# 16 – Settings (company settings, profile, password, mass email, email master)

Tested in the QA company (company admin) · Pages: Setting, Admin Profile, Change Password, Mass Email, Email Master

## Works fine

- All five pages open.
- **Company Setting:** saving unchanged works ("Admin updated successfully."); an empty name → "The name field is required."; a bad email → "The email field must be a valid email address."; a PDF as logo → "The logo field must be an image."; a normal PNG logo saves and shows; **Add Additional Address** saves and is shown after reload.
- **Admin Profile:** password and confirmation that differ → "The password field confirmation does not match."; a 3-letter password → "must be at least 6 characters."; a new username saves.
- **Mass Email:** empty subject / body → "The subject field is required. The body field is required." (I did **not** send – it would email real recipients and the mail server is not working on live.)
- **Email Master** (sender / reply email shown on each PDF: quotation, load request, order, BOL, rate confirmation, invoice, remittance, commission): a valid email saves ("Email updated successfully"); a wrong email is stopped by the browser.

## Issues

| # | Sev | What the user experiences | Steps | Evidence |
|---|-----|---------------------------|-------|----------|
| S1 | **Medium** – *you confirmed: two company admins must NOT share an email. Already refused by the local code (tested); live has an older SettingController – upload it* | **A company can take another company's login email.** In Setting I changed the QA company's email to the email of another company's admin and it saved ("Admin updated successfully") – two company owners then share one login email. *(Please confirm if this is allowed; I put the QA email back straight away.)* | Setting → Email → another admin's email → Update Setting | – |
| S2 | Not an issue (your decision, 12 Oct 2026) | ~~The company phone accepts any number~~ - foreign mobile numbers must be allowed, so no fixed 10-digit rule. | Setting → Phone | – |
| S3 | Low | **Logo size rule is hidden:** a normal screenshot was refused with "invalid image dimensions" – the page never says the logo must be at most 1000 px wide. | Setting → Logo → big image | `screens/set_logo_saved.png` |
| S4 | ~~Low~~ **Fixed locally 12 Oct 2026 (needs upload)** | **Empty username:** "Profile updated successfully" is shown but nothing changes (no "username required" message). | Admin Profile → empty username → Update Profile | – |
| S5 | Low - **corrected 12 Oct 2026: matches the register pages** | ~~Password rule is only 6 characters; the registration pages ask for more~~ - **that last part was wrong:** customer / carrier registration and all four profile pages also require only 6 characters (no letter / number / symbol rule anywhere). Only staff "Add User" and "Update User" require 8. Open decision: one common rule for every place a password is set. | Admin Profile → short / simple password | – |
| S6 | Low | Script errors on Setting, Admin Profile and Mass Email pages. | Console | – |

## Not tested (and why)

- **Change Password** (needs the Google reCAPTCHA tick, cannot be automated), **sending** a Mass Email, switching the company Status to Inactive (would lock the QA company), the superadmin mail-server (SMTP) screen (covered in the login report).

## Test data left in the QA company

- Company logo (blue 200×80 PNG) and an additional address "9 Warehouse Road, 110009".
- Email Master: quotation emails "qa.quotes@example.com", invoice emails "qa.billing@example.com". QA email, phone and username were put back to the original values.