fix: Address remaining CodeRabbit review comments

- Fix invalid jq string filter syntax (missing quotes around interpolation) - Add environment validation job in deploy.yml for workflow_call input - Add fork detection guard in deploy-pr.yml to prevent fork PR deployments Fixes: - deploy.yml:183-184 - jq filter syntax error - deploy.yml:31 - unvalidated environment input in reusable workflow - deploy-pr.yml:5 - fork PR deployments blocked by pull_request_review restrictions - deploy-pr.yml:168-200 - jq filter syntax errors
fix(docker): enable .htaccess and set proper file permissions
2026-05-25 00:44:03 -04:00 · 2026-05-15 09:57:03 +02:00 · 2026-05-12 19:48:23 +02:00 · 2026-05-12 17:49:56 +02:00 · 2026-05-12 17:47:36 +02:00 · 2026-05-12 17:47:36 +02:00
37 changed files with 485 additions and 721 deletions
--- a/.env.example
+++ b/.env.example
@@ -16,9 +16,6 @@ CI_ENVIRONMENT = production
 # Configure with comma-separated list of domains/subdomains:
 #   app.allowedHostnames = 'yourdomain.com,www.yourdomain.com'
 #
-# Or via environment variable (useful for Docker/Compose):
-#   ALLOWED_HOSTNAMES=yourdomain.com,www.yourdomain.com
-#
 # For local development:
 #   app.allowedHostnames = 'localhost'
 #
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -123,7 +123,6 @@ jobs:
            .
            !.git
            !node_modules
-          include-hidden-files: true
          retention-days: 1

  docker:
--- a/.github/workflows/deploy-core.yml
+++ b/.github/workflows/deploy-core.yml
@@ -1,219 +0,0 @@
-name: Deploy Core
-
-on:
-  workflow_call:
-    inputs:
-      image_tag:
-        description: 'Docker image tag to deploy'
-        type: string
-        required: true
-      sha:
-        description: 'Git commit SHA to deploy'
-        type: string
-        required: true
-      description:
-        description: 'Deployment description'
-        type: string
-        required: true
-      pr_number:
-        description: 'Pull request number (optional)'
-        type: string
-        required: false
-    outputs:
-      deployment_id:
-        description: 'GitHub deployment ID'
-        value: ${{ jobs.deploy.outputs.deployment_id }}
-      status:
-        description: 'Deployment status (success/failure)'
-        value: ${{ jobs.deploy.outputs.status }}
-
-concurrency:
-  group: deploy-staging
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  deployments: write
-
-jobs:
-  deploy:
-    name: Deploy to staging
-    runs-on: ubuntu-latest
-    
-    environment:
-      name: staging
-      url: ${{ vars.DEPLOY_URL || 'https://dev.opensourcepos.org' }}
-      deployment: false
-    
-    outputs:
-      deployment_id: ${{ steps.deployment.outputs.deployment_id }}
-      status: ${{ steps.webhook.outputs.status }}
-    
-    steps:
-      - name: Create GitHub Deployment
-        id: deployment
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-          REF_SHA: ${{ inputs.sha }}
-          DESCRIPTION: ${{ inputs.description }}
-        run: |
-          set -euo pipefail
-          
-          DEPLOYMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/deployments" \
-            -X POST \
-            -f ref="${REF_SHA}" \
-            -f environment="staging" \
-            -f description="${DESCRIPTION}" \
-            -F auto_merge=false \
-            -F required_contexts[] \
-            --jq '.id')
-          
-          if [ -z "$DEPLOYMENT_ID" ]; then
-            echo "::error::Failed to create deployment"
-            exit 1
-          fi
-          
-          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
-          echo "Created deployment: $DEPLOYMENT_ID"
-      
-      - name: Set deployment status to in_progress
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          
-          gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-            -X POST \
-            -f state="in_progress" \
-            -f description="Deployment in progress..." \
-            -f log_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-      
-      - name: Trigger deployment webhook
-        id: webhook
-        env:
-          DEPLOY_WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
-          DEPLOY_WEBHOOK_SECRET: ${{ secrets.DEPLOY_WEBHOOK_SECRET }}
-          DOCKER_REPO_NAME: ${{ secrets.DOCKER_REPO_NAME }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-          REF_SHA: ${{ inputs.sha }}
-          DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}
-          PR_NUMBER: ${{ inputs.pr_number }}
-        run: |
-          set -euo pipefail
-          
-          if [ -z "$DEPLOY_WEBHOOK_URL" ]; then
-            echo "::error::DEPLOY_WEBHOOK_URL secret is not configured"
-            echo "Please add the DEPLOY_WEBHOOK_URL secret in your repository settings"
-            echo "status=failure" >> "$GITHUB_OUTPUT"
-            exit 1
-          fi
-          
-          REPO_NAME="${DOCKER_REPO_NAME:-opensourcepos/opensourcepos}"
-          REPO_NAMESPACE="${REPO_NAME%%/*}"
-          REPO_SHORT_NAME="${REPO_NAME#*/}"
-          PUSHED_AT=$(date +%s)
-          
-          if [ -n "$PR_NUMBER" ]; then
-            PAYLOAD=$(jq -n \
-              --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-              --argjson pushed_at "$PUSHED_AT" \
-              --arg pusher "$GITHUB_ACTOR" \
-              --arg tag "$IMAGE_TAG" \
-              --arg repo_name "$REPO_NAME" \
-              --arg name "$REPO_SHORT_NAME" \
-              --arg namespace "$REPO_NAMESPACE" \
-              --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
-              --arg deployment_id "$DEPLOYMENT_ID" \
-              --arg repository "$GITHUB_REPOSITORY" \
-              --arg sha "$REF_SHA" \
-              --arg run_id "$GITHUB_RUN_ID" \
-              --arg actor "$GITHUB_ACTOR" \
-              --argjson pr_number "$PR_NUMBER" \
-              '{
-                callback_url: $callback_url,
-                push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
-                repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
-                github_deployment: {id: $deployment_id, environment: "staging", repository: $repository, sha: $sha, run_id: $run_id, actor: $actor, pull_request: $pr_number}
-              }')
-          else
-            PAYLOAD=$(jq -n \
-              --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
-              --argjson pushed_at "$PUSHED_AT" \
-              --arg pusher "$GITHUB_ACTOR" \
-              --arg tag "$IMAGE_TAG" \
-              --arg repo_name "$REPO_NAME" \
-              --arg name "$REPO_SHORT_NAME" \
-              --arg namespace "$REPO_NAMESPACE" \
-              --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
-              --arg deployment_id "$DEPLOYMENT_ID" \
-              --arg repository "$GITHUB_REPOSITORY" \
-              --arg sha "$REF_SHA" \
-              --arg run_id "$GITHUB_RUN_ID" \
-              --arg actor "$GITHUB_ACTOR" \
-              '{
-                callback_url: $callback_url,
-                push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
-                repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
-                github_deployment: {id: $deployment_id, environment: "staging", repository: $repository, sha: $sha, run_id: $run_id, actor: $actor}
-              }')
-          fi
-          
-          echo "Sending webhook..."
-          echo "Image: ${IMAGE_TAG}"
-          echo "Environment: staging"
-          
-          HEADERS=(-H "Content-Type: application/json")
-          
-          if [ -n "$DEPLOY_WEBHOOK_SECRET" ]; then
-            SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" | sed 's/.*= //')
-            HEADERS+=(-H "X-Hub-Signature-256: sha256=$SIGNATURE")
-            echo "Using HMAC-SHA256 signature verification"
-          else
-            echo "::warning::DEPLOY_WEBHOOK_SECRET not set - webhook calls will not be signed"
-            echo "For security, configure DEPLOY_WEBHOOK_SECRET in your repository settings"
-          fi
-          
-          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 120 \
-            -o response.txt -w "%{http_code}" \
-            -X POST \
-            "${HEADERS[@]}" \
-            -d "$PAYLOAD" \
-            "$DEPLOY_WEBHOOK_URL") || HTTP_CODE="000"
-          
-          echo "Response code: $HTTP_CODE"
-          if [ -s response.txt ]; then
-            cat response.txt
-          fi
-          
-          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
-            echo "status=success" >> "$GITHUB_OUTPUT"
-          else
-            echo "status=failure" >> "$GITHUB_OUTPUT"
-          fi
-      
-      - name: Set deployment status
-        if: always()
-        env:
-          GH_TOKEN: ${{ github.token }}
-          IMAGE_TAG: ${{ inputs.image_tag }}
-        run: |
-          set -euo pipefail
-          
-          STATE="${{ steps.webhook.outputs.status }}"
-          
-          if [ "$STATE" = "success" ]; then
-            DESCRIPTION=$(jq -nr --arg tag "$IMAGE_TAG" \
-              '"Deployed image \($tag) to staging"')
-            
-            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-              -X POST \
-              -f state="success" \
-              -f description="$DESCRIPTION"
-          else
-            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
-              -X POST \
-              -f state="failure" \
-              -f description="Deployment failed"
-            exit 1
-          fi
--- a/.github/workflows/deploy-pr.yml
+++ b/.github/workflows/deploy-pr.yml
@@ -14,16 +14,17 @@ permissions:
  pull-requests: write

 jobs:
-  prepare:
-    name: Prepare deployment
+  deploy-staging:
+    name: Deploy to staging
    runs-on: ubuntu-latest
    if: >
      github.event.review.state == 'approved' &&
      github.event.pull_request.head.repo.full_name == github.repository
-    outputs:
-      image_tag: ${{ steps.image.outputs.tag }}
-      sha: ${{ github.event.pull_request.head.sha }}
-      pr_number: ${{ github.event.pull_request.number }}
+    
+    environment:
+      name: staging
+      url: ${{ vars.DEPLOY_URL || 'https://dev.opensourcepos.org' }}
+      deployment: false
    
    steps:
      - name: Checkout PR
@@ -39,32 +40,156 @@ jobs:
        run: |
          IMAGE_TAG="pr-${PR_NUMBER}-${PR_SHA:0:7}"
          echo "tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
-
-  deploy:
-    name: Deploy to staging
-    needs: prepare
-    uses: ./.github/workflows/deploy-core.yml
-    with:
-      image_tag: ${{ needs.prepare.outputs.image_tag }}
-      sha: ${{ needs.prepare.outputs.sha }}
-      description: Deploy PR #${{ needs.prepare.outputs.pr_number }} to staging
-      pr_number: ${{ needs.prepare.outputs.pr_number }}
-    secrets: inherit
-
-  comment:
-    name: Comment deployment status
-    needs: [prepare, deploy]
-    if: always()
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ github.token }}
-      IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
-      PR_NUMBER: ${{ needs.prepare.outputs.pr_number }}
-      REF_SHA: ${{ needs.prepare.outputs.sha }}
-      STATUS: ${{ needs.deploy.outputs.status }}
-    
-    steps:
-      - name: Comment on PR
+      
+      - name: Create GitHub Deployment
+        id: deployment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REF_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          
+          DEPLOYMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/deployments" \
+            -X POST \
+            -f ref="${REF_SHA}" \
+            -f environment="staging" \
+            -f description="Deploy PR #${PR_NUMBER} to staging" \
+            -F auto_merge=false \
+            -F required_contexts[] \
+            --jq '.id')
+          
+          if [ -z "$DEPLOYMENT_ID" ]; then
+            echo "::error::Failed to create deployment"
+            exit 1
+          fi
+          
+          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
+          echo "Created deployment: $DEPLOYMENT_ID"
+      
+      - name: Set deployment status to in_progress
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          
+          gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+            -X POST \
+            -f state="in_progress" \
+            -f description="Deploying PR #${PR_NUMBER}..." \
+            -f log_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+      
+      - name: Trigger deployment webhook
+        id: webhook
+        env:
+          DEPLOY_WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
+          DEPLOY_WEBHOOK_SECRET: ${{ secrets.DEPLOY_WEBHOOK_SECRET }}
+          DOCKER_REPO_NAME: ${{ secrets.DOCKER_REPO_NAME }}
+          IMAGE_TAG: ${{ steps.image.outputs.tag }}
+          REF_SHA: ${{ github.event.pull_request.head.sha }}
+          DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          
+          if [ -z "$DEPLOY_WEBHOOK_URL" ]; then
+            echo "::error::DEPLOY_WEBHOOK_URL secret is not configured"
+            echo "status=failure" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+          
+          REPO_NAME="${DOCKER_REPO_NAME:-opensourcepos/opensourcepos}"
+          REPO_NAMESPACE="${REPO_NAME%%/*}"
+          REPO_SHORT_NAME="${REPO_NAME#*/}"
+          PUSHED_AT=$(date +%s)
+          
+          PAYLOAD=$(jq -n \
+            --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+            --argjson pushed_at "$PUSHED_AT" \
+            --arg pusher "$GITHUB_ACTOR" \
+            --arg tag "$IMAGE_TAG" \
+            --arg repo_name "$REPO_NAME" \
+            --arg name "$REPO_SHORT_NAME" \
+            --arg namespace "$REPO_NAMESPACE" \
+            --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
+            --arg deployment_id "$DEPLOYMENT_ID" \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg sha "$REF_SHA" \
+            --arg run_id "$GITHUB_RUN_ID" \
+            --arg actor "$GITHUB_ACTOR" \
+            --argjson pr_number "$PR_NUMBER" \
+            '{
+              callback_url: $callback_url,
+              push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
+              repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
+              github_deployment: {id: $deployment_id, environment: "staging", repository: $repository, sha: $sha, run_id: $run_id, actor: $actor, pull_request: $pr_number}
+            }')
+          
+          echo "Sending webhook..."
+          echo "Image: ${IMAGE_TAG}"
+          echo "PR: #${PR_NUMBER}"
+          
+          HEADERS=(-H "Content-Type: application/json")
+          
+          if [ -n "$DEPLOY_WEBHOOK_SECRET" ]; then
+            SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" | sed 's/.*= //')
+            HEADERS+=(-H "X-Hub-Signature-256: sha256=$SIGNATURE")
+          fi
+          
+          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 120 \
+            -o response.txt -w "%{http_code}" \
+            -X POST \
+            "${HEADERS[@]}" \
+            -d "$PAYLOAD" \
+            "$DEPLOY_WEBHOOK_URL") || HTTP_CODE="000"
+          
+          echo "Response code: $HTTP_CODE"
+          if [ -s response.txt ]; then
+            cat response.txt
+          fi
+          
+          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+            echo "status=success" >> "$GITHUB_OUTPUT"
+          else
+            echo "status=failure" >> "$GITHUB_OUTPUT"
+          fi
+      
+      - name: Set deployment status
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_TAG: ${{ steps.image.outputs.tag }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          
+          STATE="${{ steps.webhook.outputs.status }}"
+          
+          if [ "$STATE" = "success" ]; then
+            DESCRIPTION=$(jq -nr --arg tag "$IMAGE_TAG" --arg pr "$PR_NUMBER" \
+              '"Deployed PR #\($pr) (\($tag)) to staging"')
+            
+            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+              -X POST \
+              -f state="success" \
+              -f description="$DESCRIPTION"
+          else
+            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+              -X POST \
+              -f state="failure" \
+              -f description="Staging deployment failed"
+            exit 1
+          fi
+      
+      - name: Comment deployment status
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_TAG: ${{ steps.image.outputs.tag }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REF_SHA: ${{ github.event.pull_request.head.sha }}
+          STATUS: ${{ steps.webhook.outputs.status }}
        run: |
          if [ "$STATUS" = "success" ]; then
            BODY=$(jq -nr --arg tag "$IMAGE_TAG" --arg sha "$REF_SHA" --arg url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -7,17 +7,208 @@ on:
        description: 'Docker image tag to deploy (e.g., v3.4.0, latest)'
        required: true
        default: 'latest'
+      environment:
+        description: 'Target environment'
+        required: true
+        type: choice
+        options:
+          - production
+          - staging
+        default: 'production'
+  workflow_call:
+    inputs:
+      image_tag:
+        description: 'Docker image tag to deploy'
+        type: string
+        default: 'latest'
+      environment:
+        description: 'Target environment'
+        type: string
+        default: 'staging'
+      sha:
+        description: 'Git commit SHA to deploy'
+        required: true
+        type: string
+
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: false

 permissions:
  contents: read
  deployments: write

 jobs:
+  validate-inputs:
+    name: Validate deployment inputs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate environment
+        env:
+          TARGET_ENV: ${{ inputs.environment }}
+        run: |
+          set -euo pipefail
+          case "$TARGET_ENV" in
+            production|staging) ;;
+            *)
+              echo "::error::Invalid environment '$TARGET_ENV'. Expected 'production' or 'staging'."
+              exit 1
+              ;;
+          esac
+
  deploy:
-    name: Deploy to staging
-    uses: ./.github/workflows/deploy-core.yml
-    with:
-      image_tag: ${{ inputs.image_tag }}
-      sha: ${{ github.sha }}
-      description: Deploy image ${{ inputs.image_tag }}
-    secrets: inherit
+    name: Deploy to ${{ inputs.environment }}
+    needs: validate-inputs
+    runs-on: ubuntu-latest
+    
+    environment:
+      name: ${{ inputs.environment }}
+      url: ${{ vars.DEPLOY_URL || (inputs.environment == 'production' && 'https://demo.opensourcepos.org' || 'https://dev.opensourcepos.org') }}
+      deployment: false
+    
+    steps:
+      - name: Create GitHub Deployment
+        id: deployment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+          TARGET_ENV: ${{ inputs.environment }}
+          REF_SHA: ${{ inputs.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          
+          DEPLOYMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/deployments" \
+            -X POST \
+            -f ref="${REF_SHA}" \
+            -f environment="${TARGET_ENV}" \
+            -f description="Deploy image ${IMAGE_TAG}" \
+            -F auto_merge=false \
+            -F required_contexts[] \
+            --jq '.id')
+          
+          if [ -z "$DEPLOYMENT_ID" ]; then
+            echo "::error::Failed to create deployment"
+            exit 1
+          fi
+          
+          echo "deployment_id=$DEPLOYMENT_ID" >> "$GITHUB_OUTPUT"
+          echo "Created deployment: $DEPLOYMENT_ID"
+      
+      - name: Set deployment status to in_progress
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          
+          gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+            -X POST \
+            -f state="in_progress" \
+            -f description="Deployment in progress..." \
+            -f log_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+      
+      - name: Trigger deployment webhook
+        id: webhook
+        env:
+          DEPLOY_WEBHOOK_URL: ${{ secrets.DEPLOY_WEBHOOK_URL }}
+          DEPLOY_WEBHOOK_SECRET: ${{ secrets.DEPLOY_WEBHOOK_SECRET }}
+          DOCKER_REPO_NAME: ${{ secrets.DOCKER_REPO_NAME }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+          TARGET_ENV: ${{ inputs.environment }}
+          REF_SHA: ${{ inputs.sha || github.sha }}
+          DEPLOYMENT_ID: ${{ steps.deployment.outputs.deployment_id }}
+        run: |
+          set -euo pipefail
+          
+          if [ -z "$DEPLOY_WEBHOOK_URL" ]; then
+            echo "::error::DEPLOY_WEBHOOK_URL secret is not configured"
+            echo "Please add the DEPLOY_WEBHOOK_URL secret in your repository settings"
+            echo "status=failure" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+          
+          REPO_NAME="${DOCKER_REPO_NAME:-opensourcepos/opensourcepos}"
+          REPO_NAMESPACE="${REPO_NAME%%/*}"
+          REPO_SHORT_NAME="${REPO_NAME#*/}"
+          PUSHED_AT=$(date +%s)
+          
+          PAYLOAD=$(jq -n \
+            --arg callback_url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+            --argjson pushed_at "$PUSHED_AT" \
+            --arg pusher "$GITHUB_ACTOR" \
+            --arg tag "$IMAGE_TAG" \
+            --arg repo_name "$REPO_NAME" \
+            --arg name "$REPO_SHORT_NAME" \
+            --arg namespace "$REPO_NAMESPACE" \
+            --arg repo_url "https://hub.docker.com/r/${REPO_NAME}/" \
+            --arg deployment_id "$DEPLOYMENT_ID" \
+            --arg environment "$TARGET_ENV" \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg sha "$REF_SHA" \
+            --arg run_id "$GITHUB_RUN_ID" \
+            --arg actor "$GITHUB_ACTOR" \
+            '{
+              callback_url: $callback_url,
+              push_data: {pushed_at: $pushed_at, pusher: $pusher, tag: $tag},
+              repository: {repo_name: $repo_name, name: $name, namespace: $namespace, repo_url: $repo_url, status: "Active"},
+              github_deployment: {id: $deployment_id, environment: $environment, repository: $repository, sha: $sha, run_id: $run_id, actor: $actor}
+            }')
+          
+          echo "Sending webhook..."
+          echo "Image: ${IMAGE_TAG}"
+          echo "Environment: ${TARGET_ENV}"
+          
+          HEADERS=(-H "Content-Type: application/json")
+          
+          if [ -n "$DEPLOY_WEBHOOK_SECRET" ]; then
+            SIGNATURE=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" | sed 's/.*= //')
+            HEADERS+=(-H "X-Hub-Signature-256: sha256=$SIGNATURE")
+            echo "Using HMAC-SHA256 signature verification"
+          else
+            echo "::warning::DEPLOY_WEBHOOK_SECRET not set - webhook calls will not be signed"
+            echo "For security, configure DEPLOY_WEBHOOK_SECRET in your repository settings"
+          fi
+          
+          HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 120 \
+            -o response.txt -w "%{http_code}" \
+            -X POST \
+            "${HEADERS[@]}" \
+            -d "$PAYLOAD" \
+            "$DEPLOY_WEBHOOK_URL") || HTTP_CODE="000"
+          
+          echo "Response code: $HTTP_CODE"
+          if [ -s response.txt ]; then
+            cat response.txt
+          fi
+          
+          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+            echo "status=success" >> "$GITHUB_OUTPUT"
+          else
+            echo "status=failure" >> "$GITHUB_OUTPUT"
+          fi
+      
+      - name: Set deployment status
+        if: always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IMAGE_TAG: ${{ inputs.image_tag }}
+          TARGET_ENV: ${{ inputs.environment }}
+        run: |
+          set -euo pipefail
+          
+          STATE="${{ steps.webhook.outputs.status }}"
+          
+          if [ "$STATE" = "success" ]; then
+            DESCRIPTION=$(jq -nr --arg tag "$IMAGE_TAG" --arg env "$TARGET_ENV" \
+              '"Deployed image \($tag) to \($env)"')
+            
+            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+              -X POST \
+              -f state="success" \
+              -f description="$DESCRIPTION"
+          else
+            gh api "repos/${GITHUB_REPOSITORY}/deployments/${{ steps.deployment.outputs.deployment_id }}/statuses" \
+              -X POST \
+              -f state="failure" \
+              -f description="Deployment failed"
+            exit 1
+          fi
--- a/9
+++ b/9
@@ -7,14 +7,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    && docker-php-ext-install mysqli bcmath intl gd \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* \
-    && a2enmod rewrite
+    && a2enmod rewrite \
+    && sed -i 's/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf

 RUN echo "date.timezone = \"\${PHP_TIMEZONE}\"" > /usr/local/etc/php/conf.d/timezone.ini

 WORKDIR /app
 COPY --chown=www-data:www-data . /app
-RUN chmod 750 /app/writable/logs /app/writable/uploads /app/writable/cache /app/public/uploads /app/public/uploads/item_pics \
-    && chmod 640 /app/writable/uploads/importCustomers.csv \
+RUN chmod 770 /app/writable/uploads /app/writable/logs /app/writable/cache \
+    && mkdir -p /app/public/uploads/item_pics \
+    && chown www-data:www-data /app/public/uploads/item_pics \
+    && chmod 640 /app/.env \
    && ln -s /app/*[^public] /var/www \
    && rm -rf /var/www/html \
    && ln -nsf /app/public /var/www/html
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -5,9 +5,8 @@
  - [Supported Versions](#supported-versions)
  - [Security Advisories](#security-advisories)
  - [Reporting a Vulnerability](#reporting-a-vulnerability)
-  - [Disclosure Process](#disclosure-process)

-<!-- END doctoc generated TOC please keep comment here to allow update -->
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->

 # Security Policy

@@ -22,116 +21,26 @@ We release patches for security vulnerabilities.

 ## Security Advisories

-For a complete list of published and draft security advisories with CVE details, see our [GitHub Security Advisories page](https://github.com/opensourcepos/opensourcepos/security/advisories).
+The following security vulnerabilities have been published:
+
+### High Severity
+
+| CVE | Vulnerability | CVSS | Published | Fixed In | Credit |
+|-----|--------------|------|-----------|----------|--------|
+| [CVE-2025-68434](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r) | CSRF leading to Admin Creation | 8.8 | 2025-12-17 | 3.4.2 | @Nixon-H, @jekkos |
+| [CVE-2025-68147](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xgr7-7pvw-fpmh) | Stored XSS in Return Policy | 8.1 | 2025-12-17 | 3.4.2 | @Nixon-H, @jekkos |
+| [CVE-2025-66924](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-gv8j-f6gq-g59m) | Stored XSS in Item Kits | 7.2 | 2026-03-04 | 3.4.2 | @hungnqdz, @omkaryepre |
+
+### Medium Severity
+
+| CVE | Vulnerability | CVSS | Published | Fixed In | Credit |
+|-----|--------------|------|-----------|----------|--------|
+| [CVE-2025-68658](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-32r8-8r9r-9chw) | Stored XSS in Company Name | 4.3 | 2026-01-13 | 3.4.2 | @hungnqdz |
+
+For a complete list including draft advisories, see our [GitHub Security Advisories page](https://github.com/opensourcepos/opensourcepos/security/advisories).

 ## Reporting a Vulnerability

-**Option 1: GitHub Security Advisory (Preferred)**
+Please report (suspected) security vulnerabilities to **[jeroen@steganos.dev](mailto:jeroen@steganos.dev)**. 

-1. Create a draft security advisory directly on GitHub:
-   - Go to https://github.com/opensourcepos/opensourcepos/security/advisories
-   - Click "New draft security advisory"
-   - Fill in the vulnerability details using our [template below](#vulnerability-template)
-   - Submit as **draft** (not published)
-
-2. Notify us for triage:
-   - Send an email to **[jeroen@steganos.dev](mailto:jeroen@steganos.dev)** with:
-     - Subject: `[GHSA] Brief description of vulnerability`
-     - Link to the draft advisory
-     - Brief summary
-
-**Option 2: Email Report**
-
-Send vulnerability details to **[jeroen@steganos.dev](mailto:jeroen@steganos.dev)**.
-
-You will receive a response within 48 hours. Confirmed vulnerabilities will be patched within a few days depending on complexity.
-
-## Disclosure Process
-
-### Timeline
-
-| Step | Timeline | Action |
-|------|----------|--------|
-| 1. Report received | Day 0 | We acknowledge within 48 hours |
-| 2. Triage & confirmation | Day 1-3 | We validate the vulnerability |
-| 3. Fix development | Day 3-7 | We develop and test the fix |
-| 4. Patch release | Day 7-10 | We release a security patch |
-| 5. CVE request | Day 7-14 | We request CVE from GitHub (if applicable) |
-| 6. Advisory published | Day 14 | We publish the advisory with credit |
-| 7. Public disclosure | Day 14+ | Full disclosure after patch release |
-
-### CVE Process
-
-**We request CVE identifiers through GitHub's security advisory system.** This is the preferred and easiest method:
-
-1. After we confirm and fix the vulnerability, we'll request a CVE through GitHub
-2. GitHub coordinates with MITRE on our behalf
-3. The CVE is automatically linked to the advisory
-4. You'll be credited as the reporter in the published advisory
-
-**Already have a CVE?** If you've already obtained a CVE from another source (e.g., VulDB, CVE.MITRE.ORG), please include it in your report or advisory. We'll update our advisory to reference the existing CVE.
-
-### No Bug Bounty Program
-
-**Important:** Open Source Point of Sale does not offer a bug bounty program.
-
- All security research and vulnerability triage is done on a **voluntary basis** in our free time
- We do not offer monetary rewards for vulnerability reports
- We do credit reporters in published advisories (unless anonymity is requested)
- We greatly appreciate the security research community's efforts to help improve project security
-
-### Security Best Practices for Researchers
-
- **Do not** access, modify, or delete data that doesn't belong to you
- **Do not** perform denial of service attacks
- **Do not** publicly disclose vulnerabilities before we've had time to fix them
- **Do** provide sufficient information to reproduce the vulnerability
- **Do** allow us reasonable time to fix before public disclosure
- **Do** report through official channels (GitHub advisories or email)
-
-### Vulnerability Template
-
-When creating a draft advisory, please include:
-
-```
-## Summary
-[Brief description of the vulnerability]
-
-## Impact
- **Confidentiality:** [High/Medium/Low - what data can be exposed]
- **Integrity:** [High/Medium/Low - what can be modified]
- **Availability:** [High/Medium/Low - service disruption potential]
- **Privilege Required:** [None/Low/High - authentication level needed]
- **CVSS v3.1:** [Score] ([Vector string])
-
-## Details
-[Technical details about the vulnerability]
-
-**Affected Code:**
-```php
-// Path to affected file and vulnerable code
-```
-
-**Attack Vector:**
-[How an attacker can exploit this]
-
-## Proof of Concept
-```bash
-# Steps to reproduce
-```
-
-## Patch
-[Suggested fix or approach]
-
-## Affected Versions
- OpenSourcePOS X.Y.Z and earlier
-
-## Credit
-[Your GitHub username or preferred name]
-```
-
---
-
-**Thank you to all security researchers who have contributed to making Open Source Point of Sale more secure.** Your voluntary efforts help protect thousands of users worldwide and contribute to a safer, more trustworthy free and open-source software ecosystem. We deeply appreciate your responsible disclosure and the time you invest in improving our project.
-
-If you've reported a vulnerability and would like to discuss CVE coordination or have questions about the process, please reach out to us at [jeroen@steganos.dev](mailto:jeroen@steganos.dev).
+You will receive a response from us within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -58,9 +58,9 @@ class App extends BaseConfig
     * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
     * If you want to accept multiple Hostnames, set this.
     *
-     * Or via environment variable (useful for Docker/Compose):
-     *   ALLOWED_HOSTNAMES=example.com,www.example.com
-     * 
+     * E.g.,
+     * When your site URL ($baseURL) is 'http://example.com/', and your site
+     * also accepts 'http://media.example.com/' and 'http://accounts.example.com/':
     *     ['media.example.com', 'accounts.example.com']
     *
     * @var list<string>
@@ -286,11 +286,7 @@ class App extends BaseConfig

        // Solution for CodeIgniter 4 limitation: arrays cannot be set from .env
        // See: https://github.com/codeigniter4/CodeIgniter4/issues/7311
-        // Support both: app.allowedHostnames (from .env) and ALLOWED_HOSTNAMES (from environment/Docker)
-        $envAllowedHostnames = getenv('ALLOWED_HOSTNAMES');
-        if ($envAllowedHostnames === false || trim($envAllowedHostnames) === '') {
-            $envAllowedHostnames = getenv('app.allowedHostnames');
-        }
+        $envAllowedHostnames = getenv('app.allowedHostnames');
        if ($envAllowedHostnames !== false && trim($envAllowedHostnames) !== '') {
            $this->allowedHostnames = array_values(array_filter(
                array_map('trim', explode(',', $envAllowedHostnames)),
@@ -331,8 +327,9 @@ class App extends BaseConfig
            $errorMessage =
                'Security: allowedHostnames is not configured. ' .
                'Host header injection protection is disabled. ' .
-                'Set app.allowedHostnames in your .env file or ALLOWED_HOSTNAMES environment variable. ' .
-                'Example: app.allowedHostnames = "example.com,www.example.com" ' .
+                'Either set app.allowedHostnames in your .env file ' .
+                '(e.g., app.allowedHostnames = "example.com,www.example.com") ' .
+                'or configure $allowedHostnames in app/Config/App.php. ' .
                'Received Host: ' . $httpHost;

            // Production: Fail explicitly to prevent silent security vulnerabilities
--- a/app/Config/OSPOS.php
+++ b/app/Config/OSPOS.php
@@ -5,7 +5,6 @@ namespace Config;
 use App\Models\Appconfig;
 use CodeIgniter\Cache\CacheInterface;
 use CodeIgniter\Config\BaseConfig;
-use Config\Database;

 /**
 * This class holds the configuration options stored from the database so that on launch those settings can be cached
@@ -14,7 +13,7 @@ use Config\Database;
 */
 class OSPOS extends BaseConfig
 {
-    public array $settings = [];
+    public array $settings;
    public string $commit_sha1 = 'dev';    // TODO: Travis scripts need to be updated to replace this with the commit hash on build
    private CacheInterface $cache;

@@ -34,37 +33,27 @@ class OSPOS extends BaseConfig

        if ($cache) {
            $this->settings = decode_array($cache);
-            return;
-        }
-
-        try {
-            $db = Database::connect();
-
-            if (!$db->tableExists('app_config')) {
-                $this->settings = $this->getDefaultSettings();
-                return;
+        } else {
+            try {
+                $appconfig = model(Appconfig::class);
+                foreach ($appconfig->get_all()->getResult() as $app_config) {
+                    $this->settings[$app_config->key] = $app_config->value;
+                }
+                $this->cache->save('settings', encode_array($this->settings));
+            } catch (\Exception $e) {
+                // Database table doesn't exist yet (migrations haven't run)
+                // or database connection failed. Return empty settings to
+                // allow migration page to display. Catches mysqli_sql_exception
+                // which is not a subclass of DatabaseException.
+                $this->settings = [
+                    'language' => 'english',
+                    'language_code' => 'en',
+                    'company' => 'Home'
+                ];
            }
-
-            $appconfig = model(Appconfig::class);
-            foreach ($appconfig->get_all()->getResult() as $app_config) {
-                $this->settings[$app_config->key] = $app_config->value;
-            }
-            $this->cache->save('settings', encode_array($this->settings));
-        } catch (\Exception $e) {
-            $this->settings = $this->getDefaultSettings();
        }
    }

-    private function getDefaultSettings(): array
-    {
-        return [
-            'language'      => 'english',
-            'language_code' => 'en',
-            'company'       => 'Home',
-            'barcode_type'  => 'Code39'
-        ];
-    }
-
    /**
     * @return void
     */
@@ -73,4 +62,4 @@ class OSPOS extends BaseConfig
        $this->cache->delete('settings');
        $this->set_settings();
    }
-}
+}
--- a/app/Controllers/Config.php
+++ b/app/Controllers/Config.php
@@ -924,9 +924,7 @@ class Config extends Secure_Controller
    public function postSaveReceipt(): ResponseInterface
    {
        $batch_save_data = [
-            'receipt_template'              => Sale_lib::isValidReceiptTemplate($this->request->getPost('receipt_template'))
-                ? $this->request->getPost('receipt_template')
-                : 'receipt_default',
+            'receipt_template'              => $this->request->getPost('receipt_template'),
            'receipt_font_size'             => $this->request->getPost('receipt_font_size', FILTER_SANITIZE_NUMBER_INT),
            'print_delay_autoreturn'        => $this->request->getPost('print_delay_autoreturn', FILTER_SANITIZE_NUMBER_INT),
            'email_receipt_check_behaviour' => $this->request->getPost('email_receipt_check_behaviour'),
--- a/app/Controllers/Items.php
+++ b/app/Controllers/Items.php
@@ -154,23 +154,8 @@ class Items extends Secure_Controller
    {
        helper('file');

-        // Security: Sanitize filename to prevent path traversal
-        // Use basename() to strip directory components and prevent '../' attacks
-        $pic_filename = basename(rawurldecode($pic_filename));
-        $file_extension = strtolower(pathinfo($pic_filename, PATHINFO_EXTENSION));
-
-        // Validate file extension against system-configured allowed image types
-        // Handle both legacy pipe-separated and current comma-separated formats
-        // Fallback to types that GD library can process for thumbnail generation
-        $allowed_types = $this->config['image_allowed_types'] ?? 'jpg,jpeg,gif,png,webp,bmp,tif,tiff';
-        $allowed_extensions = strpos($allowed_types, '|') !== false
-            ? explode('|', $allowed_types)
-            : explode(',', $allowed_types);
-
-        if (!in_array($file_extension, $allowed_extensions, true)) {
-            return $this->response->setStatusCode(400)->setBody('Invalid file type');
-        }
-
+        $pic_filename = rawurldecode($pic_filename);
+        $file_extension = pathinfo($pic_filename, PATHINFO_EXTENSION);
        $images = glob("./uploads/item_pics/$pic_filename");
        $base_path = './uploads/item_pics/' . pathinfo($pic_filename, PATHINFO_FILENAME);

@@ -1055,20 +1040,14 @@ class Items extends Secure_Controller
                        });

                        if (!$isFailedRow && $this->item->save_value($itemData, $itemId)) {
-                            if (!$this->save_tax_data($row, $itemData)) {
-                                $isFailedRow = true;
-                            }
-                            if (!$this->save_inventory_quantities($row, $itemData, $allowedStockLocations, $employeeId)) {
-                                $isFailedRow = true;
-                            }
+                            $this->save_tax_data($row, $itemData);
+                            $this->save_inventory_quantities($row, $itemData, $allowedStockLocations, $employeeId);
                            $csvAttributeValues = $this->extractAttributeData($row);
-                            if (!$this->attribute->saveCSVRowAttributeData($csvAttributeValues, $itemData, $attributeData)) {
-                                $isFailedRow = true;
-                            }
+                            $isFailedRow = !$this->attribute->saveCSVRowAttributeData($csvAttributeValues, $itemData, $attributeData);
                            if ($isFailedRow) {
                                $failedRow = $key + 2;
                                $failCodes[] = $failedRow;
-                                log_message('error', "CSV Item import failed on line $failedRow while saving item.");
+                                log_message('error', "CSV Item import failed on line $failedRow while saving attributes.");
                                continue;
                            }

@@ -1258,15 +1237,13 @@ class Items extends Secure_Controller
     * @param array $item_data
     * @param array $allowed_locations
     * @param int $employee_id
-     * @return bool Returns true on success, false on failure
     * @throws ReflectionException
     */
-    private function save_inventory_quantities(array $row, array $item_data, array $allowed_locations, int $employee_id): bool
+    private function save_inventory_quantities(array $row, array $item_data, array $allowed_locations, int $employee_id): void
    {
        // Quantities & Inventory Section
        $comment = lang('Items.inventory_CSV_import_quantity');
        $is_update = (bool)$row['Id'];
-        $success = true;

        foreach ($allowed_locations as $location_id => $location_name) {
            $item_quantity_data = ['item_id' => $item_data['item_id'], 'location_id' => $location_id];
@@ -1280,22 +1257,20 @@ class Items extends Secure_Controller

            if (!empty($row["location_$location_name"]) || $row["location_$location_name"] === '0') {
                $item_quantity_data['quantity'] = $row["location_$location_name"];
-                $success &= $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);
+                $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);

                $csv_data['trans_inventory'] = $row["location_$location_name"];
-                $success &= (bool)$this->inventory->insert($csv_data, false);
+                $this->inventory->insert($csv_data, false);
            } elseif ($is_update) {
-                continue;
+                return;
            } else {
                $item_quantity_data['quantity'] = 0;
-                $success &= $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);
+                $this->item_quantity->save_value($item_quantity_data, $item_data['item_id'], $location_id);

                $csv_data['trans_inventory'] = 0;
-                $success &= (bool)$this->inventory->insert($csv_data, false);
+                $this->inventory->insert($csv_data, false);
            }
        }
-
-        return (bool)$success;
    }

    /**
@@ -1303,9 +1278,8 @@ class Items extends Secure_Controller
     *
     * @param array $row
     * @param array $item_data
-     * @return bool Returns true on success, false on failure
     */
-    private function save_tax_data(array $row, array $item_data): bool
+    private function save_tax_data(array $row, array $item_data): void
    {
        $items_taxes_data = [];

@@ -1317,11 +1291,9 @@ class Items extends Secure_Controller
            $items_taxes_data[] = ['name' => $row['Tax 2 Name'], 'percent' => $row['Tax 2 Percent']];
        }

-        if (!empty($items_taxes_data)) {
-            return $this->item_taxes->save_value($items_taxes_data, $item_data['item_id']);
+        if (isset($items_taxes_data)) {
+            $this->item_taxes->save_value($items_taxes_data, $item_data['item_id']);
        }
-
-        return true;
    }

    /**
--- a/app/Controllers/Login.php
+++ b/app/Controllers/Login.php
@@ -49,13 +49,6 @@ class Login extends BaseController
                return view('login', $data);
            }

-            if (!$data['is_latest'] || $data['is_new_install']) {
-                set_time_limit(3600);
-
-                $migration->setNamespace('App')->latest();
-                return redirect()->to('login');
-            }
-
            $rules = ['username' => 'required|login_check[data]'];
            $messages = [
                'username' => [
@@ -69,6 +62,13 @@ class Login extends BaseController

                return view('login', $data);
            }
+
+            if (!$data['is_latest']) {
+                set_time_limit(3600);
+
+                $migration->setNamespace('App')->latest();
+                return redirect()->to('login');
+            }
        }

        return redirect()->to('home');
@@ -79,18 +79,18 @@ class Login extends BaseController
        try {
            $migration = new MY_Migration(config('Migrations'));
            $migration->migrate_to_ci4();
-
+            
            set_time_limit(3600);
            $migration->setNamespace('App')->latest();
-
+            
            return $this->response->setJSON([
                'success' => true,
                'message' => 'Migration completed successfully'
            ]);
-
+            
        } catch (\Exception $e) {
            log_message('error', 'Migration failed: ' . $e->getMessage());
-
+            
            return $this->response->setJSON([
                'success' => false,
                'message' => 'Migration failed: ' . $e->getMessage()
--- a/app/Controllers/Reports.php
+++ b/app/Controllers/Reports.php
@@ -1246,15 +1246,13 @@ class Reports extends Secure_Controller
    public function get_payment_type(): array
    {
        return [
-            'all'           => lang('Common.none_selected_text'),
-            'cash'          => lang('Sales.cash'),
-            'due'           => lang('Sales.due'),
-            'check'         => lang('Sales.check'),
-            'credit'        => lang('Sales.credit'),
-            'debit'         => lang('Sales.debit'),
-            'bank_transfer' => lang('Sales.bank_transfer'),
-            'wallet'        => lang('Sales.wallet'),
-            'invoices'      => lang('Sales.invoice')
+            'all'      => lang('Common.none_selected_text'),
+            'cash'     => lang('Sales.cash'),
+            'due'      => lang('Sales.due'),
+            'check'    => lang('Sales.check'),
+            'credit'   => lang('Sales.credit'),
+            'debit'    => lang('Sales.debit'),
+            'invoices' => lang('Sales.invoice')
        ];
    }

--- a/app/Controllers/Sales.php
+++ b/app/Controllers/Sales.php
@@ -93,8 +93,6 @@ class Sales extends Secure_Controller
                'only_check'        => lang('Sales.check_filter'),
                'only_creditcard'   => lang('Sales.credit_filter'),
                'only_debit'        => lang('Sales.debit'),
-                'only_bank_transfer'=> lang('Sales.bank_transfer'),
-                'only_wallet'       => lang('Sales.wallet'),
                'only_invoices'     => lang('Sales.invoice_filter'),
                'selected_customer' => lang('Sales.selected_customer')
            ];
@@ -158,10 +156,8 @@ class Sales extends Secure_Controller
            'selected_customer' => false,
            'only_creditcard'   => false,
            'only_debit'        => false,
-            'only_bank_transfer'=> false,
-            'only_wallet'       => false,
            'only_invoices'     => $this->config['invoice_enable'] && $this->request->getGet('only_invoices', FILTER_SANITIZE_NUMBER_INT),
-            'is_valid_receipt'  => $this->sale->isValidReceipt($search)
+            'is_valid_receipt'  => $this->sale->is_valid_receipt($search)
        ];

        // Check if any filter is set in the multiselect dropdown
@@ -198,7 +194,7 @@ class Sales extends Secure_Controller
            ? $this->request->getGet('term')
            : null;

-        if ($this->sale_lib->get_mode() == 'return' && $this->sale->isValidReceipt($receipt)) {
+        if ($this->sale_lib->get_mode() == 'return' && $this->sale->is_valid_receipt($receipt)) {
            // If a valid receipt or invoice was found the search term will be replaced with a receipt number (POS #)
            $suggestions[] = $receipt;
        }
@@ -525,7 +521,7 @@ class Sales extends Secure_Controller
        $quantity = ($mode == 'return') ? -$quantity : $quantity;
        $item_location = $this->sale_lib->get_sale_location();

-        if ($mode == 'return' && $this->sale->isValidReceipt($item_id_or_number_or_item_kit_or_receipt)) {
+        if ($mode == 'return' && $this->sale->is_valid_receipt($item_id_or_number_or_item_kit_or_receipt)) {
            $this->sale_lib->return_entire_sale($item_id_or_number_or_item_kit_or_receipt);
        } elseif ($this->item_kit->is_valid_item_kit($item_id_or_number_or_item_kit_or_receipt)) {
            // Add kit item to order if one is assigned
@@ -908,14 +904,6 @@ class Sales extends Secure_Controller
                return $this->_reload($data);
            } else {
                $data['barcode'] = $this->barcode_lib->generate_receipt_barcode($data['sale_id']);
-
-                // Validate receipt template to prevent path traversal
-                $receipt_template = $this->config['receipt_template'] ?? '';
-                if (!Sale_lib::isValidReceiptTemplate($receipt_template)) {
-                    $receipt_template = 'receipt_default';
-                }
-                $data['receipt_template_view'] = $receipt_template;
-
                $this->sale_lib->clear_all();
                return view('sales/receipt', $data);
            }
@@ -1171,13 +1159,6 @@ class Sales extends Secure_Controller
        }
        $data['invoice_view'] = $invoice_type;

-        // Validate receipt template to prevent path traversal
-        $receipt_template = $this->config['receipt_template'] ?? '';
-        if (!Sale_lib::isValidReceiptTemplate($receipt_template)) {
-            $receipt_template = 'receipt_default';
-        }
-        $data['receipt_template_view'] = $receipt_template;
-
        return $data;
    }

--- a/app/Database/Migrations/20170501150000_upgrade_to_3_1_1.php
+++ b/app/Database/Migrations/20170501150000_upgrade_to_3_1_1.php
@@ -2,7 +2,6 @@

 namespace App\Database\Migrations;

-use CodeIgniter\Database\Exceptions\DatabaseException;
 use CodeIgniter\Database\Migration;

 class Migration_Upgrade_To_3_1_1 extends Migration
@@ -18,37 +17,7 @@ class Migration_Upgrade_To_3_1_1 extends Migration
    public function up(): void
    {
        helper('migration');
-
-        // MariaDB blocks CONVERT TO CHARACTER SET on tables with FK constraints.
-        // Drop all FKs across affected tables before running the SQL script, recreate after.
-        $fkColumns = [
-            ['modules',         'module_id'],
-            ['stock_locations', 'location_id'],
-            ['permissions',     'permission_id'],
-            ['people',          'person_id'],
-            ['suppliers',       'supplier_id'],
-            ['items',           'item_id'],
-            ['item_kits',       'item_kit_id'],
-            ['sales',           'sale_id'],
-            ['receivings',      'receiving_id'],
-            ['employees',       'employee_id'],
-            ['customers',       'person_id'],
-        ];
-
-        $constraints = [];
-        foreach ($fkColumns as [$table, $column]) {
-            foreach (dropAllForeignKeyConstraints($table, $column) as $c) {
-                $constraints[$c['constraintName']] = $c;
-            }
-        }
-
-        if (!execute_script(APPPATH . 'Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql')) {
-            throw new DatabaseException('Migration script 3.0.2_to_3.1.1.sql failed. Check logs for details.');
-        }
-
-        $droppedTables = ['sales_suspended', 'sales_suspended_items', 'sales_suspended_items_taxes', 'sales_suspended_payments'];
-        $toRecreate = array_filter($constraints, fn($c) => !in_array($c['tableName'], $droppedTables, true));
-        recreateForeignKeyConstraints(array_values($toRecreate));
+        execute_script(APPPATH . 'Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql');
    }

    /**
--- a/app/Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql
+++ b/app/Database/Migrations/sqlscripts/3.0.2_to_3.1.1.sql
@@ -327,6 +327,19 @@ INSERT INTO `ospos_sales_items` (sale_id, item_id, description, serialnumber, li
 INSERT INTO `ospos_sales_payments` (sale_id, payment_type, payment_amount) SELECT sale_id, payment_type, payment_amount FROM `ospos_sales_suspended_payments`;
 INSERT INTO `ospos_sales_items_taxes` (sale_id, item_id, line, name, percent) SELECT sale_id, item_id, line, name, percent FROM `ospos_sales_suspended_items_taxes`;

+ALTER TABLE `ospos_sales_suspended_payments` DROP FOREIGN KEY `ospos_sales_suspended_payments_ibfk_1`;
+
+ALTER TABLE `ospos_sales_suspended_items_taxes` DROP FOREIGN KEY `ospos_sales_suspended_items_taxes_ibfk_1`;
+ALTER TABLE `ospos_sales_suspended_items_taxes` DROP FOREIGN KEY `ospos_sales_suspended_items_taxes_ibfk_2`;
+
+ALTER TABLE `ospos_sales_suspended_items` DROP FOREIGN KEY `ospos_sales_suspended_items_ibfk_1`;
+ALTER TABLE `ospos_sales_suspended_items` DROP FOREIGN KEY `ospos_sales_suspended_items_ibfk_2`;
+ALTER TABLE `ospos_sales_suspended_items` DROP FOREIGN KEY `ospos_sales_suspended_items_ibfk_3`;
+
+ALTER TABLE `ospos_sales_suspended` DROP FOREIGN KEY `ospos_sales_suspended_ibfk_1`;
+ALTER TABLE `ospos_sales_suspended` DROP FOREIGN KEY `ospos_sales_suspended_ibfk_2`;
+ALTER TABLE `ospos_sales_suspended` DROP FOREIGN KEY `ospos_sales_suspended_ibfk_3`;
+
 DROP TABLE `ospos_sales_suspended_payments`, `ospos_sales_suspended_items_taxes`, `ospos_sales_suspended_items`, `ospos_sales_suspended`;

 --
--- a/app/Database/Migrations/sqlscripts/3.1.1_to_3.2.0.sql
+++ b/app/Database/Migrations/sqlscripts/3.1.1_to_3.2.0.sql
@@ -140,7 +140,7 @@ CREATE TABLE IF NOT EXISTS `ospos_expense_categories` (
  `category_name` varchar(255) DEFAULT NULL,
  `category_description` varchar(255) NOT NULL,
  `deleted` int(1) NOT NULL DEFAULT '0'
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;


 -- Table structure for table `ospos_expenses`
@@ -154,7 +154,7 @@ CREATE TABLE IF NOT EXISTS `ospos_expenses` (
  `description` varchar(255) NOT NULL,
  `employee_id` int(10) NOT NULL,
  `deleted` int(1) NOT NULL DEFAULT '0'
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;


 -- Indexes for table `ospos_expense_categories`
--- a/app/Database/Migrations/sqlscripts/3.2.1_to_3.3.0.sql
+++ b/app/Database/Migrations/sqlscripts/3.2.1_to_3.3.0.sql
@@ -75,7 +75,7 @@ CREATE TABLE `ospos_cash_up` (
  `open_employee_id` int(10) NOT NULL,
  `close_employee_id` int(10) NOT NULL,
  `deleted` int(1) NOT NULL DEFAULT '0'
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 -- Indexes for table `ospos_cash_up`

--- a/app/Database/Migrations/sqlscripts/3.3.0_indiagst.sql
+++ b/app/Database/Migrations/sqlscripts/3.3.0_indiagst.sql
@@ -26,7 +26,7 @@ CREATE TABLE IF NOT EXISTS `ospos_tax_codes` (
    `state` varchar(255) NOT NULL DEFAULT '',
    `deleted` int(1) NOT NULL DEFAULT 0,
    PRIMARY KEY (`tax_code_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 ALTER TABLE `ospos_customers`
    ADD COLUMN `tax_id` varchar(32) NOT NULL DEFAULT '' AFTER `taxable`,
@@ -59,7 +59,7 @@ CREATE TABLE `ospos_sales_taxes` (
    `rounding_code` tinyint(2) NOT NULL DEFAULT 0,
    PRIMARY KEY (`sales_taxes_id`),
    KEY `print_sequence` (`sale_id`,`print_sequence`,`tax_group`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 CREATE TABLE IF NOT EXISTS `ospos_tax_jurisdictions` (
    `jurisdiction_id` int(11) NOT NULL AUTO_INCREMENT,
@@ -71,7 +71,7 @@ CREATE TABLE IF NOT EXISTS `ospos_tax_jurisdictions` (
    `cascade_sequence` tinyint(2) NOT NULL DEFAULT 0,
    `deleted` int(1) NOT NULL DEFAULT 0,
    PRIMARY KEY (`jurisdiction_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci AUTO_INCREMENT=1;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1;

 ALTER TABLE `ospos_suppliers`
    ADD COLUMN `tax_id` varchar(32) DEFAULT NULL AFTER `account_number`;
@@ -89,7 +89,7 @@ CREATE TABLE IF NOT EXISTS `ospos_tax_rates` (
    `tax_rate` decimal(15,4) NOT NULL DEFAULT 0.0000,
    `tax_rounding_code` tinyint(2) NOT NULL DEFAULT 0,
    PRIMARY KEY (`tax_rate_id`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 -- Add support for sales tax report

--- a/app/Database/Migrations/sqlscripts/3.3.0_paymenttracking.sql
+++ b/app/Database/Migrations/sqlscripts/3.3.0_paymenttracking.sql
@@ -12,7 +12,7 @@ CREATE TABLE `ospos_sales_payments` (
  `reference_code` varchar(40) NOT NULL DEFAULT '',
  PRIMARY KEY (`payment_id`),
  KEY `payment_sale` (`sale_id`, `payment_type`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 INSERT INTO ospos_sales_payments (sale_id, payment_type, payment_amount, payment_user)
 SELECT payments.sale_id, payments.payment_type, payments.payment_amount, sales.employee_id
--- a/app/Helpers/locale_helper.php
+++ b/app/Helpers/locale_helper.php
@@ -272,9 +272,6 @@ function get_payment_options(): array
        $payments[lang('Sales.upi')] = lang('Sales.upi');
    }

-    $payments[lang('Sales.bank_transfer')] = lang('Sales.bank_transfer');
-    $payments[lang('Sales.wallet')]        = lang('Sales.wallet');
-
    return $payments;
 }

--- a/app/Helpers/migration_helper.php
+++ b/app/Helpers/migration_helper.php
@@ -172,7 +172,6 @@ function dropAllForeignKeyConstraints(string $table, string $column): array {
            WHERE kcu.TABLE_SCHEMA = DATABASE()
                AND ((kcu.REFERENCED_TABLE_NAME = '" . $db->getPrefix() . "$table' AND kcu.REFERENCED_COLUMN_NAME = '$column')
                OR (kcu.TABLE_NAME = '" . $db->getPrefix() . "$table' AND kcu.COLUMN_NAME = '$column'))
-                AND rc.CONSTRAINT_NAME IS NOT NULL
        ");

    $deletedConstraints = [];
--- a/app/Language/en-GB/Sales.php
+++ b/app/Language/en-GB/Sales.php
@@ -9,7 +9,6 @@ return [
    "amount_due"                       => "Amount Due",
    "amount_tendered"                  => "Amount Tendered",
    "authorized_signature"             => "Authorised Signature",
-    "bank_transfer"                    => "Bank Transfer",
    "cancel_sale"                      => "Cancel",
    "cash"                             => "Cash",
    "cash_1"                           => "",
@@ -224,7 +223,6 @@ return [
    "update"                           => "Update",
    "upi"                              => "UPI",
    "visa"                             => "",
-    "wallet"                           => "Wallet",
    "wholesale"                        => "",
    "work_order"                       => "Work Order",
    "work_order_number"                => "Work Order Number",
--- a/app/Language/en/Sales.php
+++ b/app/Language/en/Sales.php
@@ -9,7 +9,6 @@ return [
    "amount_due"                       => "Amount Due",
    "amount_tendered"                  => "Amount Tendered",
    "authorized_signature"             => "Authorized Signature",
-    "bank_transfer"                    => "Bank Transfer",
    "cancel_sale"                      => "Cancel",
    "cash"                             => "Cash",
    "cash_1"                           => "",
@@ -224,7 +223,6 @@ return [
    "update"                           => "Update",
    "upi"                              => "UPI",
    "visa"                             => "",
-    "wallet"                           => "Wallet",
    "wholesale"                        => "",
    "work_order"                       => "Work Order",
    "work_order_number"                => "Work Order Number",
--- a/app/Language/es-ES/Sales.php
+++ b/app/Language/es-ES/Sales.php
@@ -9,7 +9,6 @@ return [
    "amount_due"                       => "Monto Adeudado",
    "amount_tendered"                  => "Cantidad Recibida",
    "authorized_signature"             => "Firma Autorizada",
-    "bank_transfer"                    => "Transferencia Bancaria",
    "cancel_sale"                      => "Cancelar Venta",
    "cash"                             => "Efectivo",
    "cash_1"                           => "1",
@@ -223,7 +222,6 @@ return [
    "update"                           => "Editar",
    "upi"                              => "PIN UPI",
    "visa"                             => "Tarjeta Visa",
-    "wallet"                           => "Monedero",
    "wholesale"                        => "Precio al por mayor",
    "work_order"                       => "Orden trabajo",
    "work_order_number"                => "Numero Orden Trabajo",
--- a/app/Language/es-MX/Sales.php
+++ b/app/Language/es-MX/Sales.php
@@ -9,7 +9,6 @@ return [
    "amount_due"                       => "Monto de adeudo",
    "amount_tendered"                  => "Cantidad Recibida",
    "authorized_signature"             => "Firma Autorizada",
-    "bank_transfer"                    => "Transferencia Bancaria",
    "cancel_sale"                      => "Cancelar",
    "cash"                             => "Efectivo",
    "cash_1"                           => "",
@@ -223,7 +222,6 @@ return [
    "update"                           => "Actualizar",
    "upi"                              => "UPI",
    "visa"                             => "",
-    "wallet"                           => "Monedero",
    "wholesale"                        => "",
    "work_order"                       => "Orden de trabajo",
    "work_order_number"                => "Número de orden de trabajo",
--- a/app/Language/fr/Sales.php
+++ b/app/Language/fr/Sales.php
@@ -9,7 +9,6 @@ return [
    "amount_due"                       => "Montant à Payer",
    "amount_tendered"                  => "Montant Présenté",
    "authorized_signature"             => "Signature autorisée",
-    "bank_transfer"                    => "Virement Bancaire",
    "cancel_sale"                      => "Annuler la Vente",
    "cash"                             => "Espèce",
    "cash_1"                           => "",
@@ -223,7 +222,6 @@ return [
    "update"                           => "Éditer",
    "upi"                              => "UPI",
    "visa"                             => "",
-    "wallet"                           => "Portefeuille",
    "wholesale"                        => "",
    "work_order"                       => "Commande de travail",
    "work_order_number"                => "Numéro de commande",
--- a/app/Libraries/MY_Migration.php
+++ b/app/Libraries/MY_Migration.php
@@ -25,7 +25,7 @@ class MY_Migration extends MigrationRunner
    public function get_latest_migration(): int
    {
        $migrations = $this->findMigrations();
-        return (int) basename(end($migrations)->version);
+        return basename(end($migrations)->version);
    }

    /**
@@ -41,7 +41,7 @@ class MY_Migration extends MigrationRunner
                $builder = $db->table('migrations');
                $builder->select('version')->orderBy('version', 'DESC')->limit(1);
                $result = $builder->get()->getRow();
-                return $result ? (int) $result->version : 0;
+                return $result ? $result->version : 0;
            }
        } catch (\Exception $e) {
            // Database not available yet (e.g. fresh install before schema).
--- a/app/Libraries/Sale_lib.php
+++ b/app/Libraries/Sale_lib.php
@@ -108,11 +108,6 @@ class Sale_lib
        'custom_tax_invoice'
    ];

-    private const ALLOWED_RECEIPT_TEMPLATES = [
-        'receipt_default',
-        'receipt_short'
-    ];
-
    public function get_invoice_type_options(): array
    {
        $invoice_types = [];
@@ -166,11 +161,6 @@ class Sale_lib
        return in_array($invoice_type, self::ALLOWED_INVOICE_TYPES, true);
    }

-    public static function isValidReceiptTemplate(string $receipt_template): bool
-    {
-        return in_array($receipt_template, self::ALLOWED_RECEIPT_TEMPLATES, true);
-    }
-
    /**
     * @return array
     */
--- a/app/Models/Attribute.php
+++ b/app/Models/Attribute.php
@@ -601,10 +601,6 @@ class Attribute extends Model
     */
    public function saveAttributeLink(int $itemId, int $definitionId, int $attributeId): bool
    {
-        if ($attributeId <= 0) {
-            return false;
-        }
-
        $normalizedItemId = empty($itemId) ? null : $itemId;
        $normalizedAttributeId = empty($attributeId) ? null : $attributeId;

--- a/app/Models/Receiving.php
+++ b/app/Models/Receiving.php
@@ -294,9 +294,7 @@ class Receiving extends Model
            lang('Sales.check') => lang('Sales.check'),
            lang('Sales.debit') => lang('Sales.debit'),
            lang('Sales.credit') => lang('Sales.credit'),
-            lang('Sales.due') => lang('Sales.due'),
-            lang('Sales.bank_transfer') => lang('Sales.bank_transfer'),
-            lang('Sales.wallet') => lang('Sales.wallet')
+            lang('Sales.due') => lang('Sales.due')
        ];
    }

--- a/app/Models/Reports/Summary_sales_taxes.php
+++ b/app/Models/Reports/Summary_sales_taxes.php
@@ -33,16 +33,14 @@ class Summary_sales_taxes extends Summary_report
     * @param object $builder
     * @return void
     */
-    protected function _where(array $inputs, object &$builder): void
+    protected function _where(array $inputs, object &$builder): void    // TODO: hungarian notation
    {
        $builder->where('sales.sale_status', COMPLETED);

-        if (empty($this->config['date_or_time_format'])) {
-            $builder->where('DATE(sales.sale_time) >=', $inputs['start_date']);
-            $builder->where('DATE(sales.sale_time) <=', $inputs['end_date']);
+        if (empty($this->config['date_or_time_format'])) {    // TODO: Duplicated code
+            $builder->where('DATE(sales.sale_time) BETWEEN ' . $this->db->escape($inputs['start_date']) . ' AND ' . $this->db->escape($inputs['end_date']));
        } else {
-            $builder->where('sales.sale_time >=', $inputs['start_date']);
-            $builder->where('sales.sale_time <=', $inputs['end_date']);
+            $builder->where('sales.sale_time BETWEEN ' . $this->db->escape(rawurldecode($inputs['start_date'])) . ' AND ' . $this->db->escape(rawurldecode($inputs['end_date'])));
        }
    }

@@ -55,11 +53,9 @@ class Summary_sales_taxes extends Summary_report
        $builder = $this->db->table('sales_taxes');

        if (empty($this->config['date_or_time_format'])) {
-            $builder->where('DATE(sale_time) >=', $inputs['start_date']);
-            $builder->where('DATE(sale_time) <=', $inputs['end_date']);
+            $builder->where('DATE(sale_time) BETWEEN ' . $inputs['start_date'] . ' AND ' . $inputs['end_date']);
        } else {
-            $builder->where('sale_time >=', $inputs['start_date']);
-            $builder->where('sale_time <=', $inputs['end_date']);
+            $builder->where('sale_time BETWEEN ' . $this->db->escape(rawurldecode($inputs['start_date'])) . ' AND ' . $this->db->escape(rawurldecode($inputs['end_date'])));
        }

        $builder->select('reporting_authority, jurisdiction_name, tax_category, tax_rate, SUM(sale_tax_amount) AS tax');
--- a/app/Models/Sale.php
+++ b/app/Models/Sale.php
@@ -277,14 +277,6 @@ class Sale extends Model
            $builder->like('payment_type', lang('Sales.debit'));
        }

-        if ($filters['only_bank_transfer']) {
-            $builder->like('payment_type', lang('Sales.bank_transfer'));
-        }
-
-        if ($filters['only_wallet']) {
-            $builder->like('payment_type', lang('Sales.wallet'));
-        }
-
        $builder->groupBy('payment_type');

        $payments = $builder->get()->getResultArray();
@@ -327,7 +319,7 @@ class Sale extends Model
    {
        $suggestions = [];

-        if (!$this->isValidReceipt($search)) {
+        if (!$this->is_valid_receipt($search)) {
            $builder = $this->db->table('sales');
            $builder->distinct()->select('first_name, last_name');
            $builder->join('people', 'people.person_id = sales.customer_id');
@@ -408,21 +400,21 @@ class Sale extends Model
    /**
     * Checks if valid receipt
     */
-    public function isValidReceipt(string|null &$receiptSaleId): bool    // TODO: like the others, maybe this should be an array rather than a delimited string... either that or the parameter name needs to be changed. $receipt_sale_id implies that it's an int.
+    public function is_valid_receipt(string|null &$receipt_sale_id): bool    // TODO: like the others, maybe this should be an array rather than a delimited string... either that or the parameter name needs to be changed. $receipt_sale_id implies that it's an int.
    {
        $config = config(OSPOS::class)->settings;

-        if (!empty($receiptSaleId)) {
+        if (!empty($receipt_sale_id)) {
            // POS #
-            $pieces = explode(' ', trim($receiptSaleId));
+            $pieces = explode(' ', $receipt_sale_id);

-            if (count($pieces) == 2 && strtoupper($pieces[0]) === 'POS' && ctype_digit($pieces[1])) {
-                return $this->exists((int)$pieces[1]);
+            if (count($pieces) == 2 && preg_match('/(POS)/i', $pieces[0])) {
+                return $this->exists($pieces[1]);
            } elseif ($config['invoice_enable']) {
-                $saleInfo = $this->get_sale_by_invoice_number($receiptSaleId);
+                $sale_info = $this->get_sale_by_invoice_number($receipt_sale_id);

-                if ($saleInfo->getNumRows() > 0) {
-                    $receiptSaleId = 'POS ' . $saleInfo->getRow()->sale_id;
+                if ($sale_info->getNumRows() > 0) {
+                    $receipt_sale_id = 'POS ' . $sale_info->getRow()->sale_id;

                    return true;
                }
@@ -1517,13 +1509,5 @@ class Sale extends Model
        if ($filters['only_check']) {
            $builder->like('payments.payment_type', lang('Sales.check'));
        }
-
-        if ($filters['only_bank_transfer']) {
-            $builder->like('payments.payment_type', lang('Sales.bank_transfer'));
-        }
-
-        if ($filters['only_wallet']) {
-            $builder->like('payments.payment_type', lang('Sales.wallet'));
-        }
    }
 }
--- a/app/Views/sales/receipt.php
+++ b/app/Views/sales/receipt.php
@@ -2,14 +2,11 @@
 /**
 * @var int $sale_id_num
 * @var bool $print_after_sale
- * @var string $receipt_template_view
 * @var array $config
 */

 use App\Models\Employee;

-$template = $receipt_template_view ?? 'receipt_default';
-
 ?>

 <?= view('partial/header') ?>
@@ -64,6 +61,6 @@ if (isset($error_message)) {
    <?php endif; ?>
 </div>

-<?= view('sales/' . $template) ?>
+<?= view('sales/' . $config['receipt_template']) ?>

 <?= view('partial/footer') ?>
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -46,7 +46,6 @@ services:
            - .:/app
        environment:
            - CI_ENVIRONMENT=development
-            - ALLOWED_HOSTNAMES=localhost
            - MYSQL_USERNAME=admin
            - MYSQL_PASSWORD=pointofsale
            - MYSQL_DB_NAME=ospos
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,7 +16,6 @@ services:
            - logs:/app/writable/logs
        environment:
            - CI_ENVIRONMENT=production
-            - ALLOWED_HOSTNAMES=localhost
            - FORCE_HTTPS=false
            - PHP_TIMEZONE=UTC
            - MYSQL_USERNAME=admin
--- a/tests/Config/AppTest.php
+++ b/tests/Config/AppTest.php
@@ -18,7 +18,6 @@ class AppTest extends CIUnitTestCase
        // Clean up environment
        putenv('CI_ENVIRONMENT');
        putenv('app.allowedHostnames');
-        putenv('ALLOWED_HOSTNAMES');
        unset($_SERVER['HTTP_HOST']);
    }

@@ -282,106 +281,4 @@ class AppTest extends CIUnitTestCase
        putenv('app.allowedHostnames');
        putenv('CI_ENVIRONMENT');
    }
-
-    public function testAllowedHostnamesEnvVarParsedAsCommaSeparated(): void
-    {
-        // Set ALLOWED_HOSTNAMES environment variable
-        putenv('ALLOWED_HOSTNAMES=example.com,www.example.com,demo.example.com');
-
-        $_SERVER['HTTP_HOST'] = 'www.example.com';
-        $_SERVER['SCRIPT_NAME'] = '/index.php';
-        $_SERVER['HTTPS'] = null;
-
-        $app = new App();
-
-        // Constructor should parse comma-separated values
-        $this->assertEquals(['example.com', 'www.example.com', 'demo.example.com'], $app->allowedHostnames);
-        $this->assertStringContainsString('www.example.com', $app->baseURL);
-
-        // Clean up
-        putenv('ALLOWED_HOSTNAMES');
-    }
-
-    public function testAllowedHostnamesEnvVarTakesPrecedenceOverDotEnv(): void
-    {
-        // Set both environment variables
-        putenv('ALLOWED_HOSTNAMES=allowed1.com,allowed2.com');
-        putenv('app.allowedHostnames=dotenv1.com,dotenv2.com');
-
-        $_SERVER['HTTP_HOST'] = 'allowed1.com';
-        $_SERVER['SCRIPT_NAME'] = '/index.php';
-        $_SERVER['HTTPS'] = null;
-
-        $app = new App();
-
-        // ALLOWED_HOSTNAMES should take precedence
-        $this->assertEquals(['allowed1.com', 'allowed2.com'], $app->allowedHostnames);
-        $this->assertStringContainsString('allowed1.com', $app->baseURL);
-
-        // Clean up
-        putenv('ALLOWED_HOSTNAMES');
-        putenv('app.allowedHostnames');
-    }
-
-    public function testAllowedHostnamesEnvVarFallsBackToDotEnv(): void
-    {
-        // Only set app.allowedHostnames, not ALLOWED_HOSTNAMES
-        putenv('app.allowedHostnames=dotenv1.com,dotenv2.com');
-
-        $_SERVER['HTTP_HOST'] = 'dotenv1.com';
-        $_SERVER['SCRIPT_NAME'] = '/index.php';
-        $_SERVER['HTTPS'] = null;
-
-        $app = new App();
-
-        // Should fall back to app.allowedHostnames
-        $this->assertEquals(['dotenv1.com', 'dotenv2.com'], $app->allowedHostnames);
-        $this->assertStringContainsString('dotenv1.com', $app->baseURL);
-
-        // Clean up
-        putenv('app.allowedHostnames');
-    }
-
-    public function testAllowedHostnamesEnvVarTrimmedWhitespace(): void
-    {
-        // Set environment variable with whitespace
-        putenv('ALLOWED_HOSTNAMES= example.com , www.example.com , demo.example.com ');
-
-        $_SERVER['HTTP_HOST'] = 'example.com';
-        $_SERVER['SCRIPT_NAME'] = '/index.php';
-        $_SERVER['HTTPS'] = null;
-
-        $app = new App();
-
-        // Values should be trimmed
-        $this->assertEquals(['example.com', 'www.example.com', 'demo.example.com'], $app->allowedHostnames);
-
-        // Clean up
-        putenv('ALLOWED_HOSTNAMES');
-    }
-
-    public function testAllowedHostnamesEnvVarFiltersEmptyEntries(): void
-    {
-        // Trailing comma should not produce empty entry
-        putenv('ALLOWED_HOSTNAMES=example.com,');
-        $_SERVER['HTTP_HOST'] = 'example.com';
-        $_SERVER['SCRIPT_NAME'] = '/index.php';
-        $_SERVER['HTTPS'] = null;
-
-        $app = new App();
-        $this->assertEquals(['example.com'], $app->allowedHostnames);
-
-        // Clean up
-        putenv('ALLOWED_HOSTNAMES');
-
-        // Whitespace-only entry should be filtered
-        putenv('ALLOWED_HOSTNAMES=example.com, ,www.example.com');
-        $_SERVER['HTTP_HOST'] = 'example.com';
-
-        $app = new App();
-        $this->assertEquals(['example.com', 'www.example.com'], $app->allowedHostnames);
-
-        // Clean up
-        putenv('ALLOWED_HOSTNAMES');
-    }
 }
Author	SHA1	Message	Date
Ollama	5827f60045	fix: Address remaining CodeRabbit review comments - Fix invalid jq string filter syntax (missing quotes around interpolation) - Add environment validation job in deploy.yml for workflow_call input - Add fork detection guard in deploy-pr.yml to prevent fork PR deployments Fixes: - deploy.yml:183-184 - jq filter syntax error - deploy.yml:31 - unvalidated environment input in reusable workflow - deploy-pr.yml:5 - fork PR deployments blocked by pull_request_review restrictions - deploy-pr.yml:168-200 - jq filter syntax errors	2026-05-15 09:57:03 +02:00
Ollama	2acfb4773e	fix(docker): enable .htaccess and set proper file permissions - Enable AllowOverride in Apache config so .htaccess rewrite rules work - Create missing item_pics upload directory with correct ownership - Restrict .env file permissions to 640 (owner read/write, group read) - Merged sed into existing RUN layer to minimize image size	2026-05-12 19:48:23 +02:00
Ollama	832b0e686f	fix: Address CodeRabbit review comments Security fixes: - Use jq for JSON payload construction (prevents script injection) - Add HMAC-SHA256 signature verification for webhook security - Move untrusted inputs to env: blocks instead of inline interpolation Robustness fixes: - Add curl timeouts (--connect-timeout 10, --max-time 120) - Fail when DEPLOY_WEBHOOK_URL is missing (was incorrectly succeeding) - Add set -euo pipefail for error handling - Fix required_contexts JSON array syntax (-F required_contexts[]) - Add deployment: false to prevent duplicate deployment records Workflow improvements: - Add concurrency groups to serialize same-environment deployments - Remove unused skip_approval input - Fix workflow_call inputs (removed required: true where default exists) - Use vars.DEPLOY_URL for configurable environment URLs	2026-05-12 17:49:56 +02:00
Ollama	c26146c22b	feat: Add PR-triggered staging deployment workflow - deploy.yml: Add workflow_call for reuse from other workflows - deploy-pr.yml: Auto-deploy to staging when PR is approved - Uses GitHub environment protection for approval gates - Posts deployment status as PR comment - Image tag format: pr-{number}-{short-sha}	2026-05-12 17:47:36 +02:00
Ollama	e67f6bb290	fix: Update deploy webhook to match Docker Hub payload format - Send payload matching Docker Hub webhook structure - Include push_data.tag and repository.repo_name fields - Token authentication via query string (?token=SECRET) - Add optional DOCKER_REPO_NAME secret for custom repo - Preserve GitHub deployment info in github_deployment field	2026-05-12 17:47:36 +02:00
Ollama	9f8eef96a7	feat: Add deployment workflow with approval gates Adds manual deployment workflow triggered via GitHub Actions UI. Supports production and staging environments with optional approval gates configured via GitHub environment protection rules. Workflow creates GitHub deployment records and calls an external webhook to trigger the actual deployment.	2026-05-12 17:47:36 +02:00