itflow

ai_models.php

Fix AI

2026-08-06 19:18:34 -04:00

ai_provider.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

api_keys.php

Audit logs stage 3: failed sign-ins say why and are logged against the account they were for - wrong password, no account with that email, disabled, archived or invited account, client archived, portal turned off, a wrong MFA or two-step code after the right password - with failed Microsoft 365 portal sign-ins logged too and marked Their account in the audit log; the IP lockout counts portal failures as well; the first sign-in from an IP address is badged New IP in the audit lists and quick look; new Admin > Sign-ins under Access with People and IP addresses views, search, date filter, sortable columns and paging; admins get a notification and an email on a run of failed sign-ins or turned-away API calls from one address or against one account, set in Settings > Security (10 to start, 5, 20, 50 or never), each in the audit log Security view and in Mail > Previews; API calls counted per key, day and endpoint, with a 30-day calls column and last IP on API Keys and a usage window, expired-key calls logged against the key, and usage deleted with the key and after the log retention; database 3.3.2 drops the unused auth_logs table and adds settings.config_login_alert_failures and api_key_usage; new functions/sign_in.php, admin/sign_ins.php and admin/modals/api/api_key_usage.php; the license template page no longer warns when view is missing

2026-10-19 00:56:52 -04:00

app_log.php

Vendor templates stage 1: Admin > Vendor Templates rebuilt on the standard list with Active and Archived tabs, support line, hours and SLA, how many clients have a vendor from each, last used and changed by, sortable and searchable including by support line; new template page with what a vendor starts with, the clients with it and their account numbers, the license templates that use it, made and changed by, and history; shared New/Edit window on the vendor window's tabs with per-field push to the vendors made from it, each logged on the vendor; copy, archive, restore and delete with vendors and license templates unlinked on delete; Make a template from a client's vendor, linking the vendor to it, and the vendor page linking its template for admins; Delete offered to every admin role, not only the built-in Administrator; the admin handler no longer includes the agent vendor handler; database 3.3.4 adds vendor_template_created_by and vendor_template_updated_by, backfilled from the audit log

2026-10-19 12:34:53 -04:00

audit_log.php

Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids

2026-10-18 22:36:25 -04:00

backup.php

Remove unused overdue invoice setting move master cron switch out of notificaiton and into cron

2026-08-02 17:22:28 -04:00

canned_response.php

Canned responses stages 3 and 4: agents keep canned responses of their own in Your account > Canned Responses (on the standard list with Yours and Shared tabs, how often they used each, change, copy, archive and delete their own, Copy to yours from a shared one), offered to them alone and first in the picker as Yours; Save your reply as a canned response at the foot of the picker opens the draft with the ticket's contact, first name, client, ticket number, subject, link and agent swapped back to placeholders (canned_response_unfill, text only, a one-word subject left alone), offered on the ticket's category with a switch to put it back as written, and saves it in JSON without leaving the ticket so the reply stays and the new one goes straight into the picker; Admin > Canned Responses gains an Agents' own tab showing whose each is with Share with everyone, copies made there are shared, and admins can share their own or tick Share when saving a reply; files go with a response (Files tab, up to ten of the ticket attachment kinds, kept in uploads/canned_responses/<id>/, streamed by agent/canned_response_file.php to those who may use it), shown as chips under the picker with an x to leave one off, copied onto the ticket with the reply and sent with its email on a ticket and in Update & Reply; migration 3.2.4 adds canned_response_user_id and canned_response_created_by and the canned_response_files table, existing responses staying shared; the response window moves to includes/canned_response_form.php for the admin and account windows; export and import (functions/canned_response_transfer.php) of one, some or every shared response as a versioned JSON file with categories by name, what it sets up, status by name and files as base64, importing as shared with categories matched or made and leave, add as well or replace (keeping use and archived state), everything made safe and refused files named; an MSP starter pack of 27 canned responses in Starter Content loaded through the same import, with Update for the ones already added, and the Update button now driven by the pack registry; new Canned Responses report under Service Desk by response and by agent, filtered by client and by the agent who used it, admins seeing every agent's own; changelog updated

2026-10-18 15:36:00 -04:00

category.php

Admin lists on the standard list pattern: Ticket Templates, Roles, API Keys, Taxes, Categories and Tags now have the full-size search with the dark button, Active and Archived pills with counts, sortable table-light column headings, paging through filter_footer.php with records per page, and the btn-light row menu, with old archived=1 links still opening Archived; Ticket Templates sorts by name, tasks, use or last use, gains a Last used column and moves Import, Export, the report and Starter templates onto the New button's split menu; Roles sorts by name with admin roles first, agents or last change; API Keys sorts by name, end date, agent or last use, with Active and Expired pills so a revoked key moves to Expired to be deleted; Taxes sorts by name, rate or use; Categories and Tags keep their kinds in the left nav with the pills beside the list, sort by name or use (and in order for the ordered category kinds), and page in PHP; dragging categories into order and Move up and Move down work on every page (reorder_categories takes offset); bulk actions move to the right of the search row; descriptions wrap so rows and their menus fit on a phone; the help lines above the lists are dropped, with a category kind's purpose on its nav link; apiKeyRows() removed as unused; category and tag redirects use show=archived; changelog updated

2026-10-18 02:26:56 -04:00

contract_template.php

Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids

2026-10-18 22:36:25 -04:00

cron.php

Remove unused overdue invoice setting move master cron switch out of notificaiton and into cron

2026-08-02 17:22:28 -04:00

custom_field_model.php

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

2026-07-14 17:17:50 -04:00

custom_field.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

custom_link.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

demo_data_model.php

Tags stage 2: tags on five more record kinds (tickets, documents, [kind], [kind], [kind]) working like the other seven with tag pills and + picker on list, page and quick look, Tags field in New and Edit, list tag filter and tag-name search, Bulk Action Tags, export tag filter and Tags column; tickets list shows + only once a ticket has a tag, Tags under More filters with its own chip, board cards show tags, tag changes written to ticket history and merging moves non-archived tags; document tag filter in client Files and at top level across all folders excluding uploads, bulk Tags only tags ticked documents, cross-client document tags open a global search; global search matches tag names, shows the matching tag on each result and adds a Tags group; API tags read, update and create endpoints plus a tags list on every record read, per-kind permission checks and tag creation limited to admin keys; Tags starter pack and demo data cover the new kinds; changelog breaking change for tag-name matching in searches and upgrade note now 2.7.9 to 3.1.4; stage 1 tag test updated for twelve kinds

2026-10-17 15:17:14 -04:00

document_template.php

Document templates stage 4, export, import, starter pack and report: Admin > Document Templates gets a menu beside New with Import, Export, the report and the starter pack, and each template page gets an Export link; the file carries each template's summary, its text with images embedded, its fill-ins and review interval, leaving who should have one to each install; importing a template already there by name can leave it, add the file's copy alongside or replace it (keeping its documents and who should have one), new ones come in required of no one, content goes through the HTML purifier, and images that only point at the other install's uploads are left out with the message saying how many; the MSP starter pack is rebuilt as 14 templates (Asset Inventory and Vendors and Escalation new) that fill in from the client, pull in its sites, networks, equipment, servers, domains, licenses, vendors and contacts as tables, ask for the rest with typed fill-ins, set 6 or 12 month reviews on the ones that go stale, and are required of no one out of the box; Update on Starter Content now covers document templates, bringing older starter templates up to the new versions while keeping their documents and who should have one; new Document Templates report under Clients & Documentation by template (documents made in the period against the period before, current documents, clients with one, coverage of the clients it is required of, documents due a review) and by client (what each should have, has and is missing, and documents due), filtered by client or by the agent who made them, each table exportable as CSV, and client-restricted users seeing only their clients; no database change; changelog updated

2026-10-18 19:50:42 -04:00

identity_provider.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

mail_queue.php

Clear mail bodies after successful delivery

2026-07-28 00:18:07 -04:00

payment_method.php

Revert PAyment cleanInput too

2026-08-01 18:48:07 -04:00

payment_provider_model.php

Move payment provider post vars to a model to reduce repetition

2026-08-30 15:12:14 +01:00

payment_provider.php

Move payment provider post vars to a model to reduce repetition

2026-08-30 15:12:14 +01:00

portal_announcement.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

project_template.php

Projects modernization: projects list with Active/Mine/Overdue/Due soon/Stalled/Over budget/Ready to close/Completed/Archived/All views, ticket and task progress bars, time logged against budget with unbilled hours, due badges, manager changed in place, manager/client/created filters, bulk set manager, set due date, complete, reopen, archive, restore and delete, CSV/PDF export; project page with header actions, attention banners, tickets/tasks/time/due stat cards, Tickets/Tasks/Activity tabs, scope, details and team with hours; project quick look; New/Edit Project with client contact, start date, budget hours and template that can assign its tickets to the manager; Add tickets by picking or by number; add a project template's tickets to an existing project; template ticket subjects fill in [Client], [Project], [Month], [Quarter] and [Year]; project templates admin rework with ordered ticket templates, multi-add, duplicate, archive and restore; projects on the ticket page, client overview, dashboard, calendar, global search and client actions menu; New Ticket offers internal projects; tickets only join a project of their own client or an internal one; completing a project is checked on the server and completed projects can be reopened; deleting a project keeps its tickets; deleting a client deletes its projects; bulk ticket creation limits project choices to matching clients; project template reordering limited to admins; new manager notifications; new functions/project.php; removed project_link_closed_ticket.php; DB 2.8.6 adds project_start, project_budget_hours, project_contact_id and a ticket_project_id index, and cleans up orphaned projects, ticket project links and template links

2026-10-15 16:35:00 -04:00

roles.php

Roles stage 1: Admin > Roles rebuilt showing each role's access per module as level-colored pills or Admin - everything, its agents with a link to Users filtered by role, search, Current and Archived tabs, and Edit, Copy, Archive, Restore and Delete greyed out with the reason when blocked; one role window for New, Edit and Copy with an Admin switch and a None, Read, Modify or Full level per module, each level listing what it allows, Reports limited to None and Read, and a copy dropping the Built-in description prefix; hardcoded role 3 checks replaced by guards so admin can't be taken off your own role or the only admins' role, archive needs no active agents, delete needs no agents at all, and names are unique in any case with the description optional; Administrator role can now be opened and renamed; role names escaped in flash messages, fixing an XSS; audit log records what changed on a role; lookupUserPermission reads the role's levels once per request instead of one query per check; new functions/roles.php, shared role_form.php and js/role_form.js; database 3.1.6 removes orphaned and duplicate user_role_permissions rows, clamps levels to 3 and adds a primary key on role and module; changelog updated

2026-10-17 20:43:45 -04:00

saved_payment_method.php

Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids

2026-10-18 22:36:25 -04:00

settings_ai.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_client_portal.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

settings_company.php

Feature: Designate a client record as your organization currently only provdes a direct link when you click company name in top of the side nav

2026-08-15 20:36:56 -04:00

settings_default.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_invoice.php

Trips stage 2: mileage money - Trips and Mileage in Admin > Settings > Invoice with miles or kilometers, the rate an agent is paid back for their own vehicle and the expense category it goes under, and what a trip bills a client as a trip charge, a rate a mile beyond the distance the charge covers and the invoice line name; the trip form has In their own vehicle starting as the driver's latest trip and Bill the client starting as the ticket is billable, each showing what it pays back or bills; the list gets To pay back and To bill pills, an owed card (Owed to you for agents without financial access), who is owed what and marks on each row; Pay Mileage pays one driver for the ticked trips at the usual or a past rate as a mileage expense per client paid personally by them under the mileage category to a Mileage vendor made on first use, paid back there and then from an account or later with Reimburse; Unbilled Time has Travel to bill beside the expenses at an editable price going on the client's invoice with their tickets and expenses, billing every client includes trips and Not billable writes them off; the invoice gets a Travel card with Add Trips and Take off Invoice, and deleting the line or invoice makes a trip to bill again; paid back and billed trips keep their distance, driver, vehicle, client and billable and can't be deleted, and deleting the mileage expense puts its trips back to pay; bulk Set Vehicle, Set Billable and Pay Mileage; the trip quick look shows what it pays back and bills and the mileage expense lists its trips; dashboard Trips to bill and Mileage to pay back, client overview Trips to bill and the Unbilled Time count include trips; export Vehicle, Paid Back and Billing columns; the Mileage report and dashboard chart follow the unit and the report rate starts at the mileage rate; demo data with recent trips in own vehicles and billable when trips bill; database 3.0.4 with trip_own_vehicle, trip_expense_id, trip_billable, trip_invoice_id, trip_invoice_item_id and the mileage and trip billing settings; CHANGELOG updated

2026-10-16 20:35:51 -04:00

settings_localization.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_logs.php

Vendor templates stage 1: Admin > Vendor Templates rebuilt on the standard list with Active and Archived tabs, support line, hours and SLA, how many clients have a vendor from each, last used and changed by, sortable and searchable including by support line; new template page with what a vendor starts with, the clients with it and their account numbers, the license templates that use it, made and changed by, and history; shared New/Edit window on the vendor window's tabs with per-field push to the vendors made from it, each logged on the vendor; copy, archive, restore and delete with vendors and license templates unlinked on delete; Make a template from a client's vendor, linking the vendor to it, and the vendor page linking its template for admins; Delete offered to every admin role, not only the built-in Administrator; the admin handler no longer includes the agent vendor handler; database 3.3.4 adds vendor_template_created_by and vendor_template_updated_by, backfilled from the audit log

2026-10-19 12:34:53 -04:00

settings_mail.php

Emails stage 3: every email now goes through emailQueue and the shared layout - the client portal invite sends a link to set a password (or to sign in with Microsoft) instead of the password itself, offered on New Contact as well as Edit through portalMailInvite, with Forgot password, password changed and two-step sign-in emails through portalMailPasswordReset and portalMailAccountChange; shared link and code emails with the note quoted and the whole link printed under the button, replacing shareMailHtml and shareQueueMail; calendar invitations, updates and cancellations with when, repeats, where, the description and a join button; Email on the contacts and clients lists in the layout from one of the configured mailboxes with an optional greeting and send time, leaving out archived contacts and contacts without an address, each address once, nothing queued without mail set up, through emailBulkSend and emailBulkPost with a shared bulk_email_fields window; Admin > Mail > Previews shows all 52 emails built by their real senders on sample records inside a rolled-back transaction with emailQueue capturing and custom actions off, with computer and phone widths and Send me a copy; emailHtml gains content and button show_url, emailQueue gains queued_at and always so billing still queues as before, plus emailMailboxes and emailTestSend; ticketMailCreated, ticketMailReply, ticketMailWatchersAdded, ticketMailTaskApproval, ticketMailClosedReply, ticketSlaAlert and billingMailCardSaved moved into functions; fixes Email on the contacts list queuing mail to contacts with no address, the clients list including archived contacts, and both taking any From address posted; changelog updated

2026-10-17 23:26:25 -04:00

settings_module.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_notification.php

Billing stage 5: payment reminders on a schedule set in Invoice Settings (days before, on and after the due date, then every N days until paid, with a client opt-out on the Billing tab and no reminder for autopay invoices until late), Send Reminder and next-reminder status on the invoice page, a message and PDF attachment in the invoice, quote and statement Send windows, a statement PDF with aging and an optional monthly statement run, a new look for invoice, quote, reminder, receipt, statement and team notice emails sent to primary and billing contacts, late fee added as a proper invoice line, fixes for the quote answered notice link and batch payment receipts, database 2.9.8 and changelog

2026-10-16 17:12:10 -04:00

settings_online_payment_clients.php

Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids

2026-10-18 22:36:25 -04:00

settings_online_payment.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_project.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_quote.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_security.php

Vendor templates stage 1: Admin > Vendor Templates rebuilt on the standard list with Active and Archived tabs, support line, hours and SLA, how many clients have a vendor from each, last used and changed by, sortable and searchable including by support line; new template page with what a vendor starts with, the clients with it and their account numbers, the license templates that use it, made and changed by, and history; shared New/Edit window on the vendor window's tabs with per-field push to the vendors made from it, each logged on the vendor; copy, archive, restore and delete with vendors and license templates unlinked on delete; Make a template from a client's vendor, linking the vendor to it, and the vendor page linking its template for admins; Delete offered to every admin role, not only the built-in Administrator; the admin handler no longer includes the agent vendor handler; database 3.3.4 adds vendor_template_created_by and vendor_template_updated_by, backfilled from the audit log

2026-10-19 12:34:53 -04:00

settings_telemetry.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

settings_theme.php

Fix remaing undefine vars for audits and flash messages

2026-08-03 15:40:44 -04:00

settings_ticket.php

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-07-24 13:40:37 -04:00

sla.php

Audit logs stage 1: Admin > Audit Logs rebuilt on the standard list with search, sortable columns and paging, filters for date, who (agent, portal contact or ITFlow itself), client, type and action, and counted views for Changes, Deletions, Sign-ins, Security and Data out; each entry shows who with their avatar, the client, the type and action as a coloured label, the description without the name in front, the IP and device in words, and links to its record while it exists or says No longer here; a quick look with the full entry, the raw user agent, everything from that IP, the record's other entries and what the same person did 15 minutes either side; CSV/PDF export with the page's filters, view and picked columns, itself audited; new functions/audit_log.php, admin/modals/audit_log/audit_log.php and audit_log_export.php, admin/post/audit_log.php and audit_logs export columns; agent/files.php takes ?open= for a file's quick look; database 3.3.1 adds log_client_id and log_entity_id keys on logs, gives each action one name (Unarchive/Restored to Restore, Deleted, Merged, Closed, Reopened, Resolved and Sent to Delete, Merge, Close, Reopen, Resolve and Send, Client Access to Denied, saved card and payment provider Updates to Create or Delete, contract template Update to Edit, type client to Client) and repoints entries at the right record (reply edits and redactions to the ticket, API document edits to the document, reimbursements to the recording expense, API client restores to the client), guarded so it can run again; logAudit call sites in agent, admin, api, client, cron and functions use the same names and record ids

2026-10-18 22:36:25 -04:00

software_template.php

License templates stage 4: export license templates to a file (every current one, the ones picked including archived, or one from its page or row), carrying what a license starts with, the vendor template without account number, code or contact, and the product name, but not who should have it; import a file, skipping, copying or replacing templates already here by name, matching vendor templates by name or creating them from the file, matching current products by name without creating any, and on replace keeping licenses, who should have it and the template's own product unless the file's product is here; add a License Templates starter pack of 20 common MSP licenses with type, licensing, renewal term, notes and vendor, linked to the products of the same name once Products & Services is loaded, plus an Update that refreshes the ones already here; add Import, Export, the report and the starter pack to the New License Template menu; add a License Templates report by template and by client covering licenses made, seats in use against bought, renewals, coverage of the clients that should have one and, for Sales users, licenses billed and their monthly value, with CSV export

2026-10-18 21:42:31 -04:00

starter_content_model.php

Vendor templates stage 3: add a status page and support portal to vendors and vendor templates, linked from the vendor page, quick look, vendors list and its tickets and kept in step from the template, keep the account manager line and email on templates for new vendors only, add Export and Import of vendor templates with skip, add or replace for existing names and never account numbers or PINs, refresh the starter vendor templates with support sites, status pages, portals and what support asks for plus an Update for ones added before, carry the status page and portal in license template files, the API and exports, stop making a support site with a non-http scheme a link, and database 3.3.6 adds the new vendor and vendor template columns

2026-10-20 11:21:58 -04:00

starter_content.php

Vendor templates stage 3: add a status page and support portal to vendors and vendor templates, linked from the vendor page, quick look, vendors list and its tickets and kept in step from the template, keep the account manager line and email on templates for new vendors only, add Export and Import of vendor templates with skip, add or replace for existing names and never account numbers or PINs, refresh the starter vendor templates with support sites, status pages, portals and what support asks for plus an Update for ones added before, carry the status page and portal in license template files, the API and exports, stop making a support site with a non-http scheme a link, and database 3.3.6 adds the new vendor and vendor template columns

2026-10-20 11:21:58 -04:00

tag.php

Admin lists on the standard list pattern: Ticket Templates, Roles, API Keys, Taxes, Categories and Tags now have the full-size search with the dark button, Active and Archived pills with counts, sortable table-light column headings, paging through filter_footer.php with records per page, and the btn-light row menu, with old archived=1 links still opening Archived; Ticket Templates sorts by name, tasks, use or last use, gains a Last used column and moves Import, Export, the report and Starter templates onto the New button's split menu; Roles sorts by name with admin roles first, agents or last change; API Keys sorts by name, end date, agent or last use, with Active and Expired pills so a revoked key moves to Expired to be deleted; Taxes sorts by name, rate or use; Categories and Tags keep their kinds in the left nav with the pills beside the list, sort by name or use (and in order for the ordered category kinds), and page in PHP; dragging categories into order and Move up and Move down work on every page (reorder_categories takes offset); bulk actions move to the right of the search row; descriptions wrap so rows and their menus fit on a phone; the help lines above the lists are dropped, with a category kind's purpose on its nav link; apiKeyRows() removed as unused; category and tag redirects use show=archived; changelog updated

2026-10-18 02:26:56 -04:00

tax.php

Taxes stage 1: Admin > Taxes rebuilt (renamed from Tax Rates) listing each rate with its whole percent, parts, description, registration number and usage (invoices, quotes, recurring invoices, products, clients), Current and Archived tabs showing what replaced a rate, Restore, Make default, and Delete only for a rate never used; rates made of parts (state and county, GST and QST) with parts charged on top of the ones above, the whole rate shown as typed, four decimal places and a registration number per rate or part printed with the company details on invoices, quotes and PDFs; changing the percent or parts of a rate on a sent invoice or quote makes a new rate of the same name and archives the old one, so billed lines keep the old rate while products, client rates, the default, recurring invoices and optionally drafts move to the new one, and archiving offers to move whatever still uses it; How lines are taxed settings for the default rate, taxing billed time, trips and expenses, and discounts taken off before tax (on by default, shared across lines by amount, paid, cancelled and answered documents never recalculated); clients get their own tax rate and tax exempt with certificate number and expiry on the Billing tab, new lines defaulting to the client's rate then the product's then the default and to no tax for exempt clients, exempt badge on the client header and overview, a warning with Take the tax off on open documents that still carry taxed lines for an exempt client, and Tax exempt with the certificate under the client on untaxed documents; totals, PDFs, guest and portal views show tax by part; Unbilled Time can bill at each client's usual rate and the ticket, Add Tickets, Add Expenses and Add Trips windows start on it; API client fields for rate and exemption and tax_id default on invoice item create; Tax Collected shows exact percents; demo taxes get parts and registration numbers, demo clients their rates and two nonprofits exemptions; database 3.1.1 makes tax_percent decimal(9,4) and adds tax description, registration and replaced-by, tax_components, client rate and exemption columns and the tax settings; new functions/tax.php and js/tax_form.js; changelog updated

2026-10-17 13:00:54 -04:00

ticket_status.php

Ticket SLA: Fix on hold to pause only after first reply, show resolved closed and onhold as fixed on paused sla in the list

2026-08-15 19:55:40 -04:00

ticket_template.php

Document templates stage 2, filled in from the client: placeholders [Client], [Website], [Site], [Address], [Site Phone], [Contact], [First Name], [Contact Email], [Contact Phone], [Agent], [Date], [Month], [Quarter] and [Year] are filled in across a template's name, summary and content when a document is made, using the client's primary site and contact unless another or none is picked; tables of records [Contacts], [Locations], [Assets], [Servers], [Workstations], [Network Equipment], [Printers], [Networks], [Domains], [Certificates], [Licenses], [Vendors] and [Services] put in the client's current records, as a table on a line of their own (an empty row when there are none) or as names in a sentence, all made safe; any other bracketed word is a fill-in asked for when a document is made, set up on the template page as text, date, list or yes/no, required or with help, renamed along with the template text, reset or removed, and dragged into order, with answers checked by ticketFillInAnswers and blanks left in the document; the template page gets Fill-ins and Filled in from the client cards with each kind of word marked in its own colour, and the editor gets a button for each placeholder and table to insert it at the cursor (js/document_template_form.js); New document for a client and Document from template draw the site and contact pickers and fill-ins once the template and client are picked (agent/ajax.php document_template_asks, agent/js/document_template_make.js) and open larger; copying a template copies its fill-ins; Draft it with AI is told the placeholders and tables; migration 3.2.6 adds document_template_fill_ins; fixed the fill-in add and reset messages showing raw HTML around the bracketed name on document and ticket templates; changelog updated

2026-10-18 19:47:57 -04:00

update.php

Implemented Check for updates which removs the last shell exec from web ui, and reimplemented db_update switch to update_cli.php

2026-08-26 23:38:23 -04:00

users.php

Emails stage 2: agent and staff emails in the shared email layout with an Open in ITFlow button - assigned to you (assignee pick, Bulk Action, New Ticket and Edit, several at once as one list, recurring tickets the same way, nothing when assigning yourself), new ticket to the new-ticket address (portal, email or scheduled, with what they wrote), client replied to the assigned agent (portal or email, with the reply), SLA at risk and missed to the SLA alert address and the assigned agent, scheduled work and its cancellation to the agent, contact and watchers with the calendar file, a new agent's sign in details, account changes, new device and failed MFA sign in alerts, a login sent back through a shared link, the Admin > Mail test email and the portal's saved card confirmation; nothing is queued when outgoing mail is not set up; fixes backslashes before apostrophes in the parser's new ticket and reply emails, emails skipped when no SMTP host was set for Microsoft 365 or Google mail, and the saved card email's wording; adds emailSettings(), emailReady() and cal_str to functions/email.php, the ticket agent email functions, userMailNewAccount() and userMailSignInAlert(), a new sendSlaAlert() signature, removes userQueueMail() and updates the changelog

2026-10-17 22:47:52 -04:00

vendor_template.php

Vendor templates stage 3: add a status page and support portal to vendors and vendor templates, linked from the vendor page, quick look, vendors list and its tickets and kept in step from the template, keep the account manager line and email on templates for new vendors only, add Export and Import of vendor templates with skip, add or replace for existing names and never account numbers or PINs, refresh the starter vendor templates with support sites, status pages, portals and what support asks for plus an Update for ones added before, carry the status page and portal in license template files, the API and exports, stop making a support site with a non-http scheme a link, and database 3.3.6 adds the new vendor and vendor template columns

2026-10-20 11:21:58 -04:00