Commit Graph

47 Commits

Author SHA1 Message Date
jekkos
f49d763254 XSS mitigation features (#4041)
* Remove HtmlPurifier calls

- All calls to Services::htmlPurifier()->purify() removed from data received from view.
- Bootstrap and bootswatch bump in package-lock.json

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Customers Controller

- Refactored code for clarity
- Replaced == with === operator to prevent type juggling
- Added Sanitization of Customer data before being sent to the view

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Bump bootstrap-table to 1.23.1

- Bump bootstrap-table to 1.23.1 in attempt to resolve issue with sticky headers
- Sanitize attribute data in tables
- Sanitize item data with controller function.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Minor changes

- Refactored for code clarity.
- Removed extra blank lines.
- Minor reformatting.
- Added PHPdocs
- bumped bootstrap-table to 1.23.2

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Pre-view filtering Items Controller

- Refactored code for clarity
- Created and called sanitization functions.
- Sanitize TEXT type Attributes before being sent to the view.

Signed-off-by: objecttothis <objecttothis@gmail.com>

* Sanitize Item data

- Sanitize category and item_number before display in forms.
- refactor check in pic_filename for empty to be best practices compliant.
- Added TODO

Signed-off-by: objecttothis <objecttothis@gmail.com>

---------

Signed-off-by: objecttothis <objecttothis@gmail.com>
Co-authored-by: objecttothis <objecttothis@gmail.com>
2024-08-26 11:35:56 +04:00
Steve Ireland
05538570ec Supplementing issue #3997, this change allows the discount amount to be deleted by the user (instead of needing to enter a zero). 2024-07-26 21:36:19 +02:00
BudsieBuds
c39b733c90 Language fallback improvement
- Changes for following best practice for CI4 localization
- Norwegian and Urdu languages now working again
- Sort languages by alphabet in config
2024-06-15 17:19:15 +02:00
objecttothis
1328b4d9b8 - Removed TODOs that had been completed
- Added TODO where we need to convert to querybuilder
- Converted to switch statement.
- Removed unnecessary local variable
- Replaced Qualifiers with imports
- Replaced isset() call with null coalescing operator
- Replaced strpos function calls in if statements with str_contains calls
- Removed unnecessary leading \ in use statement
- Replaced deprecated functions
- Updated PHPdocs to match function signature
- Added missing type declarations
- Made class variables private.
- Explicitly declared dynamic properties
- use https:// links instead of http://
- Fixed type error from sending null when editing transactions
- Fixed Search Suggestion function name in Employees, Persons, Suppliers controller
- Fixed function name on Receivings Controller

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-06-15 17:19:15 +02:00
objecttothis
68d3482065 Attribute item form and decimal fixes
- Updated formatting to reflect standard
- Wrapped Decimal type in to_decimals() function for localization
- Fixed function name
- Removed unneeded TODO
- Fixed problems with sales register not receiving decimals with comma for separator properly.

Signed-off-by: objecttothis <objecttothis@gmail.com>
2024-06-15 17:19:15 +02:00
objecttothis
6d37414444 Removed escaping 2024-06-15 17:19:15 +02:00
objecttothis
a6b674e995 Barcode & escaping
- Removed overflow-visible as it is not needed.
- Bumped TamTamChik/nameCase to latest.
- Workaround to prevent nameCase from capitalizing the first letter of html entities
- Autoload security_helper.php
- Develop means of escaping outputs without encoding characters we don't want encoded.
- proof of concept in form_basic_info.php
2024-06-15 17:19:15 +02:00
objecttothis
e327bb3780 Suppliers Fixes
- Added html_entity_decode() to outputs which had been html encoded
- Added escaping of direct data from the database.
2024-06-15 17:19:15 +02:00
objecttothis
68d6479f0d Decimal changes
- Format percentage per locale rules
- Format sequence as integer, not per quantity rules
- Minor formatting changes
2024-06-15 17:19:15 +02:00
objecttothis
7356500d86 - Fixed missing call to helper and helper function
- Format percentage per locale rules
- Moved constants to Constants.php
- Added PHPdoc comments
- Refactor code for clarity and simplicity.
- Added decimal formatting per locale for display.
- autoload locale helper
- Remove unneeded calls to helpers
- Removed unneeded comments
- fixed errors causing checks in parse_decimals to return false due to locales which use a comma.
2024-06-15 17:19:15 +02:00
objecttothis
61cc93ab57 Updated helper
- Removed TODO which is already a github issue (https://github.com/opensourcepos/opensourcepos/issues/3833)
- Removed call to auto_detect_line_endings which was deprecated in php 8.1. This only negatively affects files created using macOS 9 or earlier which had an EOL in 2002.
- Updated PHPdoc comments
- Removed unnecessary comments
2024-06-15 17:19:15 +02:00
Doug Hutcheson
c01b514596 ci4-bugfix further corrections for lang calls
These files have been patched to correct anomalies in the calls to lang().
2024-06-15 17:19:15 +02:00
jekkos
33a6356cc4 Create backup folder if it does not exist (#3826) 2024-06-15 17:19:15 +02:00
objecttothis
29d0703426 Fixed report error
- can_show_report() was returning an unexpected value.
2024-06-15 17:19:15 +02:00
objecttothis
cc58cecff0 Compatibility changes
- Removed `mixed` function return type from some functions for backward compatibility with php 7.4
- Refactored string concatination for readability.
- Added TODO for later
- Corrected PHPdocs
- Removed unneeded TODO
- Refactored function names with mixed snake and pascal case names
2024-06-15 17:19:15 +02:00
objecttothis
ba9bcd7786 PHPdocs
- Added missing PHPdocs
- Corrected Syntax
- Added noinspection parameters to PHPdoc for AJAX called functions
- Added missing function return types
- Added missing parameter types
- Added public keyword to functions without visibility modifier
- Corrected incorrectly formatted PHPdocs
- Added public to constants and functions missing a visibility keyword
2024-06-15 17:19:15 +02:00
objecttothis
4a23adbb2f Corrected Function call
- setAttribute() expects the second parameter to be an int or float. setTextAttribute() resolves this.
- Added TODO
2024-06-15 17:19:15 +02:00
objecttothis
2245aacf81 Refactoring
- Minor formatting fix
- Refactored function name for clarity
- Corrected name of route
2024-06-15 17:19:15 +02:00
objecttothis
7b224be665 PSR compliance and formatting changes
- Replaced TRUE/FALSE constants with true/false keywords
- Replaced NULL constant with null keyword
- Replaced `<?php echo` in views with shortened `<?=`
- Added missing variable declaration
- Added missing function return type in declaration
- replaced `== true`, `== false`, `=== true` and `=== false` in if statements with simplified forms
2024-06-15 17:19:15 +02:00
objecttothis
48c04417b8 Fixes
- PHP 8.2 deprecates dynamically declared class properties. Adding these declarations removes deprecation warnings and makes the code PHP 8.3 compatible.
- Add Elvis operator to set search string to an empty string when it's value is null to get rid of an error in the search function call.
- Imported class for OSPOS config
- Replaced private with protected in parent controller's property.
- Removed unneeded TODO
- Refactored local variables
- Replaced ternary notation
- Removed unneeded comments
- Removed unneeded class property
- Removed unneeded @property declarations
- Fixed database version
2024-06-15 17:19:15 +02:00
objecttothis
6074d984ed Code fixes
- Replaced ternary notation with null coalescing version.
- Removed unnecessary semi-colon
- Replaced `<? echo` with short echo ``<?=`
- declared stay_open explicitly with `let`
- Updated PHPdocs
- Replaced force_download() from the CI3 download helper with CI4 version
- Removed unneeded using statements
- added needed call to db_connect()
- Removed parameter that matches the default value since it's redundant.
2024-06-15 17:19:15 +02:00
objecttothis
405583c832 Attributes fixes and warning removal
- when the payments array was folded into sale_data there was an earlier payments[] reference in the foreach loop that didn't get folded in.
- Update PHPdoc
- Added ::class to remove polymorphic call warning
- Removed unreachable 'break;' statement after return statement.
- Added missing return type
- fixed missing assignment of mailchimp_api_key
2024-06-15 17:19:15 +02:00
objecttothis
e5dcdd5970 Attributes queries fixes
- Minor formatting fixes
- Adding back bitwise equals into query using RawSql()
- Corrected GET method to POST
- Removed if statement causing no attribute values
- Removed param in get() from CI3
- Changed setAttribute to setTextAttribute
- Replaced NULL constant with null keyword PSR-2,12
- Replaced TRUE/FALSE constants with true/false keywords PSR-2,12
- explicit cast to get rid of deprecation warning
2024-06-15 17:19:15 +02:00
objecttothis
af21beb19e Resolve issue with item_pics
- item_pics were being escaped by bootstrap-table
2024-06-15 17:19:15 +02:00
objecttothis
2601fbb7b0 Formatting fixes
- Removed TODOs
- String Interpolation
- Changed quotes in html to match the rest of code
2024-06-15 17:19:15 +02:00
objecttothis
e8e3073553 - Converted statement to ternary notation for readability
- Removed space
- Removed TODO
- Added TODO
2024-06-15 17:19:15 +02:00
objecttothis
aa5fd5d0aa Fixed Thumbnail Generation Endpoint
- String interpolation
- Removed TODO
- Reworked thumbnail creation for CI4
- Corrected capitalization in calling function URL
- Added send() to return the HTTP response
2024-06-15 17:19:15 +02:00
objecttothis
74210bead5 Bump to allow php 8.1 2024-06-15 17:19:15 +02:00
jekkos
b4d117011a Add CI4 language migration scripts (#3468) 2024-06-15 17:19:15 +02:00
Edwin Smith
af51e4c735 Clean up work on reports listing view and lang() methods (#3707)
* reworked reports and listing page to handle lang() functions in CI_4

* removed old methods

* update code style

* updated bracket style

---------

Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
2024-06-15 17:19:15 +02:00
Doug Hutcheson
310585d8af CI4: Bugfix - add function to remove .env.bak issue #3826
Added function remove_backup() to security_helper.php. Added a call to this from the two places that call check_encryption where the backup is created. Added more defensive code to Config.php to ensure the encrypter  objectexists before it is called to avoid a crash.
2024-06-15 17:19:15 +02:00
Doug Hutcheson
9b86ddaac0 CI4: string interpolation changes (#3811)
* Initial setup in a new environment

The result of running the npm build and editing the .env file

* Revert "Initial setup in a new environment"

This reverts commit 23e06dea7f.

* Language interpolation update

I have edited all the interpolations in the en-US tree. To be consistent in using named parameters and not just positional numbers, I also edited the relevant lines in two controllers (Sales.php and Items.php) to send named variables to the lang() calls. The language string 'Sales.invoice_number_duplicate' contains an interploation for 'invoice_number'. This is sent when used by Controllers/Sales.php, but not sent when used by Views/sales/form.php, which means that string will contain a double space where the invoice number should be. The language string 'Customers.csv_import_partially_failed' contains no interpolations but two parameters are not being sent where it is used by Controllers/Customers.php. The string appears to be a near duplicate of 'Items.csv_import_partially_failed' which contains two interpolations. Either the Customers controller needs to be edited, or the Customers language string needs to be revised to look like the Items string.

---------

Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>
2024-06-15 17:19:15 +02:00
Steve Ireland
477ceb2317 In Token_lib change App\Models\tokens\Token to App\Models\Tokens\Toke 2024-06-15 17:19:15 +02:00
Steve Ireland
f5094d62a2 Restore the tables.sql to its virgin state. 2024-06-15 17:19:15 +02:00
Steve Ireland
4798041408 Tack on the void return type onto the Employee:logout method. 2024-06-15 17:19:15 +02:00
Steve Ireland
13a14ec310 Remove grunt045 from zipped opensourcepos file. Also fix the call to array_walker since the parameters (even if not used) are validated in PHP 8. 2024-06-15 17:19:15 +02:00
objecttothis
525c65ffb3 Convert encryption to CI4
- automatic upgrade of encryption key.
- automatic decryption of CI3 data, then re-encryption in CI4 and update of table.
- Fixing save function in app_config model
2024-06-15 17:19:15 +02:00
objecttothis
ae357cab4a Formatting
- Convert indents to tabs
- Remove unnecessary else statement
- Correct PHPDoc formatting
2024-06-15 17:19:15 +02:00
objecttothis
1dd58e922f Corrected link in README.md 2024-06-15 17:19:15 +02:00
jekkos
828fd639b2 Porting over 4f3226b 2024-06-15 17:19:15 +02:00
objecttothis
de531e20c6 Migrations
- Delete old CI3 file
- Correct format of Migrations file datetime
2024-06-15 17:19:15 +02:00
jekkos
1745e973a1 Apply changes from master 2024-06-15 17:19:15 +02:00
jekkos
2d45ca626b Apply changes from master 2024-06-15 17:19:15 +02:00
objecttothis
f84b795ee6 Upgrade to CodeIgniter 4.1.3 2024-06-15 17:19:15 +02:00
jekkos
73b189b6d4 Prepare rebase: move files to new folder structure 2024-06-15 17:19:15 +02:00
jekkos
dcb797571e evert "Prepare rebase: move files to new folder structure"
This reverts commit eed0cd1ca0.
2023-05-30 17:52:17 +02:00
jekkos
eed0cd1ca0 Prepare rebase: move files to new folder structure 2023-05-07 15:10:27 +02:00