Files
itflow/admin/database_updates/3.1.0.php
johnnyq e29369926f Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated
2026-10-17 12:05:55 -04:00

47 lines
2.6 KiB
PHP

<?php
/*
* ITFlow - Database update to version 3.1.0 (from 3.0.9)
* Included by admin/database_updates.php - do not access directly
*/
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
// Notices for the client portal's home page - to every client (client 0)
// or one - shown between their start and end, from Admin > Client Portal
mysqli_query($mysqli, "CREATE TABLE IF NOT EXISTS `portal_announcements` (
`announcement_id` int(11) NOT NULL AUTO_INCREMENT,
`announcement_title` varchar(200) NOT NULL,
`announcement_body` text DEFAULT NULL,
`announcement_tone` varchar(20) NOT NULL DEFAULT 'info',
`announcement_client_id` int(11) NOT NULL DEFAULT 0,
`announcement_starts_at` datetime DEFAULT NULL,
`announcement_ends_at` datetime DEFAULT NULL,
`announcement_created_by` int(11) NOT NULL DEFAULT 0,
`announcement_created_at` datetime NOT NULL DEFAULT current_timestamp(),
`announcement_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(),
`announcement_archived_at` datetime DEFAULT NULL,
PRIMARY KEY (`announcement_id`),
KEY `announcement_client_id` (`announcement_client_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci");
// Which ticket emails a contact wants, set from Your account in the portal:
// their own tickets - every email (all) or not the created and closed
// notices (replies) - and, for primary and technical contacts, their
// company's other tickets: none, new ones, or new ones and every update (all)
mysqli_query($mysqli, "ALTER TABLE `contacts`
ADD COLUMN `contact_ticket_emails` varchar(10) NOT NULL DEFAULT 'all' AFTER `contact_technical`,
ADD COLUMN `contact_company_ticket_emails` varchar(10) NOT NULL DEFAULT 'none' AFTER `contact_ticket_emails`");
// Ask everyone signing in to the portal with a password for a code from an authenticator app
mysqli_query($mysqli, "ALTER TABLE `settings`
ADD COLUMN `config_client_portal_require_mfa` tinyint(1) NOT NULL DEFAULT 0 AFTER `config_client_portal_enable`");
// Portal password links are kept as a SHA-256 of the token from now on, and
// run out (user_password_reset_token_expire, unused until now). Links sent
// before this keep working for a day.
mysqli_query($mysqli, "UPDATE `users` SET
`user_password_reset_token` = SHA2(`user_password_reset_token`, 256),
`user_password_reset_token_expire` = NOW() + INTERVAL 1 DAY
WHERE `user_password_reset_token` IS NOT NULL AND `user_password_reset_token` <> ''");