Commit Graph

18 Commits

Author SHA1 Message Date
jekkos
f49d763254 XSS mitigation features (#4041)
* Remove HtmlPurifier calls

- All calls to Services::htmlPurifier()->purify() removed from data received from view.
- Bootstrap and bootswatch bump in package-lock.json

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Customers Controller

- Refactored code for clarity
- Replaced == with === operator to prevent type juggling
- Added Sanitization of Customer data before being sent to the view

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Bump bootstrap-table to 1.23.1

- Bump bootstrap-table to 1.23.1 in attempt to resolve issue with sticky headers
- Sanitize attribute data in tables
- Sanitize item data with controller function.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Minor changes

- Refactored for code clarity.
- Removed extra blank lines.
- Minor reformatting.
- Added PHPdocs
- bumped bootstrap-table to 1.23.2

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

---------

Signed-off-by: objecttothis <objecttothis@gmail.com>
Co-authored-by: objecttothis <objecttothis@gmail.com>
2024-08-26 11:35:56 +04:00
objecttothis
b3b8e7ec1d HTMLPurifier filtering on searches
- Formatting
- Added calls to HTMLPurifier
- Added filtering
- Refactored out variable for clarity

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-06-15 17:19:15 +02:00
objecttothis
ba9bcd7786 PHPdocs
- Added missing PHPdocs
- Corrected Syntax
- Added noinspection parameters to PHPdoc for AJAX called functions
- Added missing function return types
- Added missing parameter types
- Added public keyword to functions without visibility modifier
- Corrected incorrectly formatted PHPdocs
- Added public to constants and functions missing a visibility keyword
2024-06-15 17:19:15 +02:00
objecttothis
7b224be665 PSR compliance and formatting changes
- Replaced TRUE/FALSE constants with true/false keywords
- Replaced NULL constant with null keyword
- Replaced `<?php echo` in views with shortened `<?=`
- Added missing variable declaration
- Added missing function return type in declaration
- replaced `== true`, `== false`, `=== true` and `=== false` in if statements with simplified forms
2024-06-15 17:19:15 +02:00
objecttothis
0754f2f6e6 Fix Request variable retrieval
- getSearch functions to properly retrieve HTTP vars.
- getVar() function calls replaced with getGet() or getPost()
- replaced TRUE/FALSE constants with true/false keywords
2024-06-15 17:19:15 +02:00
objecttothis
48c04417b8 Fixes
- PHP 8.2 deprecates dynamically declared class properties. Adding these declarations removes deprecation warnings and makes the code PHP 8.3 compatible.
- Add Elvis operator to set search string to an empty string when it's value is null to get rid of an error in the search function call.
- Imported class for OSPOS config
- Replaced private with protected in parent controller's property.
- Removed unneeded TODO
- Refactored local variables
- Replaced ternary notation
- Removed unneeded comments
- Removed unneeded class property
- Removed unneeded @property declarations
- Fixed database version
2024-06-15 17:19:15 +02:00
objecttothis
2bb4b7c865 Formatting and naming refactor
- Added `@noinspection PhpUnused` tags to PHPdocs for functions which are called via AJAX.
- removed conversion to array in getResult in favor of returning an array to begin with.
- Refactored variable for clarity.
- declared variable in view coming from controller
- Added PHPdocs
- Refactored nested if/else statements into ternary notation.
- Corrected tab type
- added missing model declaration in view
- Modified query builder to extrapolate out the set() command for clarity
2024-06-15 17:19:15 +02:00
objecttothis
086a90b04d Code fixes
- Added PHPdoc tags for the IDE to ignore unused function inspections on AJAX calls.
- set TRUE, FALSE, NULL to true, false, null for PSR-2,12 compliance
2024-06-15 17:19:15 +02:00
Doug Hutcheson
1a465621e0 Ci4 bugfix string interpolation (#3836)
* CI4: Bugfix string interpolation language files

These are the language files with all placeholders converted to CI4 numbered style eg {0}.

* CI4: Bugfix string interpolation source code files

These are the controllers and views which call lang() with parameters to be interpolated.

* CI4: Bugfix string interpolation shell scripts

These are the Linux bash scripts which use the sed (stream editor) utility to convert earlier forms of placeholders to CI4 numeric type. A number of typographical errors in the original Language files were corrected by these scripts.
2024-06-15 17:19:15 +02:00
Steve Ireland
f5094d62a2 Restore the tables.sql to its virgin state. 2024-06-15 17:19:15 +02:00
Steve Ireland
4798041408 Tack on the void return type onto the Employee:logout method. 2024-06-15 17:19:15 +02:00
objecttothis
8d80f5a261 CI4 bugfixes
- Added session variable instantiation where needed.
- Added tabular helper to autoload
- removed tabular helper reference where no longer needed.
- Remove esc() references where it was causing display problems.
- Remove excess whitespace on blank line
- Remove unecessary using reference
- Make parameters for dinner table functions nullable
2024-06-15 17:19:15 +02:00
objecttothis
ae357cab4a Formatting
- Convert indents to tabs
- Remove unnecessary else statement
- Correct PHPDoc formatting
2024-06-15 17:19:15 +02:00
objecttothis
1dd58e922f Corrected link in README.md 2024-06-15 17:19:15 +02:00
objecttothis
f84b795ee6 Upgrade to CodeIgniter 4.1.3 2024-06-15 17:19:15 +02:00
jekkos
73b189b6d4 Prepare rebase: move files to new folder structure 2024-06-15 17:19:15 +02:00
jekkos
dcb797571e evert "Prepare rebase: move files to new folder structure"
This reverts commit eed0cd1ca0.
2023-05-30 17:52:17 +02:00
jekkos
eed0cd1ca0 Prepare rebase: move files to new folder structure 2023-05-07 15:10:27 +02:00