- Add static getParsedFile() helper that caches include-based
file parses per file path
- Replace repeated `include $file` calls in
testLanguageFile_ParsesToArray, key-matching, and key-sorting
tests with calls to the cached helper
- Avoid redundant file includes/parsing when the same language
file is loaded across multiple test methods, speeding up the
test suite
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Remove 'integrations' and 'integrations_configuration' (and
'plugins'/'plugins_configuration' in ckb) entries from Config.php
across all language files under app/Language/*.
- Dead keys no longer referenced in UI, dropped repo-wide for
consistency across locales (ar-EG, ar-LB, az, bg, bs, ckb, cs,
da, de-CH, de-DE, el, en-GB, en, es-ES, es-MX, fa, fr, and others)
- Keeps all language Config.php files structurally in sync
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Resolve language-file conflicts by taking master's English-removal
cleanup across non-English locales, while stripping the MailChimp
keys master reintroduced (already moved to MailchimpPlugin on this
branch) and reapplying this branch's plugins/integrations rename and
new Module.php plugins keys where master lacked them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Replace untranslated English strings with empty fallback ('') across all non-English catalogs and sort keys alphabetically (closes#4783, closes#4660)
- Restore missing Sales.no_sales_to_display in English while preserving existing translations (closes#4794, references #4637, #4795)
- Register Georgian (ka) and Swahili (sw-KE, sw-TZ) locales, normalize Croatian to hr per BCP 47, and fix datepicker long month keys (partially addresses #4476, references #3891)
- Hardcode invariant brand constants (OSPOS, website, copyrights) in login/footer views, remove from catalogs, and standardize Latin OSPOS branding
- Fix English catalog typos and maintain consistent British English variants in en-GB
- Add LanguageFilesTest with 4,418 automated tests for syntax, key parity, sorting, and bidirectional locale registrations
- Update AGENTS.md with localization guidelines and development best practices
- Dockerfile: use rolling php:8.2-apache with expose_php = Off.
- Dockerfile: validate runtime against composer.lock at build boundary via BuildKit composer check-platform-reqs.
- Dockerfile: enforce least-privilege permissions (root:www-data 0640 files, 0750 dirs), restricting write access to writable/ and public/uploads.
- dockerignore: include composer.json and composer.lock in build context for platform validation.
- CI: remove redundant bash version checks across workflows; enforce fresh upstream base via pull: true in build-release.yml.
- Docs & Changelog: remove security advisory identifiers while preserving minimum patch levels.
getEdit, postDelete, getReceipt, and postSave all accept a
user-controlled receiving_id and previously only checked the class-level
receivings module grant. This allowed any employee with basic receiving
permissions to read, modify, or delete historical receiving records
belonging to other employees.
Add reports_receivings permission checks to all four per-record
endpoints, following the same pattern as Sales (PR #4627).
* fix(sales): allow gift card credit for returns + surface errors
- Add incrementGiftcardValue() to Giftcard model for crediting cards
- In Sale::save_value(), use incrementGiftcardValue() for returns
with negative gift card payments (credits the card)
- Add error_message rendering to register view so failed completions
show the error instead of silently reloading
Fixes#4779
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(migrations): prevent concurrent runs with pessimistic DB lock
Adds GET_LOCK/RELEASE_LOCK around the migration sequence so a second
request (page refresh, double-click, supervisor retry) cannot re-trigger
the same migration while the first is still executing. Also adds
ignore_user_abort(true) so a client disconnect does not tear down the
PHP process mid-migration.
Fixes#4763
Introduce a CashupAmounts transfer object and break down large Cashups
controller methods into focused private helpers. Includes a breaking
change to constructor parameter order.
- Add CashupAmounts (TransferObjects/Cashups) to bundle open/transfer/
closed cash, due, card, and check amounts; reorder constructor params
to cash-before-due sequence
- Replace positional _calculate_total() with calculateTotal(CashupAmounts),
eliminating argument-order errors
- Decompose getView() into buildEmployeeLookup(), normalizeCashupInfo(),
initializeNewCashup(), isPendingClose(), closeCashup(),
buildReportDateRangeInputs(), applyPaymentTotals(), subtractCashExpenses()
- Decompose postSave() with parseCashupDate() and getCashupAmountsFromPost()
helpers; update both CashupAmounts call sites to new param order
- Rename snake_case vars/params to camelCase throughout Cashups controller
- Drop stale TODO comments in OSPOS.php and Cashups::getIndex filter block
- Scope escape => false to cashup_headers() note column rather than a
broad regex exclusion in transform_headers()
- Add CashupFixtureTrait and ExpenseFixtureTrait under tests/Support;
tighten cashup view test to assertSeeInField on specific form fields
BREAKING CHANGE: CashupAmounts constructor positional argument order
changed — closedAmountCash now precedes closedAmountDue; any callers
passing positional args must swap those two arguments.
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
When a customer is selected after items are already in the cart,
apply_customer_discount() set the discount value and recomputed totals
using the customer's discount type, but never updated the line's
discount_type field. get_totals() later recomputes from the line's
discount_type (still the store default), producing wrong totals.
Fixes#4778
- Extend composer.json and composer.lock PHP requirement to include PHP 8.5
- Add PHP 8.5 to test matrix in phpunit.yml and main.yml workflows
- Modernize php-linter.yml to use setup-php@v2 with parallel matrix for PHP 8.2–8.5
- Propagate PHP 8.2 lint failures via shell loop in find -exec + while retaining batching for 8.3–8.5
- Add permissions: contents: read and cancel-in-progress concurrency to php-linter.yml
- Remove obsolete Node.js and npm install steps from phpunit.yml
- Update phpunit.yml runner to ubuntu-latest and composer cache action to v4
- Address PHP 8.5 deprecations and syntax:
- Replace deprecated switch-case semicolon with standard colon in app/Config/Database.php
- Replace non-standard (double) cast with (float) in app/Libraries/Token_lib.php
- Remove obsolete curl_close() calls in app/Config/Validation/OSPOSRules.php and app/Libraries/Mailchimp_lib.php
- Update INSTALL.md, workflows README, and bug report issue template to include PHP 8.5
Replace hardcoded string concatenation of the app name and version in the
document <title> with named-placeholder interpolation, consistent with the
existing Common.migration_needed pattern.
- header.php passes ['OSPOS', application_version] as the lang() array
argument instead of concatenating values around the translation
- All 46 Common.php locale files convert powered_by to a named-placeholder
template, preserving current rendered output while allowing each locale
to reorder the app name and version as needed
- hy, ml, nb, and ur leave powered_by empty so MY_Language::getLine()
falls back to English rather than rendering bare placeholder strings
- de-CH powered_by translated to German
- Codify named-placeholder + ICU MessageFormat as the localization standard
in the agents documentation
build/refactor/fix: tighten tooling, rename accessors to camelCase, and correct model bugs
* build: tighten gitignore, lockfile, and script config
- gitignore /build and /.php-cs-fixer.cache
- allow core-js@3.50.0 postinstall script in package.json
* refactor: rename snake_case data accessors to camelCase
Rename get_info, get_multiple_info, get_sale_items, get_sale_payments,
and save_customer across Customer, Employee, Item, Sale, and Supplier
models to PSR-12 camelCase, updating every call site in controllers,
libraries, and views.
* test: update calls to match renamed camelCase accessors
Update HomeTest, ItemsControllerTest, and ItemTest to call
getInfo()/getMultipleInfo() instead of the old snake_case model methods.
* fix: correct independent bugs in Item, Item_taxes, and Attribute models
- Item::delete()/delete_list(): let $this->db->transStatus() alone decide
success instead of accumulating a bitwise-AND over intermediate results,
which could report failure (and trigger error toasts) even when the
delete had actually completed
- Item_taxes: correct $table property from 'item_taxes' to 'items_taxes'
- Attribute::getDefinitionNames(): pass an array to
QueryBuilder->whereNotIn(), which requires one
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Rename core migration 20260627000000_PluginMigrationsTableCreate to
20261026000000_PluginConfigTableCreate, merging plugin_migrations
table creation into the same SQL script as plugin_config and adding
a startup log message; down() now drops both tables.
- Consolidate the plugin_migrations CREATE TABLE statement into
3.5.0_PluginConfigTableCreate.sql and remove the now-redundant
3.5.1_PluginMigrationsTableCreate.sql script.
- Update app/Plugins/README.md reference to the renamed migration
class.
- Add WhatsAppPlugin migration CreateWhatsAppMessagesTable to create
the whatsapp_messages conversation log table (utf8mb4, unique
wa_message_id to dedupe webhook redelivery); dropped explicitly by
WhatsAppPlugin::uninstall() instead of a down() method.
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Map plugin.svg source icon to plugins.svg in MENUBAR_ICONS list
so build pipeline generates correct icon for plugins menu item.
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
- Fix broken array/method chain in debug-js task where a stray
string concatenation left `.pipe(rev()).pipe(gulp.dest(...))`
embedded inside the file list array instead of after it
- Close file list array properly after plugin_data_helper.js entry
so the pipeline methods run once, after the array is complete
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Drop verified-unused keys from Sales.php across all locales to reduce
translation burden. Retained:
- invoice_type_* keys (referenced by Sale_lib)
- rewards_package key (built dynamically by register.php)
Fixes#4586
Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
MailchimpConnector called curl_close($ch) immediately after
curl_exec, before checking curl_errno/curl_error on failure.
Closing the handle early invalidates it for any subsequent
curl_getinfo/curl_error calls that rely on the handle.
- Drop curl_close call in MailchimpConnector.php so the handle
stays valid through error inspection; connector is responsible
for closing it later where appropriate
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Refactor Stock_location model to camelCase naming and introduce
is_default and sort_order fields with full migration, UI, and
item-sync support. Multiple follow-up fixes consolidated.
Database
- Add is_default (TINYINT, backfilled to oldest non-deleted row) and
sort_order (nullable unsigned TINYINT unique, dense 0..N-1) columns
via new migration; MySQL 5.7-compatible backfill using user variables
instead of ROW_NUMBER(); down() drops both columns
Model
- Rename show_locations → showLocations (camelCase convention)
- Add getDefaultLocationId(), setDefaultLocation(), saveSortOrder();
validate location existence before setting as default
- delete() compacts sort_order via two-pass CASE update to avoid
collisions after prior reorders
- Atomic sort_order assignment via explicit SQL COUNT query
Controller / Config
- Modularize save logic into sanitizeSubmittedLocations(),
deleteRemovedLocations(), saveSubmittedLocations(),
saveLocationOrderAndDefault(); wrap in single transaction
- Support stock_location_new inputs for new-row creation
- Resolve new-* ID placeholders to real IDs post-save
- Abort loop on save failure; default missing POST arrays to []
- Validate that at least one location array is non-empty
Views
- Add Default column with center-aligned radio buttons; disable for
unsaved rows; use attr() instead of data() for location IDs
- Escape dynamic location IDs against XSS in all affected partials
- form_count_details.php: fall back to default location when current
is undefined; guard quantity input similarly
- Add aria-label to default radio inputs
Libraries / Items
- Widen Item_lib::get_item_location() and get_stock_destination() to
nullable return types
- Guard null location_id in Items::getRow() and getGenerateBarcodes()
- Item::get_multiple_info(): accept ?int $location_id; short-circuit
with where('item_id', -1) instead of always-false where('1','0')
i18n
- Add stock_location_default, stock_location_default_header,
stock_location_name_header across all locale files
Tests
- Stock_locationTest: getDefaultLocationId, setDefaultLocation,
saveSortOrder, delete compaction, saveValue; rename to
testMethod_Scenario convention
- Add ConfigControllerTest / StockLocationsControllerTest with
AdminAuthTrait covering CRUD, reorder, default assignment, and
malformed/empty/blank payload validation
- DatabaseBootstrapTrait-based setup for ItemTest and Stock_locationTest
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove Georgian (ka) locale entries for mailchimp integration
strings that are no longer referenced in the app.
- app/Language/ka/Config.php: drop mailchimp_* config labels
- app/Language/ka/Customers.php: drop mailchimp_activity_*,
mailchimp_info, mailchimp_member_rating, mailchimp_status,
mailchimp_vip entries
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
Resolve language file conflicts: take master's translations, strip
MailChimp phrases (MailChimp is now a plugin instead of core), and
retain plugin-system additions (plugins/plugins_configuration keys).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
objecttothis