From fa9bc0bbf338286d1dcdeed5b49b740e96b4bbda Mon Sep 17 00:00:00 2001
From: objecttothis <17935339+objecttothis@users.noreply.github.com>
Date: Wed, 19 Aug 2026 16:06:37 +0400
Subject: [PATCH] fix(controllers): validate default stock location ID before
 setting it

Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
---
 app/Controllers/Config.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Controllers/Config.php b/app/Controllers/Config.php
index 652daf919..bb1a8d2fb 100644
--- a/app/Controllers/Config.php
+++ b/app/Controllers/Config.php
@@ -786,7 +786,7 @@ class Config extends Secure_Controller
         }
 
         $defaultLocationId = $this->request->getPost('stock_location_default', FILTER_SANITIZE_NUMBER_INT);
-        if ($defaultLocationId) {
+        if ($defaultLocationId && in_array((int) $defaultLocationId, array_map('intval', $notToDelete), true)) {
             $this->stock_location->setDefaultLocation((int) $defaultLocationId);
         }