Develop to Master for26.08 Release

.editorconfig

@@ -0,0 +1,20 @@
+# Editor defaults for ITFlow - see CONTRIBUTING.md ("Style")
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false
+
+# Vendored - do not reformat
+[libs/**]
+indent_style = unset
+indent_size = unset
+trim_trailing_whitespace = false
+insert_final_newline = false

.gitattributes

@@ -0,0 +1,44 @@
+# ITFlow line-ending policy
+#
+# Everything ITFlow ships is LF in the repository and LF in the working tree.
+# Contributors on Windows get LF too - this is deliberate. ITFlow is deployed
+# to Linux/Apache and edited over sftp/ssh as often as it is cloned, so a
+# checkout must be byte-identical everywhere.
+
+* text=auto eol=lf
+
+# Explicit for the file types we author, so nothing depends on git's guess.
+*.php   text eol=lf
+*.js    text eol=lf
+*.css   text eol=lf
+*.html  text eol=lf
+*.sql   text eol=lf
+*.md    text eol=lf
+*.json  text eol=lf
+*.yml   text eol=lf
+*.xsd   text eol=lf
+*.svg   text eol=lf
+*.txt   text eol=lf
+*.ini   text eol=lf
+.htaccess text eol=lf
+
+# Binary assets: never touched, never diffed as text.
+*.png   binary
+*.gif   binary
+*.jpg   binary
+*.jpeg  binary
+*.webp  binary
+*.ico   binary
+*.icc   binary
+*.woff  binary
+*.woff2 binary
+*.ttf   binary
+*.eot   binary
+*.crt   binary
+*.ser   binary
+*.z     binary
+
+# Vendored third-party code is preserved byte-for-byte as shipped upstream.
+# Per CONTRIBUTING.md libs/ is never edited in place - it is replaced wholesale -
+# so normalizing it here would create spurious diffs on the next library update.
+libs/** -text

.gitignore

@@ -20,6 +20,10 @@ uploads/users/*
 !uploads/users/index.php
 uploads/tmp/*
 !uploads/tmp/index.php
+!uploads/tmp/.htaccess
+uploads/backups/*
+!uploads/backups/index.php
+!uploads/backups/.htaccess
 uploads/tickets/*
 !uploads/tickets/index.php
 uploads/ticket_templates/*
@@ -49,3 +53,5 @@ setup/custom/*
 api/v1/custom/*
 !api/v1/custom/readme.php
 .zed
+
+*.patch

.htaccess

@@ -1,2 +1,2 @@
 # Prevent access to .git, .github, and config.php
-RedirectMatch 404 ^/(\.git|\.github|config\.php)
+RedirectMatch 401 ^/(\.git|\.github|config\.php)

SECURITY.md

@@ -13,7 +13,7 @@ We operate a rolling release model. Any bug fixes will be released into latest v
 
 | Version | Supported          |
 |---------| ------------------ |
-| 25.12   | :white_check_mark: |
+| 26.08   | :white_check_mark: |
 
 ## Reporting a Vulnerability via GitHub Security Advisories
 

admin/ai_model.php → admin/ai_models.php

@@ -17,7 +17,7 @@
         <a href="/admin">Admin</a>
     </li>
     <li class="breadcrumb-item">
-        <a href="ai_provider.php">AI Providers</a>
+        <a href="ai_providers.php">AI Providers</a>
     </li>
     <li class="breadcrumb-item active">AI Models</li>
 </ol>
@@ -35,17 +35,17 @@
                 <thead class="text-dark <?php if ($num_rows == 0) { echo "d-none"; } ?>">
                 <tr>
                     <th>
-                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=ai_model_name&order=<?php echo $disp; ?>">
+                        <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=ai_model_name&order=<?= $disp ?>">
                             Model <?php if ($sort == 'ai_model_name') { echo $order_icon; } ?>
                         </a>
                     </th>
                     <th>
-                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=ai_provider_name&order=<?php echo $disp; ?>">
+                        <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=ai_provider_name&order=<?= $disp ?>">
                             Provider <?php if ($sort == 'ai_provider_name') { echo $order_icon; } ?>
                         </a>
                     </th>
                     <th>
-                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=ai_model_use_case&order=<?php echo $disp; ?>">
+                        <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=ai_model_use_case&order=<?= $disp ?>">
                             Use Case<?php if ($sort == 'ai_model_use_case') { echo $order_icon; } ?>
                         </a>
                     </th>
@@ -60,23 +60,23 @@
 
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $provider_id = intval($row['ai_provider_id']);
-                    $provider_name = nullable_htmlentities($row['ai_provider_name']);
+                    $provider_name = escapeHtml($row['ai_provider_name']);
                     $model_id = intval($row['ai_model_id']);
-                    $model_name = nullable_htmlentities($row['ai_model_name']);
-                    $use_case = nullable_htmlentities($row['ai_model_use_case']);
-                    $prompt = nl2br(nullable_htmlentities($row['ai_model_prompt']));
+                    $model_name = escapeHtml($row['ai_model_name']);
+                    $use_case = escapeHtml($row['ai_model_use_case']);
+                    $prompt = nl2br(escapeHtml($row['ai_model_prompt']));
 
                     ?>
                     <tr>
                         <td>
                             <a class="text-dark text-bold ajax-modal" href="#"
                                 data-modal-url="modals/ai/ai_model_edit.php?id=<?= $model_id ?>">
-                                <?php echo $model_name; ?>
+                                <?= $model_name ?>
                             </a>
                         </td>
-                        <td><?php echo $provider_name; ?></td>
-                        <td><?php echo $use_case; ?></td>
-                        <td><?php echo $prompt; ?></td>
+                        <td><?= $provider_name ?></td>
+                        <td><?= $use_case ?></td>
+                        <td><?= $prompt ?></td>
                         <td>
                             <div class="dropdown dropleft text-center">
                                 <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
@@ -88,7 +88,7 @@
                                         <i class="fas fa-fw fa-edit mr-2"></i>Edit
                                     </a>
                                     <div class="dropdown-divider"></div>
-                                    <a class="dropdown-item text-danger confirm-link" href="post.php?delete_ai_model=<?php echo $model_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                    <a class="dropdown-item text-danger confirm-link" href="post.php?delete_ai_model=<?= $model_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
                                         <i class="fas fa-fw fa-trash mr-2"></i>Delete
                                     </a>
                                 </div>

admin/ai_provider.php → admin/ai_providers.php

@@ -25,17 +25,17 @@
                 <thead class="text-dark <?php if ($num_rows == 0) { echo "d-none"; } ?>">
                 <tr>
                     <th>
-                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=ai_provider_name&order=<?php echo $disp; ?>">
+                        <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=ai_provider_name&order=<?= $disp ?>">
                             Provider <?php if ($sort == 'ai_provider_name') { echo $order_icon; } ?>
                         </a>
                     </th>
                     <th>
-                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=ai_provider_api_url&order=<?php echo $disp; ?>">
+                        <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=ai_provider_api_url&order=<?= $disp ?>">
                             URL <?php if ($sort == 'ai_provider_api_url') { echo $order_icon; } ?>
                         </a>
                     </th>
                     <th>
-                        <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=ai_provider_api_key&order=<?php echo $disp; ?>">
+                        <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=ai_provider_api_key&order=<?= $disp ?>">
                             Key <?php if ($sort == 'ai_provider_api_key') { echo $order_icon; } ?>
                         </a>
                     </th>
@@ -50,9 +50,9 @@
 
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $provider_id = intval($row['ai_provider_id']);
-                    $provider_name = nullable_htmlentities($row['ai_provider_name']);
-                    $url = nullable_htmlentities($row['ai_provider_api_url']);
-                    $key = nullable_htmlentities($row['ai_provider_api_key']);
+                    $provider_name = escapeHtml($row['ai_provider_name']);
+                    $url = escapeHtml($row['ai_provider_api_url']);
+                    $key = escapeHtml($row['ai_provider_api_key']);
 
                     $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ai_model_id') AS ai_model_count FROM ai_models WHERE ai_model_ai_provider_id = $provider_id"));
                     $ai_model_count = intval($row['ai_model_count']);
@@ -62,13 +62,13 @@
                         <td>
                             <a class="text-dark text-bold ajax-modal" href="#"
                                 data-modal-url="modals/ai/ai_provider_edit.php?id=<?= $provider_id ?>">
-                                <?php echo $provider_name; ?>
+                                <?= $provider_name ?>
                             </a>
                         </td>
-                        <td><?php echo $url; ?></td>
-                        <td><?php echo $key; ?></td>
+                        <td><?= $url ?></td>
+                        <td><?= $key ?></td>
                         <td class="text-center">
-                            <a class="badge badge-dark badge-pill p-2" href="ai_model.php"><?= $ai_model_count ?></a>
+                            <a class="badge badge-dark badge-pill p-2" href="ai_models.php"><?= $ai_model_count ?></a>
                         <td>
                             <div class="dropdown dropleft text-center">
                                 <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
@@ -80,7 +80,7 @@
                                         <i class="fas fa-fw fa-edit mr-2"></i>Edit
                                     </a>
                                     <div class="dropdown-divider"></div>
-                                    <a class="dropdown-item text-danger confirm-link" href="post.php?delete_ai_provider=<?php echo $provider_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                    <a class="dropdown-item text-danger confirm-link" href="post.php?delete_ai_provider=<?= $provider_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
                                         <i class="fas fa-fw fa-trash mr-2"></i>Delete
                                     </a>
                                 </div>

admin/api_keys.php

@@ -9,7 +9,7 @@
 $sql = mysqli_query(
     $mysqli,
     "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
-    LEFT JOIN clients on api_keys.api_key_client_id = clients.client_id
+    LEFT JOIN users on api_key_user_id = user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
@@ -33,7 +33,7 @@
 
                 <div class="col-md-4">
                     <div class="input-group mb-3 mb-md-0">
-                        <input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search keys">
+                        <input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(escapeHtml($q)); } ?>" placeholder="Search keys">
                         <div class="input-group-append">
                             <button class="btn btn-primary"><i class="fa fa-search"></i></button>
                         </div>
@@ -64,7 +64,7 @@
         <div class="table-responsive-sm">
 
             <form id="bulkActions" action="post.php" method="post">
-                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+                <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
 
                 <table class="table table-striped table-borderless table-hover">
                     <thead class="text-dark <?php if ($num_rows[0] == 0) { echo "d-none"; } ?>">
@@ -75,27 +75,27 @@
                             </div>
                         </td>
                         <th>
-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_name&order=<?php echo $disp; ?>">
+                            <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=api_key_name&order=<?= $disp ?>">
                                 Name <?php if ($sort == 'api_key_name') { echo $order_icon; } ?>
                             </a>
                         </th>
                         <th>
-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_client_id&order=<?php echo $disp; ?>">
-                                Client <?php if ($sort == 'api_key_client_id') { echo $order_icon; } ?>
+                            <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=api_key_user_id&order=<?= $disp ?>">
+                                User <?php if ($sort == 'api_key_user_id') { echo $order_icon; } ?>
                             </a>
                         </th>
                         <th>
-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_secret&order=<?php echo $disp; ?>">
+                            <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=api_key_secret&order=<?= $disp ?>">
                                 Secret <?php if ($sort == 'api_key_secret') { echo $order_icon; } ?>
                             </a>
                         </th>
                         <th>
-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_created_at&order=<?php echo $disp; ?>">
+                            <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=api_key_created_at&order=<?= $disp ?>">
                                 Created <?php if ($sort == 'api_key_created_at') { echo $order_icon; } ?>
                             </a>
                         </th>
                         <th>
-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_expire&order=<?php echo $disp; ?>">
+                            <a class="text-dark" href="?<?= $url_query_strings_sort ?>&sort=api_key_expire&order=<?= $disp ?>">
                                 Expires <?php if ($sort == 'api_key_expire') { echo $order_icon; } ?>
                             </a>
                         </th>
@@ -107,45 +107,44 @@
 
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $api_key_id = intval($row['api_key_id']);
-                        $api_key_name = nullable_htmlentities($row['api_key_name']);
-                        $api_key_secret = nullable_htmlentities("************" . substr($row['api_key_secret'], -4));
-                        $api_key_created_at = nullable_htmlentities($row['api_key_created_at']);
-                        $api_key_expire = nullable_htmlentities($row['api_key_expire']);
+                        $api_key_name = escapeHtml($row['api_key_name']);
+                        $api_key_secret = escapeHtml("************" . substr($row['api_key_secret'], -4));
+                        $api_key_created_at = escapeHtml($row['api_key_created_at']);
+                        $api_key_expire = escapeHtml($row['api_key_expire']);
                         if ($api_key_expire < date("Y-m-d H:i:s")) {
                             $api_key_expire = $api_key_expire . " (Expired)";
                         }
 
-                        if ($row['api_key_client_id'] == 0) {
-                            $api_key_client = "<i>All Clients</i>";
-                        } else {
-                            $api_key_client = nullable_htmlentities($row['client_name']);
-                        }
+                        $api_key_user = !empty($row['user_name']) ? escapeHtml($row['user_name']) : "<i>None</i>";
 
                         ?>
                         <tr>
                             <td class="pr-0">
                                 <div class="form-check">
-                                    <input class="form-check-input bulk-select" type="checkbox" name="api_key_ids[]" value="<?php echo $api_key_id ?>">
+                                    <input class="form-check-input bulk-select" type="checkbox" name="api_key_ids[]" value="<?= $api_key_id ?>">
                                 </div>
                             </td>
-                            <td class="text-bold"><?php echo $api_key_name; ?></td>
-                            <td><?php echo $api_key_client; ?></td>
-                            <td><?php echo $api_key_secret; ?></td>
-                            <td><?php echo $api_key_created_at; ?></td>
-                            <td><?php echo $api_key_expire; ?></td>
+                            <td class="text-bold"><?= $api_key_name ?></td>
+                            <td><?= $api_key_user ?></td>
+                            <td><?= $api_key_secret ?></td>
+                            <td><?= $api_key_created_at ?></td>
+                            <td><?= $api_key_expire ?></td>
                             <td>
                                 <div class="dropdown dropleft text-center">
                                     <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
                                         <i class="fas fa-ellipsis-h"></i>
                                     </button>
                                     <div class="dropdown-menu">
+                                        <a class="dropdown-item ajax-modal" href="#" data-modal-url="modals/api/api_key_edit.php?id=<?= $api_key_id ?>">
+                                            <i class="fas fa-fw fa-edit mr-2"></i>Edit
+                                        </a>
                                         <?php if ($api_key_expire > date("Y-m-d H:i:s")) { ?>
-                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?revoke_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?revoke_api_key=<?= $api_key_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
                                                 <i class="fas fa-fw fa-times mr-2"></i>Revoke
                                             </a>
                                         <?php } ?>
                                         <?php if ($api_key_expire < date("Y-m-d H:i:s")) { ?>
-                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                            <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_api_key=<?= $api_key_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>">
                                                 <i class="fas fa-fw fa-times mr-2"></i>Delete
                                             </a>
                                         <?php } ?>