mirror of
https://github.com/itflow-org/itflow
synced 2026-08-05 07:07:14 +00:00
ae468d6cee
Backups are now AES-256 encrypted zips in three types (full, database only, master key), catalogued in a new backups table, built by cron rather than the web request, and kept under uploads/backups with retention in the nightly job. The encryption key is one value per install held in config.php, never in the database and never in the file name. Restore is shared by the setup wizard and the new scripts/restore_cli.php, which is the only path without an upload size limit. It verifies the key and unpacks the archive before dropping anything, and dumps the current database first so a failed import is rolled back. A backup dumps, zips and encrypts for minutes without issuing a query, so on a server with a short wait_timeout the connection is closed underneath it and the UPDATE marking the backup complete is what fails - long after the archive was written correctly. The connection is now held open for the job and re-established before any write that follows long file work, including the database phase of a restore. Retention recovers rows a dropped connection left behind: still Running after six hours becomes Complete if the archive is on disk, Failed if it is not. cron.php's own failure path is hardened to match. It recorded job failures through the same connection the failing job had just killed, so an uncaught exception ended the dispatch and no trace of the original error survived. Failures now also echo to stdout, so cron mails something useful when the database is unreachable. Security: the setup wizard's restore step is now closed on any install that has users, whatever config.php says. $config_enable_setup defaulted to enabled when the flag was absent, and the flag is only written at the end of a successful install, so an install abandoned partway left an unauthenticated endpoint that would drop every table, import an attacker-supplied archive, and overwrite uploads/ including the .htaccess that stops PHP running there. Affects 26.07 and earlier. Restoring over a live install is now CLI only.
ITFlow
IT documentation, ticketing and accounting system for small MSPs.
View demo
Username: demo@demo.com | Password: demo
About
·
Docs
·
Forum
·
Report Bug
·
Request Feature
·
Security
About
A comprehensive, free & open-source documentation, ticket management, and accounting platform.
The Problem
- You're a small but busy managed service provider with 101 things to do. Information about your clients is unorganised, unstructured and outdated.
- For some work, you seem to spend longer looking for the relevant documentation than actually working on the issue/project.
- On top of the technical day to day, you also have to take care of the financial side of the business - consistent pricing, quotes/invoicing, and accounting.
The Solution: ITFlow
- ITFlow consolidates common MSP needs (documentation, ticketing and billing) into one unified system.
Getting Started
Self Hosting
- The best installation method is to use the install script on Ubuntu/Debian. A video walk through is available here.
wget -O itflow_install.sh https://github.com/itflow-org/itflow-install-script/raw/main/itflow_install.sh
bash itflow_install.sh
- Other manual installation methods are available in the docs.
Managed Hosting
- If you'd prefer, we can host ITFlow for you.
Key Features
- Client documentation - assets, contacts, domains, docs, files, passwords, and more
- Accounting / Billing - finance dashboard, quotes, invoices, accounting, expenses, etc
- Client Portal - self service quote/invoice/ticket management for clients
- Alerting - account balance, invoices, domain/SSL renewals
- Completely free & open-source alternative to ITGlue and Hudu
Roadmap / Future to-do
We track the implementation of confirmed features and bugs via TaskFlow. Use the forum to request features or raise bug reports.
Support & Contributions
Forum
For help using ITFlow, bugs, feature requests, and general ideas / discussions please use the community forum.
Contributing
We have temporarily paused PRs from the community.
Contributors
Supporters
We’re incredibly grateful to the organizations and individuals who support the project - a big thank you to:
- CompuMatter
- F1 for HELP
- digiBandit
- JetBrains (PhpStorm)
License
ITFlow is distributed "as is" under the GPL License, WITHOUT WARRANTY OF ANY KIND. See LICENSE for details.
Security
- As of 2025, we now have a stable release of the project.
- Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs. Use your best judgement before storing highly confidential information in ITFlow.
- If you have a security concern, privately report it here.