Adds DatabaseBootstrapTrait and OsposConfigFixtureTrait to replace
duplicated per-file setUp()/tearDown() bootstrap and OSPOS config mock
boilerplate across test classes, bringing them in line with the
ItemsControllerTest gold-standard shape.
Fixes the real root cause of tabular_helperTest's suite-order-dependent
failure: dropAllForeignKeyConstraints()/foreignKeyExists()/
dropColumnIfExists() temporarily blank the shared connection's DBPrefix
via overridePrefix() but never restored it if the query between the two
calls threw (e.g. migration_helperTest's mocked-failure tests) -
permanently corrupting prefixed table lookups for the rest of the
process. Wrapped each in try/finally. Also widens executeScript() to
accept an explicit connection so migration SQL can't silently run
against the wrong DB group.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
These landed on master by accident via a local branch that was
mistakenly created tracking OpensourcePOS/master directly, rather than
pushed as its own branch. Reverting to restore master to its prior
state; the reverted work will come back through a proper PR instead.
This reverts commit 00bf4cb8af.
This reverts commit 37cc1b15e7.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Adds DatabaseBootstrapTrait and OsposConfigFixtureTrait to replace
duplicated per-file setUp()/tearDown() bootstrap and OSPOS config mock
boilerplate across test classes, bringing them in line with the
ItemsControllerTest gold-standard shape.
Fixes the real root cause of tabular_helperTest's suite-order-dependent
failure: dropAllForeignKeyConstraints()/foreignKeyExists()/
dropColumnIfExists() temporarily blank the shared connection's DBPrefix
via overridePrefix() but never restored it if the query between the two
calls threw (e.g. migration_helperTest's mocked-failure tests) -
permanently corrupting prefixed table lookups for the rest of the
process. Wrapped each in try/finally. Also widens executeScript() to
accept an explicit connection so migration SQL can't silently run
against the wrong DB group.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Per the project's policy of treating security advisory IDs as
secret-like, remove the identifiers embedded in source/test comments
and CHANGELOG entries. Each keeps its human-readable description (and
PR number where present), so traceability is preserved. No logic changes.
fix(reports, home): strengthen method grant validation and URI decoding (#4660)
- Reports, Home: fix URI decoding in hasGrant() method checks to use
urldecode consistently, preventing malformed URI segments from
bypassing access controls
- Reports: rename snake_case variables to camelCase for PSR-12 compliance
- Reports: adjust access checks to accurately handle null submodule IDs
Tests:
- Add grant check tests for encoded URI inputs across Reports and Home
- Add test case for employee access with base reports grant
- Add secondary grant check for reports_customers in relevant test cases
- Confirm logout bypass remains functional and properly controlled
- Refactor TestDatabaseBootstrapSeeder to expose static reset() for
per-class DB re-initialization instead of only via seeder run()
- Standardize session handling, setup logic, and boolean declarations
- Use unique data in test helpers to avoid collisions
- Add docblocks to ReportsControllerTest and HomeTest for PSR-5 compliance
- Add exception handling for failed employee creation in test setup
- Wrap password validation test in try-finally to guarantee state cleanup
Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
- Non-admin employees can no longer view/modify admin accounts
- Non-admin employees can no longer delete admin accounts
- Non-admin employees can only grant permissions they themselves have
- Added is_admin() and can_modify_employee() methods to Employee model
- Prevents privilege escalation via permission grants
Add tests for BOLA fix and permission delegation
- EmployeeTest: Unit tests for is_admin() and can_modify_employee() methods
- EmployeesControllerTest: Test cases for authorization checks (integration tests require DB)
- ReportsControllerTest: Test validating the constructor redirect fix pattern
Fix return type error in Employees controller
Use $this->response->setJSON() instead of echo json_encode() + return
to properly satisfy the ResponseInterface return type.
