johnnyq 9b92261e8c Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id

2026-11-04 13:50:17 -05:00

..

custom

Update .gitignore and add custom directories to /admin /client /guest /user Example Documentation coming soon

2025-09-22 19:33:40 -04:00

includes

Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id

2026-11-04 13:50:17 -05:00

activity.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

asset.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

assets.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

certificates.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

contact_add.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

contact_edit.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

contact.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

contacts.php

Client portal: invite people by email from a client's Contacts (Invites tab with send again, cancel, search and sorting) or by the primary contact in the portal, several at once with optional names and roles, each joining from the emailed link with their own name, title, phone and password or Microsoft 365 and becoming a contact then, an existing contact with that address being given access instead; self sign-up from Create an account on the sign-in page for addresses at a client's Domains when it is on in Admin > Settings > Client portal and for that client, verified by an emailed link and joining as a plain contact with agents and the primary contact told; the same answer whatever address is entered, per address and per IP limits and a hidden field for bots; nightly clean-up of unused links; six new email previews; new functions/portal_invite.php, client/invite.php, client/join.php and client/signup.php, replacing the unused contact_invite modal; DB 3.4.6 adds portal_invites, client_portal_signup and config_client_portal_signup

2026-10-25 01:07:53 -04:00

contract.php

Contracts stage 3: prepaid hours - hours included each month, and blocks bought with a price, expiry, note and an optional draft invoice; a nightly draw of billable ticket time, oldest ticket first from the hours that run out first, with Draw now and Put back, and a ticket the hours run out on staying in Unbilled Time at the usual rate; Prepaid hours card, a low hours email to the owner, and hours left on the contracts list, client overview, ticket, Unbilled Time and the client portal; [Monthly Hours] placeholder; new functions/contract_hours.php; DB 3.4.4 adds monthly hours and the alert level to contracts and templates, plus contract_blocks and contract_block_uses

2026-10-25 01:06:27 -04:00

contracts.php

Contracts stage 3: prepaid hours - hours included each month, and blocks bought with a price, expiry, note and an optional draft invoice; a nightly draw of billable ticket time, oldest ticket first from the hours that run out first, with Draw now and Put back, and a ticket the hours run out on staying in Unbilled Time at the usual rate; Prepaid hours card, a low hours email to the owner, and hours left on the contracts list, client overview, ticket, Unbilled Time and the client portal; [Monthly Hours] placeholder; new functions/contract_hours.php; DB 3.4.4 adds monthly hours and the alert level to contracts and templates, plus contract_blocks and contract_block_uses

2026-10-25 01:06:27 -04:00

document_add.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

document.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

documents.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

domains.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

file.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

functions.php

Contracts: refuse impossible dates (2026-02-30) when adding, editing, activating, renewing, cancelling or starting from a template instead of failing on save; keep each term to the day of the month it started on or the last day of a shorter month so month-end contracts no longer drift (PHP, nightly renewal, the Renew window, templates, Standard terms and contract_form.js); withdraw signing requests still waiting on the client or a countersignature when a contract is cancelled, when it ends nightly or when its client is archived (singly or in bulk), and refuse signing or countersigning on ended, cancelled or archived-client contracts through the link, the portal and Countersign; leave archived clients' contracts alone nightly (no renewing, ending or reminders), keep them out of the all-clients list, Due soon and the side menu count, and refuse sending them to sign; count a self-renewing contract as due soon and remind about it only when its notice date falls within its term, so Standard terms and monthly contracts with 30 days' notice no longer remind every term; keep drawing and adding prepaid hours on a cancelled contract until its last day; refuse deleting a contract once tickets drew on its prepaid hours or it was signed by both, showing why in place of Delete; changelog updated

2026-10-28 23:51:45 -04:00

index.php

Contracts stage 2: each contract is a document with placeholders ([Client], [Start Date], [Rate], an [SLA] table and more) to preview, print or download as PDF; Send to sign emails a contact or anyone a link to sign with a drawn or typed signature, from the link or the client portal (Billing > Contracts and the home page list of ones waiting); Countersign makes a draft active and emails the PDF signed by both with its signing trail and document fingerprint; Signing card with copy link, send again, withdraw and earlier requests; changing the document while it is out for signature withdraws the request; contract emails in Mail > Previews; new functions/contract_signature.php and functions/contract_pdf.php, guest/guest_view_contract.php, client/contracts.php and client/contract.php; DB 3.4.3 adds contract_signatures and keeps any stored signature as a recorded round

2026-10-25 01:05:42 -04:00

invite.php

Client portal: invite people by email from a client's Contacts (Invites tab with send again, cancel, search and sorting) or by the primary contact in the portal, several at once with optional names and roles, each joining from the emailed link with their own name, title, phone and password or Microsoft 365 and becoming a contact then, an existing contact with that address being given access instead; self sign-up from Create an account on the sign-in page for addresses at a client's Domains when it is on in Admin > Settings > Client portal and for that client, verified by an emailed link and joining as a plain contact with agents and the primary contact told; the same answer whatever address is entered, per address and per IP limits and a hidden field for bots; nightly clean-up of unused links; six new email previews; new functions/portal_invite.php, client/invite.php, client/join.php and client/signup.php, replacing the unused contact_invite modal; DB 3.4.6 adds portal_invites, client_portal_signup and config_client_portal_signup

2026-10-25 01:07:53 -04:00

invoice.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

invoices.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

join.php

Security sweep 2: API archive, unarchive, resolve and close now check the client named in the call the same as create, update and delete do (every call except read.php and time.php counts as a write); API asset, contact, network and document create/update keep linked contacts, locations, vendors, networks and folders within the record's own client; linking a contact to an asset refuses another client's contact, and unlinking only clears the contact it was linked to; agents limited to certain clients no longer see other clients' names in the asset import template file name, export filter summaries, or the messages from file moves, unlinks, ticket asset removal, bulk project add and bulk interface network; guest quote Accept and Decline post instead of being plain links and check the key with hash_equals; exports that match nothing say so instead of showing a blank page; about 30 handlers now stop with 'no longer exists' when their record was just deleted, instead of showing warnings or an error page and writing history for a record that is gone; restore_contact_note reads its own id parameter; ticket prefix pattern escaped for the v flag; missing user agent and array key parameters handled; CHANGELOG updated

2026-10-26 19:54:36 -04:00

licenses.php

Client portal stage 3: Your IT - Devices with tabs by kind (Computers, Servers, Network, Phones and tablets, Other) with counts, an Everyone's or Mine filter, search and warranty badges when expired or expiring; a device page with make and model, serial, OS, user, location, purchase date and age, warranty, status, open tickets and licenses on it, Report a problem opening a new ticket with the device picked and plain contacts reaching their own devices from home; Licenses with All, Renewing soon and Expired tabs showing seats in use and renewal state without license keys; Domains and certificates on one page with registrar, DNS, website and email vendors, expiry and auto-renew, and a certificates tab with short-lived certificates shown as renewing themselves, the old certificates page redirecting there; Documents as a help library of client-visible documents with folder tabs and full-text search, a document page keeping its own tables and colours under a widened style policy, files to open or download with the first PDF or image shown inline, Print and Ask us about it, and new documents written in the editor or uploaded as a file with an agent notification; Contacts listing everyone primary first with roles and search, and the primary contact alone adding and editing contacts, giving portal access with an emailed set-password or Microsoft 365 invite, resending it, turning access off and marking someone as left, which turns off access and opens an offboarding ticket, all audited and notified; home renewals and devices linking to their pages; fixes a technical contact being able to change the primary contact's login email, revoked contacts staying signed in, portal documents recording the contact id as author, the upload stub going in unescaped and gated pages leaving a bare header; check_login ends sessions without a sign-in method, header.php buffers output so gates redirect properly, enforceContactCan sends contacts home with a message instead of logging them out, add_contact and edit_contact replaced by portal_contact_save, portal_contact_access and portal_contact_left, new Your IT helpers in client/functions.php and portal tile, roles, PDF and document styles; changelog updated

2026-10-17 02:40:59 -04:00

login_microsoft.php

Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id

2026-11-04 13:50:17 -05:00

login_reset.php

Vendor templates stage 1: Admin > Vendor Templates rebuilt on the standard list with Active and Archived tabs, support line, hours and SLA, how many clients have a vendor from each, last used and changed by, sortable and searchable including by support line; new template page with what a vendor starts with, the clients with it and their account numbers, the license templates that use it, made and changed by, and history; shared New/Edit window on the vendor window's tabs with per-field push to the vendors made from it, each logged on the vendor; copy, archive, restore and delete with vendors and license templates unlinked on delete; Make a template from a client's vendor, linking the vendor to it, and the vendor page linking its template for admins; Delete offered to every admin role, not only the built-in Administrator; the admin handler no longer includes the agent vendor handler; database 3.3.4 adds vendor_template_created_by and vendor_template_updated_by, backfilled from the audit log

2026-10-19 12:34:53 -04:00

pay.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

payments.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

pdf.php

Contracts stage 2: each contract is a document with placeholders ([Client], [Start Date], [Rate], an [SLA] table and more) to preview, print or download as PDF; Send to sign emails a contact or anyone a link to sign with a drawn or typed signature, from the link or the client portal (Billing > Contracts and the home page list of ones waiting); Countersign makes a draft active and emails the PDF signed by both with its signing trail and document fingerprint; Signing card with copy link, send again, withdraw and earlier requests; changing the document while it is out for signature withdraws the request; contract emails in Mail > Previews; new functions/contract_signature.php and functions/contract_pdf.php, guest/guest_view_contract.php, client/contracts.php and client/contract.php; DB 3.4.3 adds contract_signatures and keeps any stored signature as a recorded round

2026-10-25 01:05:42 -04:00

post.php

Security: end a user's other sessions when their password changes - each session carries a stamp of the password it signed in with and the agent and client portal checks sign out any that no longer match, covering a self change, an admin setting it, the incident-response reset, portal reset links and invites, and View as contact; a portal self change keeps the browser that made it on a new session id

2026-11-04 13:50:17 -05:00

profile.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

quote.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

quotes.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

receipt.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

recurring_invoice.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

recurring_invoices.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

saved_payment_methods.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

signup.php

Client portal: invite people by email from a client's Contacts (Invites tab with send again, cancel, search and sorting) or by the primary contact in the portal, several at once with optional names and roles, each joining from the emailed link with their own name, title, phone and password or Microsoft 365 and becoming a contact then, an existing contact with that address being given access instead; self sign-up from Create an account on the sign-in page for addresses at a client's Domains when it is on in Admin > Settings > Client portal and for that client, verified by an emailed link and joining as a plain contact with agents and the primary contact told; the same answer whatever address is entered, per address and per IP limits and a hidden field for bots; nightly clean-up of unused links; six new email previews; new functions/portal_invite.php, client/invite.php, client/join.php and client/signup.php, replacing the unused contact_invite modal; DB 3.4.6 adds portal_invites, client_portal_signup and config_client_portal_signup

2026-10-25 01:07:53 -04:00

statement.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00

ticket_add.php

Ticket templates stage 3: request forms in the client portal - a template can be offered there under its own title, description and icon, to everyone with portal access or primary and technical contacts only, at every client or the ones picked (migration 3.2.1 adds the ticket_template_portal columns, ticket_template_portal_clients, and fill_in_client, ticket_fill_in_client and recurring_ticket_fill_in_client); New ticket in the portal starts with a choice of Report a problem or one of the forms, home lists them under Ask for something, and a form asks the fill-ins set to ask the client plus anything else, files and the device when the template mentions [Asset], then raises the ticket set up as the template says with its category, priority, billing, agent (notified), due time, tags and the tasks for those answers, the client's notes first in the details and who asked in its history; fill-ins can be kept for agents to answer, marked on the agent's ticket and left off the client's Request details; the template window gets a Client portal tab, the template page a card showing how and where it is offered and its requests, and the list marks the ones in the portal; a copy starts off not offered; forms a contact may not use are refused by link or post, and View as contact raises nothing; [Agent] is no longer filled with a client's name for a portal ticket with no agent; changelog updated

2026-10-18 01:11:12 -04:00

ticket_attachment.php

Client portal stage 4: accounts - Your account rebuilt with details and an ask-us link, phone numbers, ticket email choices, password change needing the current password and 8 characters with an email notice, two-step sign-in with an authenticator app set up from a QR code, remembered browsers with Forget them, phone PIN and recent sign-ins with the device; activity rebuilt with signing-in and changes tabs and paging; sign-in asks portal users with two-step sign-in for a code, remembers the browser on request and locks an account after five wrong codes in ten minutes, matching portal users by contact_user_id; Admin > Client Portal can require two-step sign-in, sending anyone without it to set it up first, and agents can turn it off for a contact from the contact page; password links stored as SHA-256 and running out after an hour for Forgot password and a week for invites, the nightly run clearing only run-out links, Forgot password limited to one email per account every five minutes and ten requests per address in ten minutes, the reset page rebuilt with the password typed twice and a confirmation email, fixing the empty-token check that let anyone trigger the reset email; contacts choose every ticket email or replies and fixes only, and primary and technical contacts can hear about new tickets at their company or every update, honoured by agent, portal, email parser and recurring ticket emails; announcements for every client or one with tone and start and end dates on the portal home page, managed in Admin > Client Portal; View as contact opens the portal read only as a contact from the agent contact page, audited, with billing shown only when the agent's role reads sales and financial, nothing written or paid while viewing; agent contact page shows two-step status, last sign-in and ticket email choices; database 3.1.0 adds portal_announcements, contact ticket email columns and config_client_portal_require_mfa and hashes outstanding links; new functions/portal.php; changelog updated

2026-10-17 12:05:55 -04:00

ticket_view_all.php

Client portal stage 1, look, home and tickets: a new light shell with the company logo or initials on the theme colour, sections shown by what each contact may open (Home, Tickets, Billing for billing contacts, Your IT for technical contacts, custom links), New ticket and an account menu with a dark mode switch kept in a cookie, a bottom tab bar and slide-in menu on phones, and the welcome banner removed; a rebuilt home showing what needs the contact (tickets waiting on their reply or to confirm, approvals, past-due invoices), open tickets, balance with Pay invoices, renewals in the next 45 days, their devices with warranty status and the company phone and email; tickets rebuilt with Open, Waiting on you, Resolved, Closed and All tabs with counts, search, paging and the whole company's tickets for primary and technical contacts with a Mine filter, the old all-tickets page redirecting there; a ticket page with progress steps, the conversation oldest first, approvals, details alongside, replies with drag and drop attachments, It's fixed, close or reopen and rating; New Ticket with priority, category, device and attachments; fixes downloading files from internal notes, files on closed tickets not downloading, new tickets linking to another client's device or a non-ticket category, empty replies and tickets being accepted, PHP warnings on Pay invoices and Recurring invoices with no payment provider, and Bootstrap icons and the editor setup blocked by the portal CSP, which now allows data: images; new js/portal.js and portal helpers in client/functions.php, ticketPortalStatusHtml removed; changelog updated

2026-10-17 01:28:27 -04:00

ticket.php

Ticket templates stage 3: request forms in the client portal - a template can be offered there under its own title, description and icon, to everyone with portal access or primary and technical contacts only, at every client or the ones picked (migration 3.2.1 adds the ticket_template_portal columns, ticket_template_portal_clients, and fill_in_client, ticket_fill_in_client and recurring_ticket_fill_in_client); New ticket in the portal starts with a choice of Report a problem or one of the forms, home lists them under Ask for something, and a form asks the fill-ins set to ask the client plus anything else, files and the device when the template mentions [Asset], then raises the ticket set up as the template says with its category, priority, billing, agent (notified), due time, tags and the tasks for those answers, the client's notes first in the details and who asked in its history; fill-ins can be kept for agents to answer, marked on the agent's ticket and left off the client's Request details; the template window gets a Client portal tab, the template page a card showing how and where it is offered and its requests, and the list marks the ones in the portal; a copy starts off not offered; forms a contact may not use are refused by link or post, and View as contact raises nothing; [Agent] is no longer filled with a client's name for a portal ticket with no agent; changelog updated

2026-10-18 01:11:12 -04:00

tickets.php

Client portal stage 1, look, home and tickets: a new light shell with the company logo or initials on the theme colour, sections shown by what each contact may open (Home, Tickets, Billing for billing contacts, Your IT for technical contacts, custom links), New ticket and an account menu with a dark mode switch kept in a cookie, a bottom tab bar and slide-in menu on phones, and the welcome banner removed; a rebuilt home showing what needs the contact (tickets waiting on their reply or to confirm, approvals, past-due invoices), open tickets, balance with Pay invoices, renewals in the next 45 days, their devices with warranty status and the company phone and email; tickets rebuilt with Open, Waiting on you, Resolved, Closed and All tabs with counts, search, paging and the whole company's tickets for primary and technical contacts with a Mine filter, the old all-tickets page redirecting there; a ticket page with progress steps, the conversation oldest first, approvals, details alongside, replies with drag and drop attachments, It's fixed, close or reopen and rating; New Ticket with priority, category, device and attachments; fixes downloading files from internal notes, files on closed tickets not downloading, new tickets linking to another client's device or a non-ticket category, empty replies and tickets being accepted, PHP warnings on Pay invoices and Recurring invoices with no payment provider, and Bootstrap icons and the editor setup blocked by the portal CSP, which now allows data: images; new js/portal.js and portal helpers in client/functions.php, ticketPortalStatusHtml removed; changelog updated

2026-10-17 01:28:27 -04:00

unpaid_invoices.php

Client portal stage 2: billing in the portal - invoices and quotes open in the portal with PDF download and print, Pay invoices pays several invoices as one Stripe card payment with a saved card or a new card on a checkout page (one payment per invoice under a shared reference, booked once under a lock, one receipt and one paid notification), quotes accepted or declined with the contact's name and a note plus signed copy or PO upload, payments list with printable receipts, statement with aging and the shared statement PDF, recurring invoice page with autopay, Cards and autopay on one page, quotes waiting and past-due invoices on home, Ask us links prefill a ticket subject; shared billingQuoteAnswer and billingQuoteAddFiles used by the guest links too, new functions/billing_pay.php, Stripe-aware CSP for card pages with js/portal_stripe.js, nightly Stripe fee reconciled once per payment reference, Stripe refund limited to the payment's own amount, old add_payment_by_provider removed

2026-10-17 02:12:05 -04:00