mirror/opensourcepos
1
0 Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-09-12 21:37:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(sales): enforce server-side authorization for price changes (#4631)

Browse Source 
Client-side \"change_price\" flag is UI-only, not trustworthy. Compare
submitted price against current cart price server-side and require
sales_change_price grant when they differ, else reject with
not_authorized error.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>
Co-authored-by: Travis Garrison <travis@chiraqbookstore.com>
This commit is contained in:
objecttothisandTravis Garrison authored and GitHub committed 2026-08-07 02:20:01 +04:00
1 parent 2c69dc0c34
commit 3bafa07e04
1 file changed
+8
Download Patch File Download Diff File Expand all files Collapse all files
app/Controllers/Sales.php
+8
View File
@@ -647,6 +647,14 @@ class Sales extends Secure_Controller
return $this->reload($data);
}
// sales_change_price grant is enforced server-side here; the UI-only "change_price" flag must not be trusted
$current_price = $this->sale_lib->get_cart()[$line]['price'] ?? null;
$employee_id = $this->employee->get_logged_in_employee_info()->person_id;
if ($current_price !== null && bccomp((string)$price, (string)$current_price, $precision) != 0 && !$this->employee->has_grant('sales_change_price', $employee_id)) {
$data['error'] = lang('Sales.not_authorized');
return $this->reload($data);
}
$item_location = $this->request->getPost('location', FILTER_SANITIZE_NUMBER_INT);
$discounted_total = $this->request->getPost('discounted_total') != ''
? parse_decimals($this->request->getPost('discounted_total') ?? '')