johnnyq f7cc3fde54 Make the audit log, notification and history writers safe whatever text they are given, and fix the API client delete that relied on them: logAudit, appNotify, logTicketHistory and logHistory now pass their text through the new logSqlText, which reads it as MySQL reads a quoted string, cuts it to the column by character and escapes it once, so text a caller escaped is stored exactly as before and text passed as read from a row can no longer end the quote; api/v1/clients/delete.php escapes the client name as archive.php does, where a name written for the purpose ran a query when the client was deleted and a name with an apostrophe ended in an error after the delete with nothing logged; logAudit also cuts the session IP and User-Agent to their columns, since a User-Agent over 250 characters failed the insert under strict mode, leaving the action unlogged and failed sign-ins and wrong two-step codes uncounted by the lockout and the code limit, and the User-Agent is cut to 250 where it is written to logs directly or compared with it in login.php, client/login_reset.php, api/v1/validate_api_key.php, guest/includes/inc_all_guest.php and portalSignupRequest; add_invoice_copy, add_invoice_recurring and add_recurring_invoice escape the invoice and recurring invoice prefixes before their inserts, which failed with an apostrophe in the prefix; add the changelog entries

2026-11-11 11:57:09 -05:00

..

guest_header.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

inc_all_guest.php

Make the audit log, notification and history writers safe whatever text they are given, and fix the API client delete that relied on them: logAudit, appNotify, logTicketHistory and logHistory now pass their text through the new logSqlText, which reads it as MySQL reads a quoted string, cuts it to the column by character and escapes it once, so text a caller escaped is stored exactly as before and text passed as read from a row can no longer end the quote; api/v1/clients/delete.php escapes the client name as archive.php does, where a name written for the purpose ran a query when the client was deleted and a name with an apostrophe ended in an error after the delete with nothing logged; logAudit also cuts the session IP and User-Agent to their columns, since a User-Agent over 250 characters failed the insert under strict mode, leaving the action unlogged and failed sign-ins and wrong two-step codes uncounted by the lockout and the code limit, and the User-Agent is cut to 250 where it is written to logs directly or compared with it in login.php, client/login_reset.php, api/v1/validate_api_key.php, guest/includes/inc_all_guest.php and portalSignupRequest; add_invoice_copy, add_invoice_recurring and add_recurring_invoice escape the invoice and recurring invoice prefixes before their inserts, which failed with an apostrophe in the prefix; add the changelog entries

2026-11-11 11:57:09 -05:00

inc_wrapper.php

Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5

2026-08-14 13:22:11 -04:00