Commit Graph

6555 Commits

Author SHA1 Message Date
jekkos
86e150ad96 Update INSTALL.md with opensourcepos.org short URL
- Preferred install URL: https://opensourcepos.org/install
- Falls back to direct GitHub URL if redirect unavailable
- More professional and easier to remember
2026-03-06 10:21:22 +00:00
jekkos
8f4055c711 Add one-line Ubuntu installation script
- Creates scripts/install-ubuntu.sh for automated fresh Ubuntu server setup
- Installs Apache, MariaDB, PHP 8.2 with required extensions
- Downloads and configures OSPOS from GitHub
- Sets up Apache virtual host with proper permissions
- Generates secure random database password
- Supports environment variables for customization
- Updates INSTALL.md with curl pipe to bash instructions

This provides an alternative to cloud-specific instructions and
allows users to quickly set up OSPOS on any fresh Ubuntu server.
2026-03-05 15:11:06 +00:00
jekkos
3c25fd77e2 Add validation for invalid stock locations in CSV import
- Add validateCSVStockLocations() method to check CSV columns against allowed locations
- Log error when invalid stock location columns are detected
- Tests for valid, invalid, and mixed stock location columns
- Tests for location name case sensitivity
- Tests for CSV parsing and detecting location columns
- Add error message language string for invalid locations
2026-03-05 15:06:28 +00:00
jekkos
3f7ea18f18 Add unit tests for CSV import functionality
- Add comprehensive test suite for CSV import in ItemsCsvImportTest.php
- Test CSV header generation (locations, attributes, BOM handling)
- Test CSV file parsing (multiple rows, BOM detection)
- Test item import (basic fields, quantities, inventory records)
- Test item updates, taxes, and attributes
- Test edge cases (zero quantities, negative values, precision)
- Add GitHub Actions workflow for unit tests
- Tests verify data ends up correctly in items/item_quantities tables
2026-03-05 12:57:37 +00:00
jekkos
36bf130bdd Add comprehensive unit tests for PR #4384
This commit adds unit tests for the case-sensitive attribute updates
and CSV import attribute deletion capability features introduced in PR #4384.

Test Coverage:
- Attribute Model Tests (tests/Models/AttributeTest.php):
  - testCaseSensitiveAttributeValueUpdate: Verifies case-insensitive check then case-sensitive update
  - testDeleteAttributeLinks: Tests deletion of attribute links
  - testCategoryDropdownCanBeEnabled: Verifies dropdown enablement bug fix
  - testDropdownAttributeValueSave: Tests DROPDOWN type attributes
  - testDateAttributeValueSave/Update: Tests DATE type attributes
  - testDecimalAttributeValueSave: Tests DECIMAL type attributes
  - testCheckboxAttributeValueSave: Tests CHECKBOX type attributes
  - testCategoryDropdownWithConstant: Tests CATEGORY_DEFINITION_ID usage
  - testDeleteAttributeLinksPreservesSalesAndReceivings: Ensures sales/receivings links protected
  - testDeleteOrphanedValues: Tests orphan value cleanup
  - testUnicodeCaseComparison: Tests Unicode handling in case comparisons
  - testGetAttributeValueByAttributeId: Tests new utility method
  - testAttributeLinkWithNullAttributeId: Tests null attribute_id handling
  - testCategoryDropdownUpdatesItemCategory: Tests category dropdown behavior

- Attribute Helper Tests (tests/Helpers/AttributeHelperTest.php):
  - Test getAttributeDataType for all attribute types (TEXT, DECIMAL, DATE, DROPDOWN, CHECKBOX)
  - Test getAttributeDataType returns 'attribute_value' as fallback for invalid types
  - Test validateAttributeValueType throws InvalidArgumentException for invalid types
  - Test validateAttributeValueType accepts valid data types

- Import File Helper Tests (tests/Helpers/ImportFileHelperTest.php):
  - Tests _DELETE_ magic word case-insensitive comparison using strcasecmp
  - Tests that _DELETE_ does not match similar-looking strings (security)
  - Tests empty string does not match _DELETE_
  - Tests null safety considerations for strcasecmp usage

Test Configuration:
- Updated phpunit.xml to include Models and Controllers test suites
- Uses DatabaseTestTrait for database migration between tests
- Tests cover positive and negative cases
- Tests include edge cases: Unicode, null values, empty strings, similar strings

Files Added:
- tests/Models/AttributeTest.php (26,541 bytes, 16 test methods)
- tests/Helpers/AttributeHelperTest.php (3,331 bytes, 8 test methods)
- tests/Helpers/ImportFileHelperTest.php (2,906 bytes, 4 test methods)

Total: 28 test methods covering all new features and edge cases

Note: Tests currently designed; will run once PHP environment is configured.
2026-03-04 20:48:10 +00:00
objec
088ad47c99 CSV Barcode Update Bug
- Refactored variable names for PSR compliance
- Removed bug preventing updates in CSV import files from updating the barcode number.
- Corrected duplicate saveAttributeLink() calls with attribute type was not DROPDOWN.

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-27 18:00:30 +04:00
objec
808840b2e9 Implement Magic word deletion in CSV import
- Corrected spacing
- Added business logic to delete an attribute_link if the import contains `_DELETE_` in that space.
- Removed unneeded PHPdoc comments
- Improved PHPdoc to clarify behavior of function
- Refactor variable names for PSR compliance
- Add logic in validation code for magic word

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-27 16:53:03 +04:00
objec
2ed74c5c0e Resolve review comments
- Replaced -1 for CATEGORY_DEFINITION_ID constant for readability

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-27 00:31:51 +04:00
objec
c935fc7a2a Resolve review comments
- Move validation function to attribute_helper.php
- Removed extra line in security_helper.php
- Corrected some calls to helper() that included `_helper`

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-26 23:16:39 +04:00
objec
89012054b4 Resolve review comments
- Fixed call to deleteOrphanedValues that refactor missed.
- Removed unused import.
- Fixed issue preventing DROPDOWN values from being added.
- Updated logic to fix potential TypeError being thrown by strcasecmp()

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-26 15:16:51 +04:00
objec
89572aa289 Resolve review comments
- Replaced unneeded case-sensitive database search with case-insensitive variant.
- Added input validation.
- Added logic to properly check for case changes in CSV import.
- Moved deleteOrphanedValues() to outside a foreach loop to prevent it running redundantly.

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-26 13:52:14 +04:00
objec
2b56d56072 Resolve business logic bugs
- Fixed logic causing attribute_value to be updated to a value that already exists for a different attribute_id.
- Added logic for edge case where an attribute_value was updated due to capitalization that had a row in attribute_links for category_dropdown definitions (definition_id = -1). This will also update the items.category values to correct the capitalization of those.

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-26 12:28:48 +04:00
objec
2fc9fc09a4 Comment Resolutions
- Removed redundant variable declaration.
- Refactored local variables for PSR compliance.
- Add back in Date Formatting and corrected business logic
- Corrected spacing in comments.
- Corrected business logic of function call in Attribute model and refactored redundant code to a private function.

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-26 00:19:57 +04:00
objec
932b612c9e Case-sensitive attribute update in Item view
- Refactored local variables for PSR compliance
- Added business logic to Attribute->saveAttributeValue so that the attribute value gets overwritten if the only difference is capitalization.
- Added PHPdocs
- Fixed bug in Attribute->saveDefinition preventing category as dropdown from working.
- Modified Attribute->saveAttributeLink() to account for dropdown attributes.

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-25 19:22:02 +04:00
objec
ab6e8ee083 Case-sensitive attributes in CSV imports
- Added attribute_helper.php and getAttributeDataType function for quick translation in the code.
- Refactored code for PSR compliance
- Added getAttributeValueByAttributeId() to the attribute model.
- Added PHPdocs where it was missing
- Updated business logic to check for capitalization differences on CSV import of an item.

Signed-off-by: objec <objecttothis@gmail.com>
2026-02-25 16:30:21 +04:00
jekkos
79427481b3 Fix XSS vulnerabilities in invoices + receipts (#3965) (#4363) 2026-02-23 20:14:55 +01:00
dependabot[bot]
b23351a45c Bump jspdf and jspdf-autotable (#4373)
Bumps [jspdf](https://github.com/parallax/jsPDF) and [jspdf-autotable](https://github.com/simonbengtsson/jsPDF-AutoTable). These dependencies needed to be updated together.

Updates `jspdf` from 3.0.2 to 4.1.0
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](https://github.com/parallax/jsPDF/compare/v3.0.2...v4.1.0)

Updates `jspdf-autotable` from 5.0.2 to 5.0.7
- [Release notes](https://github.com/simonbengtsson/jsPDF-AutoTable/releases)
- [Commits](https://github.com/simonbengtsson/jsPDF-AutoTable/compare/v5.0.2...v5.0.7)

---
updated-dependencies:
- dependency-name: jspdf
  dependency-version: 4.1.0
  dependency-type: direct:production
- dependency-name: jspdf-autotable
  dependency-version: 5.0.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-07 11:46:11 +00:00
dependabot[bot]
bee0c8e364 Bump lodash from 4.17.21 to 4.17.23 (#4369)
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-22 20:51:03 +01:00
jekkos
849439c71e Fix multiple XSS vulnerabilities (#3965) (#4356) 2025-12-22 17:21:49 +01:00
Chathura Dilushanka
25680f05db Add equals as permitted URI character (#4329)
This should resolve the 400 error when deleting payments with base64 encoded IDs containing `=`.
2025-12-21 22:41:36 +01:00
jekkos
a11fb099e2 Fix travis build after merge (#4130) 2025-12-21 19:51:21 +01:00
BhojKamal
aee5f31cf5 Add show/hide cost price & profit feature - in reports #4130 (#4350)
* Add show/hide cost price & profit feature

* .env should be ignored.

* js code formatted. .vscode folder ignore for vscode user settings.json

* style is replaced with bootstrap class, formatted and .env.example

* toggle button on table to like in other

* comment corrected.

* class re-factored

* minor refactor

* formatted with 4 space

---------

Co-authored-by: Lotussoft Youngtech <lotussoftyoungtech@gmail.com>
2025-12-21 15:23:39 +05:45
jekkos
643b0ac499 Fix for detailed suppliers report (#4351) 2025-12-17 22:46:59 +01:00
jekkos
3e844f2f89 Escape return_policy in receipt + invoice (#4349)
* Escape return_policy in receipt + invoice

* Enable CSRF using session token (#3632)
2025-12-17 20:39:58 +01:00
jekkos
2acdec431f Fix wrong migration script location (#4285) 2025-12-08 23:06:48 +01:00
jekkos
f245f585da Fix creation of date attribute value (#4310) (#4344)
Fix type hints in case search string is empty in sales
2025-12-02 07:19:14 +01:00
jekkos
e48ab45094 Fix toast notifications in config (#4341) (#4343) 2025-11-28 09:01:07 +01:00
jekkos
46e31b1c16 Allow anonymous giftcard creation (#4278)
* Allow giftcard without person (#4276)

* Update giftcard form validation (#4276)
2025-11-24 22:54:52 +01:00
jekkos
bea69c7aa1 Add DOMPurify to JS includes (#4341) 2025-11-23 22:20:40 +01:00
jekkos
30da69a382 Fix attachment cid (#4314)
* Add attachment cid when sending emails (#4308)

Also check if an encryption key is set before decrypting the SMTP
password.

* Upgrade to CI 4.6.3 (#4308)

* Fix for changing invoice id in email (#4308)
2025-11-23 21:37:32 +01:00
jekkos
6dd5a9162f Add DOMpurify + fix XSS (#4341) 2025-11-23 21:35:47 +01:00
jekkos
26a398f7d2 Add recent releases to issue template (#4317) 2025-11-21 23:55:24 +01:00
jekkos
ce73d9bb31 Add env variable to disallow pwd change (#4325) 2025-11-21 23:46:48 +01:00
jekkos
83af580d40 Add server side validation for password (#4335) 2025-11-21 23:45:47 +01:00
jekkos
ca7adf76c1 Update SECURITY.md contact (#4335) 2025-11-21 23:22:39 +01:00
jekkos
832db664e5 Fix tax configuration pages (#4331) 2025-11-21 22:13:35 +01:00
jekkos
36e73a84af Clean up docker compose setup (#4308) 2025-10-27 21:57:12 +01:00
Joe Williams
bcddf482fe [Feature] Add logging to migrations (#4327)
* `execute_script()` now returns a boolean for error handling.

* Added transaction to `Migration_MissingConfigKeys.up()`.

* Added logging to various migrations.

* Added transaction to `Migration_MissingConfigKeys.up()`.

* Added logging to various migrations.

* Formatting and function call fixes

Fixed a minor formatting issue in the migration helper.
Replaced a few remaining error_log() calls.
Updated executeScriptWithTransaction() to use log_message()

* Function call fix

Replaced the last error_log() calls with log_message().

---------

Co-authored-by: Joe Williams <hey-there-joe@outlook.com>
2025-10-19 22:10:28 -07:00
Joe Williams
759356288b Add transactions to missing config keys migration. (#4318)
* `execute_script()` now returns a boolean for error handling.

* Added transaction to `Migration_MissingConfigKeys.up()`.

* Added `executeScriptWithTransaction()` to migration helpers.

* Many changes for testing; also minor formatting fixes.

* Removed test code and pointed the `NullableTaxCategoryId` migration at the right SQL file.

* Fixed header.php

* Code cleanup from code review:
- Added IGNORE to SQL scripts.
- Added try-catch to executeScriptWithTransaction().
- Various comment changes.

* Fixed naming issue

Nullable tax category ID migration now runs the correct script.

* Updated SQL

Replaced INSERT WHERE NOT EXISTS in missing config keys sql script to use a single INSERT IGNORE.

* Updated migration helper

Updated executeScriptWithTransaction to use transRollback

---------

Co-authored-by: Joe Williams <hey-there-joe@outlook.com>
2025-10-15 22:53:14 -07:00
j2272850861-pixel
d1e5575ac1 Translated using Weblate (Portuguese (Brazil))
Currently translated at 100.0% (8 of 8 strings)

Translation: opensourcepos/bootstrap_tables
Translate-URL: https://translate.opensourcepos.org/projects/opensourcepos/bootstrap_tables/pt_BR/
2025-10-10 12:58:48 +02:00
j2272850861-pixel
b3f67a5e0f Translated using Weblate (Portuguese (Brazil))
Currently translated at 100.0% (85 of 85 strings)

Translation: opensourcepos/common
Translate-URL: https://translate.opensourcepos.org/projects/opensourcepos/common/pt_BR/
2025-10-10 12:58:48 +02:00
j2272850861-pixel
41b349134a Translated using Weblate (Portuguese (Brazil))
Currently translated at 100.0% (12 of 12 strings)

Translation: opensourcepos/login
Translate-URL: https://translate.opensourcepos.org/projects/opensourcepos/login/pt_BR/
2025-10-10 12:58:48 +02:00
jekkos
b1f6ae6d35 Fix mount path for uploads (#4308)
Remove duplicated compose sections in nginx version.  We will include
parts of the main file instead of duplicating it here.
2025-08-29 09:12:02 +02:00
dependabot[bot]
4153c69ccd Bump jspdf from 3.0.1 to 3.0.2 (#4309)
Bumps [jspdf](https://github.com/parallax/jsPDF) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](https://github.com/parallax/jsPDF/compare/v3.0.1...v3.0.2)

---
updated-dependencies:
- dependency-name: jspdf
  dependency-version: 3.0.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-29 07:32:54 +02:00
jekkos
87fbd72478 Add generic try/catch in import (#4302) 2025-08-28 00:05:58 +02:00
jekkos
a4ac42b4ad Fix reference to uploads folder (#4270) (#4286) 2025-08-18 21:19:36 +02:00
jekkos
2eff79a8b6 Fix for suspended sales (#4283) (#4303) 2025-08-15 23:12:35 +02:00
Aril Apria Susanto
880fb8faef Translated using Weblate (Indonesian)
Currently translated at 100.0% (327 of 327 strings)

Translation: opensourcepos/config
Translate-URL: https://translate.opensourcepos.org/projects/opensourcepos/config/id/
2025-08-11 10:27:22 +02:00
Aril Apria Susanto
4d2347173b Translated using Weblate (Indonesian)
Currently translated at 100.0% (85 of 85 strings)

Translation: opensourcepos/common
Translate-URL: https://translate.opensourcepos.org/projects/opensourcepos/common/id/
2025-08-11 10:27:22 +02:00
Aril Apria Susanto
82d36d01fb Translated using Weblate (Indonesian)
Currently translated at 100.0% (45 of 45 strings)

Translation: opensourcepos/module
Translate-URL: https://translate.opensourcepos.org/projects/opensourcepos/module/id/
2025-08-11 10:27:22 +02:00