From 9253cfe83655824d78136e40a0b72df215940dbc Mon Sep 17 00:00:00 2001
From: objecttothis <17935339+objecttothis@users.noreply.github.com>
Date: Mon, 26 Oct 2026 18:12:52 +0400
Subject: [PATCH] test(config): add coverage for email/locale/general security
 fixes (#4782)

Add ConfigControllerTest covering validation added to protect
config save endpoints from injection and bypass attacks.

- Mailpath validation: accept legit sendmail paths (with dots,
  trailing args), require mailpath when protocol is sendmail,
  reject command injection via shell metacharacters (e.g.
  semicolon) for both sendmail and non-sendmail protocols
- postSaveLocale: verify payment_reference_code_min/max bounds
  (reject non-numeric, zero, negative, max < min; accept valid
  and min==max cases)
- postSaveLocale: verify language_code allow-list enforcement
  against path traversal (forward/backslash variants), unknown
  languages, and case-mismatched codes (GHSA-related hardening)
- postSaveGeneral: begin coverage of theme validation with a
  reusable base payload builder

Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
---
 ...{ConfigTest.php => ConfigControllerTest.php} | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
 rename tests/Controllers/{ConfigTest.php => ConfigControllerTest.php} (96%)

diff --git a/tests/Controllers/ConfigTest.php b/tests/Controllers/ConfigControllerTest.php
similarity index 96%
rename from tests/Controllers/ConfigTest.php
rename to tests/Controllers/ConfigControllerTest.php
index 7b0c54a35..ab085fe9e 100644
--- a/tests/Controllers/ConfigTest.php
+++ b/tests/Controllers/ConfigControllerTest.php
@@ -5,12 +5,17 @@ namespace Tests\Controllers;
 use CodeIgniter\Test\CIUnitTestCase;
 use CodeIgniter\Test\DatabaseTestTrait;
 use CodeIgniter\Test\FeatureTestTrait;
+use Config\OSPOS;
+use Tests\Support\DatabaseBootstrapTrait;
+use Tests\Support\EmployeeFixtureTrait;
 use Tests\Support\TaxFixtureTrait;
 
-class ConfigTest extends CIUnitTestCase
+class ConfigControllerTest extends CIUnitTestCase
 {
     use DatabaseTestTrait;
+    use DatabaseBootstrapTrait;
     use FeatureTestTrait;
+    use EmployeeFixtureTrait;
     use TaxFixtureTrait;
 
     protected $migrate     = true;
@@ -20,12 +25,20 @@ class ConfigTest extends CIUnitTestCase
 
     protected function setUp(): void
     {
+        $this->resetDatabaseOnce();
+
         parent::setUp();
+
+        config(OSPOS::class)->update_settings();
     }
 
     protected function resetSession(): void
     {
-        $this->withSession(['person_id' => 1, 'menu_group' => 'office']);
+        $personId = $this->createEmployee(grants: [
+            ['permission_id' => 'config', 'menu_group' => 'office'],
+        ]);
+
+        $this->withSession(['person_id' => $personId, 'menu_group' => 'office']);
     }
 
     // ========== Valid Mailpath Tests ==========