mirror/opensourcepos
1
0
Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-03-31 13:24:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

XSS mitigation features (#4041)

Browse Source 
* Remove HtmlPurifier calls

- All calls to Services::htmlPurifier()->purify() removed from data received from view.
- Bootstrap and bootswatch bump in package-lock.json

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Customers Controller

- Refactored code for clarity
- Replaced == with === operator to prevent type juggling
- Added Sanitization of Customer data before being sent to the view

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Bump bootstrap-table to 1.23.1

- Bump bootstrap-table to 1.23.1 in attempt to resolve issue with sticky headers
- Sanitize attribute data in tables
- Sanitize item data with controller function.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Minor changes

- Refactored for code clarity.
- Removed extra blank lines.
- Minor reformatting.
- Added PHPdocs
- bumped bootstrap-table to 1.23.2

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

---------

Signed-off-by: objecttothis <objecttothis@gmail.com>
Co-authored-by: objecttothis <objecttothis@gmail.com>
This commit is contained in:
jekkos
2024-08-26 09:35:56 +02:00
committed by GitHub
parent 402997f0da
commit f49d763254
25 changed files with 158 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/Controllers/Taxes.php
View File

@@ -83,7 +83,7 @@ class Taxes extends Secure_Controller
*/
public function getSearch(): void
{
$search = Services::htmlPurifier()->purify($this->request->getGet('search'));
$search = $this->request->getGet('search');
$limit = $this->request->getGet('limit', FILTER_SANITIZE_NUMBER_INT);
$offset = $this->request->getGet('offset', FILTER_SANITIZE_NUMBER_INT);
$sort = $this->request->getGet('sort', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
@@ -107,7 +107,7 @@ class Taxes extends Secure_Controller
*/
public function suggest_search(): void
{
$search = Services::htmlPurifier()->purify($this->request->getPost('term'));
$search = $this->request->getPost('term');
$suggestions = $this->tax->get_search_suggestions($search); //TODO: There is no get_search_suggestions function in the tax model
echo json_encode($suggestions);
@@ -120,7 +120,7 @@ class Taxes extends Secure_Controller
*/
public function suggest_tax_categories(): void
{
$search = Services::htmlPurifier()->purify($this->request->getPost('term'));
$search = $this->request->getPost('term');
$suggestions = $this->tax_category->get_tax_category_suggestions($search);
echo json_encode($suggestions);
@@ -461,7 +461,7 @@ class Taxes extends Secure_Controller
*/
public function getSuggestTaxCodes(): void
{
$search = Services::htmlPurifier()->purify($this->request->getPostGet('term'));
$search = $this->request->getPostGet('term');
$suggestions = $this->tax_code->get_tax_codes_search_suggestions($search);
echo json_encode($suggestions);