54 Commits

Author SHA1 Message Date
jekkos
3e844f2f89 Escape return_policy in receipt + invoice (#4349)
* Escape return_policy in receipt + invoice

* Enable CSRF using session token (#3632)
2025-12-17 20:39:58 +01:00
jekkos
6dd5a9162f Add DOMpurify + fix XSS (#4341) 2025-11-23 21:35:47 +01:00
jekkos
832db664e5 Fix tax configuration pages (#4331) 2025-11-21 22:13:35 +01:00
dependabot[bot]
4153c69ccd Bump jspdf from 3.0.1 to 3.0.2 (#4309)
Bumps [jspdf](https://github.com/parallax/jsPDF) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](https://github.com/parallax/jsPDF/compare/v3.0.1...v3.0.2)

---
updated-dependencies:
- dependency-name: jspdf
  dependency-version: 3.0.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-29 07:32:54 +02:00
jekkos
0d1f4efe3c Extended payment delete fix (#4274)
* Create a  Base64 URL-Safe encoding and decoding helper

* Rename web_helper to url_helper

---------

Co-authored-by: El_Coloso <diegoramosp@gmail.com>
2025-07-07 13:57:03 +02:00
BudsieBuds
2fec49e7df Enhance license handling (#4223)
- automate license updates
- license text rendered in monospace font
- removed old bower license generation code
2025-04-19 20:20:50 +02:00
BudsieBuds
1bdc19f14f Convert menu icons to SVG (#4220)
* Convert menu icons to SVG
- replaced png images with svg
- 20% decrease in file size, improving load times
- removed 384 unused files from repo

* Transferred package to organisation
2025-04-18 19:48:19 +02:00
BudsieBuds
fc37848fa7 Add default bootstrap to themes (#4219)
- also update bootstrap
2025-04-16 07:15:27 +02:00
dependabot[bot]
2c9ae36247 Bump jspdf and jspdf-autotable (#4190)
Bumps [jspdf](https://github.com/MrRio/jsPDF) and [jspdf-autotable](https://github.com/simonbengtsson/jsPDF-AutoTable). These dependencies needed to be updated together.

Updates `jspdf` from 2.5.1 to 3.0.1
- [Release notes](https://github.com/MrRio/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](https://github.com/MrRio/jsPDF/compare/v2.5.1...v3.0.1)

Updates `jspdf-autotable` from 3.8.2 to 5.0.2
- [Release notes](https://github.com/simonbengtsson/jsPDF-AutoTable/releases)
- [Commits](https://github.com/simonbengtsson/jsPDF-AutoTable/compare/v3.8.2...v5.0.2)

---
updated-dependencies:
- dependency-name: jspdf
  dependency-type: direct:production
- dependency-name: jspdf-autotable
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 13:03:50 +04:00
dependabot[bot]
69a507f879 Bump canvg from 3.0.10 to 3.0.11 (#4189)
Bumps [canvg](https://github.com/canvg/canvg) from 3.0.10 to 3.0.11.
- [Release notes](https://github.com/canvg/canvg/releases)
- [Changelog](https://github.com/canvg/canvg/blob/v3.0.11/CHANGELOG.md)
- [Commits](https://github.com/canvg/canvg/commits/v3.0.11)

---
updated-dependencies:
- dependency-name: canvg
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 11:40:49 +04:00
objecttothis
e90b5b87da Replace tabs with spaces (#4196)
Signed-off-by: objecttothis <objecttothis@gmail.com>
2025-03-28 21:24:21 +04:00
BudsieBuds
beb18ff96b Random fixes (#4144)
Random fixes in time for the 3.4.0 release.
- corrects typo in the items controller
- small update to login view
- removes deprecated code from header view
- ospos license updated to end 2024
- moved gulp packages to dev dependencies
- updated gulp-zip and npm-check-updates to latest version
- updated readme for consistency
- makes ospos license in config fully readable
- fixes composer libraries license view in config
- gulp now updates composer libraries license and ospos license
- updated other license views in config
2025-01-28 23:48:45 +01:00
objecttothis
28b8ff2ea6 Bump Bootstrap-table to 1.23.5
- This does not resolve #3854 but keeps the version up to date.

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-10-28 22:22:37 +01:00
dependabot[bot]
99530d64e0 Bump micromatch from 4.0.5 to 4.0.8 (#4078)
Bumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8.
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/micromatch/compare/4.0.5...4.0.8)

---
updated-dependencies:
- dependency-name: micromatch
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 13:43:59 +04:00
dependabot[bot]
1662ef5856 Bump braces from 3.0.2 to 3.0.3 (#4077)
Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3.
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/braces/compare/3.0.2...3.0.3)

---
updated-dependencies:
- dependency-name: braces
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 13:43:17 +04:00
dependabot[bot]
07ee353113 Bump dompurify from 2.5.1 to 2.5.6 (#4057)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 2.5.1 to 2.5.6.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/2.5.1...2.5.6)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 13:37:28 +04:00
jekkos
f49d763254 XSS mitigation features (#4041)
* Remove HtmlPurifier calls

- All calls to Services::htmlPurifier()->purify() removed from data received from view.
- Bootstrap and bootswatch bump in package-lock.json

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Customers Controller

- Refactored code for clarity
- Replaced == with === operator to prevent type juggling
- Added Sanitization of Customer data before being sent to the view

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Bump bootstrap-table to 1.23.1

- Bump bootstrap-table to 1.23.1 in attempt to resolve issue with sticky headers
- Sanitize attribute data in tables
- Sanitize item data with controller function.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Minor changes

- Refactored for code clarity.
- Removed extra blank lines.
- Minor reformatting.
- Added PHPdocs
- bumped bootstrap-table to 1.23.2

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

---------

Signed-off-by: objecttothis <objecttothis@gmail.com>
Co-authored-by: objecttothis <objecttothis@gmail.com>
2024-08-26 11:35:56 +04:00
objecttothis
e1f8b73005 Add check to migration to prevent errors (#4032)
* Add check to migration

- Only drop the constraint if it exists.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Automatic bump of package-lock.json

Signed-off-by: objecttothis <objecttothis@gmail.com>

---------

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-07-27 00:08:49 +04:00
jekkos
8f52e283bb Add gulp compress task (#3916) 2024-06-15 17:19:15 +02:00
jekkos
2fdddbc043 Revert gulp downgrade (#3909) 2024-06-15 17:19:15 +02:00
jekkos
75b00be637 Upgrade jspdf (#3909) 2024-06-15 17:19:15 +02:00
objecttothis
1bc3d141e9 Bump npm dependencies
- Revert jspdf and jspdf-autotable bump due to problems caused in npm run build
- Correct gulpfile for fixed reference.
- Reverted chartist dependency changes since it broke the build.

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-06-15 17:19:15 +02:00
objecttothis
2985b8c6ae Bump npm dependencies
- Revert jspdf and jspdf-autotable bump due to problems caused in npm run build
- Correct gulpfile for fixed reference.
- Reverted chartist dependency changes since it broke the build.

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-06-15 17:19:15 +02:00
objecttothis
87b4526078 Bump npm dependencies
- bootstrap-tagsinput-2021 replaced bootstrap-tagsinput because the latter has vulnerabilities.
- Chartist and addons bumped to attempt to resolve issues with graphical reports.
- jspdf and addons bumped due to vulnerabilities.  It's still be broken however.

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-06-15 17:19:15 +02:00
objecttothis
c1c2e9df77 Bumped bootstrap-table to 1.22.4 2024-06-15 17:19:15 +02:00
jekkos
fba33ed995 Update packaga-lock.json (#3923) 2024-06-15 17:19:15 +02:00
objecttothis
cb1b269d7a Datepicker fixes
- Updated datepicker_locale.php to prevent array/string conversion.
- changed bootstrap-datepicker_locale version in package.json to specify which version.
- Changed bootstrap-table back to latest since the github commit did not resolve the issue.
2024-06-15 17:19:15 +02:00
jekkos
09bf4d2f31 Update npm dependencies (#3909) 2024-06-15 17:19:15 +02:00
jekkos
7523c0fed8 Fix bstables to commit ca85b98 2024-06-15 17:19:15 +02:00
jekkos
0669428026 Bump bstables (#3854) 2024-06-15 17:19:15 +02:00
objecttothis
47341f1a07 Bump tableexport.jquery.plugin
- New version 1.28.0
2024-06-15 17:19:15 +02:00
objecttothis
05d39ff896 Attempts at correcting problem with JSPDF 2024-06-15 17:19:15 +02:00
objecttothis
ae44e38855 Dependencies
- Updated bootstrap-table
- Updated jquery
- Refactored local variable name
- fixed problem with null being sent on no filters
- fixed incorrect reference in view of variables
2024-06-15 17:19:15 +02:00
objecttothis
f662f45bf7 bootstrap-table
- Updated dependency
- Added XLSX format to export formats.
2024-06-15 17:19:15 +02:00
objecttothis
0de0f3ec89 bump bootstrap5
- bootstrap5 to 5.3.2
- bootswatch5 to 5.3.2
2024-06-15 17:19:15 +02:00
objecttothis
aa5bfd9b18 bump readable-stream to 4.4.2 2024-06-15 17:19:15 +02:00
objecttothis
3536454638 bump gulp-debug to 5.0.1 2024-06-15 17:19:15 +02:00
objecttothis
08f1318268 bump npm-check-updates to 16.14.6 2024-06-15 17:19:15 +02:00
jekkos
b4d117011a Add CI4 language migration scripts (#3468) 2024-06-15 17:19:15 +02:00
Steve Ireland
2e06f89724 This revises the build process to handle grunt components requiring two versions of grunt. The new BUILD.md file documents the changes. 2024-06-15 17:19:15 +02:00
objecttothis
ae357cab4a Formatting
- Convert indents to tabs
- Remove unnecessary else statement
- Correct PHPDoc formatting
2024-06-15 17:19:15 +02:00
objecttothis
1dd58e922f Corrected link in README.md 2024-06-15 17:19:15 +02:00
objecttothis
b4f0aaa587 Porting 5669dff 2024-06-15 17:19:15 +02:00
jekkos
7c87ac6f60 Bump to 3.3.9 2023-11-06 09:55:29 +01:00
dependabot[bot]
eacd7d1f07 Bump mout and grunt-wiredep (#3651)
Bumps [mout](https://github.com/mout/mout) to 1.2.4 and updates ancestor dependency [grunt-wiredep](https://github.com/stephenplusplus/grunt-wiredep). These dependencies need to be updated together.


Updates `mout` from 0.9.1 to 1.2.4
- [Release notes](https://github.com/mout/mout/releases)
- [Changelog](https://github.com/mout/mout/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mout/mout/compare/v0.9.1...v1.2.4)

Updates `grunt-wiredep` from 2.0.0 to 3.0.1
- [Release notes](https://github.com/stephenplusplus/grunt-wiredep/releases)
- [Commits](https://github.com/stephenplusplus/grunt-wiredep/compare/v2.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: mout
  dependency-type: indirect
- dependency-name: grunt-wiredep
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-06 09:17:22 +04:00
dependabot[bot]
702d0c773c Bump http-cache-semantics and npm (#3645)
Removes [http-cache-semantics](https://github.com/kornelski/http-cache-semantics). It's no longer used after updating ancestor dependency [npm](https://github.com/npm/cli). These dependencies need to be updated together.


Removes `http-cache-semantics`

Updates `npm` from 6.14.15 to 9.4.1
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](https://github.com/npm/cli/compare/v6.14.15...v9.4.1)

---
updated-dependencies:
- dependency-name: http-cache-semantics
  dependency-type: indirect
- dependency-name: npm
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-06 06:48:46 +04:00
dependabot[bot]
6c7ff029d3 Bump debug and grunt-contrib-watch (#3625)
Bumps [debug](https://github.com/debug-js/debug) to 3.2.7 and updates ancestor dependency [grunt-contrib-watch](https://github.com/gruntjs/grunt-contrib-watch). These dependencies need to be updated together.


Updates `debug` from 0.7.4 to 3.2.7
- [Release notes](https://github.com/debug-js/debug/releases)
- [Commits](https://github.com/debug-js/debug/compare/0.7.4...3.2.7)

Updates `grunt-contrib-watch` from 0.5.3 to 1.1.0
- [Release notes](https://github.com/gruntjs/grunt-contrib-watch/releases)
- [Changelog](https://github.com/gruntjs/grunt-contrib-watch/blob/main/CHANGELOG)
- [Commits](https://github.com/gruntjs/grunt-contrib-watch/compare/v0.5.3...v1.1.0)

---
updated-dependencies:
- dependency-name: debug
  dependency-type: indirect
- dependency-name: grunt-contrib-watch
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-06 06:41:44 +04:00
jekkos
ffe49278fc Bump to 3.3.8 2022-08-03 08:50:41 +02:00
dependabot[bot]
7e3d048bfc Bump grunt from 1.5.2 to 1.5.3
Bumps [grunt](https://github.com/gruntjs/grunt) from 1.5.2 to 1.5.3.
- [Release notes](https://github.com/gruntjs/grunt/releases)
- [Changelog](https://github.com/gruntjs/grunt/blob/main/CHANGELOG)
- [Commits](https://github.com/gruntjs/grunt/compare/v1.5.2...v1.5.3)

---
updated-dependencies:
- dependency-name: grunt
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-05-26 09:47:02 +02:00
dependabot[bot]
19342e4d6f Bump simple-get from 3.1.0 to 3.1.1
Bumps [simple-get](https://github.com/feross/simple-get) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/feross/simple-get/releases)
- [Commits](https://github.com/feross/simple-get/compare/v3.1.0...v3.1.1)

---
updated-dependencies:
- dependency-name: simple-get
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-29 18:36:35 +02:00