Skip to content

ITFlow

v26.07 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 25d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

accounting asset-lifecycle asset-management billing contact-management crm
+14 more
documentation-management domain-management estimates invoice-management invoicing lead-management managed-services php project-management psa ssl-certificate-manager ticket-management ticketing-system vendor-management

Affected surfaces

auth deps

Summary

AI summary

Updates Bug fixes, New Features & Updates, and 26.07 across a mixed release.

Full changelog

[26.07]

Major Changes

Migrated from Webklex php Library to IMAPEngine.
Major Rewrite of the mail settings page to better support Microsoft 365 and Google OAUTH2.

Bug fixes

  • Many Security Fixes.
    
  • Microsoft 365 and Google can now specify Licensed User.
    
  • Clients - Only show 3 Tags per line instead of streching all the way across.
    
  • Login: Make Email field email type instead of text.
    
  • Fixed Invoice Late Overdue notices now shows correct balance when late fees are attached and if partial invoice was paid.
    
  • User Preferences Avatar: Fix creating user upload directory if doesn't exist, and remove Avatar now properly deletes the old avatar image.
    
  • Do not send an in-app alert on successful cron execution, keep it in logging only.
    
  • Fix Issues with Clients Signing in via Entra in the client Portal, items were broken because CSRF token was not being generated.
    

New Features & Updates

  • Clients: Removed Entity Stat Counter was slow and unused.
    
  • Added Monospace text in areas where it deserves it like, IPs, Amounts Costs in Tabular data forms etc.
    
  • Cicking into the client section no longer turns the main nav and text gray, it keeps the configured theme across the app. It was implmented long ago to differentiate between the client section and the main section of ITFLow but didn't work very well.
    
  • Bump Sortablejs from 1.15.6 to 1.15.7.
    
  • Bump TinyMCE from 8.5.0 to 8.6.0.
    
  • Bump Fullcalendar from 6.1.20 to 7.0.0 amd convert existing code to comply with 7.0, also make calendar more printable.
    
  • Bump PHPMailer from 7.0.2 to 7.1.1.
    

Breaking Changes

  • Migrated from Webklex php Library to IMAPEngine.

Security Fixes

  • Many Security Fixes.
  • Fixed CSRF token generation issue preventing clients from signing in via Entra in the client portal.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track ITFlow

Get notified when new releases ship.

Sign up free

About ITFlow

Client IT documentation, ticketing, invoicing and accounting for MSPs (Managed Service Providers).

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]