mirror of
https://github.com/itflow-org/itflow
synced 2026-08-05 07:07:14 +00:00
b555a300bc
generateUserSessionKey() built its AES-128 key with randomString(16), which draws 12 random bytes and base64url-encodes them into 16 printable characters. Those 16 characters were handed to openssl_encrypt as the 16-byte key, so the key that wraps the site master key in the user's session carried 96 bits of entropy instead of 128. Same for the IV. The key and IV are now random_bytes(16) and stay raw for the cipher. Base64 is applied only for transport - the cookie and the session copy of the IV - and decoded again at the three read sites. Sessions issued before this change will not decode and are not supported; anyone logged in at deploy time is prompted to log in again. Nothing is stored long term in this path, so there is nothing to migrate. Also guards encryptCredentialEntry against a master key that failed to decrypt. openssl_encrypt accepts false as a key and silently encrypts under an empty key, so a session whose cookie had expired could write a credential that no key would ever recover. It now returns false instead. This was reachable before this change too, whenever a cookie expired mid-session.
ITFlow
IT documentation, ticketing and accounting system for small MSPs.
View demo
Username: demo@demo.com | Password: demo
About
·
Docs
·
Forum
·
Report Bug
·
Request Feature
·
Security
About
A comprehensive, free & open-source documentation, ticket management, and accounting platform.
The Problem
- You're a small but busy managed service provider with 101 things to do. Information about your clients is unorganised, unstructured and outdated.
- For some work, you seem to spend longer looking for the relevant documentation than actually working on the issue/project.
- On top of the technical day to day, you also have to take care of the financial side of the business - consistent pricing, quotes/invoicing, and accounting.
The Solution: ITFlow
- ITFlow consolidates common MSP needs (documentation, ticketing and billing) into one unified system.
Getting Started
Self Hosting
- The best installation method is to use the install script on Ubuntu/Debian. A video walk through is available here.
wget -O itflow_install.sh https://github.com/itflow-org/itflow-install-script/raw/main/itflow_install.sh
bash itflow_install.sh
- Other manual installation methods are available in the docs.
Managed Hosting
- If you'd prefer, we can host ITFlow for you.
Key Features
- Client documentation - assets, contacts, domains, docs, files, passwords, and more
- Accounting / Billing - finance dashboard, quotes, invoices, accounting, expenses, etc
- Client Portal - self service quote/invoice/ticket management for clients
- Alerting - account balance, invoices, domain/SSL renewals
- Completely free & open-source alternative to ITGlue and Hudu
Roadmap / Future to-do
We track the implementation of confirmed features and bugs via TaskFlow. Use the forum to request features or raise bug reports.
Support & Contributions
Forum
For help using ITFlow, bugs, feature requests, and general ideas / discussions please use the community forum.
Contributing
We have temporarily paused PRs from the community.
Contributors
Supporters
We’re incredibly grateful to the organizations and individuals who support the project - a big thank you to:
- CompuMatter
- F1 for HELP
- digiBandit
- JetBrains (PhpStorm)
License
ITFlow is distributed "as is" under the GPL License, WITHOUT WARRANTY OF ANY KIND. See LICENSE for details.
Security
- As of 2025, we now have a stable release of the project.
- Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs. Use your best judgement before storing highly confidential information in ITFlow.
- If you have a security concern, privately report it here.