Move 'export_all' entry above 'export_csv' in Common.php across all
locale files to maintain alphabetical key ordering.
- Affects all locales under app/Language/*/Common.php
- No translation values changed, only key position
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
- Replace untranslated English strings with empty fallback ('') across all non-English catalogs and sort keys alphabetically (closes#4783, closes#4660)
- Restore missing Sales.no_sales_to_display in English while preserving existing translations (closes#4794, references #4637, #4795)
- Register Georgian (ka) and Swahili (sw-KE, sw-TZ) locales, normalize Croatian to hr per BCP 47, and fix datepicker long month keys (partially addresses #4476, references #3891)
- Hardcode invariant brand constants (OSPOS, website, copyrights) in login/footer views, remove from catalogs, and standardize Latin OSPOS branding
- Fix English catalog typos and maintain consistent British English variants in en-GB
- Add LanguageFilesTest with 4,418 automated tests for syntax, key parity, sorting, and bidirectional locale registrations
- Update AGENTS.md with localization guidelines and development best practices
- Dockerfile: use rolling php:8.2-apache with expose_php = Off.
- Dockerfile: validate runtime against composer.lock at build boundary via BuildKit composer check-platform-reqs.
- Dockerfile: enforce least-privilege permissions (root:www-data 0640 files, 0750 dirs), restricting write access to writable/ and public/uploads.
- dockerignore: include composer.json and composer.lock in build context for platform validation.
- CI: remove redundant bash version checks across workflows; enforce fresh upstream base via pull: true in build-release.yml.
- Docs & Changelog: remove security advisory identifiers while preserving minimum patch levels.
getEdit, postDelete, getReceipt, and postSave all accept a
user-controlled receiving_id and previously only checked the class-level
receivings module grant. This allowed any employee with basic receiving
permissions to read, modify, or delete historical receiving records
belonging to other employees.
Add reports_receivings permission checks to all four per-record
endpoints, following the same pattern as Sales (PR #4627).
* fix(sales): allow gift card credit for returns + surface errors
- Add incrementGiftcardValue() to Giftcard model for crediting cards
- In Sale::save_value(), use incrementGiftcardValue() for returns
with negative gift card payments (credits the card)
- Add error_message rendering to register view so failed completions
show the error instead of silently reloading
Fixes#4779
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(migrations): prevent concurrent runs with pessimistic DB lock
Adds GET_LOCK/RELEASE_LOCK around the migration sequence so a second
request (page refresh, double-click, supervisor retry) cannot re-trigger
the same migration while the first is still executing. Also adds
ignore_user_abort(true) so a client disconnect does not tear down the
PHP process mid-migration.
Fixes#4763
Introduce a CashupAmounts transfer object and break down large Cashups
controller methods into focused private helpers. Includes a breaking
change to constructor parameter order.
- Add CashupAmounts (TransferObjects/Cashups) to bundle open/transfer/
closed cash, due, card, and check amounts; reorder constructor params
to cash-before-due sequence
- Replace positional _calculate_total() with calculateTotal(CashupAmounts),
eliminating argument-order errors
- Decompose getView() into buildEmployeeLookup(), normalizeCashupInfo(),
initializeNewCashup(), isPendingClose(), closeCashup(),
buildReportDateRangeInputs(), applyPaymentTotals(), subtractCashExpenses()
- Decompose postSave() with parseCashupDate() and getCashupAmountsFromPost()
helpers; update both CashupAmounts call sites to new param order
- Rename snake_case vars/params to camelCase throughout Cashups controller
- Drop stale TODO comments in OSPOS.php and Cashups::getIndex filter block
- Scope escape => false to cashup_headers() note column rather than a
broad regex exclusion in transform_headers()
- Add CashupFixtureTrait and ExpenseFixtureTrait under tests/Support;
tighten cashup view test to assertSeeInField on specific form fields
BREAKING CHANGE: CashupAmounts constructor positional argument order
changed — closedAmountCash now precedes closedAmountDue; any callers
passing positional args must swap those two arguments.
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
When a customer is selected after items are already in the cart,
apply_customer_discount() set the discount value and recomputed totals
using the customer's discount type, but never updated the line's
discount_type field. get_totals() later recomputes from the line's
discount_type (still the store default), producing wrong totals.
Fixes#4778
- Extend composer.json and composer.lock PHP requirement to include PHP 8.5
- Add PHP 8.5 to test matrix in phpunit.yml and main.yml workflows
- Modernize php-linter.yml to use setup-php@v2 with parallel matrix for PHP 8.2–8.5
- Propagate PHP 8.2 lint failures via shell loop in find -exec + while retaining batching for 8.3–8.5
- Add permissions: contents: read and cancel-in-progress concurrency to php-linter.yml
- Remove obsolete Node.js and npm install steps from phpunit.yml
- Update phpunit.yml runner to ubuntu-latest and composer cache action to v4
- Address PHP 8.5 deprecations and syntax:
- Replace deprecated switch-case semicolon with standard colon in app/Config/Database.php
- Replace non-standard (double) cast with (float) in app/Libraries/Token_lib.php
- Remove obsolete curl_close() calls in app/Config/Validation/OSPOSRules.php and app/Libraries/Mailchimp_lib.php
- Update INSTALL.md, workflows README, and bug report issue template to include PHP 8.5
Replace hardcoded string concatenation of the app name and version in the
document <title> with named-placeholder interpolation, consistent with the
existing Common.migration_needed pattern.
- header.php passes ['OSPOS', application_version] as the lang() array
argument instead of concatenating values around the translation
- All 46 Common.php locale files convert powered_by to a named-placeholder
template, preserving current rendered output while allowing each locale
to reorder the app name and version as needed
- hy, ml, nb, and ur leave powered_by empty so MY_Language::getLine()
falls back to English rather than rendering bare placeholder strings
- de-CH powered_by translated to German
- Codify named-placeholder + ICU MessageFormat as the localization standard
in the agents documentation
build/refactor/fix: tighten tooling, rename accessors to camelCase, and correct model bugs
* build: tighten gitignore, lockfile, and script config
- gitignore /build and /.php-cs-fixer.cache
- allow core-js@3.50.0 postinstall script in package.json
* refactor: rename snake_case data accessors to camelCase
Rename get_info, get_multiple_info, get_sale_items, get_sale_payments,
and save_customer across Customer, Employee, Item, Sale, and Supplier
models to PSR-12 camelCase, updating every call site in controllers,
libraries, and views.
* test: update calls to match renamed camelCase accessors
Update HomeTest, ItemsControllerTest, and ItemTest to call
getInfo()/getMultipleInfo() instead of the old snake_case model methods.
* fix: correct independent bugs in Item, Item_taxes, and Attribute models
- Item::delete()/delete_list(): let $this->db->transStatus() alone decide
success instead of accumulating a bitwise-AND over intermediate results,
which could report failure (and trigger error toasts) even when the
delete had actually completed
- Item_taxes: correct $table property from 'item_taxes' to 'items_taxes'
- Attribute::getDefinitionNames(): pass an array to
QueryBuilder->whereNotIn(), which requires one
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drop verified-unused keys from Sales.php across all locales to reduce
translation burden. Retained:
- invoice_type_* keys (referenced by Sale_lib)
- rewards_package key (built dynamically by register.php)
Fixes#4586
Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Refactor Stock_location model to camelCase naming and introduce
is_default and sort_order fields with full migration, UI, and
item-sync support. Multiple follow-up fixes consolidated.
Database
- Add is_default (TINYINT, backfilled to oldest non-deleted row) and
sort_order (nullable unsigned TINYINT unique, dense 0..N-1) columns
via new migration; MySQL 5.7-compatible backfill using user variables
instead of ROW_NUMBER(); down() drops both columns
Model
- Rename show_locations → showLocations (camelCase convention)
- Add getDefaultLocationId(), setDefaultLocation(), saveSortOrder();
validate location existence before setting as default
- delete() compacts sort_order via two-pass CASE update to avoid
collisions after prior reorders
- Atomic sort_order assignment via explicit SQL COUNT query
Controller / Config
- Modularize save logic into sanitizeSubmittedLocations(),
deleteRemovedLocations(), saveSubmittedLocations(),
saveLocationOrderAndDefault(); wrap in single transaction
- Support stock_location_new inputs for new-row creation
- Resolve new-* ID placeholders to real IDs post-save
- Abort loop on save failure; default missing POST arrays to []
- Validate that at least one location array is non-empty
Views
- Add Default column with center-aligned radio buttons; disable for
unsaved rows; use attr() instead of data() for location IDs
- Escape dynamic location IDs against XSS in all affected partials
- form_count_details.php: fall back to default location when current
is undefined; guard quantity input similarly
- Add aria-label to default radio inputs
Libraries / Items
- Widen Item_lib::get_item_location() and get_stock_destination() to
nullable return types
- Guard null location_id in Items::getRow() and getGenerateBarcodes()
- Item::get_multiple_info(): accept ?int $location_id; short-circuit
with where('item_id', -1) instead of always-false where('1','0')
i18n
- Add stock_location_default, stock_location_default_header,
stock_location_name_header across all locale files
Tests
- Stock_locationTest: getDefaultLocationId, setDefaultLocation,
saveSortOrder, delete compaction, saveValue; rename to
testMethod_Scenario convention
- Add ConfigControllerTest / StockLocationsControllerTest with
AdminAuthTrait covering CRUD, reorder, default assignment, and
malformed/empty/blank payload validation
- DatabaseBootstrapTrait-based setup for ItemTest and Stock_locationTest
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- release.yml:
- Normalize App.php, package.json, and package-lock.json to clean release version ($TARGET) prior to tagging, ensuring tagged commits contain clean release metadata in git history.
- Update release commit message to `chore(release): release <version>` to reflect that code, manifests, and templates are committed.
- Automate updating issue templates (bug report.yml and feature_request.yml) on release: prepends new release, retains top 5 versions, and preserves the fallback option.
- Automate updating supported versions in SECURITY.md (>= $TARGET and < $TARGET).
- Remove automated regex update of README.md: the intro sentence describes the v3.4 rewrite to CI4, so blindly regex-replacing the version on future releases produces misleading prose and is brittle against wording edits.
- Add concurrency group `release` and restrict workflow execution to master branch.
- Bump App.php, package.json, and package-lock.json to next dev snapshot ($NEXT) in post-release commit.
- build-release.yml:
- Remove redundant VERSION="${VERSION%-dev}" check and in-runner normalization step now that release commits are clean.
- Templates and Security Policy:
- Add OpenSourcePOS 3.4.3 to bug report.yml, feature_request.yml, and SECURITY.md.
- Add "- Older version (specify in description)" fallback option to issue templates.
- Remove default selection in bug report.yml so reporters specify version explicitly.
objecttothis