johnnyq 156c51224d Fix client portal review findings: PIN wipe, log indexing, statement currency (db 2.7.8)
Setting a PIN containing < or > silently cleared it: the length check ran before escapeSql(), whose strip_tags() then emptied the value, and the UPDATE stored the blank while flashing success. Length is now checked after sanitising.

Password and PIN changes require the current password. SSO contacts are exempt - no local password to check, and the IdP already did it.

New index on logs(log_user_id, log_client_id) for the portal profile and activity pages, which were scanning the whole table twice per profile view. admin/audit_logs.php's date filter rewritten as a half-open range so KEY log_created_at is usable - DATE(log_created_at) BETWEEN made it non-sargable.

Portal statement page and PDF now render in the client's currency, matching the guest view and the emailed statement.

Quick Send asks for confirmation; confirm-link extended to submit buttons.

Portal audit entries logged an empty name - client/post.php used , which only exists agent-side.
2026-08-28 16:38:42 -04:00
2026-08-27 23:54:04 -04:00
2026-08-03 17:51:04 +01:00
2026-08-03 17:51:04 +01:00
2026-08-03 17:51:04 +01:00
2026-08-12 15:20:48 +01:00
2026-08-12 15:27:40 +01:00

Contributors Stargazers Commits GPL License

ITFlow

IT documentation, ticketing and accounting system for small MSPs.

View demo
Username: demo@demo.com | Password: demo

About · Docs · Forum · Report Bug · Suggest Feature · Security

About

A comprehensive, free & open-source documentation, ticket management, and accounting platform.

ITFlow

The Problem

  • You're a small but busy managed service provider with 101 things to do. Information about your clients is unorganised, unstructured and outdated.
  • For some work, you seem to spend longer looking for the relevant documentation than actually working on the issue/project.
  • MSP tools can be expensive, with recurring licensing costs adding up quickly.
  • On top of the technical day-to-day, you also have to take care of the financial side of the business - consistent pricing, quotes/invoicing, and accounting.

The Solution: ITFlow

  • ITFlow consolidates common MSP needs (documentation, ticketing and billing) into one unified, free platform that you control.

Getting Started

Self Hosting

  • The best installation method is to use the install script on Ubuntu/Debian. See the video walk through.
  wget -O itflow_install.sh https://github.com/itflow-org/itflow-install-script/raw/main/itflow_install.sh
  bash itflow_install.sh
  • Other manual installation methods are available in the docs.

Managed Hosting

Key Features

  • Client documentation - assets, contacts, domains, docs/files, passwords, tickets, and more
  • Billing - quotes, invoices and expenses, with Stripe integration for online payments
  • Alerting - domain and SSL expiry/renewals
  • Client Portal - self service quote, invoice, and ticket management for clients

Roadmap / Future to-do

We track the implementation of confirmed features and bugs via TaskFlow. Use the forum to suggest new features or report bugs.

Support & Contributions

Forum

For help using ITFlow, bugs, feature suggestions, and other general ideas or discussions, please use the community forum.

Contributing

We have temporarily paused PRs from the community.

Contributors

Supporters

Were incredibly grateful to the organizations and individuals who sponsor the project - a big thank you to:

  • CompuMatter
  • F1 for HELP
  • digiBandit

License

ITFlow is distributed "as is" under the GPL License, WITHOUT WARRANTY OF ANY KIND. See LICENSE for details.

Security

  • We've had a stable release of the project since Jan 2025.
  • Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs. Use your best judgement before storing highly confidential information in ITFlow.
  • If you have a security concern, privately report it here.
Description
No description provided
Readme 139 MiB
Languages
PHP 91.6%
JavaScript 7.5%
CSS 0.8%