# Changelog This file documents all notable changes made to ITFlow. ## [26.08] ### Backups Backups are now encrypted, catalogued, schedulable, and restorable from the command line. - **Three types** — Full (database + uploads), Database Only, and Master Key. Every archive is an AES-256 encrypted zip. - **One encryption key per install**, generated on first use and stored in `config.php` — never in the database and never in the file name. It is shown in Maintenance > Backup. **Write it down: without it a backup cannot be restored.** Open archives with 7-Zip, WinZip, PeaZip or Keka — `unzip`, Windows Explorer and the macOS Archive Utility do not support AES. - **Backups are built by cron, not by your browser.** The button queues the work and the dispatcher picks it up within the minute, then notifies you. A dump of a real install takes longer than a web request is allowed to live, which is why the old Download Backup button timed out on large instances. - **Scheduled backups** are a new `backup` cron job, off by default. Turn it on in Maintenance > Cron. Retention (by age and by count) runs in the nightly job and never deletes the newest backup. - **Archives are stored outside the web-served path** under `uploads/backups/` with a deny-all rule, and downloaded through an admin-only handler. Set `$config_backup_path` in `config.php` to keep them off the web root entirely. - **Restore from the command line** with `php scripts/restore_cli.php --file=/path/to/backup.zip`. This is the only restore path with no size limit — the setup wizard's restore is capped by PHP's upload limits, and a full backup is usually larger. Use `--inspect` to check an archive without changing anything. - **Restores validate before they destroy.** The key is checked and the archive unpacked before any table is dropped, and the current database is dumped first and put back automatically if the import fails. ### Security - **The setup wizard's restore step is now closed on any install that has users**, whatever `config.php` says. Previously, if `$config_enable_setup` was missing from `config.php` — a state an install can be left in when setup does not reach its final step — the restore step stayed reachable. An install in that state cannot be logged into, so it is normally noticed and corrected straight away, but the restore step should not have been reachable in that window. Restoring over a live install is now done from the command line. - A restore no longer takes ITFlow's `uploads/.htaccess` from the archive — the guards are rewritten afterwards regardless of what the backup contained, so restoring a backup taken before those guards existed no longer removes them. ### Upgrading to 26.08 > **Read this before you start.** Done out of order this update will break your instance. The database structure changes, every API key is deleted, and the whole cron setup is replaced. 1. **Back everything up.** Snapshot the VM and dump the database: ```bash mysqldump itflow > itflow-pre-26.08.sql ``` 2. **Remove every ITFlow line from your crontab** (or delete `/etc/cron.d/itflow`). The old per-minute jobs must not keep firing against a half-updated install. You put the new one in at step 5. 3. **Update the files** from Settings > Update as usual, or from the shell with `php /path/to/itflow/scripts/update_cli.php --update`. 4. **You will get a 500 error. That is expected.** The new code needs the new database, and just this once the database update has to be run from the command line. Run it as the user that owns the ITFlow files — the script tells you which user if you get it wrong: ```bash sudo -u www-data php /path/to/itflow/scripts/update_cli.php --update_db ``` It applies every pending version in order and reports each one as it goes. On an install with a lot of ticket history it can take a minute or more, so let it finish. If a step fails it stops there without advancing the recorded version, so you can fix the problem and run it again. The 500s stop as soon as it completes. 5. **Add the new cron entry.** One line runs everything now, and the schedules are managed in ITFlow under Maintenance > Cron: ``` * * * * * www-data php /path/to/itflow/cron/cron.php >/dev/null ``` Drop the `www-data` column if this goes in a user crontab rather than `/etc/cron.d`. 6. **Recreate your API keys.** Every existing key is deleted by this update. Issue new ones and update anything that talks to the ITFlow API. 7. **Check it took, and check the master switch.** Open Maintenance > Cron — the green "Cron last checked in" banner should appear within a couple of minutes and every job should pick up a schedule. The **Enable Cron** switch has moved to this page from Settings > Notifications, and it now stops *every* job rather than most of them. If it is off, turn it on here: on earlier releases the ticket email parser and the SLA monitor ran regardless of it, so an install with the switch off may have been parsing mail all along without anyone realising the switch mattered. Only this release needs the command line for the database update. Normal updates go back to running from Settings > Update as usual. ### Breaking Changes and Notes - Cron: the crontab collapses to a single entry. `cron/cron.php` is now a dispatcher that runs every minute and works out which jobs in `cron/` are due, and the old nightly work has moved to `cron/nightly_tasks.php` which it runs at 03:00. - Cron: an existing crontab keeps working — the per-minute scripts still run and still lock correctly, and a single daily `cron.php` entry still runs the daily jobs — but any job added in this or a future release only runs once the dispatcher is scheduled. - Cron: ticket SLAs need no entry of their own. `cron/ticket_sla.php` is in the dispatcher's job list and runs every minute once the new entry is in place. Without it SLA targets are still worked out and displayed, but warnings and breaches never fire. - API: every existing key is deleted by this update and must be recreated. Keys are now owned by a user and inherit that user's role, module and client permissions instead of carrying their own client scope, and existing keys cannot be safely mapped to a user. - API: credential decrypt passwords are now read from the request body instead of the query string. Any caller passing that value in the URL needs updating. - Client access permissions now support deny rules as well as allow, and the permissions UI will not load until the database update has run. - Business hours are new and default to Monday to Friday, 09:00 to 17:00 in your configured timezone. SLA targets are measured against them, so set them before assigning SLAs. - The `plugins` directory is now `libs`. Anything pointing at `plugins/` directly — custom scripts, reverse proxy rules, web server config — needs updating. - Several pages dropped the `_details` suffix and moved to consistent singular and plural filenames, so old bookmarks and external links will 404. ### New Features & Updates - Cron: one entry instead of five, and a page to manage it. Jobs are tracked in a new `cron_jobs` table, so a job whose slot was missed runs at the next opportunity rather than waiting a day, and each job locks for its own run so a slow mailbox or a long nightly pass no longer holds anything else up. - Cron: new Maintenance > Cron page listing every job with its schedule, last run, duration, outcome and next due time. Jobs can be disabled, rescheduled, or run on demand — Run Now hands the job to the next dispatch so it starts within a minute and still runs on the command line. The last error is kept until dismissed rather than vanishing behind the next success, and the page says plainly when the crontab entry itself is missing. - Cron: the master **Enable Cron** switch has moved from Settings > Notifications to Maintenance > Cron, alongside everything else about cron. It can be turned on and off from that page, and the page now explains what it is for — stopping a restored backup or a staging clone from emailing clients and charging cards, which per-job toggles cannot do on their own. Saving Notification settings no longer touches it. - Cron: the master switch now stops **every** job. The Ticket Email Parser and Ticket SLA Monitor previously ignored it and kept running while cron was switched off, which was neither documented nor visible anywhere. **If your Enable Cron switch is off but email-to-ticket has been working, turn cron on in Maintenance > Cron after upgrading** — see the upgrade steps above. Both jobs report "Cron: is not enabled" on the Cron page when the switch is off, so the state is now legible instead of silent. - Settings > Notifications: removed five rows that had no controls in them and no setting behind them — certificate expiry, asset warranty expiry, shared item views, cron execution and ITFlow updates. The cron execution row is now covered properly by the last run, duration and outcome columns on Maintenance > Cron. - Settings > Ticketing: the email-to-ticket hint no longer names a cron script that has not existed for several releases, and points at Maintenance > Cron instead. - Setup: the command line installer now prints the crontab entry and the reminder to turn cron on, the same two steps the web installer shows on its finish page. - Removed the unused `config_invoice_overdue_reminders` setting. It was seeded on install and read in two places but never actually used by anything; the overdue reminder schedule is fixed in the nightly job. - Update page: reworked. Release, tracked branch, database version and code commit are now shown whatever state the install is in, instead of only when it is already up to date, and a pending database update no longer hides a pending application update — both appear, in the order they need doing. Pending commits are listed in a readable table rather than a centred one, and the backup warning is stated once instead of twice. - Update page: **Force Update no longer resets to `origin/master` regardless of the branch you track.** On an install following any other branch it silently moved the files onto master and discarded the code that was actually running. It now resets to the branch in `$repo_branch`, and so does `update_cli.php --force_update`. Installs with no `$repo_branch` in `config.php` still get master, as before. - Update page: the database update is now offered using a proper version comparison. The old string comparison would have stopped offering updates once a version reached a two-digit part — `2.6.10` sorts below `2.6.9` as plain text. - Update page: Git output — commit subjects and error text — is escaped before it reaches the page, and the branch name is escaped before it reaches a shell command. The page also no longer runs a second `git fetch` just to read the error message from the first one. - Income: added a Category filter and a Category column. A revenue carries its own category and a payment inherits the one on the invoice it was paid against, so both are categorised. Only categories actually in use are listed. Category is searchable and sortable, and it carries through to the export. - Income: the Source column now shows what the money was for. A revenue's category was being displayed there, which meant the revenue description never appeared on the page at all even though it is captured on the add and edit forms. Category has its own column now, so both are visible. - Income: fixed a PHP warning on every page load without a date range, and the export's filter summary, which was never populated - a filtered PDF came out looking like a full export. - Cron: the nightly run is safe to repeat. Late fees, overdue invoice reminders and autopay retries now apply at most once per invoice per day, so a Run Now after the scheduled pass no longer stacks fees or re-emails clients. Nightly Tasks only accepts the daily schedule. - Ticket SLAs, optional throughout. An SLA sets a response target and an optional resolution target, assigned per client and priority with a global default and an explicit "no SLA" override. Targets are measured against your business hours. Tickets show time remaining and turn yellow at a configurable warning threshold and red on breach, on both the ticket list and the kanban board, and can be filtered by SLA state. Nominated statuses pause the resolution clock for "waiting on customer", preserving the remaining budget. Two new reports, SLA Summary and SLA by Client. With no assignments defined nothing behaves any differently. - Ticket: added an Urgent priority. - Ticket: agents can attach files to tickets from inside the app, both when raising a ticket and on a reply, and attachments are emailed to the contact through the mail queue. A 10 MB ceiling applies per message; anything that does not fit stays on the ticket to download. - Ticket: tasks can be added and edited inline in the add ticket and add recurring ticket modals. - Ticket: the older add ticket modal has been retired, there is one add ticket modal now. - Ticket: watchers and attachments have moved into the assignment section of the add ticket modal. - Ticket: recurring tickets can be assigned a ticket template. Picking one fills in the subject and details and stamps the template's task list onto every ticket the schedule raises, from the nightly run and a forced run alike. The recurring ticket list shows which schedules carry a template and how many tasks it adds. - Ticket: recurring tickets now own their task list. The template fills it in when picked but it can then be edited per schedule, and it is those edits the run reads. Existing schedules are backfilled from their template by the database update. - API: added ticket reply endpoints for creating and reading replies. - Calendar: calendars can be published as a read-only iCalendar (ICS) subscription feed and read by Google Calendar, Nextcloud, Apple Calendar, Thunderbird or anything else that takes a feed URL. The link carries a secret key and needs no login, can be regenerated or revoked at any time, and a busy only option publishes time blocks without titles, descriptions or locations. Refresh timing belongs to the subscribing client — Google refreshes on its own schedule and cannot be forced, and Nextcloud defaults to weekly and refuses feed URLs resolving to private IPs. - Calendar: events can be marked all day, and the date and time are now separate fields. Previously all day was inferred from a midnight start, which made a genuine midnight appointment indistinguishable from an all-day event. Existing events are backfilled by the database update using the old rule, so nothing changes appearance. - Calendar: repeating events now work. The Repeat field was present but disabled and the stored value was never drawn. It is now selectable daily, weekly, monthly or yearly, and monthly and yearly series skip dates that do not exist in a period rather than sliding into the next month. Recurrence is series-wide — editing any occurrence edits the whole series, and individual occurrences cannot yet be moved or cancelled. Repeating events are marked with an icon and a hover note, and the delete action reads Delete series and asks for confirmation. - Calendar: clicking empty space creates an event there. Clicking a day or a time slot, or dragging across several, opens the New Event modal with the start and end already filled in and the All day switch set to match. A range dragged out or lengthened by hand is no longer overwritten by the end-time-follows-start behaviour. - Exports: every export modal now has a Filter tab and a Selectable Columns tab with sensible defaults, and can export to PDF as well as CSV. - Combined Payments and Revenues into a single Income page with CSV export. Revenue not tied to an invoice is still added there and payments are still added from invoices. The standalone Payments and Revenues pages are gone. - New Transactions page — a per-account ledger of transfers, revenues, payments and expenses with filtering by type, category, client, payment method, amount range and date, a running balance, summary cards, account balances in the account picker, and CSV export. - Added user based RBAC for API keys, so a key runs as a user and inherits that user's permissions. - Added deny rules to client access permissions, so access can be granted broadly and revoked for specific clients. - New secure file download handler for files and ticket attachments, with client and contact permission isolation on the client portal. - Invoices: clicking the Paid or Partial status badge opens a read-only breakdown of the payments recorded against that invoice. - Assets: multiple notes per asset, same as contact notes, with categorized note types (Maintenance, Repair, Configuration, Upgrade, Inspection, Note). - Dashboard: added expiring asset warranties and licenses, along with an "Expiring in" filter for assets, licenses, domains and certificates. - Added bulk and single refresh actions for domains and certificates. - Stripe gateway fees now come from the actual Stripe balance transaction rather than a static percentage and flat fee configured in ITFlow, with a nightly pass to backfill fees that were not available at payment time. The static fee fields are gone from payment provider settings. - Database updates are now split into per-version files under `admin/database_updates/`, the latest version is derived from the directory listing, and one run applies everything pending. Migration history before 2.0.0 has been pruned. - Reorganized the main, client, admin and reports side navigation menus. - Mail settings tabs are now URL addressable and stay on the active tab after saving. - Removed the legacy vendor contacts feature. - `dig` and `whois` are no longer required, domain lookups use native DNS and RDAP. ### Security - Rate limited 2FA code attempts and narrowed the TOTP acceptance window. - Rotate the session ID on login to prevent session fixation, and fixed client portal Entra SSO. - Stopped parallel login attempts from bypassing the login rate limits. - Fixed a SQL injection in the recurring invoice frequency handling reached via cron. - Admin UI modals are now gated to admins. Previously any logged-in user could open them directly and read stored payment provider and AI provider API keys — rotate those keys when you update, as there is no record of who may have viewed them. - Credential module access is now required to view or share credentials, and password reveals are written to the audit log. - Swept module and client permission enforcement across modals and ajax endpoints to match the post handlers, closing a number of cases where a user restricted to certain clients could read another client's records by ID. - Products: the CSV export now requires sales module read access. - Neutralized CSV formula injection in generated exports. - Fixed weak random number generation in TOTP secret generation. - Shared item views are now claimed atomically so the view limit cannot be exceeded by simultaneous requests, and guest audit IPs are logged. - Hardened CSRF handling and session cookies, and set `SameSite=Lax` on the session cookie. - Hardened file upload handling to use random storage names. - Client Portal: contacts can no longer edit their own contact record. - Empty directories under `uploads` are no longer indexable. ### Bug Fixes - Deleting a payment now correctly recalculates and sets the invoice status. - Fixed contact notes, and several broken modal links in contacts, assets and file linking. - Client Portal: fixed adding saved payment methods and cards following a Stripe API change. - Fixed sending invoices and quotes over OAUTH2, which was reading the SMTP host instead of the SMTP provider. - Mail Parser: correctly work out whether the ITFlow folder belongs under the `INBOX` namespace or the root directory, fixing folder creation on cPanel Dovecot Maildir++ setups. - Fixed possible duplicate emails caused by a race condition in the mail queue. - Added a shared lock guard across every cron entry point, scoped per script and per install, replacing the mail queue's non-atomic lock file. Rows left in a sending state by a run that died are now recovered. - Prevented duplicate Stripe payment bookings and overlapping cron runs. - Mail bodies are cleared after successful delivery. - Fixed client name truncation in the side navigation being applied after escaping. - Side navigation counts are only shown to users with permission to see them. - Invoice statistics now only reflect clients the user has permission to see. - The agent category handler no longer drops the category description. - Expenses: allowed negative amounts, and the current date is now prefilled. - Certificates can now be searched by description. - Fixed cents calculation rounding. - Fixed guest view credential TOTP display, and removed the legacy OTP code path. - Deleting a ticket template task or a payment provider recorded the wrong name in the audit log and the confirmation message, reading an unrelated record's id in place of the name. - Bulk-creating tickets from a template against multiple assets only added the template's tasks to the first ticket, and dropped each task's completion estimate. - Deleting a ticket template now unlinks it from any recurring ticket that referenced it, instead of leaving the schedule pointing at a template that no longer exists. - Fixed the asset section in the recurring ticket modal when opened outside a client, and project selection when raising a ticket. - Tickets raised by the nightly recurring schedule were created without a guest URL key, so the "View ticket" link in reply and task approval emails could not be opened. Cron now generates a key like every other path that raises a ticket, and existing tickets missing one are backfilled by the database update. - Calendar: fixed the last day of a multi-day all-day event not being drawn or published to subscribed feeds. `event_end` holds the last day the event covers, which is what the event modal asks for, but FullCalendar and iCalendar both treat an all-day end as exclusive. - Fixed `confirm-link` doing nothing inside an ajax modal, where the handler was only bound to links present at page load. ### Developer Updates - Line endings normalized to LF across the codebase, with `.gitattributes` and `.editorconfig` added. Vendored code under `libs/` is marked so it stays byte identical to upstream. - Converted to the short echo tag `` tags into actual image files stored under `/uploads///` with secure filenames. Added wrapper functions, and updated document creation to use processed image paths. - For new documents and document templates, images are now stored in `/uploads/documents/$document_id` instead of being stored as base64 in the database, using the `saveBase64Images()` function. - UI/UX improvements made to the document details page. - Removed sidebar quick-add options. - Created new folders in the uploads directory: `documents`, `document_templates`, and `recurring_tickets`. - Reworked the bulk action function to pass the name arrays, instead of a generic `selected_ids` array. This allows multiple bulk name arrays to be passed at once, currently used for the new file-document merge. - Big task: Converted the remaining modals to use the new `ajax-modal` system, enabling more flexible flow expansion going forward. - Mail queue: Added a `--no-mx-validation` flag to bypass recipient domain MX validation. - Bump PHPMailer from 7.0.0 to 7.0.1. - Bump stripe-php from 18.1.0 to 19.0.0. - Bump TCPDF from 6.10.0 to 6.10.1. - Bump TinyMCE from 8.2.0 to 8.2.2. ## [25.11.1] Maint Release ### Fixes - Fix broken edit Payment Method. - Fix unable to delete Vendor Template. - Fix Mail Queue link in flash alert for testing email and sending a quote. - Add Show Category Type select if not defined. - Add Show Product Type select if not defined. - Fix add ticket watcher. - Fix if Client isn't assigned to a ticket dont show client view. - Fix missing session client id check when paying an invoice from client portal. - Update Composer Webklex-IMAP library dependency symfony/http-foundation from 7.3.3 to 7.3.7 to fix security related issues. - Add back delete Payment provider the database will handle cascade deletes to saved cards, recurring payments and client payment provider reference. - Don't show Client Tickets Breadcrumb if no client is assigned to a ticket. - Don't Show Contact or Assignment Tab in edit ticket if no Client is Assigned. - Don't Show add contact, asset, vendor, watcher if not client is assigned to a ticket. - Don't Show Public Comment & Email if contact email doesn't exist. - Fixed IMAP Test whicn now uses RAW TCP Connection instead of the depracated php-imap extension. - Fix Broken Link in Ticket Updates via Client Portal to agent. ### Added / Changed - [Feature] Added Asset Tags. - [Feature] Added Quick Add Links to most side bar navs example quickly add a client from sidebar. - Migrate ticket template add to ajax modal. - Add TOTP secret to Client Export PDF in Credential section. - Add UserID on hover in users listing. - Merge ticket now redirects to the new ticket details page. - [Feature] Add Pay via saved card under invoice Listings. - Ticket Related Side Items UI Cleanup to use btn-tool class. ## [25.11] Stable ### Deprecation Notice: - **Outdated CRON Scripts**: The following scripts are removed. - `/scripts/cron_mail_queue.php` - `/scripts/cron_ticket_email_parser.php` - `/scripts/cron.php` - `/scripts/cron_domain_refresher.php` - `/scripts/cron_certificate_refresher.php` **Action Required**: Transition to the new versions: - `/cron/mail_queue.php` - `/cron/ticket_email_parser.php` - `/cron/cron.php` - `/cron/domain_refresher.php` - `/cron/certificate_refresher.php` - PHP Extensions php-imap and php-mime-mail-parser are no longer required. --- ### Fixes - **Ticket Listing**: Resolved issue where the “Check All” checkbox was visible even when ticket status wasn’t set. Now hidden for closed tickets only. - **Timer Auto-Start**: Show H/M/S placeholders when timer auto-start is disabled. - **Ticket Guest URL**: Fixed email not including the ticket guest URL key. - **EML Generation**: Resolved issue with EML not being generated in the new ticket parser. - **New Ticket Mail Notification**: Included message when notifying the tech of a reply in the new ticket mail parser. - **Advanced Filter Collapse**: Added clause to prevent collapse of advanced filters when the “from” date is set to the default (1970-01-01). - **Recurring Invoice**: Fixed issue where email was marked as sent but not actually sent when forcing a recurring invoice to an invoice. - **CSRF Token**: Fixed issue with deleting recurring ticket from asset details page due to missing CSRF check token. - **Vendor Website Link**: Fixed missing `https://` prefix in the vendor website link on the vendor details modal. - **Agent Select Box**: Resolved issue where agents sometimes didn’t appear in the agent select boxes. - **TinyMCE**: Fixed TinyMCE editor issue on Bulk Create Ticket in Assets. - **Ticket Timer**: Fixed ticket timer initialization after reload and when the tab is put to sleep (background tab). - **Client Deletion**: Fixed issue with client deletion. - **Domain Records**: Added flag for missing SOA record when adding a domain (prevents subdomain creation). - **Domain Fetching**: Quits domain record fetching if no SOA record exists (prevents subdomains). - **Domain Expiry**: Only show time to expiry when there’s an expiry date set; otherwise, display a dash. - **Certificates**: Improved handling of empty date in the agent UI. - **Certificates API**: Fixed bug with missing JS to fetch certificate details. - **API Updates**: - Clients API: Added support for archiving/un-archiving clients, updating client data, and abbreviation support. - Contacts API: Added archiving/un-archiving and restriction to only allow one primary contact per client. - Mail Queue: Added recipient domain MX validation before sending emails. --- ### Added / Changed - **Backup / Restore**: Improved backup and restore by streaming data to disk (to prevent memory issues), setting unlimited timeouts, checking for bad backup contents, and using PHP for DB import instead of shell exec. Added `.htaccess` to prevent PHP execution in `/uploads/` directory. - **Ajax Modals**: Migrated all Add and Bulk modals to the new Ajax Modal for improved performance. - **Recurring Ticket Sorting**: Default sorting of recurring tickets by `RunDate` instead of subject. - **Recurring Ticket Enhancements**: - Added Billable column. - Added bulk actions for setting priority, agent, billable status, and next run dates. - Added filters for category, assigned agent, and billable status. - Added new frequency options: 3-day and biweekly. - **Asset Select**: Updated asset select dropdown to separate asset types using opt groups (planned for wider use). - **Expiring Domains & Certificates**: Added "30 Day" warning for expiring domains and certificates in the dashboard. - **Ticket Search**: Allowed search using both ticket prefix and number. - **Recurring Invoice**: Cancel recurring invoices when the associated client is archived. - **Credentials Import/Export**: Now includes TOTP secrets when importing/exporting credentials. - **Asset Notes Import**: Allowed importing of asset notes. - **Ticket View**: Added a "View HTML Code" button in all ticket views for TinyMCE. - **Date Range Picker**: Updated all date filters to use the improved DateRangePicker JS. - **Bulk Ticket Creation**: Added bulk ticket creation for clients. - **Sidebar Updates**: Updated all sidebars to use absolute paths for easier integration with custom code. - **Document Actions**: Added Archive and Delete buttons to the Document Details view with improved redirect behavior. - **Ticket Template Sorting**: Allowed sorting by task count in ticket templates. - **Contact Modal UI**: Updated contact details modal to display contact information at the top. - **API & Code Updates**: - Separated out post files for recurring tickets, invoices, expenses, and payments. - Removed unused budget code. - **Invoice Product Autocomplete**: Now allows searching for product codes as well as names. - **Client Duplicate Check**: Flags duplicate clients or leads when using the client add modal. - **Recurring Invoice Reference**: Added a column to invoices indicating if they were created from a recurring invoice. - **Global Search Enhancements**: - Allowed ticket details to be searchable in global search. - Allowed searching for quotes in global search. - **UI/UX Improvements**: - Spruced up the ticket details page UI. - Added contact email validation to flag duplicates or invalid addresses. - **API Debugging**: Log API endpoint/URL path for authentication failures to aid in debugging. - **Image Upload Optimization**: Removed image optimization from uploads (this will be handled by a cron job in the future). - **View Behavior Change**: Updated ticket/invoice/quote views to always be in the Client section, showing client-side navigation and top info bar. --- ### Library Updates: - **DataTable**: Bumped from 2.3.3 to 2.3.4. - **TinyMCE**: Bumped from 8.0.2 to 8.2.0. - **Stripe-PHP**: Bumped from 17.6.0 to 18.1.0. - **PHPMailer**: Bumped from 6.10.0 to 7.0.0. - **Chart.js**: Bumped from 4.5.0 to 4.5.1. ## [25.10.1] - Deprecation Notice: `/scripts/cron_mail_queue.php` , `/scripts/cron_ticket_email_parser.php` , `/scripts/cron.php` `/scripts/cron_domain_refresher.php`, `/scripts/cron_certificate_refresher.php` are being phased out. Please transition to `/cron/mail_queue.php` , `/cron/ticket_email_parser.php`, `/cron/cron.php`, `/cron/domain_refresher.php`, `/cron/certificate_refresher.php` These older scripts will be removed in the November 25.11 release—update accordingly. 25.10.1 installs have the script already configured. ### Fixes - Fix regression missing custom Favicon. - Update SMTP and IMAP provider to allow for empty strings, empty means disabled. - Fix Client portal Microsoft SSO Logins. - Fix regression in Vendor Templates. - Fix refression in some broken links from user to agent. - Fix Project edit. - Prevent open redirects upon agent login. - Fix regression on switching to Webklex IMAP to allow for no SSL/TLS in IMAP. - Fix Setup Redirect not behaving properly when setup hasnt been performed. - Added Server Document Root Var to several includes, headers, footers files to allow includes from deeper directory strutures such as the new custom directories. - Fix edit contact in contact details. - Add .htaccess to /cron/. ### Added / Changed - Support for HTML Signatures. - Add Edit Project Functionality in a ticket. - Added more custom locations: /cron/custom/, /scripts/custom/, /api/v1/custom/, /setup/custom/. - Copied `/scripts/cron.php` `/scripts/cron_domain_refresher.php`, `/scripts/cron_certificate_refresher.php` to `/cron/cron.php`, `/cron/domain_refresher.php`, `/cron/certificate_refresher.php`. See Above! - Signatures is now handled in post ticket reply on Public Comments only. ## [25.10] ### Breaking Changes - Renamed `/user/` directory to `/agent/`. - Deprecation Notice: `/scripts/cron_mail_queue.php` and `/scripts/cron_ticket_email_parser.php` are being phased out. Please transition to `/cron/mail_queue.php` and `/cron/ticket_email_parser.php`. These older scripts will be removed in the November release—update accordingly. New Installs via the script will have this already configured. - Custom is working now. Custom code should be placed in /admin/custom/ , /agent/custom/ , /client/custom/ /guest/custom/ We will provide example code with directory structure for each custom directory a week after this release. ### Fixes - Resolved issue with "Restore from Setup" not functioning correctly. - Corrected asset name display in logs and flash messages when editing an asset in a ticket. - Fixed Payment Provider Threshold not being applied. - Fixed issue where Threshold setting was not saving properly. - Various minor fixes for Payment Provider issues. - Removed leads from the client selection list in the "New Ticket" modal. - Fixed issues with the MFA modal. - Resolved MFA enforcement bugs. - Fixed KeepAlive functionality to maintain user sessions longer. - Fixed multiple broken links caused by the `/user/` to `/agent/` path migration. - Fixed Custom code directories. ### Added / Changed - Removed "ACH" as a payment method; added "Bank Transfer" instead. - Replaced relative paths with absolute paths for web assets. - Tickets can now be resolved via the API. - Added a filter for Archived Users and an option to restore them. - Introduced a modal when archiving users, allowing reassignment of open and recurring tickets to another agent. - Improved logic for determining the index/root page. - Added "Assigned Agent" column for recurring tickets. - Introduced "Additional Assets" option when editing assets in tickets; modal now uses the updated AJAX method. - Added Gibraltar to the list of supported countries. - Added Custom Link Option for the Admin Nav. - Added Custom Link Option for the Reports Nav. ### Other notes - Major releases will happen on the first week of every Month. ## [25.09.2] ### Fixes - Fix Payment Method Select box in Revenue. - Remove Extra Feeback Wording When Invoice Sends. - Updated all CSV exports to use escape parameters. - Fix Missing First row on Asset interface export. - Fix Edit User not working due to incorrect modal footer path. - Fix Add Certificate breaking due spelling on function. - Update all CSV Exports to include company name or client name depending on when its being exported from. - Introduced new function sanitize_filename and implmented it in all exports. - Spruced up UI/UX Saved Paymented section in Client Portal. - Fix add Payment Link in client portal recurring invoice section. - Better Logic handling for default page redirect. ### Features - Introduced new Beta mail parser cron using webklex imap library instead of php-imap as this is deprecated --Not Enabled on existing installs, only new installs. - Introduced Beta support for OAUTH2 Authentication for Microsoft 365 and Google Workspaces for both incoming ticket parsing and outgoing email but must use new mail parser and mail queue for this to work, and requires changing the cron jobs: scripts/cron_mail_queue.php to cron/mail_queue.php and scripts/cron_ticket_email_parser.php to cron/ticket_email_parser.php. --- ## [25.09.1] ### Fixes - **Web Installer**: Resolved issue with broken installer caused by incorrect database schema file name. - Hide the "Add Credit" button as the feature is not fully implemented yet. - Corrected long invoice/quote notes that were overlapping with the footer in PDF exports. - Fixed AI settings not appearing in the Admin Menu when the Billing module was disabled. - Enabled wrapping of client tags when they are too long. - Fixed an issue where AI was not functioning correctly. - Removed extra spacing between the contact name and icon in the Ticket Details contact card. ### Features - Redesigned **AI Ticket Summary**, now divided into 3 sections: Main Issue, Actions Taken, and Resolution/Next Steps. - Updated the **AI Ticket Summary** prompt to include ticket status, reply author, source, category, and priority. --- ## [25.09] ***BACK UP*** before updating. --- ### Breaking Changes and Notes - We strongly recommend updating from the command line, however if performed via the webui and after performed it will return a 404. thats normal as the directory structure has changed, just close your browser then log back in then go back to update to perform the many database updates. - This is a major release with significant changes. While the community has done a great job identifying bugs, some may still remain — continued testing is encouraged. - All AI settings will be **reset** and must be reconfigured using the new AI provider backend. - The `xcustom` directory has been renamed to `custom`. All custom libraries and post-processing scripts should now be placed here. --- ### Added / Changed - Numerous UI improvements and refinements across the application. - Enhanced visual clarity by thickening the left border on ticket comments to help identify comment types. - Ticket details UI redesigned to use less space at the top of the screen. - Introduced tracking for the **first response date/time** on tickets. - New reporting feature: **Average time to first response** on tickets. - Stripe integration rebuilt using the new **payment provider backend**. - Clients can now save and manage **multiple payment methods**. - Support for selecting saved cards for **recurring invoices** in both the client and agent portals. - Initial database structure and logic added for **credit management** (feature not yet enabled). - Major **backend directory restructuring**. - Introduced **stock/inventory management**, including a stock ledger backend. - Stock quantities now update automatically when invoice items are added or removed. - Invoice autocomplete now includes: **name, description, price, tax, stock levels**, and links `product_id` to `item_id`. - Added a **category filter** to invoices. - Linked stock to related expenses. - New product fields: **location, code, and type**. - Products now separated into two types: **Service** and **Product**. - **Dark mode** introduced. - Projects: Now support linking **closed tickets**. - Clients: Added bulk actions for tags, referral source, industry, hourly rate, email, archive, and restore. - Invoices: Bulk action added to **assign categories**. - Assets: New `client_uri` field, visible in both the agent and client portals. - Client Portal: Clients can now **select an asset** during ticket creation. - Client Portal: Company logo now **displays in the header**. - Client Portal: Dashboard cards are now **clickable** for more detail. - Assets: Option added to include **MAC Address** in additional columns. - Asset Interface: Bulk actions added — set DHCP, network type, and delete. - API: - Added `/location` endpoint. - Ticket content now supports **HTML formatting**. - New option to filter and display **500 records per page** in the footer. - Payment methods are now treated as a **separate entity** instead of being grouped under categories. - Updated libraries: - **TinyMCE** - **Chart.js** (major upgrade) - **DataTables** - **Bootstrap** - **FullCalendar** - **php-stripe** --- ### Fixed - Several security vulnerabilities patched (with thanks to www.helx.io). - Ticket status is no longer updated when scheduling. - Client Portal: Tech contacts can no longer edit their own details. - Fixed overlapping logo issue in Invoice/Quote PDF exports. - Refactored `check_login.php` into multiple files for modular login functionality. - Removed redundant logging comments for redirects. - Renamed `get_settings.php` to `load_global_settings.php`. - Simplified syntax for `ajax-modal` and updated usage throughout the app. - Fixed issue where primary contact text wasn’t displaying. - Corrected client **Net Terms** display. - Fixed logic for recurring expense **next run date**. - Resolved broken **IMAP test button**. - Archived clients can no longer log into the portal. - Searching closed tickets no longer reverts to open tickets. - Fixed project search filter not showing completed projects. - Fixed issue where company logo was not being removed correctly. - Resolved API bugs: - Default rate and net terms. - Contact location. - Document endpoint. --- ### Developer Updates - Replaced legacy code with newer functions like `redirect()`, `getFieldById()`, and `flash_alert()`. - Significantly improved performance of queries used for filter selection boxes. ## [25.06.1] ### Fixed - Fixed a regression in setup causing it to crash and never complete, due to missing default for currency. ## [25.06] ### Breaking CHANGES - Old Document Verions will be deleted due to the major backend rewrite how document versions work. ### Added / Changed - Improved function for retrieving remote IP address for logging purposes. - Ticket categories are now sorted alphabetically. - Visiting a deleted invoice or recurring invoice now redirects to the listing page; delete option added to invoice details page. - Added "Mark as Sent" and "Make Payment" actions directly on the invoice listing page. - Introduced Ticket Category UI for recurring tickets. - In Project Details, bulk actions and sorting are now available for tickets. - Updated ticket details UI to use full card stacks with edit icons for stackable items (e.g., asset, watchers, contact). - Added a new setting to toggle AutoStart Timer in ticket details (disabled by default). - Applied gray accent theme in the client section to visually distinguish from the global view. - Introduced Ticket Due Date functionality (currently supports add/edit only; more updates coming next release). - Added settings option to display Company Tax ID on invoices. - Client overview now displays badge counts for all entities. - Overhauled UI for Invoice, Quote, and Recurring Invoice details; switched PDF generation to TCPDF PHP from PDFMake JS. - Document versioning has been moved to a separate backend table to resolve permanent link issues -- SEE Breaking CHANGES. - Migrated Document Templates, Vendor Templates, and Software/License Templates to dedicated tables. - Added functionality to mark all tasks in a ticket as complete or incomplete. - Asset CSV import now supports a purchase date field. - Recurring Payments have been restructured to auto-charge on the invoice due date instead of at generation time. - Added "Base Template" label for vendor templates when available. - Backup and restore processes now use a temporary directory; files are cleaned up automatically if operations fail. - Added confirmation prompt when accepting or declining a quote. - Other minor code UI/UX cleanups and refactoring throughout the app. ### Fixed - Resolved issue with enabling MFA. - Fixed UI regression where ticket listing columns would misalign. - Non-billable invoices are no longer included in calculations. - Addressed multiple minor reported security vulnerabilities. - Tickets with open tasks are no longer resolved in bulk; a warning is shown along with a count of affected tickets. ## [25.05.1] ### Added / Changed - Added Domain Expiring Card to Client Portal Dashboard for Primary and Technical Users. - Added Balance and Monthly Recurring Amount to Client Portal Dahboard for Primary and Technical Users. - Added Archive Searching to network and certificates also added unarchive capabilities to them as well. ### Fixed - Add Payment not showing in Invoice. - Updated Client Overview Entities to not show archived client's Entities even though the entity may not be archived. ## [25.05] ### Added / Changed - Expanded file upload allow-list to include .bat and .stk file types. - Added full backup/restore functionality. Backup downloads a zip that includes the SQL dump and uploads folder, setup now has option to restore from zip backup. - Migrated Asset and Contact Links to modals to resolve variable overlap issue. - Added Pagination to Notification Modal. - Removed 500 Records Per Page option. - Removed unused old DB checks in the top nav. - Clients can now use the portal to setup Stripe automatic payments themselves for recurring invoices - Automatic payments are now disabled for all recurring invoices if the saved payment method is removed - Added Card Details and Payment added to Client Stripe. - UI / UX updates to guest pay Make use of cards. - Don't show Checkbox columns when ticket is closed, compact ticket list now matches round pills for status and priority. - Ticket UI/UX update allow the ticket toolbar to be a little more mobile-friendly - UI / UX Updates to Expenses - Combine Category and Description into 1 column. - Country information is now displayed in Invoices, Quotes, Recurring Invoices, Clients, Locations, and the client top header. - Added country-based search filters in Locations and Clients sections. - Changed the settings name from Integrations to Identity Providers to make room for future iDPs (e.g. Google). - Bump FullCalendar from 6.1.15 to 6.1.17. - Bump DataTables from 2.2.2 to 2.3.1. - Bump TCPDF from 6.8.2 to 6.9.4. - Bump tinyMCE from 7.7.1 to 7.9.0. - Bump phpMailer from 6.9.2 to 6.10.0. - Bump stripe-php from 16.4.0 to 17.2.1. ### Fixed - "None" option for SMTP encryption now functions correctly. - Debug table row counts now reflect actual counts instead of relying on SHOW TABLE STATUS. - Archived Categories now display properly. - Stripe saved payment methods are now limited to credit/debit cards only. ## [25.03.6] ### Fixed - Set default to date to 2035-12-31 as 9999-12-31 and 2999-12-31 broke certain browsers. - Update Client PDF Export, add header added company logo. - Present Larger clearer Warning about updates on update page. - Allow to search by project reference. ## [25.03.5] ### Fixed - Fixed the user listing issue when copying a trip. - Corrected the display of recurring invoice amounts on the dashboard. - Fixed the linking of entities with assets and contacts. - Resolved the issue with displaying the correct mobile country code in the contact listing. - Set the default date to `9999-12-31` to ensure future items (like invoices) are displayed by default. - Fixed the display issue where file folders were not showing properly during document creation. - Migrated from Dragula to SortableJS for a more modern, mobile-friendly solution. - Added Handlebars icons for drag-and-drop items. - Changed behavior to open Contact and Asset Details pages directly instead of using a modal. ## [25.03.4] ### Fixed - Ability to remove additional assets from the ticket details screen. - Fix the ability to remove assets from edit ticket not working when only 1 asset exists. - Fix Database Backup corruption. - Client Portal - show ticket number instead of ticket id in ticket listing. - Add Purchase Reference to copy asset. - Add Link to asset details from the global search. - Fix Bulk assign ticket only showing contacts instead of ITFlow users. ## [25.03.3] ### Fixed - Fix adding ITFlow user. - Do not alert on inactive recurring invoices. - Fix ticket user assignment including bulk assignment. - Fix adding a location phone extension. - Do not default to +1 Country code, instead default to null. - Do not format numbers unless a country code is entered. - Fix editing network location. - Fix ticket redaction on client replies. - Remove more from user activity as it requires admin privledges. - Fix MFA Enforcement page. ## [25.03.2] ### Fixed - Revert DB.sql change ## [25.03.1] ### Fixed - Phone number missing in various sections. - Match Database. - Client Export Only display licenses users and assets from the selected client only. ## [25.03] ### Fixed - Resolved missing attachments in ticket replies processed via the email parser. - Fixed issue where the top half of portrait image uploads appeared cut off at the bottom. - Ensured all tables and fields use `CHARACTER SET utf8mb4` and `COLLATE utf8mb4_general_ci` for updates and new installations. - Converted `service_domains` table to use InnoDB instead of MyISAM. - Fixed the initials function to properly handle UTF-8 characters, preventing contact-related issues. - Interfaces can now start with `0`. - Adjusted AI prompt handling to focus solely on content, avoiding unnecessary additions. ### Added / Changed - Introduced bulk delete functionality for assets. - Added the ability to redact ticket replies after a ticket is closed. - Added support for redacting specific text while a ticket is open. - Switched file upload hashing from SHA256 to MD5 to significantly improve performance. - Enabled assigning multiple assets to a single ticket. - Updated all many-to-many tables to support cascading deletes using foreign key associations, improving efficiency, performance, and data integrity. - Enabled caching for AJAX modals to reduce repeated reloads and enhance browser performance. - Upgraded DataTables from 2.2.1 to 2.2.2. - Upgraded TinyMCE from 7.6.1 to 7.7.1, providing a significant performance boost. - Added “Copy Credentials to Clipboard” button in AJAX asset and contact views. - Renamed and reorganized several tables. - Improved theme color organization by grouping primary colors and their related shades. - Displayed a user icon next to contacts who have user accounts. - New image uploads are now converted to optimized `.webp` format by default; original files are no longer saved. Existing images remain unchanged. - Added international phone number support throughout the system. - Introduced user signatures in preferences, which are now appended to all ticket replies. - Optimized search filters to only display defined tags. - Added “Projects” to the client-side navigation. - Enabled “Create New Ticket” from within project details. - Reintroduced batch payment functionality in client invoices. - Included client abbreviations in both client and global search options. - Added assigned software license details (User/Asset) to the client PDF export. - Replaced client-side `pdfMake` with the PHP-based `TCPDF` library for generating client export runbooks. - Introduced the ability to download documents as PDFs. - Added a “Reference” field to tickets and invoices generated from recurring templates (not yet in active use). ### Breaking Changes > **Important:** To update to this version, you **must** run the following commands from the command line from the scripts directory: > > ```bash > php update_cli.php > php update_cli.php --db_update > ``` > > Repeat `--db_update` until no further updates are found. > > **Back up your system before upgrading.** > This version includes numerous backend changes critical for future development. ## [25.02.4] ### Fixed - Resolved issue preventing the addition or editing of licenses when no vendor was selected. - Fixed several undeclared variables in AJAX contact details. - Corrected the contact ticket count display. - Addressed an issue where clicking "More Details" in AJAX contact/asset details failed to include the `client_id` in the URL. - Fixed an issue with recurring invoices in the client URL: clicking "Inactive" or "Active" would unexpectedly navigate away from the client section. - Added new php function getFieldById() to return a record using just an id and sanitized as well. ## [25.02.3] ### Fixed - Fixed notifications being reversed as dismissed notifications. ## [25.02.2] ### Fixed - Corrected some edit modals not showing notes correctly. - Bugfix: When exporting to CSV, the first asset wasn't being shown. - Fix broken create / edit credentials. - Fixed missing Notificatons link. - Fixed a few dead links. - Fixed Overdue count also counting Non-Billable Invoices. - Fix Edit Client Notes. ### Added / Changed - Implemented SSL certificate history tracking. - Added Inactive / Active Filter to Recurring Invoices. - Merged Dismissed notifications and notification in one. - Added Link Button to addd / edit Document WYSIWYG. - Added Physical location to the asset export / import. ## [25.02.1] ### Fixed - Resolved broken links in the client overview, project and client listings, and rack details. - Corrected asset transfer functionality to clients. - Fixed the ticket scheduling redirect. - Corrected the ticket link in the Scheduled Ticket Agent Notification email. - Addressed issues with credentials and ticket actions in the Contact Detail Modal. - Fixed text wrapping in notifications. - Adjusted notifications so that they are sorted with the newest first. - Fixed drag-and-drop functionality for tickets in the Kanban view on mobile devices. - Resolved a weird issue with TinyMCE that prevented using links referencing your ITFlow instance url. - Corrected image orientation issues during upload and the preview optimization process. ### Added / Changed - Introduced entity link indicator icons and counts in the contacts and credentials section. - Implemented a fade animation for the new AJAX modal. - Removed the Client Overview Expire Day Select and replaced it with simplified 1, 7, or 45-day options. - Added the ability to link and unlink entities within asset details. - Introduced quick tag/category creation across the app. - Added a Vendor Quick Details Modal. - Enabled vendor linking and added a License Purchase Reference in the Software Licenses section. - Added download original, optimized and thumbnail option for images. - Added Paid status to the top corner of Invoice PDFs. ## [25.02] ### Fixed - Migrated several reports to the new permissions/roles system. - Resolved issue with empty task box showing for closed/resolved tickets. - Corrected ticket priority sorting. - Cloned asset interfaces when transferring assets between clients. ### Added / Changed - Restored max number of records per page option back to 500 since we dont have repeating modals. - Bulk Categorize Tickets feature. - Renamed "Interface port" to "Interface Description." "Interface Name" should now refer to port name and/or number. - Changed "Transfer Asset to Client" from a single action to a bulk action. - Updated Filter Footer UI to show "Showing x to x of x records" instead of just the total records. - Added Client Overview section to view client assets, contacts, licenses, credentials, etc. - Introduced Quick Peek for asset details, contact information, and document viewing throughout the ITFlow App, all made possible by AJAX. - Enabled Simple Drag-and-Drop Ordering for Invoices, Recurring Invoices, Quotes, Ticket Tasks, and Ticket Template Tasks. - Added new Ticket View options: Kanban and Simple View. - Migrated all repeating modals to the new AJAX modal function for faster loading times and quicker development. - Allowed clients to upload PDF documents to accepted quotes. - Client Portal now shows ticket category. - Custom links can now be added to the Client Portal navbar. - Lots of little tweaks to UI, performance, bugs, etc. ### Breaking Changes - Cron scripts have officially been moved to the /scripts folder and are no longer in the root directory; they must be updated to function properly. ## [25.01.3] ### Fixed - Fixed ticket assignment modal showing client contacts. ## [25.01.2] ### Fixed - Fixed app version. ## [25.01.1] ### Added / Changed - Redesigned the Multi-Factor Authentication (MFA) Setup and Enforcement Flow UI/UX for a more intuitive user experience. - Added a "Member" column in the user roles listing for improved visibility. - General UI/UX improvements, along with minor performance optimizations and cleanups. ### Fixed - Fixed an issue where Stripe was not appearing as a recurring payment option. - Corrected inaccurate Quarter 2 Expense results in the Profit & Loss Report. - Resolved TOTP code not displaying correctly on hover in the Contact or Asset Details sections. - Archived contacts no longer appear in the Bulk Mail section. - Fixed an issue where the Ticket Assign Modal was showing both ITFlow and client users. - Fixed issue with login key redirecting to legacy client portal page. ## [25.01] ### Added / Changed - Added support for saving cards in Stripe for automatic invoice payments. - Page titles now display detailed information (e.g., page name, client selection, company name, ticket and invoice info) for easier multi-tab navigation. - Reintroduced the new admin role-check for admin pages. - Admin roles can now be archived. - Debug mode now shows the current Git branch. - The auto-acknowledgment email for email-parsed tickets now includes a guest link. - Recurring tickets no longer require a contact. - Stripe online payment setup now prompts you to set the income/expense account. - New cron/CLI scripts have been moved to the `/scripts` subfolder — remember to update your cron configurations! - Moved modal includes to `/modals` to tidy up the root directory. - Moved most include files to `/includes` to improve directory structure. - Moved guest pages to `/guest` for better organization. - Renamed the include file `pagination.php` to `filter_footer.php`, as it is used in conjunction with `filter_header.php` for page filtering. - Guest ticket feedback now shows the ticket prefix and number, not just the ID. - Individual POST handler logic pages are no longer directly accessible. - Added the ability to delete payments on the Payments and Client Payments pages. - Implemented domain history tracking. - Added Asset Interface Linking/Connections to show what interface is connected to which interface port of another asset. - Added Force Recurring Ticket option in more locations, not just for recurring tickets. - Implemented row spanning and centered devices that occupy multiple units in a rack. - Added tooltips to main navigation badge counts to clarify what is being counted. - Reduced max records per page from 500 to 100 to prevent performance issues. - Updated several plugins: - `stripe-php` from 10.5.0 to 16.4.0 - `Inputmask` from 5.0.8 to 5.0.9 - `DataTables` from 2.1.8 to 2.2.1 - `pdfmake` from 0.2.8 to 0.2.18 - `php-mime-mail-parser` to 9.0.1 - `TinyMCE` from 7.5.1 to 7.6.1 - Removed unused libraries from the vendor folder and moved Stripe to the plugins folder, eliminating the vendor folder. - Merged the MFA TOTP functionality files `base32static.php` and `rfc6238.php` into a single file (`totp`) and moved it to the plugins folder. - No longer need to pass the DB connection (`$mysqli`) to the `addToMailQueue` function. - Disabled HTML Purifier caching. - Replaced the `nullable_htmlentities` function with `htmlspecialchars`. - Updated filter variable naming. - Implemented other minor UI updates, performance optimizations, and directory cleanups. ### Fixed - Fixed an issue where the ticket edit modal didn't show multi-client or no-client projects. - Fixed asset interface losing DHCP settings. - Fixed a 500 error when creating or editing recurring expenses due to an incorrect variable name. - Fixed tickets created via the portal/email not being marked as billable. - Fixed issues with editing recurring expenses. - Resolved a regression where the TinyMCE editor didn’t display when adding or editing ticket templates. - Fixed a TinyMCE license issue. ### Removed / Deprecated - Deprecated the cron scripts in the root directory. Cron jobs should now use the ones in the `/scripts` subfolder, which no longer require a cron key and must be run via CLI. ### BREAKING CHANGES - The client portal has been moved from `/portal` to `/client`: - Links in previous emails will be broken. - The Azure Entra ID SSO Redirect URI needs to be updated to `/client`. - You may need to update other links (e.g., website, support page). - Guest links have been moved from `/` to `/guest`. Previous links will be broken. ## [24.12] ### Added / Changed - Introduced versioned releases for the first time!