <br>
+        </div>
+        <?php require_once "../includes/filter_footer.php"; ?>
+    </div>
+</div>
+
+<?php require_once "../includes/footer.php"; ?>

admin/custom/readme.php

@@ -0,0 +1,8 @@
+<?php
+
+/*
+
+- Custom Pages -
+     If you wish to add custom pages to ITFlow, add them to this directory"
+     Link to Documentation for File Directory Structure and examples
+*/

admin/custom_link.php

@@ -21,7 +21,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
         <div class="card-header py-2">
             <h3 class="card-title mt-2"><i class="fas fa-fw fa-external-link-alt mr-2"></i>Custom Links</h3>
             <div class="card-tools">
-                <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addLinkModal"><i class="fas fa-plus mr-2"></i>New Link</button>
+                <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/custom_link/custom_link_add.php"><i class="fas fa-plus mr-2"></i>New Link</button>
             </div>
         </div>
 
@@ -72,7 +72,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $custom_link_id = intval($row['custom_link_id']);
                         $custom_link_name = nullable_htmlentities($row['custom_link_name']);
                         $custom_link_uri = nullable_htmlentities($row['custom_link_uri']);
@@ -96,6 +96,10 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $custom_link_location_display = "Top Nav";
                         } elseif ($custom_link_location == 3) {
                             $custom_link_location_display = "Client Portal Nav";
+                        } elseif ($custom_link_location == 4) {
+                            $custom_link_location_display = "Admin Nav";
+                        } elseif ($custom_link_location == 5) {
+                            $custom_link_location_display = "Reports Nav";
                         }
 
                         ?>
@@ -141,5 +145,4 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
     </div>
 
 <?php
-require_once "modals/custom_link/custom_link_add.php";
 require_once "../includes/footer.php";

admin/database_updates.php

@@ -791,7 +791,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
 
         // Copy primary_location and primary_contact to their new vars in their own respecting tables
         $sql = mysqli_query($mysqli, "SELECT * FROM clients");
-        while($row = mysqli_fetch_array($sql)) {
+        while($row = mysqli_fetch_assoc($sql)) {
             $primary_contact = $row['primary_contact'];
             $primary_location = $row['primary_location'];
 
@@ -1666,7 +1666,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
     if (CURRENT_DATABASE_VERSION == '1.3.9') {
         // Migrate all Network Info from Assets to Interface Table and make it primary interface
         $sql = mysqli_query($mysqli, "SELECT * FROM assets");
-        while ($row = mysqli_fetch_array($sql)) {
+        while ($row = mysqli_fetch_assoc($sql)) {
             $asset_id = intval($row['asset_id']);
             $mac = sanitizeInput($row['asset_mac']);
             $ip = sanitizeInput($row['asset_ip']);
@@ -1945,7 +1945,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
     if (CURRENT_DATABASE_VERSION == '1.5.7') {
         // Create Users for contacts that have logins enabled and that are not archived
         $contacts_sql = mysqli_query($mysqli, "SELECT * FROM `contacts` WHERE contact_archived_at IS NULL AND (contact_auth_method = 'local' OR contact_auth_method = 'azure')");
-        while($row = mysqli_fetch_array($contacts_sql)) {
+        while($row = mysqli_fetch_assoc($contacts_sql)) {
             $contact_id = intval($row['contact_id']);
             $contact_name = mysqli_real_escape_string($mysqli, $row['contact_name']);
             $contact_email = mysqli_real_escape_string($mysqli, $row['contact_email']);
@@ -3853,7 +3853,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
 
         // Get Current Stripe Settings
         $sql_stripe_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
-        $row = mysqli_fetch_array($sql_stripe_settings);
+        $row = mysqli_fetch_assoc($sql_stripe_settings);
         $config_stripe_enable = intval($row['config_stripe_enable']);
         if ($config_stripe_enable === 1) {
             $config_stripe_publishable = mysqli_real_escape_string($mysqli, $row['config_stripe_publishable']);
@@ -3879,7 +3879,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
 
             // Migrate Clients and Payment Method over
             $sql_stripe_clients = mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE stripe_pm IS NOT NULL AND stripe_pm != ''");
-            while ($row = mysqli_fetch_array($sql_stripe_clients)) {
+            while ($row = mysqli_fetch_assoc($sql_stripe_clients)) {
                 $client_id = intval($row['client_id']);
                 $stripe_id = mysqli_real_escape_string($mysqli, $row['stripe_id']);
                 $stripe_pm = mysqli_real_escape_string($mysqli, $row['stripe_pm']);
@@ -3932,7 +3932,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
         // Migrate Payment Methods from Categories Table to new payment_methods table
         $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
 
-        while ($row = mysqli_fetch_array($sql_categories)) {
+        while ($row = mysqli_fetch_assoc($sql_categories)) {
             $category_name = sanitizeInput($row['category_name']);
 
             mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$category_name'");
@@ -3969,10 +3969,234 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) {
         mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.2'");
     }
 
-    // if (CURRENT_DATABASE_VERSION == '2.3.2') {
+    if (CURRENT_DATABASE_VERSION == '2.3.2') {
-    //     // Insert queries here required to update to DB version 2.3.3
+
+        mysqli_query($mysqli, "ALTER TABLE settings
+            ADD `config_imap_provider` ENUM('standard_imap','google_oauth','microsoft_oauth') NULL DEFAULT NULL AFTER `config_mail_from_name`,
+            ADD `config_mail_oauth_client_id` VARCHAR(255) NULL AFTER `config_imap_provider`,
+            ADD `config_mail_oauth_client_secret` VARCHAR(255) NULL AFTER `config_mail_oauth_client_id`,
+            ADD `config_mail_oauth_tenant_id` VARCHAR(255) NULL AFTER `config_mail_oauth_client_secret`,
+            ADD `config_mail_oauth_refresh_token` TEXT NULL AFTER `config_mail_oauth_tenant_id`,
+            ADD `config_mail_oauth_access_token` TEXT NULL AFTER `config_mail_oauth_refresh_token`,
+            ADD `config_mail_oauth_access_token_expires_at` DATETIME NULL AFTER `config_mail_oauth_access_token`
+        ");
+
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.3'");
+    }
+
+    if (CURRENT_DATABASE_VERSION == '2.3.3') {
+
+        mysqli_query($mysqli, "ALTER TABLE settings
+            ADD `config_smtp_provider` ENUM('standard_smtp','google_oauth','microsoft_oauth') NULL DEFAULT NULL AFTER `config_start_page`
+        ");
+
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.4'");
+    }
+
+    if (CURRENT_DATABASE_VERSION == '2.3.4') {
+
+        // Add Software Keys
+        mysqli_query($mysqli, "CREATE TABLE `software_keys` (
+            `software_key_id` INT(11) NOT NULL AUTO_INCREMENT,
+            `software_key` VARCHAR(400) NOT NULL,
+            `software_key_software_id` INT(11) NOT NULL,
+            PRIMARY KEY (`software_key_id`),
+            FOREIGN KEY (`software_key_software_id`) REFERENCES `software`(`software_id`) ON DELETE CASCADE
+        )");
+
+        // Software Key Assignments to Contacts
+        mysqli_query($mysqli, "CREATE TABLE `software_key_contact_assignments` (
+            `software_key_id` INT(11) NOT NULL,
+            `contact_id` INT(11) NOT NULL,
+            `software_key_assigned_at` DATETIME DEFAULT CURRENT_TIMESTAMP,
+            PRIMARY KEY (`software_key_id`, `contact_id`),
+            FOREIGN KEY (`software_key_id`) REFERENCES `software_keys`(`software_key_id`) ON DELETE CASCADE,
+            FOREIGN KEY (`contact_id`) REFERENCES `contacts`(`contact_id`) ON DELETE CASCADE
+        )");
+
+        // Software Key Assignments to Assets
+        mysqli_query($mysqli, "CREATE TABLE `software_key_asset_assignments` (
+            `software_key_id` INT(11) NOT NULL,
+            `asset_id` INT(11) NOT NULL,
+            `software_key_assigned_at` DATETIME DEFAULT CURRENT_TIMESTAMP,
+            PRIMARY KEY (`software_key_id`, `asset_id`),
+            FOREIGN KEY (`software_key_id`) REFERENCES `software_keys`(`software_key_id`) ON DELETE CASCADE,
+            FOREIGN KEY (`asset_id`) REFERENCES `assets`(`asset_id`) ON DELETE CASCADE
+        )");
+
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.5'");
+    }
+
+    if (CURRENT_DATABASE_VERSION == '2.3.5') {
+        mysqli_query($mysqli, "ALTER TABLE `settings` CHANGE `config_smtp_provider` `config_smtp_provider` VARCHAR(200) DEFAULT NULL");
+        mysqli_query($mysqli, "ALTER TABLE `settings` CHANGE `config_imap_provider` `config_imap_provider` VARCHAR(200) DEFAULT NULL");
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.6'");
+    }
+
+    if (CURRENT_DATABASE_VERSION == '2.3.6') {
+        // Create New Contract Templates Table
+        mysqli_query($mysqli, "CREATE TABLE `contract_templates` (
+          `contract_template_id` INT(11) AUTO_INCREMENT PRIMARY KEY,
+          `contract_template_name` VARCHAR(255) NOT NULL,
+          `contract_template_description` TEXT NULL DEFAULT NULL,
+          `contract_template_type` VARCHAR(50) NULL DEFAULT NULL,
+
+          `contract_template_sla_low_response_time` INT(11) NULL DEFAULT NULL,
+          `contract_template_sla_low_resolution_time` INT(11) NULL DEFAULT NULL,
+          `contract_template_sla_medium_response_time` INT(11) NULL DEFAULT NULL,
+          `contract_template_sla_medium_resolution_time` INT(11) NULL DEFAULT NULL,
+          `contract_template_sla_high_response_time` INT(11) NULL DEFAULT NULL,
+          `contract_template_sla_high_resolution_time` INT(11) NULL DEFAULT NULL,
+
+          `contract_template_rate_standard` DECIMAL(10,2) NULL DEFAULT NULL,
+          `contract_template_rate_after_hours` DECIMAL(10,2) NULL DEFAULT NULL,
+
+          `contract_template_net_terms` VARCHAR(50) NULL DEFAULT NULL,
+          `contract_template_support_hours` VARCHAR(100) NULL DEFAULT NULL,
+          `contract_template_renewal_frequency` VARCHAR(50) NULL DEFAULT NULL,
+
+          `contract_template_details` TEXT NULL DEFAULT NULL,
+
+          `contract_template_created_at` DATETIME DEFAULT CURRENT_TIMESTAMP,
+          `contract_template_updated_at` DATETIME NULL ON UPDATE CURRENT_TIMESTAMP,
+          `contract_template_archived_at` DATETIME NULL DEFAULT NULL
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;");
+
+
+        // Create New Contracts Table
+        mysqli_query($mysqli, "CREATE TABLE `contracts` (
+            `contract_id` INT(11) AUTO_INCREMENT PRIMARY KEY,
+            `contract_name` VARCHAR(255) NOT NULL,
+            `contract_status` VARCHAR(50) NOT NULL,
+            `contract_type` VARCHAR(50) NOT NULL,
+
+            `contract_sla_low_response_time` INT(11) NULL DEFAULT NULL,
+            `contract_sla_low_resolution_time` INT(11) NULL DEFAULT NULL,
+            `contract_sla_medium_response_time` INT(11) NULL DEFAULT NULL,
+            `contract_sla_medium_resolution_time` INT(11) NULL DEFAULT NULL,
+            `contract_sla_high_response_time` INT(11) NULL DEFAULT NULL,
+            `contract_sla_high_resolution_time` INT(11) NULL DEFAULT NULL,
+
+            `contract_details` TEXT NULL DEFAULT NULL,
+
+            `contract_client_id` INT(11) NULL DEFAULT NULL,
+            `contract_client_name` VARCHAR(255) NULL DEFAULT NULL,
+            `contract_client_address` TEXT NULL DEFAULT NULL,
+            `contract_client_email` VARCHAR(255) NULL DEFAULT NULL,
+            `contract_client_phone` VARCHAR(100) NULL DEFAULT NULL,
+
+            `contract_contact_name` VARCHAR(255) NULL DEFAULT NULL,
+            `contract_contact_signature` TEXT NULL DEFAULT NULL,
+            `contract_contact_signature_date` DATETIME NULL DEFAULT NULL,
+
+            `contract_agent_name` VARCHAR(255) NULL DEFAULT NULL,
+            `contract_agent_signature` TEXT NULL DEFAULT NULL,
+            `contract_agent_signature_date` DATETIME NULL DEFAULT NULL,
+
+            `contract_rate_standard` DECIMAL(10,2) NULL DEFAULT NULL,
+            `contract_rate_after_hours` DECIMAL(10,2) NULL DEFAULT NULL,
+
+            `contract_net_terms` VARCHAR(50) NULL DEFAULT NULL,
+            `contract_support_hours` VARCHAR(100) NULL DEFAULT NULL,
+
+            `contract_start_date` DATE NULL DEFAULT NULL,
+            `contract_end_date` DATE NULL DEFAULT NULL,
+            `contract_renewal_frequency` VARCHAR(50) NULL DEFAULT NULL,
+
+            `contract_created_at` DATETIME DEFAULT CURRENT_TIMESTAMP,
+            `contract_updated_at` DATETIME NULL ON UPDATE CURRENT_TIMESTAMP,
+            `contract_archived_at` DATETIME NULL DEFAULT NULL,
+
+            FOREIGN KEY (`contract_client_id`) REFERENCES `clients`(`client_id`)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;");
+
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.7'");
+    }
+
+    if (CURRENT_DATABASE_VERSION == '2.3.7') {
+
+        mysqli_query($mysqli, "
+            CREATE TABLE `asset_tags` (
+                `asset_tag_asset_id` INT(11) NOT NULL,
+                `asset_tag_tag_id` INT(11) NOT NULL,
+                PRIMARY KEY (`asset_tag_asset_id`, `asset_tag_tag_id`),
+                CONSTRAINT `fk_asset`
+                    FOREIGN KEY (`asset_tag_asset_id`)
+                    REFERENCES `assets`(`asset_id`)
+                    ON DELETE CASCADE,
+                CONSTRAINT `fk_tag`
+                    FOREIGN KEY (`asset_tag_tag_id`)
+                    REFERENCES `tags`(`tag_id`)
+                    ON DELETE CASCADE
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+        ");
+
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.8'");
+    }
+
+     if (CURRENT_DATABASE_VERSION == '2.3.8') {
+
+         mysqli_query($mysqli, "
+            CREATE TABLE `task_approvals` (
+              `approval_id` int(11) NOT NULL AUTO_INCREMENT,
+              `approval_scope` enum('client','internal') NOT NULL,
+              `approval_type` enum('any','technical','billing','specific') NOT NULL,
+              `approval_required_user_id` int(11) DEFAULT NULL,
+              `approval_status` enum('pending','approved','declined') NOT NULL,
+              `approval_created_by` int(11) NOT NULL,
+              `approval_approved_by` varchar(255) DEFAULT NULL,
+              `approval_url_key` varchar(200) NOT NULL,
+              `approval_task_id` int(11) NOT NULL,
+              PRIMARY KEY (`approval_id`)
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+        ");
+
+         mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.9'");
+     }
+
+    if (CURRENT_DATABASE_VERSION == '2.3.9') {
+        mysqli_query($mysqli, "ALTER TABLE `clients` ADD `client_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `client_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `locations` ADD `location_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `location_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `vendors` ADD `vendor_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `vendor_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `software` ADD `software_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `software_notes`");
+
+        mysqli_query(
+            $mysqli,
+            "ALTER TABLE `credentials`
+             CHANGE `credential_important` `credential_favorite`
+             TINYINT(1) NOT NULL DEFAULT 0
+             AFTER `credential_note`"
+        );
+
+        mysqli_query($mysqli, "ALTER TABLE `assets` DROP `asset_important`");
+        mysqli_query($mysqli, "ALTER TABLE `assets` ADD `asset_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `asset_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `documents` DROP `document_important`");
+        mysqli_query($mysqli, "ALTER TABLE `documents` ADD `document_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `document_client_visible`");
+
+        mysqli_query($mysqli, "ALTER TABLE `racks` ADD `rack_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `rack_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `files` DROP `file_important`");
+        mysqli_query($mysqli, "ALTER TABLE `files` ADD `file_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `file_mime_type`");
+
+        mysqli_query($mysqli, "ALTER TABLE `networks` ADD `network_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `network_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `domains` ADD `domain_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `domain_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `certificates` ADD `certificate_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `certificate_notes`");
+
+        mysqli_query($mysqli, "ALTER TABLE `services` ADD `service_favorite` TINYINT(1) NOT NULL DEFAULT '0' AFTER `service_notes`");
+
+        mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.4.0'");
+    }
+
+    // if (CURRENT_DATABASE_VERSION == '2.4.0') {
+    //     // Insert queries here required to update to DB version 2.4.1
     //     // Then, update the database to the next sequential version
-    //     mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.3.3'");
+    //     mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '2.4.1'");
     // }
 
 } else {

admin/debug.php

@@ -46,14 +46,13 @@ $systemInfo[] = [
 // Section: PHP Extensions
 $phpExtensions = [];
 $extensions = [
-    'php-mailparse' => 'mailparse',
-    'php-imap' => 'imap',
     'php-mysqli' => 'mysqli',
     'php-intl' => 'intl',
     'php-curl' => 'curl',
     'php-mbstring' => 'mbstring',
     'php-gd' => 'gd',
     'php-zip' => 'zip',
+    'php-xml' => 'xml',
 ];
 
 foreach ($extensions as $name => $ext) {
@@ -767,4 +766,3 @@ $mysqli->close();
 <?php
 
 require_once "../includes/footer.php";
-

admin/document_template.php

@@ -22,7 +22,7 @@
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fa fa-fw fa-file mr-2"></i>Document Templates</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addDocumentTemplateModal">
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/document_template/document_template_add.php" data-modal-size="xl">
                 <i class="fas fa-plus mr-2"></i>New Template
             </button>
         </div>
@@ -66,7 +66,7 @@
                 <tbody>
                     <?php
 
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $document_template_id = intval($row['document_template_id']);
                             $document_template_name = nullable_htmlentities($row['document_template_name']);
                             $document_template_description = nullable_htmlentities($row['document_template_description']);
@@ -121,38 +121,4 @@
     </div>
 </div>
 
-<?php require_once "modals/document_template/document_template_add.php"; ?>
+<?php require_once "../includes/footer.php";
-<?php require_once "../includes/footer.php"; ?>
-
-<script>
-$(document).ready(function(){
-
-    $('#generateAIContent').on('click', function(){
-        var prompt = $('#aiPrompt').val().trim();
-        if(prompt === '') {
-            alert('Please enter a prompt.');
-            return;
-        }
-
-        $('#generateAIContent').prop('disabled', true).html('<i class="fa fa-spinner fa-spin"></i> Generating...');
-
-        $.ajax({
-            url: 'post.php?ai_create_document_template', // The PHP script that calls the OpenAI API
-            method: 'POST',
-            data: { prompt: prompt },
-            dataType: 'html',
-            success: function(response) {
-                // Assuming you have exactly one TinyMCE instance on the page
-                // and it's targeting the .tinymce textarea:
-                tinymce.activeEditor.setContent(response);
-            },
-            error: function() {
-                alert('Error generating content. Please try again.');
-            },
-            complete: function() {
-                $('#generateAIContent').prop('disabled', false).html('<i class="fa fa-fw fa-magic mr-1"></i>Generate with AI');
-            }
-        });
-    });
-});
-</script>

admin/document_template_details.php

@@ -15,9 +15,15 @@ if (isset($_GET['document_template_id'])) {
     $document_template_id = intval($_GET['document_template_id']);
 }
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id");
+$sql_document = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql_document);
+if (mysqli_num_rows($sql_document) == 0) {
+    echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
+    require_once "../includes/footer.php";
+    exit();
+}
+
+$row = mysqli_fetch_assoc($sql_document);
 
 $document_template_name = nullable_htmlentities($row['document_template_name']);
 $document_template_description = nullable_htmlentities($row['document_template_description']);

admin/includes/inc_all_admin.php

@@ -1,17 +1,16 @@
 <?php
 
-require_once "../config.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/config.php';
-require_once "../functions.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/functions.php';
-require_once "../includes/router.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/check_login.php';
-require_once "../includes/check_login.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/page_title.php';
-require_once "../includes/page_title.php";
 if (!isset($session_is_admin) || !$session_is_admin) {
     exit(WORDING_ROLECHECK_FAILED . "<br>Tell your admin: Your role does not have admin access.");
 }
-require_once "../includes/header.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/header.php';
-require_once "../includes/top_nav.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/top_nav.php';
-require_once "includes/side_nav.php";
+require_once 'includes/side_nav.php';
-require_once "../includes/inc_wrapper.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/inc_wrapper.php';
-require_once "../includes/inc_alert_feedback.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/inc_alert_feedback.php';
-require_once "../includes/filter_header.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/filter_header.php';
-require_once "../includes/app_version.php";
+require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/app_version.php';

admin/includes/side_nav.php

@@ -1,6 +1,6 @@
 <!-- Main Sidebar Container -->
 <aside class="main-sidebar sidebar-dark-<?php echo nullable_htmlentities($config_theme); ?> d-print-none">
-    <a class="brand-link pb-1 mt-1" href="../user/dashboard.php">
+    <a class="brand-link pb-1 mt-1" href="/agent/<?php echo $config_start_page ?>">
         <p class="h6">
             <i class="nav-icon fas fa-arrow-left ml-3 mr-2"></i>
             <span class="brand-text">
@@ -14,21 +14,29 @@
         <!-- Sidebar Menu -->
         <nav>
             <ul class="nav nav-pills nav-sidebar flex-column mt-2" data-widget="treeview" data-accordion="false">
-                <!-- ACCESS Section -->
+                <li class="nav-header">ACCESS</li>
                 <li class="nav-item">
-                    <a href="users.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "users.php") {echo "active";} ?>">
+                    <a href="/admin/users.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "users.php") {echo "active";} ?>">
                         <i class="nav-icon fas fa-users"></i>
                         <p>Users</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="roles.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "roles.php") {echo "active";} ?>">
+                    <a href="/admin/roles.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "roles.php") {echo "active";} ?>">
                         <i class="nav-icon fas fa-user-shield"></i>
                         <p>Roles</p>
                     </a>
                 </li>
+                <!-- 2025-12-05 JQ - Hide Permission Modules currently just shows modules
                 <li class="nav-item">
-                    <a href="api_keys.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "api_keys.php") {echo "active";} ?>">
+                    <a href="/admin/modules.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "modules.php") {echo "active";} ?>">
+                        <i class="nav-icon fas fa-puzzle-piece"></i>
+                        <p>Modules</p>
+                    </a>
+                </li>
+                -->
+                <li class="nav-item">
+                    <a href="/admin/api_keys.php" class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == "api_keys.php") {echo "active";} ?>">
                         <i class="nav-icon fas fa-key"></i>
                         <p>API Keys</p>
                     </a>
@@ -36,65 +44,56 @@
                 <li class="nav-header">TAGS & CATEGORIES</li>
 
                 <li class="nav-item">
-                    <a href="tag.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'tag.php' ? 'active' : ''); ?>">
+                    <a href="/admin/tag.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'tag.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-tags"></i>
                         <p>Tags</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="category.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'category.php' ? 'active' : ''); ?>">
+                    <a href="/admin/category.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'category.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-list-ul"></i>
                         <p>Categories</p>
                     </a>
                 </li>
                 <?php if ($config_module_enable_accounting) { ?>
                     <li class="nav-item">
-                        <a href="tax.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'tax.php' ? 'active' : ''); ?>">
+                        <a href="/admin/tax.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'tax.php' ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-balance-scale"></i>
                             <p>Taxes</p>
                         </a>
                     </li>
                     <li class="nav-item">
-                        <a href="payment_method.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'payment_method.php' ? 'active' : ''); ?>">
+                        <a href="/admin/payment_method.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'payment_method.php' ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-hand-holding-usd"></i>
                             <p>Payment Methods</p>
                         </a>
                     </li>
                     <li class="nav-item">
-                        <a href="payment_provider.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'payment_provider.php' ? 'active' : ''); ?>">
+                        <a href="/admin/payment_provider.php"
+                           class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['payment_provider.php', 'saved_payment_method.php']) ? 'active' : ''); ?>">
                             <i class="nav-icon far fa-credit-card"></i>
                             <p>Payment Providers</p>
                         </a>
                     </li>
+                <?php } ?>
                     <li class="nav-item">
-                        <a href="saved_payment_method.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'saved_payment_method.php' ? 'active' : ''); ?>">
+                        <a href="/admin/ai_provider.php"
-                            <i class="nav-icon far fa-credit-card"></i>
+                        class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['ai_provider.php', 'ai_model.php']) ? 'active' : ''); ?>">
-                            <p>Saved Payments</p>
-                        </a>
-                    </li>
-                    <li class="nav-item">
-                        <a href="ai_provider.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'ai_provider.php' ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-robot"></i>
                             <p>AI Providers</p>
                         </a>
                     </li>
-                    <li class="nav-item">
+
-                        <a href="ai_model.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'ai_model.php' ? 'active' : ''); ?>">
-                            <i class="nav-icon fas fa-robot"></i>
-                            <p>AI Models</p>
-                        </a>
-                    </li>
-                <?php } ?>
                 <?php if ($config_module_enable_ticketing) { ?>
                     <li class="nav-item">
-                        <a href="ticket_status.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'ticket_status.php' ? 'active' : ''); ?>">
+                        <a href="/admin/ticket_status.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'ticket_status.php' ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-info-circle"></i>
                             <p>Ticket Statuses</p>
                         </a>
                     </li>
                 <?php } ?>
                 <li class="nav-item">
-                    <a href="custom_link.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'custom_link.php' ? 'active' : ''); ?>">
+                    <a href="/admin/custom_link.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'custom_link.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-external-link-alt"></i>
                         <p>Custom Links</p>
                     </a>
@@ -103,32 +102,43 @@
                 <?php if ($config_module_enable_itdoc) { ?>
                     <li class="nav-header">TEMPLATES</li>
 
+                    <!-- 2025-11-16 JQ - Hide Contracts not yet ready
                     <li class="nav-item">
-                        <a href="project_template.php" class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['project_template.php', 'project_template_details.php']) ? 'active' : ''); ?>">
+                        <a href="/admin/contract_template.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'contract_template.php' ? 'active' : ''); ?>">
+                            <i class="nav-icon fas fa-file-contract"></i>
+                            <p>
+                                <span href="#" class="fas fa-plus-circle right ajax-modal" data-modal-url="/admin/modals/contract_template/contract_template_add.php" data-modal-size="lg"></span>
+                                Contract Templates
+                            </p>
+                        </a>
+                    </li>
+                    -->
+                    <li class="nav-item">
+                        <a href="/admin/project_template.php" class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['project_template.php', 'project_template_details.php']) ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-project-diagram"></i>
                             <p>Project Templates</p>
                         </a>
                     </li>
                     <li class="nav-item">
-                        <a href="ticket_template.php" class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['ticket_template.php', 'ticket_template_details.php']) ? 'active' : ''); ?>">
+                        <a href="/admin/ticket_template.php" class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['ticket_template.php', 'ticket_template_details.php']) ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-life-ring"></i>
                             <p>Ticket Templates</p>
                         </a>
                     </li>
                     <li class="nav-item">
-                        <a href="vendor_template.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'vendor_template.php' ? 'active' : ''); ?>">
+                        <a href="/admin/vendor_template.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'vendor_template.php' ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-building"></i>
                             <p>Vendor Templates</p>
                         </a>
                     </li>
                     <li class="nav-item">
-                        <a href="software_template.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'software_template.php' ? 'active' : ''); ?>">
+                        <a href="/admin/software_template.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'software_template.php' ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-rocket"></i>
                             <p>License Templates</p>
                         </a>
                     </li>
                     <li class="nav-item">
-                        <a href="document_template.php" class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['document_template.php', 'document_template_details.php']) ? 'active' : ''); ?>">
+                        <a href="/admin/document_template.php" class="nav-link <?php echo (in_array(basename($_SERVER['PHP_SELF']), ['document_template.php', 'document_template_details.php']) ? 'active' : ''); ?>">
                             <i class="nav-icon fas fa-file"></i>
                             <p>Document Templates</p>
                         </a>
@@ -138,37 +148,37 @@
                 <li class="nav-header">MAINTENANCE</li>
 
                 <li class="nav-item">
-                    <a href="mail_queue.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'mail_queue.php' ? 'active' : ''); ?>">
+                    <a href="/admin/mail_queue.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'mail_queue.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-mail-bulk"></i>
                         <p>Mail Queue</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="audit_log.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'audit_log.php' ? 'active' : ''); ?>">
+                    <a href="/admin/audit_log.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'audit_log.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-history"></i>
                         <p>Audit Logs</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="app_log.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'app_log.php' ? 'active' : ''); ?>">
+                    <a href="/admin/app_log.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'app_log.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-history"></i>
                         <p>App Logs</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="backup.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'backup.php' ? 'active' : ''); ?>">
+                    <a href="/admin/backup.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'backup.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-cloud-upload-alt"></i>
                         <p>Backup</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="debug.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'debug.php' ? 'active' : ''); ?>">
+                    <a href="/admin/debug.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'debug.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-bug"></i>
                         <p>Debug</p>
                     </a>
                 </li>
                 <li class="nav-item">
-                    <a href="update.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'update.php' ? 'active' : ''); ?>">
+                    <a href="/admin/update.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'update.php' ? 'active' : ''); ?>">
                         <i class="nav-icon fas fa-download"></i>
                         <p>Update</p>
                     </a>
@@ -184,56 +194,56 @@
                     </a>
                     <ul class="nav nav-treeview">
                         <li class="nav-item">
-                            <a href="settings_company.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_company.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_company.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_company.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fa fa-briefcase"></i>
                                 <p>Company Details</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_localization.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_localization.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_localization.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_localization.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fa fa-globe"></i>
                                 <p>Localization</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_theme.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_theme.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_theme.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_theme.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fa fa-paint-brush"></i>
                                 <p>Theme</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_security.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_security.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_security.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_security.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fas fa-shield-alt"></i>
                                 <p>Security</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_mail.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_mail.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_mail.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_mail.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon far fa-envelope"></i>
                                 <p>Mail</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_notification.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_notification.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_notification.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_notification.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon far fa-bell"></i>
                                 <p>Notifications</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_default.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_default.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_default.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_default.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fas fa-cogs"></i>
                                 <p>Defaults</p>
                             </a>
                         </li>
                         <?php if ($config_module_enable_accounting) { ?>
                             <li class="nav-item">
-                                <a href="settings_invoice.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_invoice.php' ? 'active' : ''); ?>">
+                                <a href="/admin/settings_invoice.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_invoice.php' ? 'active' : ''); ?>">
                                     <i class="nav-icon fas fa-file-invoice"></i>
                                     <p>Invoice</p>
                                 </a>
                             </li>
                             <li class="nav-item">
-                                <a href="settings_quote.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_quote.php' ? 'active' : ''); ?>">
+                                <a href="/admin/settings_quote.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_quote.php' ? 'active' : ''); ?>">
                                     <i class="nav-icon fas fa-comment-dollar"></i>
                                     <p>Quote</p>
                                 </a>
@@ -241,13 +251,13 @@
                         <?php } ?>
                         <?php if ($config_module_enable_ticketing) { ?>
                             <li class="nav-item">
-                                <a href="settings_project.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_project.php' ? 'active' : ''); ?>">
+                                <a href="/admin/settings_project.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_project.php' ? 'active' : ''); ?>">
                                     <i class="nav-icon fas fa-project-diagram"></i>
                                     <p>Project</p>
                                 </a>
                             </li>
                             <li class="nav-item">
-                                <a href="settings_ticket.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_ticket.php' ? 'active' : ''); ?>">
+                                <a href="/admin/settings_ticket.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_ticket.php' ? 'active' : ''); ?>">
                                     <i class="nav-icon fas fa-life-ring"></i>
                                     <p>Ticket</p>
                                 </a>
@@ -256,26 +266,56 @@
                         <!-- Currently the only integration is the client portal SSO -->
                         <?php if ($config_client_portal_enable) { ?>
                             <li class="nav-item">
-                                <a href="identity_provider.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'identity_provider.php' ? 'active' : ''); ?>">
+                                <a href="/admin/identity_provider.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'identity_provider.php' ? 'active' : ''); ?>">
                                     <i class="nav-icon fas fa-fingerprint"></i>
                                     <p>Identity Provider</p>
                                 </a>
                             </li>
                         <?php } ?>
                         <li class="nav-item">
-                            <a href="settings_telemetry.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_telemetry.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_telemetry.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_telemetry.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fas fa-satellite-dish"></i>
                                 <p>Telemetry</p>
                             </a>
                         </li>
                         <li class="nav-item">
-                            <a href="settings_module.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_module.php' ? 'active' : ''); ?>">
+                            <a href="/admin/settings_module.php" class="nav-link <?php echo (basename($_SERVER['PHP_SELF']) == 'settings_module.php' ? 'active' : ''); ?>">
                                 <i class="nav-icon fas fa-cube"></i>
                                 <p>Modules</p>
                             </a>
                         </li>
                     </ul>
                 </li>
+
+                <?php
+                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links
+                    WHERE custom_link_location = 4 AND custom_link_archived_at IS NULL
+                    ORDER BY custom_link_order ASC, custom_link_name ASC"
+                );
+
+                while ($row = mysqli_fetch_assoc($sql_custom_links)) {
+                    $custom_link_name = nullable_htmlentities($row['custom_link_name']);
+                    $custom_link_uri = sanitize_url($row['custom_link_uri']);
+                    $custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
+                    $custom_link_new_tab = intval($row['custom_link_new_tab']);
+                    if ($custom_link_new_tab == 1) {
+                        $target = "target='_blank' rel='noopener noreferrer'";
+                    } else {
+                        $target = "";
+                    }
+
+                    ?>
+
+                <li class="nav-item">
+                    <a href="<?php echo $custom_link_uri; ?>" <?php echo $target; ?> class="nav-link <?php if (basename($_SERVER["PHP_SELF"]) == basename($custom_link_uri)) { echo "active"; } ?>">
+                        <i class="fas fa-<?php echo $custom_link_icon; ?> nav-icon"></i>
+                        <p><?php echo $custom_link_name; ?></p>
+                        <i class="fas fa-angle-right nav-icon float-right"></i>
+                    </a>
+                </li>
+
+                <?php } ?>
+
             </ul>
         </nav>
         <!-- /.sidebar-menu -->

admin/mail_queue.php

@@ -53,34 +53,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         </div>
                     </div>
                 </div>
-                <div class="collapse mt-3 <?php if (!empty($_GET['dtf']) || $_GET['canned_date'] !== "custom" ) { echo "show"; } ?>" id="advancedFilter">
+                <div class="collapse mt-3 <?php if (isset($_GET['dtf']) && $_GET['dtf'] !== '1970-01-01') { echo "show"; } ?>" id="advancedFilter">
                     <div class="row">
-                        <div class="col-md-2">
+                        <div class="col-md-3">
                             <div class="form-group">
-                                <label>Canned Date</label>
+                                <label>Date range</label>
-                                <select onchange="this.form.submit()" class="form-control select2" name="canned_date">
+                                <input type="text" id="dateFilter" class="form-control" autocomplete="off">
-                                    <option <?php if ($_GET['canned_date'] == "custom") { echo "selected"; } ?> value="">Custom</option>
+                                <input type="hidden" name="canned_date" id="canned_date" value="<?php echo nullable_htmlentities($_GET['canned_date']) ?? ''; ?>">
-                                    <option <?php if ($_GET['canned_date'] == "today") { echo "selected"; } ?> value="today">Today</option>
+                                <input type="hidden" name="dtf" id="dtf" value="<?php echo nullable_htmlentities($dtf ?? ''); ?>">
-                                    <option <?php if ($_GET['canned_date'] == "yesterday") { echo "selected"; } ?> value="yesterday">Yesterday</option>
+                                <input type="hidden" name="dtt" id="dtt" value="<?php echo nullable_htmlentities($dtt ?? ''); ?>">
-                                    <option <?php if ($_GET['canned_date'] == "thisweek") { echo "selected"; } ?> value="thisweek">This Week</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastweek") { echo "selected"; } ?> value="lastweek">Last Week</option>
-                                    <option <?php if ($_GET['canned_date'] == "thismonth") { echo "selected"; } ?> value="thismonth">This Month</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastmonth") { echo "selected"; } ?> value="lastmonth">Last Month</option>
-                                    <option <?php if ($_GET['canned_date'] == "thisyear") { echo "selected"; } ?> value="thisyear">This Year</option>
-                                    <option <?php if ($_GET['canned_date'] == "lastyear") { echo "selected"; } ?> value="lastyear">Last Year</option>
-                                </select>
-                            </div>
-                        </div>
-                        <div class="col-md-2">
-                            <div class="form-group">
-                                <label>Date From</label>
-                                <input onchange="this.form.submit()" type="date" class="form-control" name="dtf" max="2999-12-31" value="<?php echo nullable_htmlentities($dtf); ?>">
-                            </div>
-                        </div>
-                        <div class="col-md-2">
-                            <div class="form-group">
-                                <label>Date To</label>
-                                <input onchange="this.form.submit()" type="date" class="form-control" name="dtt" max="2999-12-31" value="<?php echo nullable_htmlentities($dtt); ?>">
                             </div>
                         </div>
                     </div>
@@ -135,7 +116,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         <tbody>
                         <?php
 
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $email_id = intval($row['email_id']);
                             $email_from = nullable_htmlentities($row['email_from']);
                             $email_from_name = nullable_htmlentities($row['email_from_name']);

admin/modals/ai/ai_model_add.php

@@ -1,14 +1,18 @@
-<div class="form-group">
+<?php
-    <div class="modal" id="addAIModelModal" tabindex="-1">
+
-    <div class="modal-dialog">
+require_once '../../../includes/modal_header.php';
-        <div class="modal-content">
+
-            <div class="modal-header bg-dark">
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-robot mr-2"></i>Add AI Model</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
     <div class="modal-body">
@@ -23,7 +27,7 @@
                     <option value="">- Select an AI Provider -</option>
                     <?php
                         $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
-                                    while ($row = mysqli_fetch_array($sql_ai_providers)) {
+                        while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = nullable_htmlentities($row['ai_provider_name']);
 
@@ -67,7 +71,7 @@
         <button type="submit" name="add_ai_model" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/ai/ai_model_edit.php

@@ -6,7 +6,7 @@ $model_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
 $model_id = intval($row['ai_model_id']);
 $model_name = nullable_htmlentities($row['ai_model_name']);
@@ -39,7 +39,7 @@ ob_start();
                     <option value="">- Select an AI Provider -</option>
                     <?php
                         $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
-                        while ($row = mysqli_fetch_array($sql_ai_providers)) {
+                        while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = nullable_htmlentities($row['ai_provider_name']);
 

admin/modals/ai/ai_provider_add.php

@@ -1,14 +1,18 @@
-<div class="form-group">
+<?php
-    <div class="modal" id="addAIProviderModal" tabindex="-1">
+
-    <div class="modal-dialog">
+require_once '../../../includes/modal_header.php';
-        <div class="modal-content">
+
-            <div class="modal-header bg-dark">
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-robot mr-2"></i>New AI Provider</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
     <div class="modal-body">
@@ -48,7 +52,7 @@
         <button type="submit" name="add_ai_provider" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/ai/ai_provider_edit.php

@@ -6,7 +6,7 @@ $provider_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $provider_name = nullable_htmlentities($row['ai_provider_name']);
 $url = nullable_htmlentities($row['ai_provider_api_url']);
 $key = nullable_htmlentities($row['ai_provider_api_key']);

admin/modals/api/api_key_add.php

@@ -1,17 +1,20 @@
 <?php
-$key = randomString(156);
+
-$decryptPW = randomString(160);
+require_once '../../../includes/modal_header.php';
+
+$key = randomString(32);
+$decryptPW = randomString(32);
+
+ob_start();
 ?>
-<div class="modal" id="addApiKeyModal" tabindex="-1">
+
-    <div class="modal-dialog">
+<div class="modal-header bg-dark">
-        <div class="modal-content">
-            <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-key mr-2"></i>New Key</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <div class="modal-body">
 
         <ul class="nav nav-pills nav-justified mb-3">
@@ -61,7 +64,7 @@ $decryptPW = randomString(160);
                             <option value="0"> ALL CLIENTS </option>
                             <?php
                             $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
-                                        while ($row = mysqli_fetch_array($sql)) {
+                            while ($row = mysqli_fetch_assoc($sql)) {
                                 $client_id = intval($row['client_id']);
                                 $client_name = nullable_htmlentities($row['client_name']); ?>
                                 <option value="<?php echo $client_id; ?>"><?php echo "$client_name  (Client ID: $client_id)"; ?></option>
@@ -115,7 +118,7 @@ $decryptPW = randomString(160);
         <button type="submit" name="add_api_key" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/category/category_add.php

@@ -2,7 +2,9 @@
 
 require_once '../../../includes/modal_header.php';
 
-$category = nullable_htmlentities($_GET['category']);
+$category = nullable_htmlentities($_GET['category'] ?? '');
+
+$category_types_array = ['Expense', 'Income', 'Referral', 'Ticket'];
 
 ?>
 
@@ -13,10 +15,30 @@ $category = nullable_htmlentities($_GET['category']);
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
-    <input type="hidden" name="type" value="<?php echo ($category); ?>">
 
     <div class="modal-body">
 
+        <?php if ($category) { ?>
+        <input type="hidden" name="type" value="<?= $category ?>">
+        <?php } else { ?>
+
+        <div class="form-group">
+            <label>Type <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-tag"></i></span>
+                </div>
+                <select class="form-control select2" name="type" required>
+                    <option value="">- Select Type -</option>
+                    <?php foreach ($category_types_array as $type_select) { ?>
+                        <option><?= $type_select ?></option>
+                    <?php } ?>
+                </select>
+            </div>
+        </div>
+
+        <?php } ?>
+
         <div class="form-group">
             <label>Name <strong class="text-danger">*</strong></label>
             <div class="input-group">
@@ -39,7 +61,7 @@ $category = nullable_htmlentities($_GET['category']);
 
     </div>
     <div class="modal-footer">
-        <button type="submit" name="add_category" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
+        <button type="submit" name="add_category" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create Category</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
 </form>

admin/modals/category/category_edit.php

@@ -6,7 +6,7 @@ $category_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $category_name = nullable_htmlentities($row['category_name']);
 $category_color = nullable_htmlentities($row['category_color']);
 $category_type = nullable_htmlentities($row['category_type']);

admin/modals/contract_template/contract_template_add.php

@@ -0,0 +1,221 @@
+<?php
+require_once '../../../includes/modal_header.php';
+
+
+$contract_types_array = ['Fully Managed', 'Partialy Managed', 'Break/Fix'];
+$renewal_frequency_array = ['Manual', 'Annually', '2 Year', '3 Year', '5 Year', '7 Year'];
+
+ob_start();
+?>
+
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fa fa-fw fa-file-contract mr-2"></i>New Contract Template</h5>
+    <button type="button" class="close text-white" data-dismiss="modal"><span>&times;</span></button>
+</div>
+
+<!-- Tabs Navigation -->
+<ul class="modal-header nav nav-pills nav-justified">
+    <li class="nav-item">
+        <a class="nav-link active" id="general-tab" data-toggle="tab" href="#general" role="tab">General Info</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link" id="sla-tab" data-toggle="tab" href="#sla" role="tab">SLA</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link" id="rates-tab" data-toggle="tab" href="#rates" role="tab">Rates & Support</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link" id="details-tab" data-toggle="tab" href="#details" role="tab">Details</a>
+    </li>
+</ul>
+
+<form action="post.php" method="post" autocomplete="off">
+    <div class="modal-body">
+        <div class="tab-content" id="contractTemplateTabContent">
+
+            <!-- General Info Tab -->
+            <div class="tab-pane fade show active" id="general" role="tabpanel">
+                <div class="form-group">
+                    <label>Template Name <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-file-contract"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="name" placeholder="Contract Template Name" maxlength="200" required autofocus>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Template Description <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-align-left"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="description"
+                        placeholder="Contract Template Description" maxlength="200" required>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Contract Type <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-list"></i></span>
+                        </div>
+                        <select class="form-control select2" name="type" required>
+                            <option value="">- Select Type -</option>
+                            <?php foreach ($contract_types_array as $type) { ?>
+                                <option><?= $type ?></option>
+                            <?php } ?>
+                        </select>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Renewal Frequency</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-sync-alt"></i></span>
+                        </div>
+                        <select class="form-control select2" name="renewal_frequency">
+                            <option value="">- Select Frequency -</option>
+                            <?php foreach ($renewal_frequency_array as $renewal_frequency) { ?>
+                                <option><?= $renewal_frequency ?></option>
+                            <?php } ?>
+                        </select>
+                    </div>
+                </div>
+            </div>
+
+            <!-- SLA Tab -->
+            <div class="tab-pane fade" id="sla" role="tabpanel">
+                <div class="form-row">
+                    <div class="form-group col-md-6">
+                        <label>Low Priority Response (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-clock"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_low_response_time" placeholder="e.g., 24">
+                        </div>
+                    </div>
+                    <div class="form-group col-md-6">
+                        <label>Low Priority Resolution (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-hourglass-half"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_low_resolution_time" placeholder="e.g., 48">
+                        </div>
+                    </div>
+                </div>
+
+                <div class="form-row">
+                    <div class="form-group col-md-6">
+                        <label>Medium Priority Response (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-clock"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_medium_response_time" placeholder="e.g., 12">
+                        </div>
+                    </div>
+                    <div class="form-group col-md-6">
+                        <label>Medium Priority Resolution (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-hourglass-half"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_medium_resolution_time" placeholder="e.g., 24">
+                        </div>
+                    </div>
+                </div>
+
+                <div class="form-row">
+                    <div class="form-group col-md-6">
+                        <label>High Priority Response (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-bolt"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_high_response_time" placeholder="e.g., 1">
+                        </div>
+                    </div>
+                    <div class="form-group col-md-6">
+                        <label>High Priority Resolution (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-stopwatch"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_high_resolution_time" placeholder="e.g., 4">
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Rates & Support Tab -->
+            <div class="tab-pane fade" id="rates" role="tabpanel">
+                <div class="form-group">
+                    <label>Standard Hourly Rate</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-dollar-sign"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="rate_standard" placeholder="e.g., 100">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>After Hours Hourly Rate</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-moon"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="rate_after_hours" placeholder="e.g., 150">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Support Hours</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="support_hours" placeholder="e.g., Mon-Fri 9am-5pm">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Net Terms</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-file-invoice-dollar"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="net_terms" placeholder="e.g., Net 30">
+                    </div>
+                </div>
+            </div>
+
+            <!-- Details Tab -->
+            <div class="tab-pane fade" id="details" role="tabpanel">
+                <div class="form-group">
+                    <textarea class="form-control tinymce" rows="6" name="details" placeholder="Enter Contract Details"></textarea>
+                </div>
+            </div>
+
+        </div>
+    </div>
+
+    <div class="modal-footer">
+        <button type="submit" name="add_contract_template" class="btn btn-primary text-bold">
+            <i class="fa fa-check mr-2"></i>Create Template
+        </button>
+        <button type="button" class="btn btn-light" data-dismiss="modal">
+            <i class="fa fa-times mr-2"></i>Cancel
+        </button>
+    </div>
+</form>
+
+<?php
+require_once '../../../includes/modal_footer.php';
+?>

admin/modals/contract_template/contract_template_edit.php

@@ -0,0 +1,265 @@
+<?php
+require_once '../../../includes/modal_header.php';
+
+$contract_template_id = intval($_GET['id']);
+
+$contract_types_array = ['Fully Managed', 'Partialy Managed', 'Break/Fix'];
+$update_frequency_array = ['Manual', 'Annually', '2 Year', '3 Year', '5 Year', '7 Year'];
+
+// Fetch existing template
+$sql = mysqli_query($mysqli, "SELECT * FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
+$row = mysqli_fetch_assoc($sql);
+
+// Assign locals
+$name          = nullable_htmlentities($row['contract_template_name']);
+$description   = nullable_htmlentities($row['contract_template_description']);
+$type          = nullable_htmlentities($row['contract_template_type']);
+$renewal_frequency = nullable_htmlentities($row['contract_template_renewal_frequency']);
+$sla_low_resp  = intval($row['contract_template_sla_low_response_time']);
+$sla_med_resp  = intval($row['contract_template_sla_medium_response_time']);
+$sla_high_resp = intval($row['contract_template_sla_high_response_time']);
+$sla_low_res   = intval($row['contract_template_sla_low_resolution_time']);
+$sla_med_res   = intval($row['contract_template_sla_medium_resolution_time']);
+$sla_high_res  = intval($row['contract_template_sla_high_resolution_time']);
+$hourly_rate   = intval($row['contract_template_rate_standard']);
+$after_hours   = intval($row['contract_template_rate_after_hours']);
+$support_hours = nullable_htmlentities($row['contract_template_support_hours']);
+$net_terms     = intval($row['contract_template_net_terms']);
+$details       = nullable_htmlentities($row['contract_template_details']);
+
+ob_start();
+?>
+
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fa fa-fw fa-file-contract mr-2"></i>Edit Contract Template</h5>
+    <button type="button" class="close text-white" data-dismiss="modal"><span>&times;</span></button>
+</div>
+
+<!-- Tabs Navigation -->
+<ul class="modal-header nav nav-pills nav-justified">
+    <li class="nav-item">
+        <a class="nav-link active" id="general-tab" data-toggle="tab" href="#general" role="tab">General Info</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link" id="sla-tab" data-toggle="tab" href="#sla" role="tab">SLA</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link" id="rates-tab" data-toggle="tab" href="#rates" role="tab">Rates & Support</a>
+    </li>
+    <li class="nav-item">
+        <a class="nav-link" id="details-tab" data-toggle="tab" href="#details" role="tab">Details</a>
+    </li>
+</ul>
+
+<form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="contract_template_id" value="<?php echo $contract_template_id; ?>">
+
+    <div class="modal-body">
+        <div class="tab-content" id="contractTemplateTabContent">
+
+            <!-- General Info Tab -->
+            <div class="tab-pane fade show active" id="general" role="tabpanel">
+                <div class="form-group">
+                    <label>Template Name <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-file-contract"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="name"
+                            placeholder="Contract Template Name" maxlength="200" required autofocus
+                            value="<?= $name ?>">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Template Description <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-align-left"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="description"
+                            placeholder="Contract Template Description" maxlength="200" required
+                            value="<?= $description ?>">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Contract Type <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-list"></i></span>
+                        </div>
+                        <select class="form-control select2" name="type" required>
+                            <option value="">- Select Type -</option>
+                            <?php foreach ($contract_types_array as $type_select) { ?>
+                                <option <?php if ($type == $type_select) { echo "selected"; } ?>><?= $type_select ?></option>
+                            <?php } ?>
+                        </select>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Renewal Frequency</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-sync-alt"></i></span>
+                        </div>
+                        <select class="form-control select2" name="renewal_frequency">
+                            <option value="">- Select Frequency -</option>
+                            <?php foreach ($renewal_frequency_array as $renewal_frequency_select) { ?>
+                                <option <?php if ($renewal_frequency == $renewal_frequency_select) { echo "selected"; } ?>><?= $renewal_frequency_select ?></option>
+                            <?php } ?>
+                        </select>
+                    </div>
+                </div>
+            </div>
+
+            <!-- SLA Tab -->
+            <div class="tab-pane fade" id="sla" role="tabpanel">
+                <div class="form-row">
+                    <div class="form-group col-md-6">
+                        <label>Low Priority Response (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-clock"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_low_response_time" placeholder="e.g., 24"
+                                value="<?= $sla_low_resp ?>">
+                        </div>
+                    </div>
+                    <div class="form-group col-md-6">
+                        <label>Low Priority Resolution (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-hourglass-half"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_low_resolution_time" placeholder="e.g., 48"
+                                value="<?= $sla_low_res ?>">
+                        </div>
+                    </div>
+                </div>
+
+                <div class="form-row">
+                    <div class="form-group col-md-6">
+                        <label>Medium Priority Response (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-clock"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_medium_response_time" placeholder="e.g., 12"
+                                value="<?= $sla_med_resp ?>">
+                        </div>
+                    </div>
+                    <div class="form-group col-md-6">
+                        <label>Medium Priority Resolution (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-hourglass-half"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_medium_resolution_time" placeholder="e.g., 24"
+                                value="<?= $sla_med_res ?>">
+                        </div>
+                    </div>
+                </div>
+
+                <div class="form-row">
+                    <div class="form-group col-md-6">
+                        <label>High Priority Response (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-bolt"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_high_response_time" placeholder="e.g., 1"
+                                value="<?= $sla_high_resp ?>">
+                        </div>
+                    </div>
+                    <div class="form-group col-md-6">
+                        <label>High Priority Resolution (hrs)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend">
+                                <span class="input-group-text"><i class="fa fa-fw fa-stopwatch"></i></span>
+                            </div>
+                            <input type="number" class="form-control" name="sla_high_resolution_time" placeholder="e.g., 4"
+                                value="<?= $sla_high_res ?>">
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Rates & Support Tab -->
+            <div class="tab-pane fade" id="rates" role="tabpanel">
+                <div class="form-group">
+                    <label>Standard Hourly Rate</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-dollar-sign"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="rate_standard" placeholder="e.g., 100"
+                            value="<?= $rate_standard ?>">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>After Hours Hourly Rate</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-moon"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="rate_after_hours" placeholder="e.g., 150"
+                            value="<?= $rate_after_hours ?>">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Support Hours</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="support_hours" placeholder="e.g., Mon-Fri 9am-5pm"
+                            value="<?= $support_hours ?>">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Net Terms</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-file-invoice-dollar"></i></span>
+                        </div>
+                        <input type="text" class="form-control" name="net_terms" placeholder="e.g., Net 30"
+                            value="<?= $net_terms ?>">
+                    </div>
+                </div>
+            </div>
+
+            <!-- Details Tab -->
+            <div class="tab-pane fade" id="details" role="tabpanel">
+                <div class="form-group">
+                    <label>Contract Details</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-align-left"></i></span>
+                        </div>
+                        <textarea class="form-control tinymce" rows="6" name="details"
+                            placeholder="Enter Contract Details"><?= $details ?></textarea>
+                    </div>
+                </div>
+            </div>
+
+        </div>
+    </div>
+
+    <div class="modal-footer">
+        <button type="submit" name="edit_contract_template" class="btn btn-primary text-bold">
+            <i class="fa fa-check mr-2"></i>Save Changes
+        </button>
+        <button type="button" class="btn btn-light" data-dismiss="modal">
+            <i class="fa fa-times mr-2"></i>Cancel
+        </button>
+    </div>
+</form>
+
+<?php
+require_once '../../../includes/modal_footer.php';
+?>

admin/modals/custom_link/custom_link_add.php

@@ -1,13 +1,18 @@
-<div class="modal" id="addLinkModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-external-link-alt mr-2"></i>New Custom Link</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
 
     <div class="modal-body">
 
@@ -66,6 +71,8 @@
                     <option value="1">Main Side Nav</option>
                     <option value="2">Top Nav (Icon Required)</option>
                     <option value="3">Client Portal Nav</option>
+                    <option value="4">Admin Nav</option>
+                    <option value="5">Reports Nav</option>
                 </select>
             </div>
         </div>
@@ -75,7 +82,7 @@
         <button type="submit" name="add_custom_link" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/custom_link/custom_link_edit.php

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
 $custom_link_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $custom_link_name = nullable_htmlentities($row['custom_link_name']);
 $custom_link_uri = nullable_htmlentities($row['custom_link_uri']);
 $custom_link_icon = nullable_htmlentities($row['custom_link_icon']);
@@ -81,9 +81,11 @@ ob_start();
                     <span class="input-group-text"><i class="fa fa-fw fa-home"></i></span>
                 </div>
                 <select class="form-control select2" name="location" required>
-                    <option value="1" <?php if ($custom_link_location == 1) { echo "selected"; } ?> >Main Side Nav</option>
+                    <option value="1" <?php if ($custom_link_location === 1) { echo "selected"; } ?> >Main Side Nav</option>
-                    <option value="2" <?php if ($custom_link_location == 2) { echo "selected"; } ?> >Top Nav (Icon Required)</option>
+                    <option value="2" <?php if ($custom_link_location === 2) { echo "selected"; } ?> >Top Nav (Icon Required)</option>
-                    <option value="3" <?php if ($custom_link_location == 3) { echo "selected"; } ?> >Client Portal Nav</option>
+                    <option value="3" <?php if ($custom_link_location === 3) { echo "selected"; } ?> >Client Portal Nav</option>
+                    <option value="4" <?php if ($custom_link_location === 4) { echo "selected"; } ?> >Admin Nav</option>
+                    <option value="5" <?php if ($custom_link_location === 5) { echo "selected"; } ?> >Reports Nav</option>
                 </select>
             </div>
         </div>

admin/modals/document_template/document_template_add.php

@@ -1,21 +1,24 @@
-<div class="modal" id="addDocumentTemplateModal" tabindex="-1">
+<?php
-    <div class="modal-dialog modal-xl">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-file-alt mr-2"></i>Creating Document Template</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <div class="modal-body">
 
         <div class="form-group">
             <input type="text" class="form-control" name="name" placeholder="Template name" maxlength="200">
         </div>
 
-                    <?php if ($config_ai_enable == 1) { ?>
-                    <!-- Prompt for AI -->
         <div class="form-group">
             <label>Enter a prompt for the type of IT documentation you want to generate:</label>
             <div class="input-group mb-3">
@@ -27,7 +30,6 @@
                 </div>
             </div>
         </div>
-                    <?php } ?>
 
         <!-- TinyMCE Content -->
         <div class="form-group">
@@ -46,7 +48,40 @@
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
 
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<script>
-</div>
+$(document).ready(function(){
+
+    $('#generateAIContent').on('click', function(){
+        var prompt = $('#aiPrompt').val().trim();
+        if(prompt === '') {
+            alert('Please enter a prompt.');
+            return;
+        }
+
+        $('#generateAIContent').prop('disabled', true).html('<i class="fa fa-spinner fa-spin"></i> Generating...');
+
+        $.ajax({
+            url: '/agent/ajax.php?ai_create_document_template', // The PHP script that calls the OpenAI API
+            method: 'POST',
+            data: { prompt: prompt },
+            dataType: 'html',
+            success: function(response) {
+                // Assuming you have exactly one TinyMCE instance on the page
+                // and it's targeting the .tinymce textarea:
+                tinymce.activeEditor.setContent(response);
+            },
+            error: function() {
+                alert('Error generating content. Please try again.');
+            },
+            complete: function() {
+                $('#generateAIContent').prop('disabled', false).html('<i class="fa fa-fw fa-magic mr-1"></i>Generate with AI');
+            }
+        });
+    });
+});
+</script>
+
+<?php
+require_once '../../../includes/modal_footer.php';

admin/modals/document_template/document_template_edit.php

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
 $document_template_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $document_template_name = nullable_htmlentities($row['document_template_name']);
 $document_template_description = nullable_htmlentities($row['document_template_description']);
 $document_template_content = nullable_htmlentities($row['document_template_content']);

admin/modals/mail_queue/mail_queue_message_view.php

@@ -17,7 +17,7 @@ $purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'htt
 $purifier = new HTMLPurifier($purifier_config);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 
 $email_from = nullable_htmlentities($row['email_from']);
 $email_from_name = nullable_htmlentities($row['email_from_name']);

admin/modals/payment_method/payment_method_add.php

@@ -1,13 +1,18 @@
-<div class="modal" id="addPaymentMethodModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-credit-card mr-2"></i>Creating: <strong>Payment Method</strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
     <div class="modal-body">
@@ -31,7 +36,7 @@
         <button type="submit" name="add_payment_method" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/payment_method/payment_method_edit.php

@@ -6,7 +6,7 @@ $payment_method_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $payment_method_id = intval($row['payment_method_id']);
 $payment_method_name = nullable_htmlentities($row['payment_method_name']);
 $payment_method_description = nullable_htmlentities($row['payment_method_description']);
@@ -22,7 +22,7 @@ ob_start();
 </div>
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
-
+    <input type="hidden" name="payment_method_id" value="<?= $payment_method_id ?>">
     <div class="modal-body">
 
         <div class="form-group">

admin/modals/payment_provider/payment_provider_add.php

@@ -1,23 +1,41 @@
-<div class="form-group">
+<?php
-    <div class="modal" id="addPaymentProviderModal" tabindex="-1">
+
-    <div class="modal-dialog">
+require_once '../../../includes/modal_header.php';
-        <div class="modal-content">
+
-            <div class="modal-header bg-dark">
+ob_start();
+
+?>
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-credit-card mr-2"></i>Add Payment Provider</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
     <div class="modal-body">
 
-                    <div class="alert alert-info">
+        <div class="alert alert-info text-center">
-                        An income account named after the provider will always be created and used for income of paid invoices.<br>
+            <h6>Before Adding a Payment Provider!</h6>
-                        If "Enable Expense" option is enabled, a matching vendor will also be automatically created for expense tracking. Additionally, an expense category named "Payment Processing" will be created.
+            We recommend you add an <strong>Account</strong> and <strong>Vendor</strong> based off the Provider name before continuing eg <strong>Stripe</strong>
         </div>
 
+        <ul class="nav nav-pills nav-justified mb-3">
+            <li class="nav-item">
+                <a class="nav-link active" data-toggle="pill" href="#pills-details">Details</a>
+            </li>
+            <li class="nav-item">
+                <a class="nav-link" data-toggle="pill" href="#pills-expense">Expense</a>
+            </li>
+        </ul>
+
+        <hr>
+
+        <div class="tab-content">
+
+            <div class="tab-pane fade show active" id="pills-details">
+
                 <div class="form-group">
                     <label>Provider <strong class="text-danger">*</strong></label>
                     <div class="input-group">
@@ -50,18 +68,44 @@
                     </div>
                 </div>
 
+                <div class="form-group">
+                    <label>Income / Expense Account <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-piggy-bank"></i></span>
+                        </div>
+                        <select class="form-control select2" name="account" required>
+                            <option value="">- Select an Account -</option>
+                            <?php
+
+                            $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                            while ($row = mysqli_fetch_assoc($sql)) {
+                                $account_id = intval($row['account_id']);
+                                $account_name = nullable_htmlentities($row['account_name']);
+                                ?>
+                                <option <?php if ($account_name === 'Stripe') { echo "selected"; } ?> value="<?= $account_id ?>"><?= $account_name ?></option>
+
+                                <?php
+                            }
+                            ?>
+                        </select>
+                    </div>
+                </div>
+
                 <div class="form-group">
                     <label>Threshold</label>
                     <div class="input-group">
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-shopping-cart"></i></span>
                         </div>
-                            <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,2}" name="threshold" placeholder="1000.00">
+                        <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,2}" name="threshold" placeholder="1000.00">
                     </div>
-                        <small class="form-text text-muted">Will not show as an option at Checkout if above this number</small>
+                    <small class="form-text text-muted">Will not show as an option at Checkout if invoice amount is above this number, 0 disables the threshold check.</small>
                 </div>
 
-                    <hr>
+            </div>
+
+            <div class="tab-pane fade" id="pills-expense">
 
                 <div class="form-group">
                     <div class="custom-control custom-switch">
@@ -70,13 +114,67 @@
                     </div>
                 </div>
 
+                <div class="form-group">
+                    <label>Payment Provider Vendor <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-building"></i></span>
+                        </div>
+                        <select class="form-control select2" name="expense_vendor" required>
+                            <option value="0">Expense Disabled</option>
+                            <?php
+
+                            $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
+                            while ($row = mysqli_fetch_assoc($sql)) {
+                                $vendor_id = intval($row['vendor_id']);
+                                $vendor_name = nullable_htmlentities($row['vendor_name']);
+                                ?>
+                                <option <?php if ($vendor_name === 'Stripe') { echo "selected"; } ?> value="<?= $vendor_id ?>"><?= $vendor_name ?></option>
+
+                                <?php
+                            }
+                            ?>
+                        </select>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Expense Category <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-list"></i></span>
+                        </div>
+                        <select class="form-control select2" name="expense_category" required>
+                            <option value="">- Select a Category -</option>
+                            <?php
+
+                            $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                            while ($row = mysqli_fetch_assoc($sql)) {
+                                $category_id = intval($row['category_id']);
+                                $category_name = nullable_htmlentities($row['category_name']);
+                                ?>
+                                <option <?php if ($category_name === 'Processing Fee') { echo "selected"; } ?> value="<?= $category_id ?>"><?= $category_name ?></option>
+
+                                <?php
+                            }
+                            ?>
+                        </select>
+                        <div class="input-group-append">
+                            <button class="btn btn-secondary ajax-modal" type="button"
+                                data-modal-url="../admin/modals/category/category_add.php?category=Expense">
+                                <i class="fas fa-plus"></i>
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
                 <div class="form-group">
                     <label>Percentage Fee to expense</label>
                     <div class="input-group">
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-percent"></i></span>
                         </div>
-                            <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,2}" name="percentage_fee" placeholder="Enter Percentage">
+                        <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,2}" name="percentage_fee" placeholder="Enter Percentage">
                     </div>
                     <small class="form-text text-muted">See <a href="https://stripe.com/pricing" target="_blank">here <i class="fas fa-fw fa-external-link-alt"></i></a> for the latest Stripe Fees.</small>
                 </div>
@@ -87,17 +185,19 @@
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-shopping-cart"></i></span>
                         </div>
-                            <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,3}" name="flat_fee" placeholder="0.030">
+                        <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,3}" name="flat_fee" placeholder="0.030">
                     </div>
                     <small class="form-text text-muted">See <a href="https://stripe.com/pricing" target="_blank">here <i class="fas fa-fw fa-external-link-alt"></i></a> for the latest Stripe Fees.</small>
                 </div>
 
             </div>
+        </div>
+    </div>
     <div class="modal-footer">
         <button type="submit" name="add_payment_provider" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Add</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/payment_provider/payment_provider_edit.php

@@ -6,14 +6,14 @@ $provider_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $provider_name = nullable_htmlentities($row['payment_provider_name']);
 $public_key = nullable_htmlentities($row['payment_provider_public_key']);
 $private_key = nullable_htmlentities($row['payment_provider_private_key']);
-$account_id = nullable_htmlentities($row['payment_provider_account']);
+$account_id = intval($row['payment_provider_account']);
 $threshold = floatval($row['payment_provider_threshold']);
-$vendor_id = nullable_htmlentities($row['payment_provider_expense_vendor']);
+$vendor_id = intval($row['payment_provider_expense_vendor']);
-$category_id = nullable_htmlentities($row['payment_provider_expense_category']);
+$category_id = intval($row['payment_provider_expense_category']);
 $percent_fee = floatval($row['payment_provider_expense_percentage_fee']) * 100;
 $flat_fee = floatval($row['payment_provider_expense_flat_fee']);
 
@@ -21,24 +21,39 @@ $flat_fee = floatval($row['payment_provider_expense_flat_fee']);
 ob_start();
 ?>
 <div class="modal-header bg-dark">
-    <h5 class="modal-title"><i class="fa fa-fw fa-credit-card mr-2"></i>Editing: <strong><?php echo $provider_name; ?></strong></h5>
+    <h5 class="modal-title"><i class="fa fa-fw fa-credit-card mr-2"></i>Editing: <strong><?= $provider_name ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
-    <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
-    <input type="hidden" name="provider_id" value="<?php echo $provider_id; ?>">
+    <input type="hidden" name="provider_id" value="<?= $provider_id ?>">
 
     <div class="modal-body">
 
+        <ul class="nav nav-pills nav-justified mb-3">
+            <li class="nav-item">
+                <a class="nav-link active" data-toggle="pill" href="#pills-details">Details</a>
+            </li>
+            <li class="nav-item">
+                <a class="nav-link" data-toggle="pill" href="#pills-expense">Expense</a>
+            </li>
+        </ul>
+
+        <hr>
+
+        <div class="tab-content">
+
+            <div class="tab-pane fade show active" id="pills-details">
+
                 <div class="form-group">
                     <label>Publishable key <strong class="text-danger">*</strong></label>
                     <div class="input-group">
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span>
                         </div>
-                <input type="text" class="form-control" name="public_key" placeholder="Publishable API Key (pk_...)" value="<?php echo $public_key; ?>">
+                        <input type="text" class="form-control" name="public_key" placeholder="Publishable API Key (pk_...)" value="<?= $public_key ?>">
                     </div>
                 </div>
 
@@ -48,7 +63,31 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-key"></i></span>
                         </div>
-                <input type="text" class="form-control" name="private_key" placeholder="Secret API Key (sk_...)" value="<?php echo $private_key; ?>">
+                        <input type="text" class="form-control" name="private_key" placeholder="Secret API Key (sk_...)" value="<?= $private_key ?>">
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Income / Expense Account <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-piggy-bank"></i></span>
+                        </div>
+                        <select class="form-control select2" name="account" required>
+                            <option value="">- Select an Account -</option>
+                            <?php
+
+                            $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                            while ($row = mysqli_fetch_assoc($sql)) {
+                                $account_id_select = intval($row['account_id']);
+                                $account_name = nullable_htmlentities($row['account_name']);
+                                ?>
+                                <option <?php if ($account_id === $account_id_select) { echo "selected"; } ?> value="<?= $account_id_select ?>"><?= $account_name ?></option>
+
+                                <?php
+                            }
+                            ?>
+                        </select>
                     </div>
                 </div>
 
@@ -58,19 +97,69 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-shopping-cart"></i></span>
                         </div>
-                <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,2}" name="Threshold" placeholder="1000.00" value="<?php echo $threshold; ?>">
+                        <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,2}" name="threshold" placeholder="1000.00" value="<?php echo $threshold; ?>">
                     </div>
                     <small class="form-text text-muted">Will not show as an option at Checkout if above this number</small>
                 </div>
 
-        <hr>
+            </div>
+
+            <div class="tab-pane fade" id="pills-expense">
 
                 <div class="form-group">
-            <div class="custom-control custom-switch">
+                    <label>Payment Provider Vendor <strong class="text-danger">*</strong></label>
-                <input type="checkbox" class="custom-control-input" name="enable_expense" <?php if ($vendor_id) { echo "checked";  } ?> value="1" id="enableEditExpenseSwitch">
+                    <div class="input-group">
-                <label class="custom-control-label" for="enableEditExpenseSwitch">Enable Expense</label>
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-building"></i></span>
+                        </div>
+                        <select class="form-control select2" name="expense_vendor" required>
+                            <option value="0">Expense Disabled</option>
+                            <?php
+
+                            $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_client_id = 0 AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
+                            while ($row = mysqli_fetch_assoc($sql)) {
+                                $vendor_id_select = intval($row['vendor_id']);
+                                $vendor_name = nullable_htmlentities($row['vendor_name']);
+                                ?>
+                                <option <?php if ($vendor_id === $vendor_id_select) { echo "selected"; } ?>
+                                    value="<?= $vendor_id_select ?>"><?= $vendor_name ?>
+                                </option>
+
+                                <?php
+                            }
+                            ?>
+                        </select>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <label>Expense Category <strong class="text-danger">*</strong></label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-list"></i></span>
+                        </div>
+                        <select class="form-control select2" name="expense_category" required>
+                            <option value="">- Select a Category -</option>
+                            <?php
+
+                            $sql_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                            while ($row = mysqli_fetch_assoc($sql_category)) {
+                                $category_id_select = intval($row['category_id']);
+                                $category_name = nullable_htmlentities($row['category_name']);
+                                ?>
+                                <option <?php if ($category_id === $category_id_select) { echo "selected"; } ?> value="<?= $category_id_select ?>"><?= $category_name ?></option>
+
+                                <?php
+                            }
+                            ?>
+                        </select>
+                        <div class="input-group-append">
+                            <button class="btn btn-secondary ajax-modal" type="button"
+                                data-modal-url="../admin/modals/category/category_add.php?category=Expense">
+                                <i class="fas fa-plus"></i>
+                            </button>
+                        </div>
                     </div>
-            <small>(Category: Payment Processing -- Vendor: <?php echo $provider_name; ?></small>
                 </div>
 
                 <div class="form-group">
@@ -79,7 +168,7 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-percent"></i></span>
                         </div>
-                <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,2}" name="percentage_fee" value="<?php echo $percent_fee; ?>" placeholder="Enter Percentage">
+                        <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,2}" name="percentage_fee" value="<?php echo $percent_fee; ?>" placeholder="Enter Percentage">
                     </div>
                     <small class="form-text text-muted">See <a href="https://stripe.com/pricing" target="_blank">here <i class="fas fa-fw fa-external-link-alt"></i></a> for the latest Stripe Fees.</small>
                 </div>
@@ -90,11 +179,12 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-shopping-cart"></i></span>
                         </div>
-                <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,3}" name="flat_fee" value="<?php echo $flat_fee; ?>" placeholder="0.030">
+                        <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,3}" name="flat_fee" value="<?php echo $flat_fee; ?>" placeholder="0.030">
                     </div>
                     <small class="form-text text-muted">See <a href="https://stripe.com/pricing" target="_blank">here <i class="fas fa-fw fa-external-link-alt"></i></a> for the latest Stripe Fees.</small>
                 </div>
-
+            </div>
+        </div>
     </div>
     <div class="modal-footer">
         <button type="submit" name="edit_payment_provider" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Save</button>

admin/modals/project_template/project_template_add.php

@@ -1,13 +1,17 @@
-<div class="modal" id="addProjectTemplateModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-project-diagram mr-2"></i>Creating Project Template</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
 
     <div class="modal-body">
         <div class="form-group">
@@ -35,7 +39,7 @@
         <button type="submit" name="add_project_template" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/project_template/project_template_edit.php

@@ -1,13 +1,25 @@
-<div class="modal" id="editProjectTemplateModal<?php echo $project_template_id; ?>" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+$project_template_id = intval($_GET['project_template_id']);
+
+$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
+$row = mysqli_fetch_assoc($sql);
+$project_template_name = nullable_htmlentities($row['project_template_name']);
+$project_template_description = nullable_htmlentities($row['project_template_description']);
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-project-diagram mr-2"></i>Editing Project Template: <strong><?php echo $project_template_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="project_template_id" value="<?php echo $project_template_id; ?>">
 
     <div class="modal-body">
@@ -34,11 +46,11 @@
     </div>
 
     <div class="modal-footer">
-                    <button type="submit" name="edit_project_template" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create</button>
+        <button type="submit" name="edit_project_template" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
 
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/project_template/project_template_ticket_template_add.php

@@ -1,13 +1,20 @@
-<div class="modal" id="addProjectTemplateTicketTemplateModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+$project_template_id = intval($_GET['project_template_id']);
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-life-ring mr-2"></i>Adding Ticket Template</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="project_template_id" value="<?php echo $project_template_id; ?>">
     <div class="modal-body">
 
@@ -29,7 +36,7 @@
                         AND ticket_template_archived_at IS NULL
                         ORDER BY ticket_template_name ASC"
                     );
-                                while ($row = mysqli_fetch_array($sql_ticket_templates_select)) {
+                    while ($row = mysqli_fetch_assoc($sql_ticket_templates_select)) {
                         $ticket_template_id_select = intval($row['ticket_template_id']);
                         $ticket_template_name_select = nullable_htmlentities($row['ticket_template_name']);
                         ?>
@@ -58,7 +65,7 @@
         <button type="submit" name="add_ticket_template_to_project_template" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Add</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/role/role_add.php

@@ -1,17 +1,38 @@
-<div class="modal" id="addRoleModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
-                <h5 class="modal-title"><i class="fas fa-fw fa-user-shield mr-2"></i>Add new role</h5>
+ob_start();
+
+?>
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fas fa-fw fa-user-shield mr-2"></i>New Role</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+
-                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
+
     <div class="modal-body">
+
+        <ul class="nav nav-pills nav-justified mb-3">
+            <li class="nav-item">
+                <a class="nav-link active" data-toggle="pill" href="#pills-role-details">Details</a>
+            </li>
+            <li class="nav-item">
+                <a class="nav-link" data-toggle="pill" href="#pills-role-permissions">Permissions</a>
+            </li>
+        </ul>
+
+        <hr>
+
         <div class="tab-content">
 
+            <!-- DETAILS TAB -->
+            <div class="tab-pane fade show active" id="pills-role-details">
+
                 <div class="form-group">
                     <label>Name <strong class="text-danger">*</strong></label>
                     <div class="input-group">
@@ -34,25 +55,159 @@
 
                 <div class="form-group">
                     <label>Admin Access <strong class="text-danger">*</strong></label>
-                            <div class="input-group">
+
-                                <div class="input-group-prepend">
+                    <div class="custom-control custom-radio mb-2">
-                                    <span class="input-group-text"><i class="fa fa-fw fa-tools"></i></span>
+                        <input type="radio" class="custom-control-input" id="admin_no" name="role_is_admin" value="0" checked required>
-                                </div>
+                        <label class="custom-control-label" for="admin_no">
-                                <select class="form-control select2" name="role_is_admin" required>
+                            No - use permissions on the next tab
-                                    <option value="0">No - edit after creation to set permissions</option>
+                        </label>
-                                    <option value="1">Yes - this role should have full admin access</option>
-                                </select>
                     </div>
+
+                    <div class="custom-control custom-radio">
+                        <input type="radio" class="custom-control-input" id="admin_yes" name="role_is_admin" value="1" required>
+                        <label class="custom-control-label" for="admin_yes">
+                            Yes - this role should have full admin access
+                        </label>
                     </div>
 
                 </div>
 
             </div>
+
+            <!-- PERMISSIONS TAB -->
+            <div class="tab-pane fade" id="pills-role-permissions">
+
+                <?php
+                // Enumerate modules
+                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
+
+                    $module_id = intval($row_modules['module_id']);
+
+                    // raw for name, escaped for display
+                    $module_name_raw = $row_modules['module_name'];
+                    $module_name_display = ucfirst(str_replace("module_", "", $module_name_raw));
+
+                    $module_name_display_safe = nullable_htmlentities($module_name_display);
+                    $module_description = nullable_htmlentities($row_modules['module_description']);
+
+                    // default for new role
+                    $module_permission = 0;
+
+                    $field_name = $module_id . "##" . $module_name_raw;
+                    $group_id = "perm_group_$module_id";
+                    ?>
+
+                    <div class="form-group">
+                        <label><?= $module_name_display_safe ?> <strong class="text-danger">*</strong></label>
+
+                        <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons" role="group"
+                             aria-label="Permissions for <?= $module_name_display_safe ?>">
+
+                            <label class="btn btn-outline-secondary btn-sm active" title="No Access">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_0"
+                                    value="0"
+                                    autocomplete="off"
+                                    checked
+                                    required
+                                >
+                                None
+                            </label>
+
+                            <label class="btn btn-outline-primary btn-sm" title="Viewing Only">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_1"
+                                    value="1"
+                                    autocomplete="off"
+                                >
+                                <i class="fas fa-fw fa-eye mr-1"></i>Read
+                            </label>
+
+                            <label class="btn btn-outline-warning btn-sm" title="Read, Edit, Archive">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_2"
+                                    value="2"
+                                    autocomplete="off"
+                                >
+                                <i class="fas fa-fw fa-edit mr-1"></i>Modify
+                            </label>
+
+                            <label class="btn btn-outline-danger btn-sm" title="Read, Edit, Archive, Delete">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_3"
+                                    value="3"
+                                    autocomplete="off"
+                                >
+                                <i class="fas fa-fw fa-trash mr-1"></i>Full
+                            </label>
+
+                        </div>
+
+                        <small class="form-text text-muted mt-2"><?= $module_description ?></small>
+                    </div>
+
+                <?php } // end while ?>
+            </div>
+
+        </div>
+
+    </div>
+
     <div class="modal-footer">
-                    <button type="submit" name="add_role" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
+        <button type="submit" name="add_role" class="btn btn-primary text-bold">
-                    <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
+            <i class="fas fa-check mr-2"></i>Create
+        </button>
+        <button type="button" class="btn btn-light" data-dismiss="modal">
+            <i class="fas fa-times mr-2"></i>Cancel
+        </button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<script>
-</div>
+    // Optional: when Admin Yes is selected, disable permission radios + switch to Details tab
+    (function () {
+        function setPermissionsEnabled(enabled) {
+            const permsTab = document.getElementById('pills-role-permissions');
+            if (!permsTab) return;
+
+            permsTab.querySelectorAll('input[type="radio"]').forEach(function (el) {
+                el.disabled = !enabled;
+            });
+
+            // also visually dim the tab content
+            permsTab.style.opacity = enabled ? '1' : '0.5';
+        }
+
+        const adminYes = document.getElementById('admin_yes');
+        const adminNo  = document.getElementById('admin_no');
+
+        function refresh() {
+            const isAdmin = adminYes && adminYes.checked;
+            setPermissionsEnabled(!isAdmin);
+
+            if (isAdmin) {
+                // move user back to Details tab (avoids confusion)
+                const detailsTab = document.querySelector('a[href="#pills-role-details"]');
+                if (detailsTab) detailsTab.click();
+            }
+        }
+
+        if (adminYes && adminNo) {
+            adminYes.addEventListener('change', refresh);
+            adminNo.addEventListener('change', refresh);
+            refresh();
+        }
+    })();
+</script>
+
+<?php
+require_once '../../../includes/modal_footer.php';

admin/modals/role/role_edit.php

@@ -6,7 +6,7 @@ $role_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_id = $role_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $role_name = nullable_htmlentities($row['role_name']);
 $role_description = nullable_htmlentities($row['role_description']);
 $role_admin = intval($row['role_is_admin']);
@@ -31,36 +31,36 @@ if (empty($user_names_string)) {
     $user_names_string = "-";
 }
 
-
-// Generate the HTML form content using output buffering.
 ob_start();
+
 ?>
 <div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-user-shield mr-2"></i>Editing role:
-        <strong><?php echo $role_name; ?></strong></h5>
+        <strong><?= $role_name ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
 </div>
 <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
-    <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
-    <input type="hidden" name="role_id" value="<?php echo $role_id; ?>">
+    <input type="hidden" name="role_id" value="<?= $role_id ?>">
     <div class="modal-body">
-
         <ul class="nav nav-pills nav-justified mb-3">
             <li class="nav-item">
-                <a class="nav-link active" data-toggle="pill" href="#pills-role-details<?php echo $role_id; ?>">Details</a>
+                <a class="nav-link active" data-toggle="pill" href="#pills-role-details">Details</a>
             </li>
+            <?php if (!$role_admin) { ?>
             <li class="nav-item">
-                <a class="nav-link" data-toggle="pill" href="#pills-role-access<?php echo $role_id; ?>">Access</a>
+                <a class="nav-link" data-toggle="pill" href="#pills-role-permissions">Permissions</a>
             </li>
+            <?php } ?>
         </ul>
 
         <hr>
 
         <div class="tab-content">
 
-            <div class="tab-pane fade show active" id="pills-role-details<?php echo $role_id; ?>">
+            <div class="tab-pane fade show active" id="pills-role-details">
 
                 <div class="form-group">
                     <label>Name <strong class="text-danger">*</strong></label>
@@ -68,7 +68,7 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
                         </div>
-                        <input type="text" class="form-control" name="role_name" placeholder="Role Name" maxlength="200" value="<?php echo $role_name; ?>" required>
+                        <input type="text" class="form-control" name="role_name" placeholder="Role Name" maxlength="200" value="<?= $role_name ?>" required>
                     </div>
                 </div>
 
@@ -78,27 +78,33 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-chevron-right"></i></span>
                         </div>
-                        <input type="text" class="form-control" name="role_description" placeholder="Role Description" maxlength="200" value="<?php echo $role_description; ?>" required>
+                        <input type="text" class="form-control" name="role_description" placeholder="Role Description" maxlength="200" value="<?= $role_description ?>" required>
                     </div>
                 </div>
 
 
                 <div class="form-group">
                     <label>Admin Access <strong class="text-danger">*</strong></label>
-                    <div class="input-group">
+                    <div class="custom-control custom-radio mb-2">
-                        <div class="input-group-prepend">
+                        <input type="radio" class="custom-control-input" id="admin_yes" name="role_is_admin" value="1"
-                            <span class="input-group-text"><i class="fa fa-fw fa-tools"></i></span>
+                            <?php if ($role_admin) { echo 'checked'; } ?> required>
+                        <label class="custom-control-label" for="admin_yes">
+                            Yes - this role should have full admin access
+                        </label>
                     </div>
-                        <select class="form-control select2" name="role_is_admin" required>
+
-                            <option value="1" <?php if ($role_admin) { echo 'selected'; } ?> >Yes - this role should have full admin access</option>
+                    <div class="custom-control custom-radio">
-                            <option value="0" <?php if (!$role_admin) { echo 'selected'; } ?>>No - use permissions on the next tab</option>
+                        <input type="radio" class="custom-control-input" id="admin_no" name="role_is_admin" value="0"
-                        </select>
+                            <?php if (!$role_admin) { echo 'checked'; } ?> required>
+                        <label class="custom-control-label" for="admin_no">
+                            No - use permissions on the next tab
+                        </label>
                     </div>
                 </div>
 
             </div>
-
+            <?php if (!$role_admin) { ?>
-            <div class="tab-pane fade" id="pills-role-access<?php echo $role_id; ?>">
+            <div class="tab-pane fade" id="pills-role-permissions">
 
                 <?php if ($role_admin) { ?>
                     <div class="alert alert-warning"><strong>Module permissions do not apply to Admins.</strong></div>
@@ -108,14 +114,14 @@ ob_start();
 
                 // Enumerate modules
                 $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
-                while ($row_modules = mysqli_fetch_array($sql_modules)) {
+                while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
                     $module_id = intval($row_modules['module_id']);
                     $module_name = nullable_htmlentities($row_modules['module_name']);
                     $module_name_display = ucfirst(str_replace("module_","",$module_name));
                     $module_description = nullable_htmlentities($row_modules['module_description']);
 
                     // Get permission level for module
-                    $module_permission_row = mysqli_fetch_array(mysqli_query($mysqli, "SELECT user_role_permission_level FROM user_role_permissions WHERE module_id = $module_id AND user_role_id = $role_id LIMIT 1"));
+                    $module_permission_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_role_permission_level FROM user_role_permissions WHERE module_id = $module_id AND user_role_id = $role_id LIMIT 1"));
                     $module_permission = 0;
                     if ($module_permission_row) {
                         $module_permission = $module_permission_row['user_role_permission_level'];
@@ -123,22 +129,73 @@ ob_start();
                     ?>
 
                     <div class="form-group">
-                        <label> <?php echo $module_name_display ?> <strong class="text-danger">*</strong></label>
+                        <label> <?= $module_name_display ?> <strong class="text-danger">*</strong></label>
-                        <div class="input-group">
+                        <?php
-                            <select class="form-control select2" name="<?php echo "$module_id##$module_name" ?>" required>
+                        $field_name = "$module_id##$module_name";
-                                <option value="0" <?php if ($module_permission == 0) { echo 'selected'; } ?> >None</option>
+                        $group_id = "perm_group_$module_id";
-                                <option value="1" <?php if ($module_permission == 1) { echo 'selected'; } ?> >Read</option>
+                        ?>
-                                <option value="2" <?php if ($module_permission == 2) { echo 'selected'; } ?>>Modify (Read, Edit, Archive)</option>
+
-                                <option value="3" <?php if ($module_permission == 3) { echo 'selected'; } ?>>Full (Read, Edit, Archive, Delete)</option>
+                        <div class="btn-group btn-group-toggle btn-block" data-toggle="buttons" role="group" aria-label="Permissions for <?= $module_name_display ?>">
-                            </select>
+
+                            <label class="btn btn-outline-secondary btn-sm <?php if ($module_permission == 0) { echo 'active'; } ?>" title="No Access">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_0"
+                                    value="0"
+                                    autocomplete="off"
+                                    <?php if ($module_permission == 0) { echo 'checked'; } ?>
+                                    required
+                                >
+                                None
+                            </label>
+
+                            <label class="btn btn-outline-primary btn-sm <?php if ($module_permission == 1) { echo 'active'; } ?>" title="Viewing Only">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_1"
+                                    value="1"
+                                    autocomplete="off"
+                                    <?php if ($module_permission == 1) { echo 'checked'; } ?>
+                                >
+                                <i class="fas fa-fw fa-eye mr-1"></i>Read
+                            </label>
+
+                            <label class="btn btn-outline-warning btn-sm <?php if ($module_permission == 2) { echo 'active'; } ?>" title="Read, Edit, Archive">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_2"
+                                    value="2"
+                                    autocomplete="off"
+                                    <?php if ($module_permission == 2) { echo 'checked'; } ?>
+                                >
+                                <i class="fas fa-fw fa-edit mr-1"></i>Modify
+                            </label>
+
+                            <label class="btn btn-outline-danger btn-sm <?php if ($module_permission == 3) { echo 'active'; } ?>" title="Read, Edit, Archive, Delete">
+                                <input
+                                    type="radio"
+                                    name="<?= $field_name ?>"
+                                    id="<?= $group_id ?>_3"
+                                    value="3"
+                                    autocomplete="off"
+                                    <?php if ($module_permission == 3) { echo 'checked'; } ?>
+                                >
+                                <i class="fas fa-fw fa-trash mr-1"></i>Full
+                            </label>
+
                         </div>
-                        <small class="form-text text-muted"><?php echo $module_description ?></small>
+
+                        <small class="form-text text-muted mt-2"><?= $module_description ?></small>
 
                     </div>
 
                 <?php } // End while ?>
 
             </div>
+            <?php } ?>
 
         </div>
 

admin/modals/software_template/software_template_add.php

@@ -1,13 +1,18 @@
-<div class="modal" id="addSoftwareTemplateModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fa fa-fw fa-cube mr-2"></i>New License Template</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <div class="modal-body">
 
         <div class="form-group">
@@ -77,7 +82,7 @@
         <button type="submit" name="add_software_template" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/software_template/software_template_edit.php

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
 $software_template_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $software_name = nullable_htmlentities($row['software_template_name']);
 $software_version = nullable_htmlentities($row['software_template_version']);
 $software_description = nullable_htmlentities($row['software_template_description']);

admin/modals/tag/tag_add.php

@@ -15,8 +15,11 @@ if (isset($_GET['type'])) {
         $type_display = "Contact";
     } elseif ($type === 4) {
         $type_display = "Credential";
+    } elseif ($type === 5) {
+        $type_display = "Asset";
     }
 }
+ob_start();
 
 ?>
 
@@ -57,6 +60,7 @@ if (isset($_GET['type'])) {
                     <option value="2">Location Tag</option>
                     <option value="3">Contact Tag</option>
                     <option value="4">Credential Tag</option>
+                    <option value="5">Asset Tag</option>
                 </select>
             </div>
         </div>
@@ -85,7 +89,7 @@ if (isset($_GET['type'])) {
 
     </div>
     <div class="modal-footer">
-        <button type="submit" name="add_tag" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create</button>
+        <button type="submit" name="add_tag" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create Tag</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
 </form>

admin/modals/tag/tag_edit.php

@@ -6,17 +6,30 @@ $tag_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $tag_name = nullable_htmlentities($row['tag_name']);
 $tag_type = intval($row['tag_type']);
 $tag_color = nullable_htmlentities($row['tag_color']);
 $tag_icon = nullable_htmlentities($row['tag_icon']);
 
-// Generate the HTML form content using output buffering.
+if ($tag_type == 1) {
+    $tag_type_display = "Client";
+} elseif ( $tag_type == 2) {
+    $tag_type_display = "Location";
+} elseif ( $tag_type == 3) {
+    $tag_type_display = "Contact";
+} elseif ( $tag_type == 4) {
+    $tag_type_display = "Credential";
+ } elseif ( $tag_type == 5) {
+    $tag_type_display = "Asset";
+} else {
+    $tag_type_display = "Unknown";
+}
+
 ob_start();
 ?>
 <div class="modal-header bg-dark">
-    <h5 class="modal-title"><i class="fas fa-fw fa-tag mr-2"></i>Editing tag: <strong><?php echo $tag_name; ?></strong></h5>
+    <h5 class="modal-title"><i class="fas fa-fw fa-tag mr-2"></i><?= $tag_type_display ?> Tag: <strong><?php echo $tag_name; ?></strong></h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
@@ -35,22 +48,6 @@ ob_start();
             </div>
         </div>
 
-        <div class="form-group">
-            <label>Type <strong class="text-danger">*</strong></label>
-            <div class="input-group">
-                <div class="input-group-prepend">
-                    <span class="input-group-text"><i class="fa fa-fw fa-th"></i></span>
-                </div>
-                <select class="form-control select2" name="type" required>
-                    <option value="">- Type -</option>
-                    <option value="1" <?php if ($tag_type == 1) { echo "selected"; } ?>>Client Tag</option>
-                    <option value="2" <?php if ($tag_type == 2) { echo "selected"; } ?>>Location Tag</option>
-                    <option value="3" <?php if ($tag_type == 3) { echo "selected"; } ?>>Contact Tag</option>
-                    <option value="4" <?php if ($tag_type == 4) { echo "selected"; } ?>>Credential Tag</option>
-                </select>
-            </div>
-        </div>
-
         <div class="form-group">
             <label>Color <strong class="text-danger">*</strong></label>
             <div class="input-group">
@@ -73,7 +70,7 @@ ob_start();
 
     </div>
     <div class="modal-footer">
-        <button type="submit" name="edit_tag" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
+        <button type="submit" name="edit_tag" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save changes</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
 </form>

admin/modals/tax/tax_add.php

@@ -1,13 +1,18 @@
-<div class="modal" id="addTaxModal" tabindex="-1">
+<?php
-  <div class="modal-dialog">
+
-    <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-      <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-balance-scale mr-2"></i>New Tax</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span aria-hidden="true">&times;</span>
     </button>
-      </div>
+</div>
-      <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
     <div class="modal-body">
@@ -21,10 +26,10 @@
         </div>
     </div>
     <div class="modal-footer">
-          <button type="submit" name="add_tax" class="btn btn-primary text-bold"><i class="fa fa-check mr- 2"></i>Create</button>
+        <button type="submit" name="add_tax" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-      </form>
+</form>
-    </div>
+
-  </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/tax/tax_edit.php

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
 $tax_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $tax_name = nullable_htmlentities($row['tax_name']);
 $tax_percent = floatval($row['tax_percent']);
 

admin/modals/ticket_status/ticket_status_add.php

@@ -1,16 +1,17 @@
-<div class="modal" id="addTicketStatusModal" tabindex="-1">
+<?php
-  <div class="modal-dialog">
+require_once '../../../includes/modal_header.php';
-    <div class="modal-content">
+ob_start();
-      <div class="modal-header bg-dark">
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-info-circle mr-2"></i>New Ticket Status</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-      </div>
+</div>
-      <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
 
     <div class="modal-body">
-          
         <div class="form-group">
             <label>Name <strong class="text-danger">*</strong></label>
             <div class="input-group">
@@ -36,7 +37,7 @@
         <button type="submit" name="add_ticket_status" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-      </form>
+</form>
-    </div>
+
-  </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/ticket_status/ticket_status_edit.php

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
 $ticket_status_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $ticket_status_name = nullable_htmlentities($row['ticket_status_name']);
 $ticket_status_color = nullable_htmlentities($row['ticket_status_color']);
 $ticket_status_order = intval($row['ticket_status_order']);

admin/modals/ticket_template/ticket_template_add.php

@@ -1,13 +1,17 @@
-<div class="modal" id="addTicketTemplateModal" tabindex="-1">
+<?php
-    <div class="modal-dialog modal-lg">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
-                <h5 class="modal-title"><i class="fa fa-fw fa-life-ring mr-2"></i>Creating Ticket Template</h5>
+ob_start();
+
+?>
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fa fa-fw fa-life-ring mr-2"></i>New Ticket Template</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <div class="modal-body">
 
         <div class="form-group">
@@ -55,7 +59,7 @@
                     <?php
 
                     $sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
-                                while ($row = mysqli_fetch_array($sql_project_templates)) {
+                    while ($row = mysqli_fetch_assoc($sql_project_templates)) {
                         $project_template_id_select = intval($row['project_template_id']);
                         $project_template_name_select = nullable_htmlentities($row['project_template_name']); ?>
                         <option value="<?php echo $project_template_id_select; ?>"><?php echo $project_template_name_select; ?></option>
@@ -66,10 +70,10 @@
         </div>
     </div>
     <div class="modal-footer">
-                    <button type="submit" name="add_ticket_template" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
+        <button type="submit" name="add_ticket_template" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create Template</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/ticket_template/ticket_template_task_edit.php

@@ -6,7 +6,7 @@ $task_template_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $task_template_name = nullable_htmlentities($row['task_template_name']);
 $task_template_order = intval($row['task_template_order']);
 $task_template_completion_estimate = intval($row['task_template_completion_estimate']);

admin/modals/user/ajax_user_edit.php

@@ -1,204 +0,0 @@
-<?php
-
-require_once '../../includes/modal_header.php';
-
-$user_id = intval($_GET['id']);
-
-$sql = mysqli_query($mysqli, "SELECT * FROM users 
-    LEFT JOIN user_settings ON users.user_id = user_settings.user_id
-    WHERE users.user_id = $user_id LIMIT 1"
-);
-
-$row = mysqli_fetch_array($sql);
-$user_name = nullable_htmlentities($row['user_name']);
-$user_email = nullable_htmlentities($row['user_email']);
-$user_avatar = nullable_htmlentities($row['user_avatar']);
-$user_token = nullable_htmlentities($row['user_token']);
-$user_config_force_mfa = intval($row['user_config_force_mfa']);
-$user_role_id = intval($row['user_role_id']);
-$user_initials = nullable_htmlentities(initials($user_name));
-
-// Get User Client Access Permissions
-$user_client_access_sql = mysqli_query($mysqli,"SELECT client_id FROM user_client_permissions WHERE user_id = $user_id");
-$client_access_array = [];
-while ($row = mysqli_fetch_assoc($user_client_access_sql)) {
-    $client_access_array[] = intval($row['client_id']);
-}
-
-// Generate the HTML form content using output buffering.
-ob_start();
-?>
-<div class="modal-header bg-dark">
-    <h5 class="modal-title"><i class="fas fa-fw fa-user-edit mr-2"></i>Editing user:
-        <strong><?php echo $user_name; ?></strong></h5>
-    <button type="button" class="close text-white" data-dismiss="modal">
-        <span>&times;</span>
-    </button>
-</div>
-<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
-    <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
-    <input type="hidden" name="user_id" value="<?php echo $user_id; ?>">
-    <div class="modal-body">
-
-        <ul class="nav nav-pills nav-justified mb-3">
-            <li class="nav-item">
-                <a class="nav-link active" data-toggle="pill" href="#pills-user-details<?php echo $user_id; ?>">Details</a>
-            </li>
-            <li class="nav-item">
-                <a class="nav-link" data-toggle="pill" href="#pills-user-access<?php echo $user_id; ?>">Restrict Access</a>
-            </li>
-        </ul>
-
-        <hr>
-
-        <div class="tab-content">
-
-            <div class="tab-pane fade show active" id="pills-user-details<?php echo $user_id; ?>">
-
-                <center class="mb-3">
-                    <?php if (!empty($user_avatar)) { ?>
-                        <img class="img-fluid" src="<?php echo "uploads/users/$user_id/$user_avatar"; ?>">
-                    <?php } else { ?>
-                        <span class="fa-stack fa-4x">
-                            <i class="fa fa-circle fa-stack-2x text-secondary"></i>
-                            <span class="fa fa-stack-1x text-white"><?php echo $user_initials; ?></span>
-                        </span>
-                    <?php } ?>
-                </center>
-
-                <div class="form-group">
-                    <label>Name <strong class="text-danger">*</strong></label>
-                    <div class="input-group">
-                        <div class="input-group-prepend">
-                            <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
-                        </div>
-                        <input type="text" class="form-control" name="name" placeholder="Full Name" maxlength="200"
-                               value="<?php echo $user_name; ?>" required>
-                    </div>
-                </div>
-
-                <div class="form-group">
-                    <label>Email <strong class="text-danger">*</strong></label>
-                    <div class="input-group">
-                        <div class="input-group-prepend">
-                            <span class="input-group-text"><i class="fa fa-fw fa-envelope"></i></span>
-                        </div>
-                        <input type="email" class="form-control" name="email" placeholder="Email Address" maxlength="200"
-                               value="<?php echo $user_email; ?>" required>
-                    </div>
-                </div>
-
-                <div class="form-group">
-                    <label>New Password</label>
-                    <div class="input-group">
-                        <div class="input-group-prepend">
-                            <span class="input-group-text"><i class="fa fa-fw fa-lock"></i></span>
-                        </div>
-                        <input type="password" class="form-control" data-toggle="password" name="new_password"
-                               placeholder="Leave Blank For No Password Change" autocomplete="new-password">
-                        <div class="input-group-append">
-                            <span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="form-group">
-                    <label>Role <strong class="text-danger">*</strong></label>
-                    <div class="input-group">
-                        <div class="input-group-prepend">
-                            <span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
-                        </div>
-                        <select class="form-control select2" name="role" required>
-                            <?php
-                            $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
-                            while ($row = mysqli_fetch_array($sql_user_roles)) {
-                                $role_id = intval($row['role_id']);
-                                $role_name = nullable_htmlentities($row['role_name']);
-
-                                ?>
-                                <option <?php if ($role_id == $user_role_id) {echo "selected";} ?> value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
-                            <?php } ?>
-
-                        </select>
-                    </div>
-                </div>
-
-                <div class="form-group">
-                    <label>Avatar</label>
-                    <input type="file" class="form-control-file" accept="image/*" name="file">
-                </div>
-
-                <div class="form-group">
-                    <div class="custom-control custom-checkbox">
-                        <input class="custom-control-input" type="checkbox" id="forceMFACheckBox<?php echo $user_id; ?>" name="force_mfa" value="1" <?php if($user_config_force_mfa == 1){ echo "checked"; } ?>>
-                        <label for="forceMFACheckBox<?php echo $user_id; ?>" class="custom-control-label">
-                            Force MFA
-                        </label>
-                    </div>
-                </div>
-
-                <?php if (!empty($user_token)) { ?>
-
-                    <div class="form-group">
-                        <label>2FA</label>
-                        <div class="input-group">
-                            <div class="input-group-prepend">
-                                <span class="input-group-text"><i class="fa fa-fw fa-id-card"></i></span>
-                            </div>
-                            <select class="form-control" name="2fa">
-                                <option value="">Keep enabled</option>
-                                <option value="disable">Disable</option>
-                            </select>
-                        </div>
-                    </div>
-
-                <?php } ?>
-            </div>
-
-            <div class="tab-pane fade" id="pills-user-access<?php echo $user_id; ?>">
-
-                <div class="alert alert-info">
-                    Check boxes to authorize user client access. No boxes grant full client access. Admin users are unaffected.
-                </div>
-
-                <ul class="list-group">
-                    <li class="list-group-item bg-dark">
-                        <div class="form-check">
-                            <input type="checkbox" class="form-check-input" onclick="this.closest('.tab-pane').querySelectorAll('.client-checkbox').forEach(checkbox => checkbox.checked = this.checked);">
-                            <label class="form-check-label ml-3"><strong>Restrict Access to Clients</strong></label>
-                        </div>
-                    </li>
-
-                    <?php
-
-                    $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
-                    while ($row = mysqli_fetch_array($sql_client_select)) {
-                        $client_id_select = intval($row['client_id']);
-                        $client_name_select = nullable_htmlentities($row['client_name']);
-
-                    ?>
-
-                    <li class="list-group-item">
-                        <div class="form-check">
-                            <input type="checkbox" class="form-check-input client-checkbox" name="clients[]" value="<?php echo $client_id_select; ?>" <?php if (in_array($client_id_select, $client_access_array)) { echo "checked"; } ?>>
-                            <label class="form-check-label ml-2"><?php echo $client_name_select; ?></label>
-                        </div>
-                    </li>
-
-                    <?php } ?>
-
-                </ul>
-
-            </div>
-
-        </div>
-
-    </div>
-    <div class="modal-footer">
-        <button type="submit" name="edit_user" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
-        <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
-    </div>
-</form>
-
-<?php
-require_once '../../includes/modal_footer.php';

admin/modals/user/user_add.php

@@ -1,13 +1,17 @@
-<div class="modal" id="addUserModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-user-plus mr-2"></i>New User</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
     <div class="modal-body">
 
@@ -72,7 +76,7 @@
                             <option value="">- Role -</option>
                             <?php
                                 $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
-                                            while ($row = mysqli_fetch_array($sql_user_roles)) {
+                                while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                     $role_id = intval($row['role_id']);
                                     $role_name = nullable_htmlentities($row['role_name']);
 
@@ -125,7 +129,7 @@
                     <?php
 
                     $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
-                                while ($row = mysqli_fetch_array($sql_client_select)) {
+                    while ($row = mysqli_fetch_assoc($sql_client_select)) {
                         $client_id = intval($row['client_id']);
                         $client_name = nullable_htmlentities($row['client_name']);
 
@@ -150,7 +154,23 @@
         <button type="submit" name="add_user" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Create</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<script>
-</div>
+
+function generatePassword() {
+    jQuery.get(
+        "/agent/ajax.php", {
+            get_readable_pass: 'true'
+        },
+        function(data) {
+            const password = JSON.parse(data);
+            document.getElementById("password").value = password;
+        }
+    );
+}
+
+</script>
+
+<?php
+require_once "../../../includes/modal_footer.php";

admin/modals/user/user_all_reset_password.php

@@ -1,7 +1,11 @@
-<div class="modal" id="resetAllUserPassModal" tabindex="-1">
+<?php
-    <div class="modal-dialog modal-lg">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-body">
+
+ob_start();
+
+?>
+<div class="modal-body">
     <div class="mb-4" style="text-align: center;">
         <i class="far fas fa-10x fa-skull-crossbones text-danger mb-3 mt-3"></i>
         <h2>Incident Response: Agent Password Reset</h2>
@@ -25,7 +29,7 @@
     </div>
     <button type="button" class="btn btn-outline-secondary btn-lg px-5 mr-4" data-dismiss="modal">Cancel</button>
 
-            </div>
-        </div>
-    </div>
 </div>
+
+<?php
+require_once "../../../includes/modal_footer.php";

admin/modals/user/user_archive.php

@@ -1,16 +1,83 @@
-<div class="modal" id="archiveUserModal<?php echo $user_id; ?>" tabindex="-1">
+<?php
-  <div class="modal-dialog">
+
-    <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-      <div class="modal-body">
+
-        <div class="mb-4" style="text-align: center;">
+$user_id = intval($_GET['id']);
-          <i class="far fa-10x fa-times-circle text-danger mb-3 mt-3"></i>
+
-          <h2>Are you sure?</h2>
+$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
-          <h6 class="mb-4 text-secondary">Do you really want to <b>archive <?php echo $user_name; ?></b>? This process cannot be undone.</h6>
+
-          <h6 class="mb-4 text-secondary"><?php echo $user_name ?> will no longer be able to log in or use ITFlow, but all associated content will remain accessible.</h6>
+$row = mysqli_fetch_assoc($sql);
-          <button type="button" class="btn btn-outline-secondary btn-lg px-5 mr-4" data-dismiss="modal">Cancel</button>
+$user_name = nullable_htmlentities($row['user_name']);
-          <a class="btn btn-danger btn-lg px-5" href="post.php?archive_user=<?php echo $user_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">Yes, archive!</a>
+$user_email = nullable_htmlentities($row['user_email']);
-        </div>
+$user_avatar = nullable_htmlentities($row['user_avatar']);
-      </div>
+$user_initials = nullable_htmlentities(initials($user_name));
-    </div>
+
-  </div>
+$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+    WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
+
+$ticket_count = mysqli_num_rows($sql_related_tickets);
+
+// Related Recurring Tickets Query
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
+
+$recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
+
+// Generate the HTML form content using output buffering.
+ob_start();
+?>
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fas fa-fw fa-user-slash mr-2"></i>Archiving user:
+        <strong><?php echo $user_name; ?></strong></h5>
+    <button type="button" class="close text-white" data-dismiss="modal">
+        <span>&times;</span>
+    </button>
 </div>
+<form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+    <input type="hidden" name="user_id" value="<?php echo $user_id; ?>">
+    <div class="modal-body">
+
+
+        <center class="mb-3">
+            <?php if (!empty($user_avatar)) { ?>
+                <img class="img-fluid" src="<?php echo "../uploads/users/$user_id/$user_avatar"; ?>">
+            <?php } else { ?>
+                <span class="fa-stack fa-4x">
+                    <i class="fa fa-circle fa-stack-2x text-secondary"></i>
+                    <span class="fa fa-stack-1x text-white"><?php echo $user_initials; ?></span>
+                </span>
+            <?php } ?>
+        </center>
+
+
+        <div class="form-group">
+            <label>Reassign <?= $ticket_count ?> Open Tickets and <?= $recurring_ticket_count ?> Recurring Tickets To:</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
+                </div>
+                <select class="form-control select2" name="ticket_assign" required>
+                    <option value="0">No one</option>
+                    <?php
+                    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
+                    while ($row = mysqli_fetch_assoc($sql_users)) {
+                        $user_id_select = intval($row['user_id']);
+                        $user_name_select = nullable_htmlentities($row['user_name']);
+
+                        ?>
+                        <option value="<?= $user_id_select ?>"><?= $user_name_select ?></option>
+                    <?php } ?>
+
+                </select>
+            </div>
+        </div>
+
+    </div>
+    <div class="modal-footer">
+        <button type="submit" name="archive_user" class="btn btn-danger text-bold"><i class="fas fa-archive mr-2"></i>Archive</button>
+        <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
+    </div>
+</form>
+
+<?php
+require_once "../../../includes/modal_footer.php";

admin/modals/user/user_edit.php

@@ -9,7 +9,7 @@ $sql = mysqli_query($mysqli, "SELECT * FROM users
     WHERE users.user_id = $user_id LIMIT 1"
 );
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $user_name = nullable_htmlentities($row['user_name']);
 $user_email = nullable_htmlentities($row['user_email']);
 $user_avatar = nullable_htmlentities($row['user_avatar']);
@@ -57,7 +57,7 @@ ob_start();
 
                 <center class="mb-3">
                     <?php if (!empty($user_avatar)) { ?>
-                        <img class="img-fluid" src="<?php echo "uploads/users/$user_id/$user_avatar"; ?>">
+                        <img class="img-fluid" src="<?php echo "../uploads/users/$user_id/$user_avatar"; ?>">
                     <?php } else { ?>
                         <span class="fa-stack fa-4x">
                             <i class="fa fa-circle fa-stack-2x text-secondary"></i>
@@ -94,11 +94,14 @@ ob_start();
                         <div class="input-group-prepend">
                             <span class="input-group-text"><i class="fa fa-fw fa-lock"></i></span>
                         </div>
-                        <input type="password" class="form-control" data-toggle="password" name="new_password"
+                        <input type="password" class="form-control" data-toggle="password" name="new_password" id="password"
                                placeholder="Leave Blank For No Password Change" autocomplete="new-password">
                         <div class="input-group-append">
                             <span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span>
                         </div>
+                        <div class="input-group-append">
+                            <span class="btn btn-default"><i class="fa fa-fw fa-question" onclick="generatePassword()"></i></span>
+                        </div>
                     </div>
                 </div>
 
@@ -111,7 +114,7 @@ ob_start();
                         <select class="form-control select2" name="role" required>
                             <?php
                             $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
-                            while ($row = mysqli_fetch_array($sql_user_roles)) {
+                            while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                 $role_id = intval($row['role_id']);
                                 $role_name = nullable_htmlentities($row['role_name']);
 
@@ -172,7 +175,7 @@ ob_start();
                     <?php
 
                     $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
-                    while ($row = mysqli_fetch_array($sql_client_select)) {
+                    while ($row = mysqli_fetch_assoc($sql_client_select)) {
                         $client_id_select = intval($row['client_id']);
                         $client_name_select = nullable_htmlentities($row['client_name']);
 
@@ -200,5 +203,23 @@ ob_start();
     </div>
 </form>
 
+<script>
+
+function generatePassword() {
+    // Send a GET request to ajax.php as ajax.php?get_readable_pass=true
+    jQuery.get(
+        "/agent/ajax.php", {
+            get_readable_pass: 'true'
+        },
+        function(data) {
+            //If we get a response from post.php, parse it as JSON
+            const password = JSON.parse(data);
+            document.getElementById("password").value = password;
+        }
+    );
+}
+
+</script>
+
 <?php
-require_once "../../../includes/modal_footer_new.php";
+require_once "../../../includes/modal_footer.php";

admin/modals/user/user_export.php

@@ -1,13 +1,18 @@
-<div class="modal" id="exportUserModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-download mr-2"></i>Export Users to CSV</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
     <div class="modal-body">
 
     </div>
@@ -15,7 +20,7 @@
         <button type="submit" name="export_users_csv" class="btn btn-primary text-bold"><i class="fas fa-fw fa-download mr-2"></i>Download CSV</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/user/user_invite.php

@@ -1,13 +1,17 @@
-<div class="modal" id="userInviteModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-user-plus"></i>Invite User</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
     <div class="modal-body">
 
@@ -39,7 +43,7 @@
         <button type="submit" name="invite_user" class="btn btn-primary text-bold"><i class="fas fa-paper-plane mr-2"></i>Send Invite</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once "../../../includes/modal_footer.php";

admin/modals/user/user_restore.php

@@ -0,0 +1,87 @@
+<?php
+
+require_once '../../../includes/modal_header.php';
+
+$user_id = intval($_GET['id']);
+
+$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
+
+$row = mysqli_fetch_assoc($sql);
+$user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
+$user_name = nullable_htmlentities($user_name);
+$user_email = nullable_htmlentities($row['user_email']);
+$user_avatar = nullable_htmlentities($row['user_avatar']);
+$user_initials = initials($user_name);
+$user_role_id = intval($row['user_role_id']);
+
+// Generate the HTML form content using output buffering.
+ob_start();
+?>
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fas fa-fw fa-redo-alt mr-2"></i>Restoring user:
+        <strong><?php echo $user_name; ?></strong></h5>
+    <button type="button" class="close text-white" data-dismiss="modal">
+        <span>&times;</span>
+    </button>
+</div>
+<form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+    <input type="hidden" name="user_id" value="<?php echo $user_id; ?>">
+    <div class="modal-body">
+
+
+        <center class="mb-3">
+            <?php if (!empty($user_avatar)) { ?>
+                <img class="img-fluid" src="<?php echo "../uploads/users/$user_id/$user_avatar"; ?>">
+            <?php } else { ?>
+                <span class="fa-stack fa-4x">
+                    <i class="fa fa-circle fa-stack-2x text-secondary"></i>
+                    <span class="fa fa-stack-1x text-white"><?php echo $user_initials; ?></span>
+                </span>
+            <?php } ?>
+        </center>
+
+        <div class="form-group">
+            <label>Set a New Password</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-lock"></i></span>
+                </div>
+                <input type="password" class="form-control" data-toggle="password" name="new_password"
+                       placeholder="Enter a new password" autocomplete="new-password" required>
+                <div class="input-group-append">
+                    <span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span>
+                </div>
+            </div>
+        </div>
+
+        <div class="form-group">
+            <label>Role <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
+                </div>
+                <select class="form-control select2" name="role" required>
+                    <?php
+                    $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                    while ($row = mysqli_fetch_assoc($sql_user_roles)) {
+                        $role_id = intval($row['role_id']);
+                        $role_name = nullable_htmlentities($row['role_name']);
+
+                        ?>
+                        <option <?php if ($role_id == $user_role_id) {echo "selected";} ?> value="<?php echo $role_id; ?>"><?php echo $role_name; ?></option>
+                    <?php } ?>
+
+                </select>
+            </div>
+        </div>
+
+    </div>
+    <div class="modal-footer">
+        <button type="submit" name="restore_user" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Restore</button>
+        <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
+    </div>
+</form>
+
+<?php
+require_once "../../../includes/modal_footer.php";

admin/modals/vendor_template/vendor_template_add.php

@@ -1,15 +1,18 @@
-<div class="modal" id="addVendorTemplateModal" tabindex="-1">
+<?php
-    <div class="modal-dialog">
+
-        <div class="modal-content">
+require_once '../../../includes/modal_header.php';
-            <div class="modal-header bg-dark">
+
+ob_start();
+
+?>
+
+<div class="modal-header bg-dark">
     <h5 class="modal-title"><i class="fas fa-fw fa-building mr-2"></i>New Vendor Template</h5>
     <button type="button" class="close text-white" data-dismiss="modal">
         <span>&times;</span>
     </button>
-            </div>
+</div>
-            <form action="post.php" method="post" autocomplete="off">
+<form action="post.php" method="post" autocomplete="off">
-
-                <input type="hidden" name="client_id" value="<?php if (isset($_GET['client_id'])) { echo $client_id; } else { echo 0; } ?>">
 
     <div class="modal-body">
 
@@ -162,7 +165,7 @@
         <button type="submit" name="add_vendor_template" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create Template</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
-            </form>
+</form>
-        </div>
+
-    </div>
+<?php
-</div>
+require_once '../../../includes/modal_footer.php';

admin/modals/vendor_template/vendor_template_edit.php

@@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php';
 $vendor_template_id = intval($_GET['id']);
 
 $sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $vendor_name = nullable_htmlentities($row['vendor_template_name']);
 $vendor_description = nullable_htmlentities($row['vendor_template_description']);
 $vendor_account_number = nullable_htmlentities($row['vendor_template_account_number']);

admin/modules.php

@@ -0,0 +1,113 @@
+<?php
+
+// Default Column Sortby Filter
+$sort = "module_name";
+$order = "DESC";
+
+require_once "includes/inc_all_admin.php";
+
+$sql = mysqli_query(
+    $mysqli,
+    "SELECT SQL_CALC_FOUND_ROWS * FROM modules
+    WHERE (module_name LIKE '%$q%' OR module_description LIKE '%$q%')
+    ORDER BY $sort $order LIMIT $record_from, $record_to"
+);
+
+$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+
+?>
+
+<div class="card card-dark">
+    <div class="card-header py-2">
+        <h3 class="card-title mt-2"><i class="fas fa-fw fa-puzzle-piece mr-2"></i>Access Modules</h3>
+        <div class="card-tools">
+            <div class="btn-group">
+                <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/module/module_add.php">
+                    <i class="fas fa-fw fa-plus mr-2"></i>New Module
+                </button>
+            </div>
+        </div>
+    </div>
+    <div class="card-body">
+        <form class="mb-4" autocomplete="off">
+            <div class="row">
+                <div class="col-md-4">
+                    <div class="input-group">
+                        <input type="search" class="form-control" name="q" value="<?php if (isset($q)) {echo stripslashes(nullable_htmlentities($q));} ?>" placeholder="Search Modules">
+                        <div class="input-group-append">
+                            <button class="btn btn-primary"><i class="fa fa-search"></i></button>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </form>
+        <hr>
+        <div class="table-responsive-sm">
+            <table class="table table-striped table-borderless table-hover">
+                <thead class="text-dark <?php if ($num_rows[0] == 0) { echo "d-none"; } ?> text-nowrap">
+                <tr>
+                    <th>
+                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=module_name&order=<?php echo $disp; ?>">
+                            Module <?php if ($sort == 'module_name') { echo $order_icon; } ?>
+                        </a>
+                    </th>
+                    <th class="text-center">Action</th>
+                </tr>
+                </thead>
+                <tbody>
+                <?php
+
+                while ($row = mysqli_fetch_assoc($sql)) {
+                    $module_id = intval($row['module_id']);
+                    $module_name = nullable_htmlentities($row['module_name']);
+                    $module_description = nullable_htmlentities($row['module_description']);
+
+                    ?>
+                    <tr>
+                        <td>
+                            <a href="#" <?php if ($module_id > 6) { ?> class="ajax-modal" data-modal-url="modals/modules/module_edit.php?id=<?= $module_id ?>" <?php } ?>>
+                                <strong class="text-dark"><?= $module_name ?></strong>
+                            </a>
+                            <div class="text-secondary"><?= $module_description ?></div>
+                        </td>
+                        <td>
+                            <?php if ($module_id > 6) { ?>
+                                <div class="dropdown dropleft text-center">
+                                    <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
+                                        <i class="fas fa-ellipsis-h"></i>
+                                    </button>
+                                    <div class="dropdown-menu">
+
+                                        <a class="dropdown-item ajax-modal" href="#"
+                                            data-modal-url="modals/module/module_edit.php?id=<?= $module_id ?>">
+                                            <i class="fas fa-fw fa-user-edit mr-2"></i>Edit
+                                        </a>
+
+                                        <div class="dropdown-divider"></div>
+                                        <a class="dropdown-item text-danger confirm-link" href="post.php?delete_module=<?= $module_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
+                                            <i class="fas fa-fw fa-archive mr-2"></i>Delete
+                                        </a>
+
+                                    </div>
+                                </div>
+                            <?php } else { echo "<p class='text-center'>N/A Predefined</p>"; } ?>
+                        </td>
+                    </tr>
+
+                    <?php
+
+                }
+
+                ?>
+
+                </tbody>
+            </table>
+        </div>
+        <?php require_once "../includes/filter_footer.php";
+        ?>
+    </div>
+</div>
+
+<?php
+
+require_once "../includes/footer.php";

admin/oauth_microsoft_mail_callback.php

@@ -0,0 +1,103 @@
+<?php
+
+require_once "../config.php";
+require_once "../functions.php";
+require_once "../includes/check_login.php";
+
+$settings_mail_path = '/admin/settings_mail.php';
+
+if (!isset($session_is_admin) || !$session_is_admin) {
+    flash_alert("Admin access required.", 'error');
+    redirect($settings_mail_path);
+}
+
+$state = sanitizeInput($_GET['state'] ?? '');
+$code = $_GET['code'] ?? '';
+$error = sanitizeInput($_GET['error'] ?? '');
+$error_description = sanitizeInput($_GET['error_description'] ?? '');
+
+$session_state = $_SESSION['mail_oauth_state'] ?? '';
+$session_state_expires = intval($_SESSION['mail_oauth_state_expires_at'] ?? 0);
+
+unset($_SESSION['mail_oauth_state'], $_SESSION['mail_oauth_state_expires_at']);
+
+if (!empty($error)) {
+    $msg = "Microsoft OAuth authorization failed: $error";
+    if (!empty($error_description)) {
+        $msg .= " ($error_description)";
+    }
+
+    flash_alert($msg, 'error');
+    redirect($settings_mail_path);
+}
+
+if (empty($state) || empty($code) || empty($session_state) || !hash_equals($session_state, $state) || time() > $session_state_expires) {
+    flash_alert("Microsoft OAuth callback validation failed. Please try connecting again.", 'error');
+    redirect($settings_mail_path);
+}
+
+if (empty($config_mail_oauth_client_id) || empty($config_mail_oauth_client_secret) || empty($config_mail_oauth_tenant_id)) {
+    flash_alert("Microsoft OAuth settings are incomplete. Please fill Client ID, Client Secret, and Tenant ID.", 'error');
+    redirect($settings_mail_path);
+}
+
+if (defined('BASE_URL') && !empty(BASE_URL)) {
+    $base_url = rtrim((string) BASE_URL, '/');
+} else {
+    $base_url = 'https://' . rtrim((string) $config_base_url, '/');
+}
+
+$redirect_uri = $base_url . '/admin/oauth_microsoft_mail_callback.php';
+$token_url = 'https://login.microsoftonline.com/' . rawurlencode($config_mail_oauth_tenant_id) . '/oauth2/v2.0/token';
+$scope = 'offline_access openid profile https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send';
+
+$ch = curl_init($token_url);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_setopt($ch, CURLOPT_POST, true);
+curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
+    'client_id' => $config_mail_oauth_client_id,
+    'client_secret' => $config_mail_oauth_client_secret,
+    'grant_type' => 'authorization_code',
+    'code' => $code,
+    'redirect_uri' => $redirect_uri,
+    'scope' => $scope,
+], '', '&'));
+curl_setopt($ch, CURLOPT_TIMEOUT, 20);
+
+$raw_body = curl_exec($ch);
+$curl_err = curl_error($ch);
+$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+curl_close($ch);
+
+if ($raw_body === false || $http_code < 200 || $http_code >= 300) {
+    $reason = !empty($curl_err) ? $curl_err : "HTTP $http_code";
+    flash_alert("Microsoft OAuth token exchange failed: $reason", 'error');
+    redirect($settings_mail_path);
+}
+
+$json = json_decode($raw_body, true);
+if (!is_array($json) || empty($json['refresh_token']) || empty($json['access_token'])) {
+    flash_alert("Microsoft OAuth token exchange failed: refresh token or access token missing.", 'error');
+    redirect($settings_mail_path);
+}
+
+$refresh_token = (string) $json['refresh_token'];
+$access_token = (string) $json['access_token'];
+$expires_at = date('Y-m-d H:i:s', time() + (int)($json['expires_in'] ?? 3600));
+
+$refresh_token_esc = mysqli_real_escape_string($mysqli, $refresh_token);
+$access_token_esc = mysqli_real_escape_string($mysqli, $access_token);
+$expires_at_esc = mysqli_real_escape_string($mysqli, $expires_at);
+
+mysqli_query($mysqli, "UPDATE settings SET
+    config_imap_provider = 'microsoft_oauth',
+    config_smtp_provider = 'microsoft_oauth',
+    config_mail_oauth_refresh_token = '$refresh_token_esc',
+    config_mail_oauth_access_token = '$access_token_esc',
+    config_mail_oauth_access_token_expires_at = '$expires_at_esc'
+    WHERE company_id = 1
+");
+
+logAction("Settings", "Edit", "$session_name completed Microsoft OAuth connect flow for mail settings");
+flash_alert("Microsoft OAuth connected successfully. Token expires at $expires_at.");
+redirect($settings_mail_path);

admin/payment_method.php

@@ -16,7 +16,7 @@ $num_rows = mysqli_num_rows($sql);
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-credit-card mr-2"></i>Payment Methods</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addPaymentMethodModal"><i class="fas fa-plus mr-2"></i>Add Payment Method</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/payment_method/payment_method_add.php"><i class="fas fa-plus mr-2"></i>Add Payment Method</button>
         </div>
     </div>
     <div class="card-body">
@@ -45,7 +45,7 @@ $num_rows = mysqli_num_rows($sql);
                 <tbody>
                 <?php
 
-                while ($row = mysqli_fetch_array($sql)) {
+                while ($row = mysqli_fetch_assoc($sql)) {
                     $payment_method_id = intval($row['payment_method_id']);
                     $payment_method_name = nullable_htmlentities($row['payment_method_name']);
                     $payment_method_description = nullable_htmlentities($row['payment_method_description']);
@@ -98,5 +98,4 @@ $num_rows = mysqli_num_rows($sql);
 </div>
 
 <?php
-require_once "modals/payment_method/payment_method_add.php";
 require_once "../includes/footer.php";

admin/payment_provider.php

@@ -21,7 +21,7 @@ $num_rows = mysqli_num_rows($sql);
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-credit-card mr-2"></i>Payment Providers</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addPaymentProviderModal"><i class="fas fa-plus mr-2"></i>Add Provider</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/payment_provider/payment_provider_add.php"><i class="fas fa-plus mr-2"></i>Add Provider</button>
         </div>
     </div>
     <div class="card-body">
@@ -55,9 +55,9 @@ $num_rows = mysqli_num_rows($sql);
                         </a>
                     </th>
                     <th>
-                        <a class="text-dark">Fee</a>
+                        <a class="text-dark">Expensed Fee</a>
                     </th>
-                    <th>
+                    <th class="text-center">
                         <a class="text-dark">Saved Payment Methods</a>
                     </th>
                     <th class="text-center">Action</th>
@@ -66,13 +66,13 @@ $num_rows = mysqli_num_rows($sql);
                 <tbody>
                 <?php
 
-                while ($row = mysqli_fetch_array($sql)) {
+                while ($row = mysqli_fetch_assoc($sql)) {
                     $provider_id = intval($row['payment_provider_id']);
                     $provider_name = nullable_htmlentities($row['payment_provider_name']);
                     $provider_description = nullable_htmlentities($row['payment_provider_description']);
                     $account_name = nullable_htmlentities($row['account_name']);
                     $threshold = floatval($row['payment_provider_threshold']);
-                    $vendor_name = nullable_htmlentities($row['vendor_name']);
+                    $vendor_name = nullable_htmlentities($row['vendor_name'] ?? "Expense Disabled");
                     $category = nullable_htmlentities($row['category_name']);
                     $percent_fee = floatval($row['payment_provider_expense_percentage_fee']) * 100;
                     $flat_fee = floatval($row['payment_provider_expense_flat_fee']);
@@ -93,8 +93,10 @@ $num_rows = mysqli_num_rows($sql);
                         <td><?php echo numfmt_format_currency($currency_format, $threshold, $session_company_currency); ?></td>
                         <td><?php echo $vendor_name; ?></td>
                         <td><?php echo $category; ?></td>
-                        <td><?php echo $percent_fee; ?> + <?php echo numfmt_format_currency($currency_format, $flat_fee, $session_company_currency); ?></td>
+                        <td><?php echo $percent_fee; ?>% + <?php echo numfmt_format_currency($currency_format, $flat_fee, $session_company_currency); ?></td>
-                        <td><?php echo $saved_payment_count; ?></td>
+                        <td class="text-center">
+                            <a class="badge badge-dark badge-pill p-2" href="saved_payment_method.php"><?= $saved_payment_count ?></a>
+                        </td>
                         <td>
                             <div class="dropdown dropleft text-center">
                                 <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
@@ -106,8 +108,13 @@ $num_rows = mysqli_num_rows($sql);
                                         <i class="fas fa-fw fa-edit mr-2"></i>Edit
                                     </a>
                                     <div class="dropdown-divider"></div>
-                                    <a class="dropdown-item text-danger confirm-link" href="post.php?disable_payment_provicer=<?php echo $provider_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                    <a class="dropdown-item text-danger confirm-link" href="post.php?delete_payment_provider=<?= $provider_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
-                                        <i class="fas fa-fw fa-thumbs-down mr-2"></i>Disable
+                                        <i class="fas fa-fw fa-trash mr-2"></i><strong>Delete Provider and</strong>
+                                        <ul class="text-xs">
+                                            <li>Related Recurring Payments</li>
+                                            <li>Related Saved cards</li>
+                                            <li>Client Provider Relations</li>
+                                        </ul>
                                     </a>
                                 </div>
                             </div>
@@ -132,5 +139,4 @@ $num_rows = mysqli_num_rows($sql);
 </div>
 
 <?php
-require_once "modals/payment_provider/payment_provider_add.php";
 require_once "../includes/footer.php";

admin/post.php

@@ -36,7 +36,4 @@ if (isset($session_is_admin) && $session_is_admin) {
 require_once "../post/logout.php";
 
 // TODO: Find a home for these
-
-require_once "../post/ai.php";
 require_once "../post/misc.php";
-

admin/post/api_keys.php

@@ -31,6 +31,27 @@ if (isset($_POST['add_api_key'])) {
 
 }
 
+if (isset($_GET['revoke_api_key'])) {
+
+    validateCSRFToken($_GET['csrf_token']);
+
+    $api_key_id = intval($_GET['revoke_api_key']);
+
+    // Get API Key Name
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
+    $api_key_name = sanitizeInput($row['api_key_name']);
+    $client_id = intval($row['api_key_client_id']);
+
+    mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id");
+
+    logAction("API Key", "Revoke", "$session_name revoked API key $name", $client_id);
+
+    flash_alert("API Key <strong>$name</strong> revoked", 'error');
+
+    redirect();
+
+}
+
 if (isset($_GET['delete_api_key'])) {
 
     validateCSRFToken($_GET['csrf_token']);
@@ -38,7 +59,7 @@ if (isset($_GET['delete_api_key'])) {
     $api_key_id = intval($_GET['delete_api_key']);
 
     // Get API Key Name
-    $row = mysqli_fetch_array(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
     $api_key_name = sanitizeInput($row['api_key_name']);
     $client_id = intval($row['api_key_client_id']);
 
@@ -66,7 +87,7 @@ if (isset($_POST['bulk_delete_api_keys'])) {
             $api_key_id = intval($api_key_id);
 
             // Get API Key Name
-            $row = mysqli_fetch_array(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
+            $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
             $api_key_name = sanitizeInput($row['api_key_name']);
             $client_id = intval($row['api_key_client_id']);
 

admin/post/backup.php

@@ -2,36 +2,170 @@
 
 /*
  * ITFlow - GET/POST request handler for DB / master key backup
+ * Rewritten with streaming SQL dump, component checksums, safer zipping, and better headers.
  */
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 
 require_once "../includes/app_version.php";
 
-if (isset($_GET['download_backup'])) {
+// --- Optional performance levers for big backups ---
+@set_time_limit(0);
+if (function_exists('ini_set')) {
+    @ini_set('memory_limit', '1024M');
+}
 
-    validateCSRFToken($_GET['csrf_token']);
+/**
+ * Write a line to a file handle with newline.
+ */
+function fwrite_ln($fh, string $s): void {
+    fwrite($fh, $s);
+    fwrite($fh, PHP_EOL);
+}
 
-    $timestamp = date('YmdHis');
+/**
-    $baseName = "itflow_$timestamp";
+ * Stream a SQL dump of schema and data into $sqlFile.
+ * - Tables first (DROP + CREATE + INSERTs)
+ * - Views (DROP VIEW + CREATE VIEW)
+ * - Triggers (DROP TRIGGER + CREATE TRIGGER)
+ *
+ * NOTE: Routines/events are not dumped here. Add if needed.
+ */
+function dump_database_streaming(mysqli $mysqli, string $sqlFile): void {
+    $fh = fopen($sqlFile, 'wb');
+    if (!$fh) {
+        http_response_code(500);
+        exit("Cannot open dump file");
+    }
 
-    // === 0. Scoped cleanup ===
+    // Preamble
-    $cleanupFiles = [];
+    fwrite_ln($fh, "-- UTF-8 + Foreign Key Safe Dump");
+    fwrite_ln($fh, "SET NAMES 'utf8mb4';");
+    fwrite_ln($fh, "SET FOREIGN_KEY_CHECKS = 0;");
+    fwrite_ln($fh, "SET UNIQUE_CHECKS = 0;");
+    fwrite_ln($fh, "SET AUTOCOMMIT = 0;");
+    fwrite_ln($fh, "");
 
-    $registerTempFileForCleanup = function ($file) use (&$cleanupFiles) {
+    // Gather tables and views
-        $cleanupFiles[] = $file;
+    $tables = [];
-    };
+    $views  = [];
 
-    register_shutdown_function(function () use (&$cleanupFiles) {
+    $res = $mysqli->query("SHOW FULL TABLES");
-        foreach ($cleanupFiles as $file) {
+    if (!$res) {
-            if (is_file($file)) {
+        fclose($fh);
-                @unlink($file);
+        error_log("MySQL Error (SHOW FULL TABLES): " . $mysqli->error);
+        http_response_code(500);
+        exit("Error retrieving tables.");
+    }
+    while ($row = $res->fetch_array(MYSQLI_NUM)) {
+        $name = $row[0];
+        $type = strtoupper($row[1] ?? '');
+        if ($type === 'VIEW') {
+            $views[] = $name;
+        } else {
+            $tables[] = $name;
         }
     }
-    });
+    $res->close();
 
-    // === 1. Local helper function: zipFolder
+    // --- TABLES: structure and data ---
-    $zipFolder = function ($folderPath, $zipFilePath) {
+    foreach ($tables as $table) {
+        $createRes = $mysqli->query("SHOW CREATE TABLE `{$mysqli->real_escape_string($table)}`");
+        if (!$createRes) {
+            error_log("MySQL Error (SHOW CREATE TABLE $table): " . $mysqli->error);
+            // continue to next table
+            continue;
+        }
+        $createRow = $createRes->fetch_assoc();
+        $createSQL = array_values($createRow)[1] ?? '';
+        $createRes->close();
+
+        fwrite_ln($fh, "-- ----------------------------");
+        fwrite_ln($fh, "-- Table structure for `{$table}`");
+        fwrite_ln($fh, "-- ----------------------------");
+        fwrite_ln($fh, "DROP TABLE IF EXISTS `{$table}`;");
+        fwrite_ln($fh, $createSQL . ";");
+        fwrite_ln($fh, "");
+
+        // Dump data in a streaming fashion
+        $dataRes = $mysqli->query("SELECT * FROM `{$mysqli->real_escape_string($table)}`", MYSQLI_USE_RESULT);
+        if ($dataRes) {
+            $wroteHeader = false;
+            while ($row = $dataRes->fetch_assoc()) {
+                if (!$wroteHeader) {
+                    fwrite_ln($fh, "-- Dumping data for table `{$table}`");
+                    $wroteHeader = true;
+                }
+                $cols = array_map(fn($c) => '`' . $mysqli->real_escape_string($c) . '`', array_keys($row));
+                $vals = array_map(
+                    function ($v) use ($mysqli) {
+                        return is_null($v) ? "NULL" : "'" . $mysqli->real_escape_string($v) . "'";
+                    },
+                    array_values($row)
+                );
+                fwrite_ln($fh, "INSERT INTO `{$table}` (" . implode(", ", $cols) . ") VALUES (" . implode(", ", $vals) . ");");
+            }
+            $dataRes->close();
+            if ($wroteHeader) fwrite_ln($fh, "");
+        }
+    }
+
+    // --- VIEWS ---
+    foreach ($views as $view) {
+        $escView = $mysqli->real_escape_string($view);
+        $cRes = $mysqli->query("SHOW CREATE VIEW `{$escView}`");
+        if ($cRes) {
+            $row = $cRes->fetch_assoc();
+            $createView = $row['Create View'] ?? '';
+            $cRes->close();
+
+            fwrite_ln($fh, "-- ----------------------------");
+            fwrite_ln($fh, "-- View structure for `{$view}`");
+            fwrite_ln($fh, "-- ----------------------------");
+            fwrite_ln($fh, "DROP VIEW IF EXISTS `{$view}`;");
+            // Ensure statement ends with semicolon
+            if (!str_ends_with($createView, ';')) $createView .= ';';
+            fwrite_ln($fh, $createView);
+            fwrite_ln($fh, "");
+        }
+    }
+
+    // --- TRIGGERS ---
+    $tRes = $mysqli->query("SHOW TRIGGERS");
+    if ($tRes) {
+        while ($t = $tRes->fetch_assoc()) {
+            $triggerName = $t['Trigger'];
+            $escTrig = $mysqli->real_escape_string($triggerName);
+            $crt = $mysqli->query("SHOW CREATE TRIGGER `{$escTrig}`");
+            if ($crt) {
+                $row = $crt->fetch_assoc();
+                $createTrig = $row['SQL Original Statement'] ?? ($row['Create Trigger'] ?? '');
+                $crt->close();
+
+                fwrite_ln($fh, "-- ----------------------------");
+                fwrite_ln($fh, "-- Trigger for `{$triggerName}`");
+                fwrite_ln($fh, "-- ----------------------------");
+                fwrite_ln($fh, "DROP TRIGGER IF EXISTS `{$triggerName}`;");
+                if (!str_ends_with($createTrig, ';')) $createTrig .= ';';
+                fwrite_ln($fh, $createTrig);
+                fwrite_ln($fh, "");
+            }
+        }
+        $tRes->close();
+    }
+
+    // Postamble
+    fwrite_ln($fh, "SET FOREIGN_KEY_CHECKS = 1;");
+    fwrite_ln($fh, "SET UNIQUE_CHECKS = 1;");
+    fwrite_ln($fh, "COMMIT;");
+
+    fclose($fh);
+}
+
+/**
+ * Zip a folder to $zipFilePath, skipping symlinks and dot-entries.
+ */
+function zipFolderStrict(string $folderPath, string $zipFilePath): void {
     $zip = new ZipArchive();
     if ($zip->open($zipFilePath, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== TRUE) {
         error_log("Failed to open zip file: $zipFilePath");
@@ -39,30 +173,57 @@ if (isset($_GET['download_backup'])) {
         exit("Internal Server Error: Cannot open zip archive.");
     }
 
-        $folderPath = realpath($folderPath);
+    $folderReal = realpath($folderPath);
-        if (!$folderPath) {
+    if (!$folderReal || !is_dir($folderReal)) {
-            error_log("Invalid folder path: $folderPath");
+        // Create an empty archive if uploads folder doesn't exist yet
-            http_response_code(500);
+        $zip->close();
-            exit("Internal Server Error: Invalid folder path.");
+        return;
     }
 
     $files = new RecursiveIteratorIterator(
-            new RecursiveDirectoryIterator($folderPath),
+        new RecursiveDirectoryIterator($folderReal, FilesystemIterator::SKIP_DOTS),
         RecursiveIteratorIterator::LEAVES_ONLY
     );
 
     foreach ($files as $file) {
-            if (!$file->isDir()) {
+        /** @var SplFileInfo $file */
+        if ($file->isDir()) continue;
+        if ($file->isLink()) continue; // skip symlinks
         $filePath = $file->getRealPath();
-                $relativePath = substr($filePath, strlen($folderPath) + 1);
+        if ($filePath === false) continue;
-                $zip->addFile($filePath, $relativePath);
+
+        // ensure path is inside the folder boundary
+        if (strpos($filePath, $folderReal . DIRECTORY_SEPARATOR) !== 0 && $filePath !== $folderReal) {
+            continue;
         }
+
+        $relativePath = substr($filePath, strlen($folderReal) + 1);
+        $zip->addFile($filePath, $relativePath);
     }
 
     $zip->close();
-    };
+}
 
-    // === 2. Create all temp files
+if (isset($_GET['download_backup'])) {
+
+    validateCSRFToken($_GET['csrf_token']);
+
+    $timestamp   = date('YmdHis');
+    $baseName    = "itflow_{$timestamp}";
+    $downloadName = $baseName . ".zip";
+
+    // === Scoped cleanup of temp files ===
+    $cleanupFiles = [];
+    $registerTempFileForCleanup = function ($file) use (&$cleanupFiles) {
+        $cleanupFiles[] = $file;
+    };
+    register_shutdown_function(function () use (&$cleanupFiles) {
+        foreach ($cleanupFiles as $file) {
+            if (is_file($file)) { @unlink($file); }
+        }
+    });
+
+    // === Create temp files ===
     $sqlFile     = tempnam(sys_get_temp_dir(), $baseName . "_sql_");
     $uploadsZip  = tempnam(sys_get_temp_dir(), $baseName . "_uploads_");
     $versionFile = tempnam(sys_get_temp_dir(), $baseName . "_version_");
@@ -70,117 +231,75 @@ if (isset($_GET['download_backup'])) {
 
     foreach ([$sqlFile, $uploadsZip, $versionFile, $finalZip] as $f) {
         $registerTempFileForCleanup($f);
-        chmod($f, 0600);
+        @chmod($f, 0600);
     }
 
-    // === 3. Generate SQL Dump
+    // === Generate SQL Dump (streaming) ===
-    $sqlContent = "-- UTF-8 + Foreign Key Safe Dump\n";
+    dump_database_streaming($mysqli, $sqlFile);
-    $sqlContent .= "SET NAMES 'utf8mb4';\n";
-    $sqlContent .= "SET foreign_key_checks = 0;\n\n";
 
-    $tables = [];
+    // === Zip the uploads folder (strict) ===
-    $res = $mysqli->query("SHOW TABLES");
+    zipFolderStrict("../uploads", $uploadsZip);
-    if (!$res) {
-        error_log("MySQL Error: " . $mysqli->error);
-        exit("Error retrieving tables.");
-    }
 
-    while ($row = $res->fetch_row()) {
+    // === Gather metadata & checksums ===
-        $tables[] = $row[0];
+    $commitHash = (function_exists('shell_exec') ? trim(shell_exec('git log -1 --format=%H 2>/dev/null')) : '') ?: 'N/A';
-    }
+    $gitBranch  = (function_exists('shell_exec') ? trim(shell_exec('git rev-parse --abbrev-ref HEAD 2>/dev/null')) : '') ?: 'N/A';
 
-    foreach ($tables as $table) {
+    $dbSha = hash_file('sha256', $sqlFile) ?: 'N/A';
-        $createRes = $mysqli->query("SHOW CREATE TABLE `$table`");
+    $upSha = hash_file('sha256', $uploadsZip) ?: 'N/A';
-        if (!$createRes) {
-            error_log("MySQL Error: " . $mysqli->error);
-            continue;
-        }
-
-        $createRow = $createRes->fetch_assoc();
-        $createSQL = array_values($createRow)[1];
-
-        $sqlContent .= "\n-- ----------------------------\n";
-        $sqlContent .= "-- Table structure for `$table`\n";
-        $sqlContent .= "-- ----------------------------\n";
-        $sqlContent .= "DROP TABLE IF EXISTS `$table`;\n";
-        $sqlContent .= $createSQL . ";\n\n";
-
-        $dataRes = $mysqli->query("SELECT * FROM `$table`");
-        if ($dataRes && $dataRes->num_rows > 0) {
-            $sqlContent .= "-- Dumping data for table `$table`\n";
-            while ($row = $dataRes->fetch_assoc()) {
-                $columns = array_map(fn($col) => '`' . $mysqli->real_escape_string($col) . '`', array_keys($row));
-                $values = array_map(function ($val) use ($mysqli) {
-                    return is_null($val) ? "NULL" : "'" . $mysqli->real_escape_string($val) . "'";
-                }, array_values($row));
-                $sqlContent .= "INSERT INTO `$table` (" . implode(", ", $columns) . ") VALUES (" . implode(", ", $values) . ");\n";
-            }
-            $sqlContent .= "\n";
-        }
-    }
-
-    $sqlContent .= "SET foreign_key_checks = 1;\n";
-    file_put_contents($sqlFile, $sqlContent);
-
-    // === 4. Zip the uploads folder
-    $zipFolder("../uploads", $uploadsZip);
-
-    // === 5. Create version.txt
-    $commitHash = trim(shell_exec('git log -1 --format=%H')) ?: 'N/A';
-    $gitBranch = trim(shell_exec('git rev-parse --abbrev-ref HEAD')) ?: 'N/A';
 
     $versionContent  = "ITFlow Backup Metadata\n";
     $versionContent .= "-----------------------------\n";
     $versionContent .= "Generated: " . date('Y-m-d H:i:s') . "\n";
-    $versionContent .= "Backup File: " . basename($finalZip) . "\n";
+    $versionContent .= "Backup File: " . $downloadName . "\n";
-    $versionContent .= "Generated By: $session_name\n";
+    $versionContent .= "Generated By: " . ($session_name ?? 'Unknown User') . "\n";
     $versionContent .= "Host: " . gethostname() . "\n";
     $versionContent .= "Git Branch: $gitBranch\n";
     $versionContent .= "Git Commit: $commitHash\n";
     $versionContent .= "ITFlow Version: " . (defined('APP_VERSION') ? APP_VERSION : 'Unknown') . "\n";
     $versionContent .= "Database Version: " . (defined('CURRENT_DATABASE_VERSION') ? CURRENT_DATABASE_VERSION : 'Unknown') . "\n";
-    $versionContent .= "Checksum (SHA256): \n";
+    $versionContent .= "Checksums (SHA256):\n";
+    $versionContent .= "  db.sql: $dbSha\n";
+    $versionContent .= "  uploads.zip: $upSha\n";
 
     file_put_contents($versionFile, $versionContent);
+    @chmod($versionFile, 0600);
 
-    // === 6. Build final ZIP
+    // === Build final ZIP ===
     $final = new ZipArchive();
     if ($final->open($finalZip, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== TRUE) {
         error_log("Failed to create final zip: $finalZip");
         http_response_code(500);
         exit("Internal Server Error: Unable to create backup archive.");
     }
-
     $final->addFile($sqlFile, "db.sql");
     $final->addFile($uploadsZip, "uploads.zip");
     $final->addFile($versionFile, "version.txt");
     $final->close();
 
-    chmod($finalZip, 0600);
+    @chmod($finalZip, 0600);
 
-    $checksum = hash_file('sha256', $finalZip);
+    // === Serve final ZIP with a stable filename ===
-    file_put_contents($versionFile, $versionContent . "$checksum\n");
-
-    // === 7. Serve final ZIP
     header('Content-Type: application/zip');
-    header('Content-Disposition: attachment; filename="' . basename($finalZip) . '"');
+    header('X-Content-Type-Options: nosniff');
+    header('Content-Disposition: attachment; filename="' . $downloadName . '"');
     header('Content-Length: ' . filesize($finalZip));
     header('Pragma: public');
     header('Expires: 0');
     header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
     header('Content-Transfer-Encoding: binary');
 
+    // Push file
     flush();
     $fp = fopen($finalZip, 'rb');
     fpassthru($fp);
     fclose($fp);
 
-    logAction("System", "Backup Download", "$session_name downloaded full backup.");
+    // Log + UX
+    logAction("System", "Backup Download", ($session_name ?? 'Unknown User') . " downloaded full backup.");
     flash_alert("Full backup downloaded.");
     exit;
 }
 
-
 if (isset($_POST['backup_master_key'])) {
 
     validateCSRFToken($_POST['csrf_token']);
@@ -188,7 +307,7 @@ if (isset($_POST['backup_master_key'])) {
     $password = $_POST['password'];
 
     $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
 
     if (password_verify($password, $row['user_password'])) {
         $site_encryption_master_key = decryptUserSpecificKey($row['user_specific_encryption_ciphertext'], $password);
@@ -210,4 +329,3 @@ if (isset($_POST['backup_master_key'])) {
         redirect();
     }
 }
-

admin/post/category.php

@@ -44,7 +44,7 @@ if (isset($_GET['archive_category'])) {
 
     // Get Category Name and Type for logging
     $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $category_name = sanitizeInput($row['category_name']);
     $category_type = sanitizeInput($row['category_type']);
 
@@ -64,7 +64,7 @@ if (isset($_GET['unarchive_category'])) {
 
     // Get Category Name and Type for logging
     $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $category_name = sanitizeInput($row['category_name']);
     $category_type = sanitizeInput($row['category_type']);
 
@@ -84,7 +84,7 @@ if (isset($_GET['delete_category'])) {
 
     // Get Category Name and Type for logging
     $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $category_name = sanitizeInput($row['category_name']);
     $category_type = sanitizeInput($row['category_type']);
 

admin/post/contract_template.php

@@ -0,0 +1,157 @@
+<?php
+
+/*
+ * ITFlow - GET/POST request handler for Contract Templates
+ */
+
+defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
+
+if (isset($_POST['add_contract_template'])) {
+
+    // Sanitize text inputs
+    $name = sanitizeInput($_POST['name']);
+    $description = sanitizeInput($_POST['description']);
+    $type = sanitizeInput($_POST['type']);
+    $renewal_frequency = sanitizeInput($_POST['renewal_frequency']);
+    $support_hours = sanitizeInput($_POST['support_hours']);
+    $details = mysqli_escape_string($mysqli, $_POST['details']);
+
+    // Numeric fields cast to integer
+    $sla_low_resp = intval($_POST['sla_low_response_time']);
+    $sla_med_resp = intval($_POST['sla_medium_response_time']);
+    $sla_high_resp = intval($_POST['sla_high_response_time']);
+    $sla_low_res = intval($_POST['sla_low_resolution_time']);
+    $sla_med_res = intval($_POST['sla_medium_resolution_time']);
+    $sla_high_res = intval($_POST['sla_high_resolution_time']);
+    $rate_standard = intval($_POST['rate_standard']);
+    $rate_after_hours = intval($_POST['hourly_rate_after_hours']);
+    $net_terms = intval($_POST['net_terms']);
+
+    // Insert into database (numbers not quoted)
+    mysqli_query($mysqli, "
+        INSERT INTO contract_templates SET
+        contract_template_name = '$name',
+        contract_template_description = '$description',
+        contract_template_details = '$details',
+        contract_template_type = '$type',
+        contract_template_renewal_frequency = '$renewal_frequency',
+        contract_template_sla_low_response_time = $sla_low_resp,
+        contract_template_sla_medium_response_time = $sla_med_resp,
+        contract_template_sla_high_response_time = $sla_high_resp,
+        contract_template_sla_low_resolution_time = $sla_low_res,
+        contract_template_sla_medium_resolution_time = $sla_med_res,
+        contract_template_sla_high_resolution_time = $sla_high_res,
+        contract_template_rate_standard = $rate_standard,
+        contract_template_rate_after_hours = $rate_after_hours,
+        contract_template_support_hours = '$support_hours',
+        contract_template_net_terms = $net_terms
+    ");
+
+    $contract_template_id = mysqli_insert_id($mysqli);
+
+    // Log action
+    logAction("Contract Template", "Create", "$session_name created contract template $name", 0, $contract_template_id);
+
+    // Flash message
+    flash_alert("Contract Template <strong>$name</strong> created");
+
+    // Redirect back
+    redirect();
+}
+
+if (isset($_POST['edit_contract_template'])) {
+
+    $contract_template_id = intval($_POST['contract_template_id']);
+    $name            = sanitizeInput($_POST['name']);
+    $description     = sanitizeInput($_POST['description']);
+    $type            = sanitizeInput($_POST['type']);
+    $renewal_frequency= sanitizeInput($_POST['renewal_frequency']);
+    $support_hours   = sanitizeInput($_POST['support_hours']);
+    $details         = mysqli_escape_string($mysqli, $_POST['details']);
+    $sla_low_resp  = intval($_POST['sla_low_response_time']);
+    $sla_med_resp  = intval($_POST['sla_medium_response_time']);
+    $sla_high_resp = intval($_POST['sla_high_response_time']);
+    $sla_low_res   = intval($_POST['sla_low_resolution_time']);
+    $sla_med_res   = intval($_POST['sla_medium_resolution_time']);
+    $sla_high_res  = intval($_POST['sla_high_resolution_time']);
+    $rate_standard   = intval($_POST['rate_standard']);
+    $rate_after_hours = intval($_POST['rate_after_hours']);
+    $net_terms     = intval($_POST['net_terms']);
+
+    mysqli_query($mysqli, "
+        UPDATE contract_templates SET
+            contract_template_name = '$name',
+            contract_template_description = '$description',
+            contract_template_details = '$details',
+            contract_template_type = '$type',
+            contract_template_renewal_frequency = '$renewal_frequency',
+            contract_template_sla_low_response_time = $sla_low_resp,
+            contract_template_sla_medium_response_time = $sla_med_resp,
+            contract_template_sla_high_response_time = $sla_high_resp,
+            contract_template_sla_low_resolution_time = $sla_low_res,
+            contract_template_sla_medium_resolution_time = $sla_med_res,
+            contract_template_sla_high_resolution_time = $sla_high_res,
+            contract_template_rate_standard = $rate_standard,
+            contract_template_rate_after_hours = $rate_after_hours,
+            contract_template_support_hours = '$support_hours',
+            contract_template_net_terms = $net_terms
+        WHERE contract_template_id = $contract_template_id
+    ");
+
+    // Log action
+    logAction("Contract Template", "Update", "$session_name updated contract template $name", 0, $contract_template_id);
+
+    // Flash + redirect
+    flash_alert("Contract Template <strong>$name</strong> updated");
+    redirect();
+}
+
+if (isset($_GET['archive_contract_template'])) {
+    $contract_template_id = intval($_GET['archive_contract_template']);
+
+    $name = getFieldById('contract_templates', $contract_template_id, 'contract_template_name');
+
+    mysqli_query($mysqli, "
+        UPDATE contract_templates SET contract_template_archived_at = NOW()
+        WHERE contract_template_id = $contract_template_id
+        LIMIT 1
+    ");
+
+    logAction("Contract Template", "Archive", "$session_name archived contract template $name", 0, $contract_template_id);
+    flash_alert("Contract Template <strong>$name</strong> archived", "danger");
+    redirect();
+}
+
+if (isset($_GET['restore_contract_template'])) {
+    $contract_template_id = intval($_GET['restore_contract_template']);
+
+    $name = getFieldById('contract_templates', $contract_template_id, 'contract_template_name');
+
+    mysqli_query($mysqli, "
+        UPDATE contract_templates SET contract_template_archived_at = NULL
+        WHERE contract_template_id = $contract_template_id
+        LIMIT 1
+    ");
+
+    logAction("Contract Template", "Restore", "$session_name restored contract template $name", 0, $contract_template_id);
+    flash_alert("Contract Template <strong>$name</strong> restored");
+    redirect();
+}
+
+if (isset($_GET['delete_contract_template'])) {
+    $contract_template_id = intval($_GET['delete_contract_template']);
+
+    $name = getFieldById('contract_templates', $contract_template_id, 'contract_template_name');
+
+    mysqli_query($mysqli, "
+        DELETE FROM contract_templates
+        WHERE contract_template_id = $contract_template_id
+        LIMIT 1
+    ");
+
+    logAction("Contract Template", "Delete", "$session_name deleted contract template $name", 0, $contract_template_id);
+    flash_alert("Contract Template <strong>$name</strong> deleted", "danger");
+    redirect();
+}
+
+?>

admin/post/custom_link.php

@@ -53,7 +53,7 @@ if (isset($_GET['delete_custom_link'])) {
 
     // Get Custom Link name and uri for logging
     $sql = mysqli_query($mysqli,"SELECT custom_link_name, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $custom_link_name = sanitizeInput($row['custom_link_name']);
     $custom_link_uri = sanitizeInput($row['custom_link_uri']);
 

admin/post/document_template.php

@@ -8,12 +8,24 @@ if (isset($_POST['add_document_template'])) {
 
     $name = sanitizeInput($_POST['name']);
     $description = sanitizeInput($_POST['description']);
-    $content = mysqli_real_escape_string($mysqli,$_POST['content']);
 
-    mysqli_query($mysqli,"INSERT INTO document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$content', document_template_created_by = $session_user_id");
+    mysqli_query($mysqli,"INSERT INTO document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '', document_template_created_by = $session_user_id");
     
     $document_template_id = mysqli_insert_id($mysqli);
 
+    $processed_content = mysqli_escape_string(
+        $mysqli,
+        saveBase64Images(
+            $_POST['content'],
+            $_SERVER['DOCUMENT_ROOT'] . "/uploads/document_templates/",
+            "uploads/document_templates/",
+            $document_template_id
+        )
+    );
+
+    // Document template update content
+    mysqli_query($mysqli,"UPDATE document_templates SET document_template_content = '$processed_content' WHERE document_template_id = $document_template_id");
+
     logAction("Document Template", "Create", "$session_name created document template $name", 0, $document_template_id);
 
     flash_alert("Document template <strong>$name</strong> created");
@@ -27,10 +39,25 @@ if (isset($_POST['edit_document_template'])) {
     $document_template_id = intval($_POST['document_template_id']);
     $name = sanitizeInput($_POST['name']);
     $description = sanitizeInput($_POST['description']);
-    $content = mysqli_real_escape_string($mysqli,$_POST['content']);
+
+    $processed_content = saveBase64Images(
+        $_POST['content'],
+        $_SERVER['DOCUMENT_ROOT'] . "/uploads/document_templates/",
+        "uploads/document_templates/",
+        $document_template_id
+    );
+
+    $processed_content_escaped = mysqli_escape_string($mysqli, $processed_content);
+
+    // CLEAN UP unused images
+    cleanupUnusedImages(
+        $processed_content,
+        $_SERVER['DOCUMENT_ROOT'] . "/uploads/document_templates/" . $document_template_id,
+        "/uploads/document_templates/" . $document_template_id
+    );
 
     // Document edit query
-    mysqli_query($mysqli,"UPDATE document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$content', document_template_updated_by = $session_user_id WHERE document_template_id = $document_template_id");
+    mysqli_query($mysqli,"UPDATE document_templates SET document_template_name = '$name', document_template_description = '$description', document_template_content = '$processed_content_escaped', document_template_updated_by = $session_user_id WHERE document_template_id = $document_template_id");
 
     logAction("Document Template", "Edit", "$session_name edited document template $name", 0, $document_template_id);
 
@@ -48,6 +75,9 @@ if (isset($_GET['delete_document_template'])) {
 
     mysqli_query($mysqli,"DELETE FROM document_templates WHERE document_template_id = $document_template_id");
 
+    // Delete uploads/document_templates/$document_template_id if exists
+    removeDirectory($_SERVER['DOCUMENT_ROOT'] . "/uploads/document_templates/" . $document_template_id);
+
     logAction("Document Template", "Delete", "$session_name deleted document template $document_template_name");
 
     flash_alert("Document Template <strong>$document_template_name</strong> deleted", 'error');

admin/post/payment_method.php

@@ -10,10 +10,17 @@ if (isset($_POST['add_payment_method'])) {
 
     validateCSRFToken($_POST['csrf_token']);
 
-    $name = sanitizeInput($_POST['name']);
+    $name = cleanInput($_POST['name']);
-    $description = sanitizeInput($_POST['description']);
+    $description = cleanInput($_POST['description']);
 
-    mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$name', payment_method_description = '$description'");
+    $query = mysqli_prepare(
+        $mysqli, "INSERT INTO payment_methods
+        SET payment_method_name = ?, payment_method_description = ?"
+    );
+
+    mysqli_stmt_bind_param($query, "ss", $name, $description);
+    
+    mysqli_stmt_execute($query);
 
     logAction("Payment Method", "Create", "$session_name created Payment Method $name");
 
@@ -28,10 +35,19 @@ if (isset($_POST['edit_payment_method'])) {
     validateCSRFToken($_POST['csrf_token']);
     
     $payment_method_id = intval($_POST['payment_method_id']);
-    $name = sanitizeInput($_POST['name']);
+    $name = cleanInput($_POST['name']);
-    $description = sanitizeInput($_POST['description']);
+    $description = cleanInput($_POST['description']);
 
-    mysqli_query($mysqli,"UPDATE payment_methods SET payment_method_name = '$name', payment_method_description = '$description' WHERE payment_method_id = $payment_method_id");
+    $query = mysqli_prepare(
+        $mysqli,
+        "UPDATE payment_methods 
+         SET payment_method_name = ?, payment_method_description = ? 
+         WHERE payment_method_id = ?"
+    );
+
+    mysqli_stmt_bind_param($query, "ssi", $name, $description, $payment_method_id);
+
+    mysqli_stmt_execute($query);
 
     logAction("Payment Method", "Edit", "$session_name edited Payment Method $name");
 

admin/post/payment_provider.php

@@ -14,49 +14,20 @@ if (isset($_POST['add_payment_provider'])) {
     $public_key = sanitizeInput($_POST['public_key']);
     $private_key = sanitizeInput($_POST['private_key']);
     $threshold = floatval($_POST['threshold']);
-    $enable_expense = intval($_POST['enable_expense'] ?? 0);
+    $account = intval($_POST['account']);
-    $percentage_fee = floatval($_POST['percentage_fee']) / 100;
+    $expense_vendor = intval($_POST['expense_vendor']) ?? 0;
-    $flat_fee = floatval($_POST['flat_fee']);
+    $expense_category = intval($_POST['expense_category']) ?? 0;
+    $percentage_fee = floatval($_POST['percentage_fee']) / 100 ?? 0;
+    $flat_fee = floatval($_POST['flat_fee']) ?? 0;
 
-    // Check to make sure Provider isnt added Twice
+    // Check to ensure provider isn't added twice
-    $sql = "SELECT 1 FROM payment_providers WHERE payment_provider_name = '$provider' LIMIT 1";
+    $sql = mysqli_query($mysqli, "SELECT 1 FROM payment_providers WHERE payment_provider_name = '$provider' LIMIT 1");
-    $result = mysqli_query($mysqli, $sql);
+    if (mysqli_num_rows($sql) > 0) {
-    if (mysqli_num_rows($result) > 0) {
         flash_alert("Payment Provider <strong>$provider</strong> already exists", 'error');
         redirect();
     }
 
-    // Check for Stripe Account if not create it
+    mysqli_query($mysqli,"INSERT INTO payment_providers SET payment_provider_name = '$provider', payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_threshold = $threshold, payment_provider_account = $account, payment_provider_expense_vendor = $expense_vendor, payment_provider_expense_category = $expense_category, payment_provider_expense_percentage_fee = $percentage_fee, payment_provider_expense_flat_fee = $flat_fee");
-    $sql_account = mysqli_query($mysqli,"SELECT account_id FROM accounts WHERE account_name = '$provider' AND account_archived_at IS NULL LIMIT 1");
-    if (mysqli_num_rows($sql_account) == 0) {
-        $account_id = mysqli_insert_id($mysqli);
-    } else {
-        $row = mysqli_fetch_array($sql_account);
-        $account_id = intval($row['account_id']);
-    }
-
-    if ($enable_expense) {
-        // Category
-        $sql_category = mysqli_query($mysqli,"SELECT category_id FROM categories WHERE category_name = 'Payment Processing' AND category_type = 'Expense' AND category_archived_at IS NULL LIMIT 1");
-        if (mysqli_num_rows($sql_category) == 0) {
-            mysqli_query($mysqli,"INSERT INTO categories SET category_name = 'Processing Fee', category_type = 'Payment Processing', category_color = 'gray'");
-            $category_id = mysqli_insert_id($mysqli);
-        } else {
-            $row = mysqli_fetch_array($sql_category);
-            $category_id = intval($row['category_id']);
-        }
-        //Vendor
-        $sql_vendor = mysqli_query($mysqli,"SELECT vendor_id FROM vendors WHERE vendor_name = '$provider' AND vendor_client_id = 0 AND vendor_archived_at IS NULL LIMIT 1");
-        if (mysqli_num_rows($sql_vendor) == 0) {
-            mysqli_query($mysqli,"INSERT INTO vendors SET vendor_name = '$provider', vendor_descripion = 'Payment Processor Provider', vendor_client_id = 0");
-            $vendor_id = mysqli_insert_id($mysqli);
-        } else {
-            $row = mysqli_fetch_array($sql_vendor);
-            $vendor_id = intval($row['vendor_id']);
-        }
-    }
-
-    mysqli_query($mysqli,"INSERT INTO payment_providers SET payment_provider_name = '$provider', payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_account = $account_id, payment_provider_expense_vendor = $vendor_id, payment_provider_expense_category = $category_id, payment_provider_expense_percentage_fee = $percentage_fee, payment_provider_expense_flat_fee = $flat_fee");
 
     $provider_id = mysqli_insert_id($mysqli);
 
@@ -77,11 +48,13 @@ if (isset($_POST['edit_payment_provider'])) {
     $public_key = sanitizeInput($_POST['public_key']);
     $private_key = sanitizeInput($_POST['private_key']);
     $threshold = floatval($_POST['threshold']);
-    $enable_expense = intval($_POST['enable_expense'] ?? 0);
+    $account = intval($_POST['account']);
+    $expense_vendor = intval($_POST['expense_vendor']) ?? 0;
+    $expense_category = intval($_POST['expense_category']) ?? 0;
     $percentage_fee = floatval($_POST['percentage_fee']) / 100;
     $flat_fee = floatval($_POST['flat_fee']);
 
-    mysqli_query($mysqli,"UPDATE payment_providers SET payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_expense_percentage_fee = $percentage_fee, payment_provider_expense_flat_fee = $flat_fee WHERE payment_provider_id = $provider_id");
+    mysqli_query($mysqli,"UPDATE payment_providers SET payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_threshold = $threshold, payment_provider_account = $account, payment_provider_expense_vendor = $expense_vendor, payment_provider_expense_category = $expense_category, payment_provider_expense_percentage_fee = $percentage_fee, payment_provider_expense_flat_fee = $flat_fee WHERE payment_provider_id = $provider_id");
 
     logAction("Payment Provider", "Edit", "$session_name edited Payment Provider $provider");
 
@@ -93,10 +66,18 @@ if (isset($_POST['edit_payment_provider'])) {
 
 if (isset($_GET['delete_payment_provider'])) {
 
+    validateCSRFToken($_GET['csrf_token']);
+
     $provider_id = intval($_GET['delete_payment_provider']);
 
-    $provider_name = sanitizeInput(getFieldById('provider_providers', $provider_id, 'provider_name'));
+    // When deleted it cascades deletes
+    // all Recurring paymentes related to payment provider
+    // Delete all Saved Cards related
+    // Delete Client Payment Provider Releation
 
+    $provider_name = sanitizeInput(getFieldById('payment_providers', $provider_id, 'provider_name'));
+
+    // Delete provider
     mysqli_query($mysqli,"DELETE FROM payment_providers WHERE payment_provider_id = $provider_id");
 
     logAction("Payment Provider", "Delete", "$session_name deleted Payment Provider $provider_name");

admin/post/roles.php

@@ -18,9 +18,23 @@ if (isset($_POST['add_role'])) {
 
     $role_id = mysqli_insert_id($mysqli);
 
+    // Insert role permissions (only if not admin)
+    if ($admin == 0) {
+        foreach ($_POST as $key => $value) {
+            if (str_contains($key, '##module_')) {
+                $module_id = intval(explode('##', $key)[0]);
+                $access_level = intval($value);
+
+                if ($access_level > 0) {
+                    mysqli_query($mysqli, "INSERT INTO user_role_permissions SET user_role_id = $role_id, module_id = $module_id, user_role_permission_level = $access_level");
+                }
+            }
+        }
+    }
+
     logAction("User Role", "Create", "$session_name created user role $name", 0, $role_id);
 
-    flash_alert("User Role <strong$name</strong> created");
+    flash_alert("User Role <strong>$name</strong> created");
 
     redirect();
 
@@ -76,7 +90,7 @@ if (isset($_GET['archive_role'])) {
 
     mysqli_query($mysqli, "UPDATE user_roles SET role_archived_at = NOW() WHERE role_id = $role_id");
 
-    $role_name = sanitizeInput(getFieldById('roles', $role_id, 'role_name'));
+    $role_name = sanitizeInput(getFieldById('user_roles', $role_id, 'role_name'));
 
     logAction("User Role", "Archive", "$session_name archived user role $role_name", 0, $role_id);
 

admin/post/saved_payment_method.php

@@ -27,7 +27,7 @@ if (isset($_GET['delete_saved_payment'])) {
         WHERE client_saved_payment_methods.saved_payment_id = $saved_payment_id"
     );
 
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['saved_payment_client_id']);
     $provider_id = intval($row['saved_payment_provider_id']);
     $payment_provider_name = nullable_htmlentities($row['payment_provider_name']);
@@ -37,12 +37,12 @@ if (isset($_GET['delete_saved_payment'])) {
 
     $private_key = $row['payment_provider_private_key'];
 
-    // Seperate logic for each Payment Provider
+    // Separate logic for each Payment Provider
     if ($payment_provider_name == 'Stripe') {
 
         try {
             // Initialize stripe
-            require_once 'plugins/stripe-php/init.php';
+            require_once '../plugins/stripe-php/init.php';
             $stripe = new \Stripe\StripeClient($private_key);
 
             // Detach PM
@@ -56,7 +56,7 @@ if (isset($_GET['delete_saved_payment'])) {
 
     }
 
-    // Remove payment method from ITFlow
+    // Remove payment method from ITFlow. This will also cascade delete related recurring payments setup
     mysqli_query($mysqli, "DELETE FROM client_saved_payment_methods WHERE saved_payment_id = $saved_payment_id");
 
     // SQL Cascade delete will Remove All Associated Auto Payment Methods on recurring invoices in the recurring payments table.

admin/post/settings_company.php

@@ -19,7 +19,7 @@ if (isset($_POST['edit_company'])) {
     $tax_id = sanitizeInput($_POST['tax_id']);
 
     $sql = mysqli_query($mysqli,"SELECT company_logo FROM companies WHERE company_id = 1");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $existing_file_name = sanitizeInput($row['company_logo']);
 
     // Company logo
@@ -55,7 +55,7 @@ if (isset($_POST['edit_company'])) {
 if (isset($_GET['remove_company_logo'])) {
 
     $sql = mysqli_query($mysqli,"SELECT company_logo FROM companies");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $company_logo = $row['company_logo']; // FileSystem Operation Logo is already sanitized
 
     unlink("../uploads/settings/$company_logo");

admin/post/settings_mail.php

@@ -2,19 +2,114 @@
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 
+if (!defined('MICROSOFT_OAUTH_BASE_URL')) {
+    define('MICROSOFT_OAUTH_BASE_URL', 'https://login.microsoftonline.com/');
+}
+
+if (isset($_POST['oauth_connect_microsoft_mail'])) {
+
+    validateCSRFToken($_POST['csrf_token']);
+
+    // Save current IMAP/OAuth form values first so auth flow always uses latest inputs.
+    $config_imap_provider = sanitizeInput($_POST['config_imap_provider'] ?? '');
+    $config_imap_username = sanitizeInput($_POST['config_imap_username'] ?? '');
+    $config_mail_oauth_client_id = sanitizeInput($_POST['config_mail_oauth_client_id'] ?? '');
+    $config_mail_oauth_client_secret = sanitizeInput($_POST['config_mail_oauth_client_secret'] ?? '');
+    $config_mail_oauth_tenant_id = sanitizeInput($_POST['config_mail_oauth_tenant_id'] ?? '');
+    $config_mail_oauth_refresh_token = sanitizeInput($_POST['config_mail_oauth_refresh_token'] ?? '');
+    $config_mail_oauth_access_token = sanitizeInput($_POST['config_mail_oauth_access_token'] ?? '');
+
+    mysqli_query($mysqli, "UPDATE settings SET
+        config_imap_provider = '$config_imap_provider',
+        config_imap_username = '$config_imap_username',
+        config_mail_oauth_client_id = '$config_mail_oauth_client_id',
+        config_mail_oauth_client_secret = '$config_mail_oauth_client_secret',
+        config_mail_oauth_tenant_id = '$config_mail_oauth_tenant_id',
+        config_mail_oauth_refresh_token = '$config_mail_oauth_refresh_token',
+        config_mail_oauth_access_token = '$config_mail_oauth_access_token'
+        WHERE company_id = 1
+    ");
+
+    if ($config_imap_provider !== 'microsoft_oauth') {
+        flash_alert("Please set IMAP Provider to Microsoft 365 (OAuth) before connecting.", 'error');
+        redirect();
+    }
+
+    if (empty($config_mail_oauth_client_id) || empty($config_mail_oauth_client_secret) || empty($config_mail_oauth_tenant_id)) {
+        flash_alert("Missing Microsoft OAuth settings. Please provide Client ID, Client Secret, and Tenant ID first.", 'error');
+        redirect();
+    }
+
+    if (defined('BASE_URL') && !empty(BASE_URL)) {
+        $base_url = rtrim((string) BASE_URL, '/');
+    } else {
+        $base_url = 'https://' . rtrim((string) $config_base_url, '/');
+    }
+
+    $redirect_uri = $base_url . '/admin/oauth_microsoft_mail_callback.php';
+
+    try {
+        $state = bin2hex(random_bytes(32));
+    } catch (Throwable $e) {
+        $state = sha1(uniqid((string) mt_rand(), true));
+    }
+
+    $_SESSION['mail_oauth_state'] = $state;
+    $_SESSION['mail_oauth_state_expires_at'] = time() + 600;
+
+    $scope = 'offline_access openid profile https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send';
+
+    $authorize_url = MICROSOFT_OAUTH_BASE_URL . rawurlencode($config_mail_oauth_tenant_id) . '/oauth2/v2.0/authorize?'
+        . http_build_query([
+            'client_id' => $config_mail_oauth_client_id,
+            'response_type' => 'code',
+            'redirect_uri' => $redirect_uri,
+            'response_mode' => 'query',
+            'scope' => $scope,
+            'state' => $state,
+            'prompt' => 'consent',
+        ], '', '&', PHP_QUERY_RFC3986);
+
+    logAction("Settings", "Edit", "$session_name started Microsoft OAuth connect flow for mail settings");
+
+    redirect($authorize_url);
+}
+
 if (isset($_POST['edit_mail_smtp_settings'])) {
     
     validateCSRFToken($_POST['csrf_token']);
 
+    $config_smtp_provider            = sanitizeInput($_POST['config_smtp_provider']);
     $config_smtp_host                = sanitizeInput($_POST['config_smtp_host']);
-    $config_smtp_port = intval($_POST['config_smtp_port']);
+    $config_smtp_port                = intval($_POST['config_smtp_port'] ?? 0);
     $config_smtp_encryption          = sanitizeInput($_POST['config_smtp_encryption']);
     $config_smtp_username            = sanitizeInput($_POST['config_smtp_username']);
     $config_smtp_password            = sanitizeInput($_POST['config_smtp_password']);
 
-    mysqli_query($mysqli,"UPDATE settings SET config_smtp_host = '$config_smtp_host', config_smtp_port = $config_smtp_port, config_smtp_encryption = '$config_smtp_encryption', config_smtp_username = '$config_smtp_username', config_smtp_password = '$config_smtp_password' WHERE company_id = 1");
+    // Shared OAuth fields
+    $config_mail_oauth_client_id     = sanitizeInput($_POST['config_mail_oauth_client_id']);
+    $config_mail_oauth_client_secret = sanitizeInput($_POST['config_mail_oauth_client_secret']);
+    $config_mail_oauth_tenant_id     = sanitizeInput($_POST['config_mail_oauth_tenant_id']);
+    $config_mail_oauth_refresh_token = sanitizeInput($_POST['config_mail_oauth_refresh_token']);
+    $config_mail_oauth_access_token  = sanitizeInput($_POST['config_mail_oauth_access_token']);
 
-    logAction("Settings", "Edit", "$session_name edited SMTP mail settings");
+    mysqli_query($mysqli, "
+        UPDATE settings SET
+            config_smtp_provider              = '$config_smtp_provider',
+            config_smtp_host                  = '$config_smtp_host',
+            config_smtp_port                  = $config_smtp_port,
+            config_smtp_encryption            = '$config_smtp_encryption',
+            config_smtp_username              = '$config_smtp_username',
+            config_smtp_password              = '$config_smtp_password',
+            config_mail_oauth_client_id       = '$config_mail_oauth_client_id',
+            config_mail_oauth_client_secret   = '$config_mail_oauth_client_secret',
+            config_mail_oauth_tenant_id       = '$config_mail_oauth_tenant_id',
+            config_mail_oauth_refresh_token   = '$config_mail_oauth_refresh_token',
+            config_mail_oauth_access_token    = '$config_mail_oauth_access_token'
+        WHERE company_id = 1
+    ");
+
+    logAction("Settings", "Edit", "$session_name edited SMTP settings");
     
     flash_alert("SMTP Mail Settings updated");
     
@@ -26,15 +121,37 @@ if (isset($_POST['edit_mail_imap_settings'])) {
     
     validateCSRFToken($_POST['csrf_token']);
 
+    $config_imap_provider            = sanitizeInput($_POST['config_imap_provider']);
     $config_imap_host                = sanitizeInput($_POST['config_imap_host']);
+    $config_imap_port                = intval($_POST['config_imap_port'] ?? 0);
+    $config_imap_encryption          = sanitizeInput($_POST['config_imap_encryption']);
     $config_imap_username            = sanitizeInput($_POST['config_imap_username']);
     $config_imap_password            = sanitizeInput($_POST['config_imap_password']);
-    $config_imap_port = intval($_POST['config_imap_port']);
-    $config_imap_encryption = sanitizeInput($_POST['config_imap_encryption']);
 
-    mysqli_query($mysqli,"UPDATE settings SET config_imap_host = '$config_imap_host', config_imap_port = $config_imap_port, config_imap_encryption = '$config_imap_encryption', config_imap_username = '$config_imap_username', config_imap_password = '$config_imap_password' WHERE company_id = 1");
+    // Shared OAuth fields
+    $config_mail_oauth_client_id     = sanitizeInput($_POST['config_mail_oauth_client_id']);
+    $config_mail_oauth_client_secret = sanitizeInput($_POST['config_mail_oauth_client_secret']);
+    $config_mail_oauth_tenant_id     = sanitizeInput($_POST['config_mail_oauth_tenant_id']);
+    $config_mail_oauth_refresh_token = sanitizeInput($_POST['config_mail_oauth_refresh_token']);
+    $config_mail_oauth_access_token  = sanitizeInput($_POST['config_mail_oauth_access_token']);
 
-    logAction("Settings", "Edit", "$session_name edited IMAP mail settings");
+    mysqli_query($mysqli, "
+        UPDATE settings SET
+            config_imap_provider              = '$config_imap_provider',
+            config_imap_host                  = '$config_imap_host',
+            config_imap_port                  = $config_imap_port,
+            config_imap_encryption            = '$config_imap_encryption',
+            config_imap_username              = '$config_imap_username',
+            config_imap_password              = '$config_imap_password',
+            config_mail_oauth_client_id       = '$config_mail_oauth_client_id',
+            config_mail_oauth_client_secret   = '$config_mail_oauth_client_secret',
+            config_mail_oauth_tenant_id       = '$config_mail_oauth_tenant_id',
+            config_mail_oauth_refresh_token   = '$config_mail_oauth_refresh_token',
+            config_mail_oauth_access_token    = '$config_mail_oauth_access_token'
+        WHERE company_id = 1
+    ");
+
+    logAction("Settings", "Edit", "$session_name edited IMAP settings");
     
     flash_alert("IMAP Mail Settings updated");
     
@@ -106,7 +223,7 @@ if (isset($_POST['test_email_smtp'])) {
     $mail = addToMailQueue($data);
 
     if ($mail === true) {
-        flash_alert("Test email queued! <a class='text-bold text-light' href='admin_mail_queue.php'>Check Admin > Mail queue</a>");
+        flash_alert("Test email queued! <a class='text-bold text-light' href='mail_queue.php'>Check Admin > Mail queue</a>");
     } else {
         flash_alert("Failed to add test mail to queue", 'error');
     }
@@ -119,24 +236,347 @@ if (isset($_POST['test_email_imap'])) {
 
     validateCSRFToken($_POST['csrf_token']);
 
-    // Setup your IMAP connection parameters
+    $provider = sanitizeInput($config_imap_provider ?? '');
-    $hostname = "{" . $config_imap_host . ":" . $config_imap_port . "/" . $config_imap_encryption . "/novalidate-cert}INBOX";
+
+    $host       = $config_imap_host;
+    $port       = (int) $config_imap_port;
+    $encryption = strtolower(trim($config_imap_encryption)); // e.g. "ssl", "tls", "none"
     $username   = $config_imap_username;
     $password   = $config_imap_password;
 
-    try {
+    // Shared OAuth fields
-        $inbox = @imap_open($hostname, $username, $password);
+    $config_mail_oauth_client_id               = $config_mail_oauth_client_id ?? '';
+    $config_mail_oauth_client_secret           = $config_mail_oauth_client_secret ?? '';
+    $config_mail_oauth_tenant_id               = $config_mail_oauth_tenant_id ?? '';
+    $config_mail_oauth_refresh_token           = $config_mail_oauth_refresh_token ?? '';
+    $config_mail_oauth_access_token            = $config_mail_oauth_access_token ?? '';
+    $config_mail_oauth_access_token_expires_at = $config_mail_oauth_access_token_expires_at ?? '';
 
-        if ($inbox) {
+    $is_oauth = ($provider === 'google_oauth' || $provider === 'microsoft_oauth');
-            imap_close($inbox);
+
-            flash_alert("Connected successfully");
+    if ($provider === 'google_oauth') {
-        } else {
+        if (empty($host)) {
-            throw new Exception(imap_last_error());
+            $host = 'imap.gmail.com';
         }
+        if (empty($port)) {
+            $port = 993;
+        }
+        if (empty($encryption)) {
+            $encryption = 'ssl';
+        }
+    } elseif ($provider === 'microsoft_oauth') {
+        if (empty($host)) {
+            $host = 'outlook.office365.com';
+        }
+        if (empty($port)) {
+            $port = 993;
+        }
+        if (empty($encryption)) {
+            $encryption = 'ssl';
+        }
+    }
+
+    if (empty($host) || empty($port) || empty($username)) {
+        flash_alert("<strong>IMAP connection failed:</strong> Missing host, port, or username.", 'error');
+        redirect();
+    }
+
+    $token_is_expired = function (?string $expires_at): bool {
+        if (empty($expires_at)) {
+            return true;
+        }
+
+        $ts = strtotime($expires_at);
+
+        if ($ts === false) {
+            return true;
+        }
+
+        return ($ts - 60) <= time();
+    };
+
+    $http_form_post = function (string $url, array $fields): array {
+        $ch = curl_init($url);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($ch, CURLOPT_POST, true);
+        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($fields, '', '&'));
+        curl_setopt($ch, CURLOPT_TIMEOUT, 20);
+
+        $raw = curl_exec($ch);
+        $err = curl_error($ch);
+        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+
+        curl_close($ch);
+
+        return [
+            'ok' => ($raw !== false && $code >= 200 && $code < 300),
+            'body' => $raw,
+            'code' => $code,
+            'err' => $err,
+        ];
+    };
+
+    if ($is_oauth) {
+        if (!empty($config_mail_oauth_access_token) && !$token_is_expired($config_mail_oauth_access_token_expires_at)) {
+            $password = $config_mail_oauth_access_token;
+        } else {
+            if (empty($config_mail_oauth_client_id) || empty($config_mail_oauth_client_secret) || empty($config_mail_oauth_refresh_token)) {
+                flash_alert("<strong>IMAP OAuth failed:</strong> Missing OAuth client credentials or refresh token.", 'error');
+                redirect();
+            }
+
+            if ($provider === 'google_oauth') {
+                $response = $http_form_post('https://oauth2.googleapis.com/token', [
+                    'client_id' => $config_mail_oauth_client_id,
+                    'client_secret' => $config_mail_oauth_client_secret,
+                    'refresh_token' => $config_mail_oauth_refresh_token,
+                    'grant_type' => 'refresh_token',
+                ]);
+            } else {
+                if (empty($config_mail_oauth_tenant_id)) {
+                    flash_alert("<strong>IMAP OAuth failed:</strong> Microsoft tenant ID is required.", 'error');
+                    redirect();
+                }
+
+                $token_url = MICROSOFT_OAUTH_BASE_URL . rawurlencode($config_mail_oauth_tenant_id) . "/oauth2/v2.0/token";
+                $response = $http_form_post($token_url, [
+                    'client_id' => $config_mail_oauth_client_id,
+                    'client_secret' => $config_mail_oauth_client_secret,
+                    'refresh_token' => $config_mail_oauth_refresh_token,
+                    'grant_type' => 'refresh_token',
+                ]);
+            }
+
+            if (!$response['ok']) {
+                flash_alert("<strong>IMAP OAuth failed:</strong> Could not refresh access token.", 'error');
+                redirect();
+            }
+
+            $json = json_decode($response['body'], true);
+            if (!is_array($json) || empty($json['access_token'])) {
+                flash_alert("<strong>IMAP OAuth failed:</strong> Token response did not include an access token.", 'error');
+                redirect();
+            }
+
+            $password = $json['access_token'];
+            $expires_at = date('Y-m-d H:i:s', time() + (int)($json['expires_in'] ?? 3600));
+            $refresh_token_to_save = $json['refresh_token'] ?? null;
+
+            $token_esc = mysqli_real_escape_string($mysqli, $password);
+            $expires_at_esc = mysqli_real_escape_string($mysqli, $expires_at);
+
+            $refresh_sql = '';
+            if (!empty($refresh_token_to_save)) {
+                $refresh_token_esc = mysqli_real_escape_string($mysqli, $refresh_token_to_save);
+                $refresh_sql = ", config_mail_oauth_refresh_token = '{$refresh_token_esc}'";
+            }
+
+            mysqli_query($mysqli, "UPDATE settings SET config_mail_oauth_access_token = '{$token_esc}', config_mail_oauth_access_token_expires_at = '{$expires_at_esc}'{$refresh_sql} WHERE company_id = 1");
+        }
+    }
+
+    // Build remote socket (implicit SSL vs plain TCP)
+    $transport = 'tcp';
+    if ($encryption === 'ssl') {
+        $transport = 'ssl';
+    }
+
+    $remote_socket = $transport . '://' . $host . ':' . $port;
+
+    // Stream context (you can tighten these if you want strict validation)
+    $context_options = [];
+    if (in_array($encryption, ['ssl', 'tls'], true)) {
+        $context_options['ssl'] = [
+            'verify_peer' => false,
+            'verify_peer_name' => false,
+            'allow_self_signed' => true,
+        ];
+    }
+
+    $context = stream_context_create($context_options);
+
+    try {
+        $errno = 0;
+        $errstr = '';
+
+        // 10-second timeout, adjust as needed
+        $fp = @stream_socket_client(
+            $remote_socket,
+            $errno,
+            $errstr,
+            10,
+            STREAM_CLIENT_CONNECT,
+            $context
+        );
+
+        if (!$fp) {
+            throw new Exception("Could not connect to IMAP server: [$errno] $errstr");
+        }
+
+        stream_set_timeout($fp, 10);
+
+        // Read server greeting (IMAP servers send something like: * OK Dovecot ready)
+        $greeting = fgets($fp, 1024);
+        if ($greeting === false || strpos($greeting, '* OK') !== 0) {
+            fclose($fp);
+            throw new Exception("Invalid IMAP greeting: " . trim((string) $greeting));
+        }
+        // If you really want STARTTLS for "tls" (port 143), you can do it here
+        if ($encryption === 'tls' && stripos($greeting, 'STARTTLS') !== false) {
+            fwrite($fp, "A0001 STARTTLS\r\n");
+            $line = fgets($fp, 1024);
+            if ($line === false || stripos($line, 'A0001 OK') !== 0) {
+                fclose($fp);
+                throw new Exception("STARTTLS failed: " . trim((string) $line));
+            }
+
+            if (!stream_socket_enable_crypto($fp, true, STREAM_CRYPTO_METHOD_TLS_CLIENT)) {
+                fclose($fp);
+                throw new Exception("Unable to enable TLS encryption on IMAP connection.");
+            }
+        }
+
+        $tag = 'A0002';
+
+        if ($is_oauth) {
+            $oauth_b64 = base64_encode("user={$username}\x01auth=Bearer {$password}\x01\x01");
+            $auth_cmd = sprintf("%s AUTHENTICATE XOAUTH2 %s\r\n", $tag, $oauth_b64);
+            fwrite($fp, $auth_cmd);
+        } else {
+            $login_cmd = sprintf(
+                "%s LOGIN \"%s\" \"%s\"\r\n",
+                $tag,
+                addcslashes($username, "\\\""),
+                addcslashes($password, "\\\"")
+            );
+
+            fwrite($fp, $login_cmd);
+        }
+
+        $success = false;
+        $error_line = '';
+
+        while (!feof($fp)) {
+            $line = fgets($fp, 2048);
+            if ($line === false) {
+                break;
+            }
+
+            if (strpos($line, $tag . ' ') === 0) {
+                if (stripos($line, $tag . ' OK') === 0) {
+                    $success = true;
+                } else {
+                    $error_line = trim($line);
+                }
+                break;
+            }
+        }
+
+        // Always logout / close
+        fwrite($fp, "A0003 LOGOUT\r\n");
+        fclose($fp);
+
+        if ($success) {
+            if ($is_oauth) {
+                flash_alert("Connected successfully using OAuth");
+            } else {
+                flash_alert("Connected successfully");
+            }
+        } else {
+            if (!$error_line) {
+                $error_line = 'Unknown IMAP authentication error';
+            }
+            throw new Exception($error_line);
+        }
+
     } catch (Exception $e) {
-        flash_alert("<strong>IMAP connection failed:</strong> " . $e->getMessage(), 'error');
+        flash_alert("<strong>IMAP connection failed:</strong> " . htmlspecialchars($e->getMessage()), 'error');
     }
 
     redirect();
-
+}
+
+
+if (isset($_POST['test_oauth_token_refresh'])) {
+
+    validateCSRFToken($_POST['csrf_token']);
+
+    $provider = sanitizeInput($_POST['oauth_provider'] ?? '');
+
+    if ($provider !== 'google_oauth' && $provider !== 'microsoft_oauth') {
+        flash_alert("OAuth token test failed: unsupported provider.", 'error');
+        redirect();
+    }
+
+    $oauth_client_id = sanitizeInput($config_mail_oauth_client_id ?? '');
+    $oauth_client_secret = sanitizeInput($config_mail_oauth_client_secret ?? '');
+    $oauth_tenant_id = sanitizeInput($config_mail_oauth_tenant_id ?? '');
+    $oauth_refresh_token = sanitizeInput($config_mail_oauth_refresh_token ?? '');
+
+    if (empty($oauth_client_id) || empty($oauth_client_secret) || empty($oauth_refresh_token)) {
+        flash_alert("OAuth token test failed: missing client ID, client secret, or refresh token.", 'error');
+        redirect();
+    }
+
+    if ($provider === 'microsoft_oauth' && empty($oauth_tenant_id)) {
+        flash_alert("OAuth token test failed: Microsoft tenant ID is required.", 'error');
+        redirect();
+    }
+
+    $token_url = 'https://oauth2.googleapis.com/token';
+    if ($provider === 'microsoft_oauth') {
+        $token_url = MICROSOFT_OAUTH_BASE_URL . rawurlencode($oauth_tenant_id) . "/oauth2/v2.0/token";
+    }
+
+    $post_fields = http_build_query([
+        'client_id' => $oauth_client_id,
+        'client_secret' => $oauth_client_secret,
+        'refresh_token' => $oauth_refresh_token,
+        'grant_type' => 'refresh_token',
+    ]);
+
+    $ch = curl_init($token_url);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_POST, true);
+    curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
+    curl_setopt($ch, CURLOPT_TIMEOUT, 20);
+
+    $raw_body = curl_exec($ch);
+    $curl_err = curl_error($ch);
+    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    curl_close($ch);
+
+    if ($raw_body === false || $http_code < 200 || $http_code >= 300) {
+        $err_msg = !empty($curl_err) ? $curl_err : "HTTP $http_code";
+        flash_alert("OAuth token test failed: $err_msg", 'error');
+        redirect();
+    }
+
+    $json = json_decode($raw_body, true);
+
+    if (!is_array($json) || empty($json['access_token'])) {
+        flash_alert("OAuth token test failed: access token missing in provider response.", 'error');
+        redirect();
+    }
+
+    $new_access_token = sanitizeInput($json['access_token']);
+    $new_expires_at = date('Y-m-d H:i:s', time() + (int)($json['expires_in'] ?? 3600));
+    $new_refresh_token = !empty($json['refresh_token']) ? sanitizeInput($json['refresh_token']) : '';
+
+    $new_access_token_esc = mysqli_real_escape_string($mysqli, $new_access_token);
+    $new_expires_at_esc = mysqli_real_escape_string($mysqli, $new_expires_at);
+
+    $refresh_sql = '';
+    if (!empty($new_refresh_token)) {
+        $new_refresh_token_esc = mysqli_real_escape_string($mysqli, $new_refresh_token);
+        $refresh_sql = ", config_mail_oauth_refresh_token = '$new_refresh_token_esc'";
+    }
+
+    mysqli_query($mysqli, "UPDATE settings SET config_mail_oauth_access_token = '$new_access_token_esc', config_mail_oauth_access_token_expires_at = '$new_expires_at_esc'$refresh_sql WHERE company_id = 1");
+
+    $provider_label = $provider === 'microsoft_oauth' ? 'Microsoft 365' : 'Google Workspace';
+    logAction("Settings", "Edit", "$session_name tested OAuth token refresh for $provider_label mail settings");
+
+    flash_alert("OAuth token refresh successful for $provider_label. Access token expires at $new_expires_at.");
+    redirect();
 }

admin/post/settings_online_payment_clients.php

@@ -34,7 +34,7 @@ if (isset($_GET['stripe_remove_pm'])) {
     // Remove Auto Pay on recurring invoices that are stripe
     $sql_recurring_invoices = mysqli_query($mysqli, "SELECT recurring_invoice_id FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id");
 
-    while ($row = mysqli_fetch_array($sql_recurring_invoices)) {
+    while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
         $recurring_invoice_id = intval($row['recurring_invoice_id']);
         mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_method = 'Stripe' AND recurring_payment_recurring_invoice_id = $recurring_invoice_id");
     }
@@ -59,7 +59,7 @@ if (isset($_GET['stripe_reset_customer'])) {
     // Remove Auto Pay on recurring invoices that are stripe
     $sql_recurring_invoices = mysqli_query($mysqli, "SELECT recurring_invoice_id FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id");
 
-    while ($row = mysqli_fetch_array($sql_recurring_invoices)) {
+    while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
         $recurring_invoice_id = intval($row['recurring_invoice_id']);
         mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_method = 'Stripe' AND recurring_payment_recurring_invoice_id = $recurring_invoice_id");
     }

admin/post/settings_theme.php

@@ -49,3 +49,17 @@ if (isset($_POST['edit_favicon_settings'])) {
     redirect();
 
 }
+
+if (isset($_GET['reset_favicon'])) {
+
+    if (file_exists("../uploads/favicon.ico")) {
+        unlink("../uploads/favicon.ico");
+    }
+
+    logAction("Settings", "Edit", "$session_name reset Favicon");
+
+    flash_alert("Favicon reset", 'error');
+
+    redirect();
+
+}

admin/post/software_template.php

@@ -51,7 +51,7 @@ if (isset($_GET['delete_software_template'])) {
 
     // Get Software Template Name for logging and alert message
     $sql = mysqli_query($mysqli,"SELECT software_template_name FROM software_templates WHERE software_template_id = $software_template_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $software_template_name = sanitizeInput($row['software_template_name']);
 
     mysqli_query($mysqli,"DELETE FROM software_templates WHERE software_template_id = $software_template_id");

admin/post/tag.php

@@ -28,7 +28,7 @@ if (isset($_POST['edit_tag'])) {
 
     $tag_id = intval($_POST['tag_id']);
 
-    mysqli_query($mysqli,"UPDATE tags SET tag_name = '$name', tag_type = $type, tag_color = '$color', tag_icon = '$icon' WHERE tag_id = $tag_id");
+    mysqli_query($mysqli,"UPDATE tags SET tag_name = '$name', tag_color = '$color', tag_icon = '$icon' WHERE tag_id = $tag_id");
 
     logAction("Tag", "Edit", "$session_name edited tag $name", 0, $tag_id);
 

admin/post/ticket_template.php

@@ -5,8 +5,8 @@
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 
 // Import shared code from user-side tickets/tasks as we reuse functions
-require_once '../user/post/ticket.php';
+require_once '../agent/post/ticket.php';
-require_once '../user/post/task.php';
+require_once '../agent/post/task.php';
 
 if (isset($_POST['add_ticket_template'])) {
 

admin/post/update.php

@@ -21,7 +21,7 @@ if (isset($_GET['update'])) {
     if ($config_telemetry > 0 OR $config_telemetry = 2) {
 
         $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
-        $row = mysqli_fetch_array($sql);
+        $row = mysqli_fetch_assoc($sql);
 
         $company_name = sanitizeInput($row['company_name']);
         $website = sanitizeInput($row['company_website']);

admin/post/users.php

@@ -53,7 +53,7 @@ if (isset($_POST['add_user'])) {
     mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa");
 
     $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $company_name = sanitizeInput($row['company_name']);
 
     // Sanitize Config vars from load_global_settings.php
@@ -118,7 +118,7 @@ if (isset($_POST['edit_user'])) {
 
     // Get current Avatar
     $sql = mysqli_query($mysqli, "SELECT user_avatar FROM users WHERE user_id = $user_id");
-    $row = mysqli_fetch_array($sql);
+    $row = mysqli_fetch_assoc($sql);
     $existing_file_name = sanitizeInput($row['user_avatar']);
 
     $extended_log_description = '';
@@ -236,16 +236,20 @@ if (isset($_GET['revoke_remember_me'])) {
 
 }
 
-if (isset($_GET['archive_user'])) {
+if (isset($_POST['archive_user'])) {
 
-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken($_POST['csrf_token']);
 
-    // Variables from GET
+    $user_id = intval($_POST['user_id']);
-    $user_id = intval($_GET['archive_user']);
+    $ticket_assign = intval($_POST['ticket_assign']);
     $password = password_hash(randomString(), PASSWORD_DEFAULT);
 
     $user_name = sanitizeInput(getFieldById('users', $user_id, 'user_name'));
 
+    // Un-assign / Re-assign tickets
+    mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $ticket_assign WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL AND ticket_resolved_at IS NULL");
+    mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_assigned_to = $ticket_assign WHERE recurring_ticket_assigned_to = $user_id");
+
     // Archive user query
     mysqli_query($mysqli, "UPDATE users SET user_name = '$user_name (archived)', user_password = '$password', user_status = 0, user_specific_encryption_ciphertext = '', user_archived_at = NOW() WHERE user_id = $user_id");
 
@@ -257,6 +261,36 @@ if (isset($_GET['archive_user'])) {
 
 }
 
+if (isset($_POST['restore_user'])) {
+
+    validateCSRFToken($_POST['csrf_token']);
+
+    $user_id = intval($_POST['user_id']);
+    $new_password = trim($_POST['new_password']);
+    $role = intval($_POST['role']);
+
+    $user_name = getFieldById('users', $user_id, 'user_name');
+    $user_name = sanitizeInput(str_replace(" (archived)", "", $user_name)); //Removed (archived) from user_name
+
+    // Restore user query
+    mysqli_query($mysqli, "UPDATE users SET user_name = '$user_name', user_status = 1, user_role_id = $role, user_archived_at = NULL WHERE user_id = $user_id");
+
+    if (!empty($new_password)) {
+        $new_password = password_hash($new_password, PASSWORD_DEFAULT);
+        $user_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['new_password']));
+        mysqli_query($mysqli, "UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $user_id");
+        //Extended Logging
+        $extended_log_description .= ", password changed";
+    }
+
+    logAction("User", "Restored", "$session_name restored user $user_name", 0, $user_id);
+
+    flash_alert("User <strong>$user_name</strong> restored");
+
+    redirect();
+
+}
+
 if (isset($_POST['export_users_csv'])) {
 
     //get records from database
@@ -266,6 +300,8 @@ if (isset($_POST['export_users_csv'])) {
 
     if ($count > 0) {
         $delimiter = ",";
+        $enclosure = '"';
+        $escape    = '\\';   // backslash
         $filename = "Users-" . date('Y-m-d') . ".csv";
 
         //create a file pointer
@@ -273,7 +309,7 @@ if (isset($_POST['export_users_csv'])) {
 
         //set column headers
         $fields = array('Name', 'Email', 'Role', 'Status', 'Creation Date');
-        fputcsv($f, $fields, $delimiter);
+        fputcsv($f, $fields, $delimiter, $enclosure, $escape);
 
         //output each row of the data, format line as csv and write to file pointer
         while($row = $sql->fetch_assoc()) {
@@ -288,7 +324,7 @@ if (isset($_POST['export_users_csv'])) {
             }
 
             $lineData = array($row['user_name'], $row['user_email'], $row['role_name'], $user_status_display, $row['user_created_at']);
-            fputcsv($f, $lineData, $delimiter);
+            fputcsv($f, $lineData, $delimiter, $enclosure, $escape);
         }
 
         //move back to beginning of file
@@ -317,7 +353,7 @@ if (isset($_POST['ir_reset_user_password'])) {
     // Confirm logged-in user password, for security
     $admin_password = $_POST['admin_password'];
     $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id");
-    $userRow = mysqli_fetch_array($sql);
+    $userRow = mysqli_fetch_assoc($sql);
 
     if (!password_verify($admin_password, $userRow['user_password'])) {
         flash_alert("Incorrect password.", 'error');
@@ -328,7 +364,7 @@ if (isset($_POST['ir_reset_user_password'])) {
     $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
 
     // Reset passwords
-    while ($row = mysqli_fetch_array($sql_users)) {
+    while ($row = mysqli_fetch_assoc($sql_users)) {
         $user_id = intval($row['user_id']);
         $user_email = sanitizeInput($row['user_email']);
         $new_password = randomString();

admin/post/vendor_template.php

@@ -5,7 +5,7 @@
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 
 // Import shared code from user-side vendor management  as we reuse functions
-require_once '../user/post/vendor.php';
+require_once '../agent/post/vendor.php';
 
 if (isset($_POST['add_vendor_template'])) {
 

admin/project_template.php

@@ -22,7 +22,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-project-diagram mr-2"></i>Project Templates</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addProjectTemplateModal"><i class="fas fa-plus mr-2"></i>New Project Template</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/project_template/project_template_add.php"><i class="fas fa-plus mr-2"></i>New Project Template</button>
         </div>
     </div>
     <div class="card-body">
@@ -61,7 +61,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                 <tbody>
                 <?php
 
-                while($row = mysqli_fetch_array($sql)){
+                while($row = mysqli_fetch_assoc($sql)){
                     $project_template_id = intval($row['project_template_id']);
                     $project_template_name = nullable_htmlentities($row['project_template_name']);
                     $project_template_description = nullable_htmlentities($row['project_template_description']);
@@ -87,7 +87,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     ?>
                     <tr>
                         <td>
-                            <a class="text-dark" href="#" data-toggle="modal" data-target="#editProjectTemplateModal<?php echo $project_template_id; ?>">
+                            <a class="text-dark ajax-modal" href="#" data-modal-url="modals/project_template/project_template_edit.php?project_template_id=<?= $project_template_id ?>">
                                 <div class="media">
                                     <i class="fa fa-fw fa-2x fa-project-diagram mr-3"></i>
                                     <div class="media-body">
@@ -109,7 +109,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                     <i class="fas fa-ellipsis-h"></i>
                                 </button>
                                 <div class="dropdown-menu">
-                                    <a class="dropdown-item" href="#" data-toggle="modal" data-target="#editProjectTemplateModal<?php echo $project_template_id; ?>">
+                                    <a class="dropdown-item ajax-modal" href="#" data-modal-url="modals/project_template/project_template_edit.php?project_template_id=<?= $project_template_id ?>">
                                         <i class="fas fa-fw fa-edit mr-2"></i>Edit
                                     </a>
                                     <?php if($session_user_role == 3) { ?>
@@ -125,8 +125,6 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                 <?php
 
-                    require "modals/project_template/project_template_edit.php";
-
                 }
 
                 ?>
@@ -134,12 +132,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                 </tbody>
             </table>
         </div>
-        <?php require_once "../includes/filter_footer.php";
+        <?php require_once "../includes/filter_footer.php"; ?>
- ?>
     </div>
 </div>
 
 <?php
-require_once "modals/project_template/project_template_add.php";
-
 require_once "../includes/footer.php";

admin/project_template_details.php

@@ -13,13 +13,13 @@ if (isset($_GET['project_template_id'])) {
     );
 
     if (mysqli_num_rows($sql_project_templates) == 0) {
-        echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='admin_project_template.php'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
+        echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
 
-        include_once "footer.php";
+        require_once "../includes/footer.php";
         exit;
     }
 
-    $row = mysqli_fetch_array($sql_project_templates);
+    $row = mysqli_fetch_assoc($sql_project_templates);
 
     $project_template_name = nullable_htmlentities($row['project_template_name']);
     $project_template_description = nullable_htmlentities($row['project_template_description']);
@@ -91,7 +91,7 @@ if (isset($_GET['project_template_id'])) {
 
         <div class="col-sm-2">
             <div class="btn-group float-right">
-                <button type="button" class="btn btn-primary btn-sm" href="#" data-toggle="modal" data-target="#addProjectTemplateTicketTemplateModal">
+                <button type="button" class="btn btn-primary btn-sm ajax-modal" href="#" data-modal-url="modals/project_template/project_template_ticket_template_add.php?project_template_id=<?= $project_template_id ?>">
                     <i class="fas fa-fw fa-plus mr-2"></i>Add Ticket Template
                 </button>
                 <div class="dropdown dropleft text-center ml-3">
@@ -99,7 +99,7 @@ if (isset($_GET['project_template_id'])) {
                         <i class="fas fa-fw fa-ellipsis-v"></i>
                     </button>
                     <div class="dropdown-menu" aria-labelledby="dropdownMenuButton">
-                        <a class="dropdown-item" href="#" data-toggle="modal" data-target="#editProjectTemplateModal<?php echo $project_template_id; ?>">
+                        <a class="dropdown-item ajax-modal" href="#" data-modal-url="modals/project_template/project_template_edit.php?project_template_id=<?= $project_template_id ?>">
                             <i class="fas fa-fw fa-edit mr-2"></i>Edit Template
                         </a>
                         <?php if ($session_user_role == 3) { ?>
@@ -143,7 +143,7 @@ if (isset($_GET['project_template_id'])) {
                         <tbody>
                         <?php
 
-                        while ($row = mysqli_fetch_array($sql_ticket_templates)) {
+                        while ($row = mysqli_fetch_assoc($sql_ticket_templates)) {
                             $ticket_template_id = intval($row['ticket_template_id']);
                             $ticket_template_order = intval($row['ticket_template_order']);
                             $ticket_template_name = nullable_htmlentities($row['ticket_template_name']);
@@ -199,7 +199,7 @@ if (isset($_GET['project_template_id'])) {
             <h5 class="text-secondary"><i class="fas fa-fw fa-tasks mr-2"></i>Project Task Templates</h5>
             <table class="table">
                 <?php
-                while($row = mysqli_fetch_array($sql_task_templates)){
+                while($row = mysqli_fetch_assoc($sql_task_templates)){
                     $task_template_id = intval($row['task_template_id']);
                     $task_template_name = nullable_htmlentities($row['task_template_name']);
                 ?>
@@ -221,9 +221,6 @@ if (isset($_GET['project_template_id'])) {
 
 <?php
 
-require_once "modals/project_template/project_template_edit.php";
-require_once "modals/project_template/project_template_ticket_template_add.php";
-
 }
 
 require_once "../includes/footer.php";

admin/roles.php

@@ -24,7 +24,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
             <h3 class="card-title mt-2"><i class="fas fa-fw fa-user-shield mr-2"></i>Roles</h3>
             <div class="card-tools">
                 <div class="btn-group">
-                    <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addRoleModal">
+                    <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/role/role_add.php">
                         <i class="fas fa-fw fa-user-plus mr-2"></i>New Role
                     </button>
                 </div>
@@ -65,7 +65,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $role_id = intval($row['role_id']);
                         $role_name = nullable_htmlentities($row['role_name']);
                         $role_description = nullable_htmlentities($row['role_description']);
@@ -143,6 +143,4 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
     </div>
 
 <?php
-
-require_once "modals/role/role_add.php";
 require_once "../includes/footer.php";

admin/saved_payment_method.php

@@ -33,6 +33,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
 ?>
 
+<ol class="breadcrumb d-print-none">
+    <li class="breadcrumb-item">
+        <a href="/admin">Admin</a>
+    </li>
+    <li class="breadcrumb-item">
+        <a href="payment_provider.php">Payment Providers</a>
+    </li>
+    <li class="breadcrumb-item active">Saved Payment Methods (Stripe)</li>
+</ol>
+
 <div class="card card-dark">
     <div class="card-header">
         <h3 class="card-title"><i class="fas fa-fw fa-credit-card mr-2"></i>Saved Payment Methods</h3>
@@ -94,7 +104,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                 <tbody>
                 <?php
 
-                while ($row = mysqli_fetch_array($sql)) {
+                while ($row = mysqli_fetch_assoc($sql)) {
                     $saved_payment_id = intval($row['saved_payment_id']);
                     $client_id = intval($row['saved_payment_client_id']);
                     $client_name = nullable_htmlentities($row['client_name']);
@@ -107,8 +117,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     ?>
                     <tr>
-                        <td><?php echo $client_name; ?> (<?php echo $client_id; ?>)</td>
+                        <td>
-                        <td><?php echo $provider_name; ?> (<?php echo $provider_id; ?>)</td>
+                            <?= $client_name ?>
+                            <br>
+                            <small class="text-secondary">ID: <?= $client_id ?></small>
+                        </td>
+                        <td>
+                            <?= $provider_name ?>
+                            <br>
+                            <small class="text-secondary">ID: <?= $provider_id ?></small>
+                        </td>
                         <td><?php echo $saved_payment_description; ?></td>
                         <td><?php echo $provider_client; ?></td>
                         <td><?php echo $provider_payment_method; ?></td>

admin/settings_company.php

@@ -4,7 +4,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $company_id = intval($row['company_id']);
 $company_name = nullable_htmlentities($row['company_name']);
 $company_country = nullable_htmlentities($row['company_country']);

admin/settings_custom_fields.php

@@ -66,7 +66,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     <tbody>
                     <?php
 
-                    while ($row = mysqli_fetch_array($sql)) {
+                    while ($row = mysqli_fetch_assoc($sql)) {
                         $custom_field_id = intval($row['custom_field_id']);
                         $custom_field_label = nullable_htmlentities($row['custom_field_label']);
                         $custom_field_type = nullable_htmlentities($row['custom_field_type']);
@@ -118,4 +118,3 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 require_once "custom_field_create_modal.php";
 
 require_once "../includes/footer.php";
-

admin/settings_default.php

@@ -42,7 +42,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $calendar_id = intval($row['calendar_id']);
                             $calendar_name = nullable_htmlentities($row['calendar_name']); ?>
                             <option <?php if ($config_default_calendar == $calendar_id) {
@@ -65,7 +65,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = nullable_htmlentities($row['account_name']); ?>
                             <option <?php if ($config_default_transfer_from_account == $account_id) {
@@ -88,7 +88,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = nullable_htmlentities($row['account_name']); ?>
                             <option <?php if ($config_default_transfer_to_account == $account_id) {
@@ -111,7 +111,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = nullable_htmlentities($row['account_name']); ?>
                             <option <?php if ($config_default_payment_account == $account_id) {
@@ -136,7 +136,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = nullable_htmlentities($row['account_name']); ?>
                             <option <?php if ($config_default_expense_account == $account_id) {
@@ -159,7 +159,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = nullable_htmlentities($row['category_name']); ?>
                             <option <?php if ($config_default_payment_method == $payment_method) {
                                         echo "selected";
@@ -181,7 +181,7 @@ require_once "includes/inc_all_admin.php";
                         <?php
 
                         $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
-                        while ($row = mysqli_fetch_array($sql)) {
+                        while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = nullable_htmlentities($row['category_name']); ?>
                             <option <?php if ($config_default_expense_payment_method == $payment_method) {
                                         echo "selected";
@@ -214,7 +214,7 @@ require_once "includes/inc_all_admin.php";
                     <div class="input-group-prepend">
                         <span class="input-group-text"><i class="fa fa-fw fa-clock"></i></span>
                     </div>
-                    <input type="text" class="form-control" inputmode="numeric" pattern="[0-9]*\.?[0-9]{0,2}" name="hourly_rate" value="<?php echo number_format($config_default_hourly_rate, 2, '.', ''); ?>" placeholder="0.00" required>
+                    <input type="text" class="form-control" inputmode="decimal" pattern="[0-9]*\.?[0-9]{0,2}" name="hourly_rate" value="<?php echo number_format($config_default_hourly_rate, 2, '.', ''); ?>" placeholder="0.00" required>
                 </div>
             </div>
 

admin/settings_localization.php

@@ -4,7 +4,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
-$row = mysqli_fetch_array($sql);
+$row = mysqli_fetch_assoc($sql);
 $company_locale = nullable_htmlentities($row['company_locale']);
 $company_currency = nullable_htmlentities($row['company_currency']);
 
@@ -76,4 +76,3 @@ $timezones = DateTimeZone::listIdentifiers();
 
 <?php
 require_once "../includes/footer.php";
-

admin/settings_mail.php

@@ -10,6 +10,28 @@ require_once "includes/inc_all_admin.php";
             <form action="post.php" method="post" autocomplete="off">
                 <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
+                <!-- SMTP Provider -->
+                <div class="form-group">
+                    <label>SMTP Provider</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-cloud"></i></span>
+                        </div>
+                        <select class="form-control" name="config_smtp_provider" id="config_smtp_provider">
+                            <option value="" <?php if(empty($config_smtp_provider)) { echo 'selected'; } ?>>None (Disabled)</option>
+                            <option value="standard_smtp" <?php if($config_smtp_provider === 'standard_smtp') { echo 'selected'; } ?>>Standard SMTP (Username/Password)</option>
+                            <option value="google_oauth" <?php if($config_smtp_provider === 'google_oauth') { echo 'selected'; } ?>>Google Workspace (OAuth)</option>
+                            <option value="microsoft_oauth" <?php if($config_smtp_provider === 'microsoft_oauth') { echo 'selected'; } ?>>Microsoft 365 (OAuth)</option>
+                        </select>
+                    </div>
+                    <small class="text-secondary d-block mt-1" id="smtp_provider_hint">
+                        Choose your SMTP provider. OAuth options ignore the SMTP password here.
+                    </small>
+                </div>
+
+
+                <!-- Standard SMTP fields (show only for standard_smtp) -->
+                <div id="smtp_standard_fields">
                     <div class="form-group">
                         <label>SMTP Host</label>
                         <div class="input-group">
@@ -54,6 +76,7 @@ require_once "includes/inc_all_admin.php";
                         </div>
                     </div>
 
+                    <div class="form-group" id="smtp_password_group">
                         <div class="form-group">
                             <label>SMTP Password</label>
                             <div class="input-group">
@@ -66,6 +89,9 @@ require_once "includes/inc_all_admin.php";
                                 </div>
                             </div>
                         </div>
+                    </div>
+
+                </div>
 
                 <hr>
 
@@ -83,6 +109,24 @@ require_once "includes/inc_all_admin.php";
             <form action="post.php" method="post" autocomplete="off">
                 <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
+                <div class="form-group">
+                    <label>IMAP Provider</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-cloud"></i></span>
+                        </div>
+                        <select class="form-control" name="config_imap_provider" id="config_imap_provider">
+                            <option value="" <?php if(empty($config_imap_provider)) { echo 'selected'; } ?>>None (Disabled)</option>
+                            <option value="standard_imap" <?php if($config_imap_provider === 'standard_imap') { echo 'selected'; } ?>>Standard IMAP (Username/Password)</option>
+                            <option value="google_oauth" <?php if($config_imap_provider === 'google_oauth') { echo 'selected'; } ?>>Google Workspace (OAuth)</option>
+                            <option value="microsoft_oauth" <?php if($config_imap_provider === 'microsoft_oauth') { echo 'selected'; } ?>>Microsoft 365 (OAuth)</option>
+                        </select>
+                    </div>
+                    <small class="text-secondary d-block mt-1" id="imap_provider_hint">
+                    Select your mailbox provider. OAuth options ignore the IMAP password here.
+                    </small>
+                </div>
+                <div id="standard_fields" style="display:none;">
                     <div class="form-group">
                         <label>IMAP Host</label>
                         <div class="input-group">
@@ -116,6 +160,7 @@ require_once "includes/inc_all_admin.php";
                             </select>
                         </div>
                     </div>
+                </div>
 
                 <div class='form-group'>
                     <label>IMAP Username</label>
@@ -123,25 +168,107 @@ require_once "includes/inc_all_admin.php";
                         <div class='input-group-prepend'>
                             <span class='input-group-text'><i class='fa fa-fw fa-user'></i></span>
                         </div>
-                        <input type='text' class='form-control' name='config_imap_username' placeholder='Username' value="<?php
+                        <input type='text' class='form-control' name='config_imap_username' placeholder='Username (email address)' value="<?php echo nullable_htmlentities($config_imap_username); ?>" required>
-                        echo nullable_htmlentities($config_imap_username); ?>" required>
                     </div>
                 </div>
 
-                <div class='form-group'>
+                <div class='form-group' id="imap_password_group">
                     <label>IMAP Password</label>
                     <div class='input-group'>
                         <div class='input-group-prepend'>
                             <span class='input-group-text'><i class='fa fa-fw fa-key'></i></span>
                         </div>
-                        <input type='password' class='form-control' data-toggle='password' name='config_imap_password' placeholder='Password' value="<?php
+                        <input type='password' class='form-control' data-toggle='password' name='config_imap_password' placeholder='Password (not used for OAuth)' value="<?php echo nullable_htmlentities($config_imap_password); ?>" autocomplete='new-password'>
-                        echo nullable_htmlentities($config_imap_password); ?>" autocomplete='new-password' required>
                         <div class='input-group-append'>
                             <span class='input-group-text'><i class='fa fa-fw fa-eye'></i></span>
                         </div>
                     </div>
                 </div>
 
+                <!-- OAuth shared fields (show for google_oauth / microsoft_oauth) -->
+                <div id="smtp_oauth_fields" style="display:none;">
+                    <hr>
+                    <h5 class="mb-2">OAuth Settings (shared for IMAP & SMTP)</h5>
+                    <p class="text-secondary" id="oauth_hint">
+                        Configure OAuth credentials for the selected provider.
+                    </p>
+
+                    <div class="form-group">
+                        <label>OAuth Client ID</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-id-badge"></i></span></div>
+                            <input type="text" class="form-control" name="config_mail_oauth_client_id"
+                                   value="<?php echo nullable_htmlentities($config_mail_oauth_client_id ?? ''); ?>">
+                        </div>
+                    </div>
+
+                    <div class="form-group">
+                        <label>OAuth Client Secret</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-key"></i></span></div>
+                            <input type="password" class="form-control" data-toggle="password" name="config_mail_oauth_client_secret"
+                                   value="<?php echo nullable_htmlentities($config_mail_oauth_client_secret ?? ''); ?>" autocomplete="new-password">
+                            <div class="input-group-append"><span class="input-group-text"><i class="fa fa-fw fa-eye"></i></span></div>
+                        </div>
+                    </div>
+
+                    <div class="form-group" id="tenant_row" style="display:none;">
+                        <label>Tenant ID (Microsoft 365 only)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-building"></i></span></div>
+                            <input type="text" class="form-control" name="config_mail_oauth_tenant_id"
+                                   value="<?php echo nullable_htmlentities($config_mail_oauth_tenant_id ?? ''); ?>">
+                        </div>
+                    </div>
+
+                    <div class="form-group">
+                        <label>Refresh Token</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-sync-alt"></i></span></div>
+                            <textarea class="form-control" name="config_mail_oauth_refresh_token" rows="2"
+                                      placeholder="Paste refresh token"><?php echo nullable_htmlentities($config_mail_oauth_refresh_token ?? ''); ?></textarea>
+                        </div>
+                    </div>
+
+                    <div class="form-group">
+                        <label>Access Token (optional – will refresh if expired)</label>
+                        <div class="input-group">
+                            <div class="input-group-prepend"><span class="input-group-text"><i class="fa fa-fw fa-shield-alt"></i></span></div>
+                            <textarea class="form-control" name="config_mail_oauth_access_token" rows="2"
+                                      placeholder="Can be left blank; system refreshes using the refresh token"><?php echo nullable_htmlentities($config_mail_oauth_access_token ?? ''); ?></textarea>
+                        </div>
+                        <small class="text-secondary">
+                            Expires at: <?php echo !empty($config_mail_oauth_access_token_expires_at) ? htmlspecialchars($config_mail_oauth_access_token_expires_at) : 'n/a'; ?>
+                        </small>
+                    </div>
+                </div>
+
+                <?php
+                if (defined('BASE_URL') && !empty(BASE_URL)) {
+                    $mail_oauth_callback_uri = rtrim((string) BASE_URL, '/') . '/admin/oauth_microsoft_mail_callback.php';
+                } else {
+                    $mail_oauth_callback_uri = 'https://' . rtrim((string) $config_base_url, '/') . '/admin/oauth_microsoft_mail_callback.php';
+                }
+                ?>
+
+                <div class="form-group">
+                    <label>Microsoft OAuth Connect (Web)</label>
+                    <div class="input-group">
+                        <div class="input-group-prepend">
+                            <span class="input-group-text"><i class="fa fa-fw fa-link"></i></span>
+                        </div>
+                        <input type="text" class="form-control" readonly value="<?php echo htmlspecialchars($mail_oauth_callback_uri); ?>">
+                        <div class="input-group-append">
+                            <button type="submit" name="oauth_connect_microsoft_mail" class="btn btn-outline-primary">
+                                <i class="fas fa-fw fa-sign-in-alt mr-2"></i>Connect Microsoft 365
+                            </button>
+                        </div>
+                    </div>
+                    <small class="text-secondary">
+                        Add this callback URI in Entra App Registration, then click Connect to authorize and store refresh token automatically.
+                    </small>
+                </div>
+
                 <hr>
 
                 <button type="submit" name="edit_mail_imap_settings" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
@@ -258,7 +385,22 @@ require_once "includes/inc_all_admin.php";
         </div>
     </div>
 
-    <?php if (!empty($config_smtp_host) && !empty($config_smtp_port) && !empty($config_mail_from_email) && !empty($config_mail_from_name)) { ?>
+    <?php
+    $smtp_standard_ready = !empty($config_smtp_host)
+        && !empty($config_smtp_port)
+        && !empty($config_mail_from_email)
+        && !empty($config_mail_from_name);
+
+    $smtp_oauth_ready = ($config_smtp_provider === 'google_oauth' || $config_smtp_provider === 'microsoft_oauth')
+        && !empty($config_mail_from_email)
+        && !empty($config_mail_from_name)
+        && !empty($config_mail_oauth_client_id)
+        && !empty($config_mail_oauth_client_secret)
+        && !empty($config_mail_oauth_refresh_token)
+        && ($config_smtp_provider !== 'microsoft_oauth' || !empty($config_mail_oauth_tenant_id));
+    ?>
+
+    <?php if ($smtp_standard_ready || $smtp_oauth_ready) { ?>
 
     <div class="card card-dark">
         <div class="card-header py-3">
@@ -308,7 +450,21 @@ require_once "includes/inc_all_admin.php";
 
     <?php } ?>
 
-    <?php if (!empty($config_imap_username) && !empty($config_imap_password) && !empty($config_imap_host) && !empty($config_imap_port)) { ?>
+    <?php
+    $imap_standard_ready = !empty($config_imap_username)
+        && !empty($config_imap_password)
+        && !empty($config_imap_host)
+        && !empty($config_imap_port);
+
+    $imap_oauth_ready = ($config_imap_provider === 'google_oauth' || $config_imap_provider === 'microsoft_oauth')
+        && !empty($config_imap_username)
+        && !empty($config_mail_oauth_client_id)
+        && !empty($config_mail_oauth_client_secret)
+        && !empty($config_mail_oauth_refresh_token)
+        && ($config_imap_provider !== 'microsoft_oauth' || !empty($config_mail_oauth_tenant_id));
+    ?>
+
+    <?php if ($imap_standard_ready || $imap_oauth_ready) { ?>
 
     <div class="card card-dark">
         <div class="card-header py-3">
@@ -327,5 +483,108 @@ require_once "includes/inc_all_admin.php";
 
     <?php } ?>
 
-<?php require_once "../includes/footer.php";
+    <?php
+    $oauth_provider_for_test = '';
+    if ($config_imap_provider === 'google_oauth' || $config_imap_provider === 'microsoft_oauth') {
+        $oauth_provider_for_test = $config_imap_provider;
+    } elseif ($config_smtp_provider === 'google_oauth' || $config_smtp_provider === 'microsoft_oauth') {
+        $oauth_provider_for_test = $config_smtp_provider;
+    }
 
+    $oauth_has_required_fields = !empty($oauth_provider_for_test)
+        && !empty($config_mail_oauth_client_id)
+        && !empty($config_mail_oauth_client_secret)
+        && !empty($config_mail_oauth_refresh_token)
+        && ($oauth_provider_for_test !== 'microsoft_oauth' || !empty($config_mail_oauth_tenant_id));
+    ?>
+
+    <?php if ($oauth_has_required_fields) { ?>
+
+    <div class="card card-dark">
+        <div class="card-header py-3">
+            <h3 class="card-title"><i class="fas fa-fw fa-key mr-2"></i>Test OAuth Token Refresh</h3>
+        </div>
+        <div class="card-body">
+            <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+                <input type="hidden" name="oauth_provider" value="<?php echo htmlspecialchars($oauth_provider_for_test); ?>">
+
+                <p class="text-secondary mb-3">
+                    This validates your refresh token and stores a new access token for
+                    <?php echo $oauth_provider_for_test === 'microsoft_oauth' ? 'Microsoft 365' : 'Google Workspace'; ?>.
+                </p>
+
+                <button type="submit" name="test_oauth_token_refresh" class="btn btn-success">
+                    <i class="fas fa-fw fa-sync-alt mr-2"></i>Test OAuth Token Refresh
+                </button>
+            </form>
+        </div>
+    </div>
+
+    <?php } ?>
+
+<script>
+(function(){
+  function setDisabled(container, disabled){
+    if(!container) return;
+    container.querySelectorAll('input, select, textarea').forEach(el => el.disabled = !!disabled);
+  }
+
+  function wireProvider(selectId, standardWrapId, passwordGroupId, oauthWrapId, tenantRowId, hintId, oauthHintId){
+    const sel   = document.getElementById(selectId);
+    const std   = document.getElementById(standardWrapId);
+    const pwd   = document.getElementById(passwordGroupId);
+    const oauth = document.getElementById(oauthWrapId);
+    const ten   = document.getElementById(tenantRowId);
+    const hint  = document.getElementById(hintId);
+    const ohint = document.getElementById(oauthHintId);
+
+    function toggle(){
+      const v = (sel && sel.value) || '';
+      const isNone  = (v === 'none' || v === '');
+      const isStd   = v === 'standard_smtp' || v === 'standard_imap';
+      const isG     = v === 'google_oauth';
+      const isM     = v === 'microsoft_oauth';
+      const isOAuth = isG || isM;
+
+      if (std)   std.style.display   = isStd ? '' : 'none';
+      if (pwd)   pwd.style.display   = isStd ? '' : 'none';
+      if (oauth) oauth.style.display = isOAuth ? '' : 'none';
+      if (ten)   ten.style.display   = isM ? '' : 'none';
+
+      setDisabled(std,   !isStd);
+      setDisabled(pwd,   !isStd);
+      setDisabled(oauth, !isOAuth);
+
+      if (hint) {
+        hint.textContent = isNone
+          ? 'Disabled.'
+          : isStd
+            ? 'Standard: provide host, port, encryption, username & password.'
+            : isG
+              ? 'Google OAuth: set Client ID/Secret; paste a refresh token; username should be the mailbox email.'
+              : 'Microsoft 365 OAuth: set Client ID/Secret/Tenant; paste a refresh token; username should be the mailbox email.';
+      }
+      if (ohint) {
+        ohint.textContent = isG
+          ? 'Google Workspace OAuth: Client ID/Secret from Google Cloud; Refresh token via consent.'
+          : isM
+            ? 'Microsoft 365 OAuth: Client ID/Secret/Tenant from Entra ID; Refresh token via consent.'
+            : 'Configure OAuth credentials for the selected provider.';
+      }
+    }
+
+    if (sel) { sel.addEventListener('change', toggle); toggle(); }
+  }
+
+  // IMAP (you already have these IDs in your page)
+  wireProvider('config_imap_provider', 'standard_fields', 'imap_password_group',
+               'oauth_fields', 'tenant_row', 'imap_provider_hint', 'oauth_hint');
+
+  // SMTP (the IDs we just added)
+  wireProvider('config_smtp_provider', 'smtp_standard_fields', 'smtp_password_group',
+               'smtp_oauth_fields', 'smtp_tenant_row', 'smtp_provider_hint', 'smtp_oauth_hint');
+})();
+</script>
+
+<?php require_once "../includes/footer.php";

admin/settings_theme.php

@@ -57,11 +57,12 @@ require_once "includes/inc_all_admin.php";
                 <hr>
 
                 <button type="submit" name="edit_favicon_settings" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Upload Icon</button>
-
+                <?php if(file_exists("../uploads/favicon.ico")) { ?>
+                <a href="post.php?reset_favicon" class="btn btn-outline-danger"><i class="fas fa-redo-alt mr-2"></i>Reset Favicon</a>
+                <?php } ?>
             </form>
         </div>
     </div>
 
 <?php
 require_once "../includes/footer.php";
-

admin/settings_ticket.php

@@ -97,7 +97,7 @@ require_once "includes/inc_all_admin.php";
                 <label>Kanban Settings</label>
                     <div class="custom-control custom-switch">
                         <input type="checkbox" class="custom-control-input" name="config_ticket_ordering" <?php if ($config_ticket_ordering == 1) { echo "checked"; } ?> value="1" id="ticketOrderingSwitch">
-                        <label class="custom-control-label" for="ticketOrderingSwitch">Allow ticket ordering within its column<small class="text-secondary">(uncheked will result in ordering it by priority and id)</small></label>
+                        <label class="custom-control-label" for="ticketOrderingSwitch">Allow ticket ordering within its column<small class="text-secondary"> (unchecked = order by priority and id)</small></label>
                     </div>
                     <div class="custom-control custom-switch">
                     <input type="checkbox" class="custom-control-input" name="config_ticket_moving_columns" <?php if ($config_ticket_moving_columns == 1) { echo "checked"; } ?> value="1" id="ticketMovingColumnsSwitch">

admin/software_template.php

@@ -21,7 +21,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
     <div class="card-header py-2">
         <h3 class="card-title mt-2"><i class="fas fa-fw fa-cube mr-2"></i>License Templates</h3>
         <div class="card-tools">
-            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addSoftwareTemplateModal"><i class="fas fa-plus mr-2"></i>New License Template</button>
+            <button type="button" class="btn btn-primary ajax-modal" data-modal-url="modals/software_template/software_template_add.php"><i class="fas fa-plus mr-2"></i>New License Template</button>
         </div>
     </div>
     <div class="card-body">
@@ -68,7 +68,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                 <tbody>
                 <?php
 
-                while($row = mysqli_fetch_array($sql)){
+                while($row = mysqli_fetch_assoc($sql)){
                     $software_template_id = intval($row['software_template_id']);
                     $software_template_name = nullable_htmlentities($row['software_template_name']);
                     $software_template_version = nullable_htmlentities($row['software_template_version']);
@@ -127,5 +127,4 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 </div>
 
 <?php
-require_once "modals/software_template/software_template_add.php";
 require_once "../includes/footer.php";