Unable to delete client - Results in '#'

chris_ha

When attempting to delete a client in ITFlow, clicking the confirmation box results in no action, and the only change observed is the addition of a '#' at the end of the URL. As a consequence, the client remains undeleted. Any assistance in resolving this issue would be greatly appreciated.

chris_ha

Sometimes i get "HTTP ERROR 500"

chris_ha

[Fri Sep 22 08:53:38.335125 2023] [php:warn] [pid 754] [client 192.168.1.4:53208] PHP Warning: Undefined array key "tax_id_number" in /var/www/post/client_model.php on line 9, referer: https://clients.php [Fri Sep 22 08:53:38.407051 2023] [php:warn] [pid 754] [client 192.168.1.4:53208] PHP Warning: Undefined variable $net_term_value in /var/www/client_edit_modal.php on line 142, referer: https://clients.php [Fri Sep 22 08:53:42.654741 2023] [php:warn] [pid 754] [client 192.168.1.4:53208] PHP Warning: Undefined array key "csrf_token" in /var/www/post/client.php on Line 182, referer: https://clients.php [Fri Sep 22 08:53:42.654790 2023] [php:error] [pid 754] [client 192.168.1.4:53208] PHP Fatal error: Uncaught TypeError: hash_equals(): Argument #1 (Sknown_string) must be of type string, null given in /var/www/functions.php:460\nStack trace: \n#0 /var/www/functions.php (460) : hash_equals (\n#1 /var/www/post/client.php (182): validateCSFToken()\n#2 /var/www/post.php (17) : require_once(' ...')\n#3 {main]\n thrown in /var/www/functions.php on line 460, referer: https://clients.php

johnny

@chris_ha thanks for reporting we'll get this fixed sometime today =]

johnny

hello @chris_ha

We fixed but removed the delete client function from the front end as its very destructive and permanently removes everything related to the client including tickets, audit log files, etc.

This could potentially be best used for test purposes or Dev purposes.

The function is still there and you may, ponce logged in in the url box /post.php?delete_client=[INSERT YOUR CLIENT ID HERE]

wrongecho

johnny

We really should move away from GET requests for destructive functions. They should be POST requests ideally.

johnny

wrongecho

A bsolutely I plan on removing most delete functionality from the code and keeping them as archive with the possibility to un-archive records.

wrongecho

johnny

I still think delete should be an option though, for compliance & security reasons.

johnny

Yeah especially for clients I can see what you mean, i will restore the option but make it with extra confirmation and only put the delete button in the client details and not in the client listing.

Bigbug

johnny

Hi, any updates on this?
I recently played around with the client/create api endpoint, finding my self with a lot of clients/leads named "Test123" … that i want to get rid of

Thanks

🙏

wrongecho

Hey @Bigbug

Unsure if you're referring to the API or Web app delete.

I've just testing deleting clients in the Web UI and it works fine. First, archive the client. Then filter the clients list for archived clients and delete the client.

Bigbug

wrongecho Thanks! it worked for me, it's a good thing that it's difficult to delete

But in my situation, how should i go about bulk delete?

Does the API have a DELETE endpoint for clients?

wrongecho

Bigbug

There's no delete API currently, it would be fairly easy to add though…just seems dangerous.

wrongecho

@Bigbug if you use phpMyAdmin you could set the client-archived-at date for all the clients, and then delete them using the UI?

How do you think we should handle API client deletes? Should we force archiving and then deletes, or just allow a straight delete - no take-backsies.

Bigbug

wrongecho i see that the way it works is with a token in the URL.
what i did is i used the same URL and just changed the client_id to the one i want to delete and.. viola!

I didn't have to archive first

although i used it as a feature… this might be a bug…..

should it allow to use a token twice? and not for the client it was setup for?

wrongecho

Bigbug

Ah great!

The token is for CSRF protection, essentially stops a random website fooling you into deleting clients by browsing to itflow.example.com/post.php?delete_client=1. I wouldn't really consider it a bug, you had to actively seek out the token, and it changes on each login.

We can probably adjust the delete logic to only delete the client where the status is already archived though. Do you think it's necessary?

hugo

wrongecho I like the idea, that delete only after archived.