mirror of
https://github.com/itflow-org/itflow
synced 2026-07-23 00:40:45 +00:00
d1e1609b8a
Remove exec/shell_exec from update checker and domain lookups Update checker (fetchUpdates) no longer shells out to git: - Current commit read directly from .git/HEAD, following the branch ref through loose refs with a packed-refs fallback (survives git gc); detached HEAD handled - Latest commit fetched from the GitHub API via curl using the Accept: application/vnd.github.sha header (returns bare SHA, no JSON parsing) - Repo owner/name derived from the origin remote in .git/config so forks check against their own remote, falling back to itflow-org/itflow - Failures now distinguish unreadable .git (permissions) from API errors (network/rate limit) instead of silently returning empty Domain lookups no longer shell out to dig and whois: - DNS records (A/NS/MX/TXT) via dns_get_record() - Registration data via RDAP (JSON over HTTPS, curl), the ICANN successor to port-43 whois; RDAP server per TLD resolved from IANA's bootstrap registry, cached locally for a week, rdap.org as secondary lookup - Expiration date from RDAP's structured expiration event, replacing regex/date-format guessing for RDAP-covered TLDs - Port-43 whois retained as socket-based fallback (fsockopen) for ccTLDs without RDAP, with IANA server discovery and one registrar referral follow - RDAP responses cached per-run: getDomainRecords() and getDomainExpirationDate() on the same domain = one HTTP request Fixes whois rate limiting, removes the exec dependency for hardened hosts (Snuffleupagus etc.), and eliminates the shell injection surface - no shell, nothing to escape.
ITFlow
IT documentation, ticketing and accounting system for small MSPs.
View demo
Username: demo@demo.com | Password: demo
About
·
Docs
·
Forum
·
Report Bug
·
Request Feature
·
Security
About
A comprehensive, free & open-source documentation, ticket management, and accounting platform.
The Problem
- You're a small but busy managed service provider with 101 things to do. Information about your clients is unorganised, unstructured and outdated.
- For some work, you seem to spend longer looking for the relevant documentation than actually working on the issue/project.
- On top of the technical day to day, you also have to take care of the financial side of the business - consistent pricing, quotes/invoicing, and accounting.
The Solution: ITFlow
- ITFlow consolidates common MSP needs (documentation, ticketing and billing) into one unified system.
Getting Started
Self Hosting
- The best installation method is to use the install script on Ubuntu/Debian. A video walk through is available here.
wget -O itflow_install.sh https://github.com/itflow-org/itflow-install-script/raw/main/itflow_install.sh
bash itflow_install.sh
- Other manual installation methods are available in the docs.
Managed Hosting
- If you'd prefer, we can host ITFlow for you.
Key Features
- Client documentation - assets, contacts, domains, docs, files, passwords, and more
- Accounting / Billing - finance dashboard, quotes, invoices, accounting, expenses, etc
- Client Portal - self service quote/invoice/ticket management for clients
- Alerting - account balance, invoices, domain/SSL renewals
- Completely free & open-source alternative to ITGlue and Hudu
Roadmap / Future to-do
We track the implementation of confirmed features and bugs via TaskFlow. Use the forum to request features or raise bug reports.
Support & Contributions
Forum
For help using ITFlow, bugs, feature requests, and general ideas / discussions please use the community forum.
Contributing
We have temporarily paused PRs from the community.
Contributors
Supporters
We’re incredibly grateful to the organizations and individuals who support the project - a big thank you to:
- CompuMatter
- F1 for HELP
- digiBandit
- JetBrains (PhpStorm)
License
ITFlow is distributed "as is" under the GPL License, WITHOUT WARRANTY OF ANY KIND. See LICENSE for details.
Security
- As of 2025, we now have a stable release of the project.
- Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs. Use your best judgement before storing highly confidential information in ITFlow.
- If you have a security concern, privately report it here.