itflow

app_version.php

2026-11-09 15:43:02 -05:00

auth_check.php

Started updating href paths to absolute paths instead of relative paths as itflow should be installed in document root anyway and not a sub-directory

2025-09-24 12:56:01 -04:00

billing_paper.php

AI stage 4: Billing use case falling back to General; Write it with AI on quotes and invoices whose lines can still change - say what it is for and AI picks lines from the product catalog at catalog prices and frequency, labor in quarter hours at the client's rate, and anything else unpriced for the agent to set (AI never sets a price), with a suggested scope, client note and pre-send checks, optionally using the quote's ticket and the client's people, sites and devices (ticket and documentation only with Support); ticked lines added through billing_ai_lines, taxed by kind, scope and note kept on request, lines that can't go on listed; Write it on the ticket Invoice window describes the work done from replies and notes for the client under the usual ticket line, passwords never sent nor written back; new functions/ai_billing.php, ai_billing_draft and ai_ticket_invoice_description endpoints, billing_ai_writer modal, billing_draft and invoice_description features; callAiApi remove mode also strips made-up secret placeholders; changelog

2026-10-20 21:23:52 -04:00

canned_response_form.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

check_login.php

Add demo mode for a public demo like demo.itflow.org - $config_demo_mode = true; in config.php puts one-click sign-in buttons for Admin, Technician, Accountant and a client portal contact on the sign-in page and a demo notice on every page, and the new Demo Reset cron job rebuilds the demo nightly at 2:00 AM from db.sql with all starter content, the demo clients and the demo accounts, empties uploads except the logo and signs everyone out, keeping the company details, timezone and cron schedules; visitors can try everything except users and roles, their own sign-in details, mail, payment, AI and texting settings, API keys, backups, updates, cron, log forwarding, company, module and portal settings, custom links, starter content and share links, Debug is closed, guest links open only for someone signed in, queued email is cancelled with the reason, no sign-in alert emails are sent, certificate checks reach only public addresses on port 443, and the domain and certificate refreshers are left out; new functions/demo.php and cron/demo_reset.php, no database change, changelog, CONTRIBUTING and README updated

2026-11-06 17:46:40 -05:00

contract_paper.php

Contracts stage 2: each contract is a document with placeholders ([Client], [Start Date], [Rate], an [SLA] table and more) to preview, print or download as PDF; Send to sign emails a contact or anyone a link to sign with a drawn or typed signature, from the link or the client portal (Billing > Contracts and the home page list of ones waiting); Countersign makes a draft active and emails the PDF signed by both with its signing trail and document fingerprint; Signing card with copy link, send again, withdraw and earlier requests; changing the document while it is out for signature withdraws the request; contract emails in Mail > Previews; new functions/contract_signature.php and functions/contract_pdf.php, guest/guest_view_contract.php, client/contracts.php and client/contract.php; DB 3.4.3 adds contract_signatures and keeps any stored signature as a recorded round

2026-10-25 01:05:42 -04:00

contract_placeholders.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

contract_signature_pad.php

Contracts stage 2: each contract is a document with placeholders ([Client], [Start Date], [Rate], an [SLA] table and more) to preview, print or download as PDF; Send to sign emails a contact or anyone a link to sign with a drawn or typed signature, from the link or the client portal (Billing > Contracts and the home page list of ones waiting); Countersign makes a draft active and emails the PDF signed by both with its signing trail and document fingerprint; Signing card with copy link, send again, withdraw and earlier requests; changing the document while it is out for signature withdraws the request; contract emails in Mail > Previews; new functions/contract_signature.php and functions/contract_pdf.php, guest/guest_view_contract.php, client/contracts.php and client/contract.php; DB 3.4.3 adds contract_signatures and keeps any stored signature as a recorded round

2026-10-25 01:05:42 -04:00

cron_jobs.php

Add demo mode for a public demo like demo.itflow.org - $config_demo_mode = true; in config.php puts one-click sign-in buttons for Admin, Technician, Accountant and a client portal contact on the sign-in page and a demo notice on every page, and the new Demo Reset cron job rebuilds the demo nightly at 2:00 AM from db.sql with all starter content, the demo clients and the demo accounts, empties uploads except the logo and signs everyone out, keeping the company details, timezone and cron schedules; visitors can try everything except users and roles, their own sign-in details, mail, payment, AI and texting settings, API keys, backups, updates, cron, log forwarding, company, module and portal settings, custom links, starter content and share links, Debug is closed, guest links open only for someone signed in, queued email is cancelled with the reason, no sign-in alert emails are sent, certificate checks reach only public addresses on port 443, and the domain and certificate refreshers are left out; new functions/demo.php and cron/demo_reset.php, no database change, changelog, CONTRIBUTING and README updated

2026-11-06 17:46:40 -05:00

database_version.php

Split DB Updates into seperate files, with the cutoff being 2.0.0

2026-07-22 18:43:11 -04:00

db.php

More progress on consolidating files into user and admin

2025-07-28 22:48:44 -04:00

detect_device_type.php

Broke up the check_login.php require into several files seperated by function and then required them in the check_login

2025-08-06 17:16:30 -04:00

filter_footer.php

Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty

2026-10-23 12:09:07 -04:00

filter_header.php

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

2026-07-14 17:17:50 -04:00

footer.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

header.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

inc_alert_feedback.php

Add demo mode for a public demo like demo.itflow.org - $config_demo_mode = true; in config.php puts one-click sign-in buttons for Admin, Technician, Accountant and a client portal contact on the sign-in page and a demo notice on every page, and the new Demo Reset cron job rebuilds the demo nightly at 2:00 AM from db.sql with all starter content, the demo clients and the demo accounts, empties uploads except the logo and signs everyone out, keeping the company details, timezone and cron schedules; visitors can try everything except users and roles, their own sign-in details, mail, payment, AI and texting settings, API keys, backups, updates, cron, log forwarding, company, module and portal settings, custom links, starter content and share links, Debug is closed, guest links open only for someone signed in, queued email is cancelled with the reason, no sign-in alert emails are sent, certificate checks reach only public addresses on port 443, and the domain and certificate refreshers are left out; new functions/demo.php and cron/demo_reset.php, no database change, changelog, CONTRIBUTING and README updated

2026-11-06 17:46:40 -05:00

inc_empty_state.php

Empty states: one shared empty state on every list page, drawn by includes/inc_empty_state.php from each page's $empty_state through the new emptyStateHtml() in functions/format.php - a grey round tile with the list's icon, a title, a line on what goes there and the page's own New and Import buttons when nothing has been added, No X match with a Clear filters button that keeps the client, archived and the current tab when a search or filters leave nothing, Nothing in {tab} with the tab's description for an empty pill and a tick for pills that flag trouble, and No archived X for an empty archive; pills count as views rather than filters; replaces the pages' own empty blocks so a filtered-to-nothing list no longer shows two messages; files, notifications and racks use it in their own layouts; adds emptyStateFiltered(), emptyStateClearUrl() and emptyStatePill() and the .itflow-empty-state styles; changelog updated

2026-10-17 00:47:32 -04:00

inc_set_timezone.php

Roles stage 4: the money on invoices goes by Financial with Sales at Read through billingMoneyCan and enforceBillingMoney, so taking payments one at a time, by saved card or as a batch, changing them and emailing receipts, reminders and statements need write access to Financial, and deleting or refunding a payment needs full access, with the old Sales rules for reminders, statements and receipts still accepted; invoice, invoice list, Income and payment quick looks offer only what the role can do, the reminder window offers only the reminder to a role that cannot send the invoice, a reminder for a draft or with nothing owed still needs Sales, and Income bulk Set Category on payments needs Sales as it changes the invoice; database 3.1.8 gives the built-in Accountant full access to Financial when it still has its shipped levels, and new installs seed it that way; calendar events for a client follow the role's Clients level through calendarEventCan, Read to see, Modify to add, change, move, skip or send, Full to delete or Modify for the agent who added it, events an agent is on always show, events with no client stay open to everyone, and the calendar, dashboard and calendar links leave out other agents' client events for roles without Clients, with New event, the client picker and dragging following the same rule; the API now sets PHP and MySQL to ITFlow's timezone so what it creates, API ticket SLA times and key expiry go by local time, and inc_set_timezone.php only writes the session when one is open and no longer leaves its result and row variables behind; changelog updated

2026-10-17 21:52:10 -04:00

inc_wrapper.php

Initial migration from AdminLTE 3 to 4, bootstrap 4 to 5

2026-08-14 13:22:11 -04:00

load_company_settings.php

Main Side Nav displays logo and company name more effiently

2026-10-14 14:43:30 -04:00

load_global_settings.php

Add demo mode for a public demo like demo.itflow.org - $config_demo_mode = true; in config.php puts one-click sign-in buttons for Admin, Technician, Accountant and a client portal contact on the sign-in page and a demo notice on every page, and the new Demo Reset cron job rebuilds the demo nightly at 2:00 AM from db.sql with all starter content, the demo clients and the demo accounts, empties uploads except the logo and signs everyone out, keeping the company details, timezone and cron schedules; visitors can try everything except users and roles, their own sign-in details, mail, payment, AI and texting settings, API keys, backups, updates, cron, log forwarding, company, module and portal settings, custom links, starter content and share links, Debug is closed, guest links open only for someone signed in, queued email is cancelled with the reason, no sign-in alert emails are sent, certificate checks reach only public addresses on port 443, and the domain and certificate refreshers are left out; new functions/demo.php and cron/demo_reset.php, no database change, changelog, CONTRIBUTING and README updated

2026-11-06 17:46:40 -05:00

load_user_session.php

Security: hold an agent who must set up MFA to the set up page on every request, not just at sign in, and fix the client portal two-step gate, which a path added to the URL or a second action sent with the set up one got past - both now go through requestIsMfaSetup(), which checks the script actually running and every key in the request; View as contact is refused while an agent still owes MFA set up, and agents are emailed when MFA is turned on

2026-11-04 14:01:40 -05:00

managed_blocked.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

modal_footer.php

Version ITFlow's scripts and stylesheets so browsers fetch the new copies after an update instead of needing a cache clear: add staticFileUrl() in functions/app.php, which adds ?v= and the file's modification time to the address, and send every script and stylesheet tag through it, libs included, with page-relative addresses changed to start from the site root; add js/tinymce_defaults.js to set TinyMCE's cache_suffix so the plugins, theme and skins it loads itself are versioned too; load ticket collision detection only when a ticket is shown, so a ticket that isn't found no longer throws a script error; add changelog entries and a CONTRIBUTING rule that new tags must use staticFileUrl()

2026-11-09 01:22:35 -05:00

modal_header.php

Roles stage 2: refusals now say why, naming the role and what it lacks, as a Not for your role card in place of a page with the layout and Back, inside the window for a window, back on the page with a message for a handler or Admin, and as a 403 JSON error from ajax.php, no longer leaving a stale not permitted message on the next page; actions a role can't do are no longer offered, covering the clients bulk menu at Read keeping Send Email, asset bulk tools and ticks at Read, asset bulk Delete below Full, editing an asset's recurring tickets at Read, report links for roles without that report with the dashboard Profit card opening Transactions instead, Credentials in All Client Docs, a contact's Assets, Documents, Files and Services tabs and a document's linked records for roles without Support, shared-link notifications for roles without Support, and the client delete window only included where Delete Client is offered; role window warns when modules are given with Clients at None; user quick look shows what the agent can open from their role and the user form shows the picked role's access; changelog updated

2026-10-17 20:44:50 -04:00

page_title.php

Replace Function sanitizeInput() with just escapeSql() and update all instances throughout

2026-07-14 17:17:50 -04:00

redirect_if_setup_enabled.php

Started updating href paths to absolute paths instead of relative paths as itflow should be installed in document root anyway and not a sub-directory

2025-09-24 12:56:01 -04:00

session_init.php

Rotate session ID on login and fix client portal Entra SSO

2026-07-27 23:49:09 -04:00

settings_localization_array.php

use intl js lib across all phone number fields

2026-08-26 13:53:27 -04:00

stripe_init.php

Use stripe_init include to init stripe and updated code everywhere

2026-07-23 13:00:01 -04:00

top_nav.php

Custom Links rebuilt: tabs for the agent menu, top bar, client portal, admin menu and reports menu with counts plus All and Archived, search by name, address or description, sortable columns, each link with its icon, description, address and new-tab marker, links whose address can't work flagged; drag into order on a menu's tab or move up and down, new links at the end of their menu in place of the Order number; one add and edit window with a live preview of the link in its menu, an icon picker with search, a description shown on hover and a new-tab switch that follows the address until changed; copy, open, archive, restore and confirmed delete; addresses limited to web addresses, ITFlow pages, mailto, tel and the remote tool schemes asset links allow, with javascript and data refused and old ones drawn as going nowhere; menus read one shared helper, the agent menu's links sit under Tools even without Reports, the admin menu's get a Links heading, new-tab links get a small arrow, links without an icon get the link arrow and every link shows its description on hover; fixes mailto and tel links showing as unsupported in the side menus, the portal menu taking any address, the delete message missing the name and the new-tab tick never showing; edits audit what changed from what to what; adds functions/custom_link.php and js/custom_link_form.js, no database change; changelog

2026-10-24 14:03:40 -04:00