mirror of
https://github.com/itflow-org/itflow
synced 2026-09-01 12:25:11 +00:00
156c51224d
Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising. Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it. New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable. Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement. Quick Send asks for confirmation; confirm-link extended to submit buttons. Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.
39 lines
1.7 KiB
PHP
39 lines
1.7 KiB
PHP
<?php
|
|
|
|
/*
|
|
* ITFlow - Database update to version 2.7.8 (from 2.7.7)
|
|
* Included by admin/database_updates.php - do not access directly
|
|
*/
|
|
|
|
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
|
|
|
|
// The logs table only ever had KEY log_created_at, which is the column the
|
|
// one page that reads it does NOT filter on usefully. Two shapes now do:
|
|
//
|
|
// 1. The client portal. profile.php shows a contact their recent sign-ins
|
|
// and recent actions, and activity.php lists the lot - all filtered on
|
|
// log_user_id + log_client_id. That is two full scans on every profile
|
|
// view of a table that grows forever and is never pruned.
|
|
//
|
|
// 2. admin/audit_logs.php, which filters a date range. It had an index
|
|
// available the whole time and could not use it, because wrapping the
|
|
// column in DATE() makes the comparison non-sargable. That query is
|
|
// rewritten as a half-open range in the same commit as this migration,
|
|
// so KEY log_created_at finally does its job.
|
|
//
|
|
// log_user_id leads the composite: a single user is a small slice of the
|
|
// table, whereas one client can account for most of it on a single-client
|
|
// install. Same selectivity rule as the 2.7.5 and 2.7.6 passes.
|
|
|
|
$itflow_index_exists = mysqli_query($mysqli, "SELECT 1 FROM information_schema.STATISTICS
|
|
WHERE TABLE_SCHEMA = DATABASE()
|
|
AND TABLE_NAME = 'logs'
|
|
AND INDEX_NAME = 'log_user_id'
|
|
LIMIT 1");
|
|
|
|
if (!$itflow_index_exists || mysqli_num_rows($itflow_index_exists) === 0) {
|
|
mysqli_query($mysqli, "ALTER TABLE `logs` ADD KEY `log_user_id` (`log_user_id`, `log_client_id`)");
|
|
}
|
|
|
|
unset($itflow_index_exists);
|