Commit Graph

  • 37c6e22fc4 Update SECURITY.md with published security advisories (#4431) jekkos 2026-03-13 17:53:32 +00:00
  • 3c7ece5c33 Fix permission bypass in Sales.getManage() access control (#4428) jekkos 2026-03-13 17:52:07 +00:00
  • 02fccaf43f Fix XSS vulnerability in tax invoice view (#4432) jekkos 2026-03-13 16:09:04 +00:00
  • ee4d44ed39 Fix IDOR vulnerability in password change (GHSA-mcc2-8rp2-q6ch) (#4427) jekkos 2026-03-13 11:13:21 +00:00
  • fa3f257e7b Fix PHPUnit test configuration for database connectivity (#4430) jekkos 2026-03-13 09:38:37 +00:00
  • 46185a6d44 Address review feedback: use ternary, camelCase, remove test file Ollama 2026-03-12 19:44:38 +00:00
  • 66f7d70749 feat(plugins): add view hooks for injecting plugin content into core views Ollama 2026-03-12 10:13:03 +00:00
  • 431a9951e9 Fix filter persistence javascript issues (#4400) jekkos 2026-03-11 22:35:12 +01:00
  • f7e8d6e427 Add filter persistence for table views via URL query string (#4400) jekkos 2026-03-11 20:11:00 +01:00
  • e7c610acd0 Refactor reward variables to camelCase Furzi 2026-01-16 21:18:59 +08:00
  • cff8762d07 Fix customer reward points not updating correctly when editing or deleting sales Furzi 2026-01-03 10:30:02 +08:00
  • 85889b6e65 Bump jspdf from 4.1.0 to 4.2.0 (#4383) dependabot[bot] 2026-03-11 16:36:53 +04:00
  • 6818f02ef9 Update SECURITY.md with published security advisories Ollama 2026-03-10 19:30:33 +00:00
  • 436696b11b Add workflow to auto-update issue templates with releases Ollama 2026-03-09 21:03:55 +00:00
  • bd8b4fa6c1 feat(plugins): Support self-contained plugin directories Ollama 2026-03-06 12:55:44 +00:00
  • a9669ddf19 feat(plugins): Implement modular plugin system with self-registering events Ollama 2026-03-06 12:51:15 +00:00
  • 9a2b308647 Sync language files (#3468) Ollama 2026-03-08 21:54:32 +00:00
  • 50fd9d5da0 Fix indentation in serveImage and getPicThumb methods Ollama 2026-03-08 22:03:34 +00:00
  • 1f55d96580 Fix mass assignment vulnerability in bulk edit (GHSA-49mq-h2g4-grr9) Ollama 2026-03-07 20:09:12 +00:00
  • b2fadea44a Fix broken SQL injection fix - use havingLike() instead of having() with named params Ollama 2026-03-08 20:58:02 +00:00
  • 0fdb3ba37b Fix payment type becoming null when editing sales Ollama 2026-03-08 21:28:50 +00:00
  • d7b2264ac1 Fix: Preserve CHECKBOX attribute state when adding attributes (#4385) jekkos 2026-03-05 12:28:13 +00:00
  • 302a76b84a Merge branch 'master' into feature/integration-tests feature/integration-tests objecttothis 2026-03-08 13:15:43 -07:00
  • a229bf6031 Fix stored XSS vulnerabilities in employee permissions and customer data Ollama 2026-03-07 18:19:14 +00:00
  • 977fa5647b Fix stored XSS vulnerability in item descriptions Ollama 2026-03-07 18:31:25 +00:00
  • 2725c6e872 Fix integration tests: run playwright on failure, fix test path and syntax error Ollama 2026-03-07 18:27:08 +00:00
  • 52b0a83190 Fix SQL injection in custom attribute search Ollama 2026-03-07 13:24:37 +00:00
  • 7cd2d3e61f Fix CI: Remove --wait flag from docker compose up Ollama 2026-03-06 21:39:50 +00:00
  • f25a0f5b09 Refactor: Move ADMIN_MODULES to constants, rename methods to camelCase jekkos 2026-03-06 10:01:28 +00:00
  • f0f288797a Add migration to fix existing image filenames with spaces (#4372) jekkos 2026-03-05 12:42:38 +00:00
  • 63083a0946 Fix: Sanitize image filenames to prevent thumbnail display issues (#4372) jekkos 2026-03-05 12:42:10 +00:00
  • 3a33098776 Fix: Handle image filenames with spaces in thumbnails jekkos 2026-03-05 12:37:40 +00:00
  • ca6a1b35af Add row-level authorization to password change endpoints (#4401) jekkos 2026-03-06 17:08:36 +01:00
  • 418580a52d Fix second-order SQL injection in currency_symbol config (#4390) jekkos 2026-03-06 17:01:38 +01:00
  • 12146275f4 fix: Fix migration foreign key constraint and remove seeder feature/rest-api-implementation Ollama 2026-03-06 15:05:59 +00:00
  • e45af91e2e feat: Add REST API implementation with API key authentication Ollama 2026-03-06 14:35:27 +00:00
  • 31d25e06dc fix(security): whitelist and validate invoice template types (#4393) jekkos 2026-03-06 13:18:47 +01:00
  • b1819b3b36 dd validation for invalid stock locations in CSV import (#4399) jekkos 2026-03-06 13:17:52 +01:00
  • 6705420373 Fix incorrect argument types in migration round_number() methods (#4403) jekkos 2026-03-06 13:07:24 +01:00
  • 09191b9af7 feat: Add OpenAPI 3.1 specification for REST API feature/api-openapi-spec jekkos 2026-03-06 10:27:11 +00:00
  • 86e150ad96 Update INSTALL.md with opensourcepos.org short URL feature/ubuntu-install-script jekkos 2026-03-06 10:21:22 +00:00
  • 2c0ae0b035 Add admin-only restriction for giftcard deletion fix/bola-remaining-controllers jekkos 2026-03-06 08:07:39 +00:00
  • d6b767c80a Bump dompurify from 3.3.1 to 3.3.2 (#4402) dependabot[bot] 2026-03-05 21:54:49 +01:00
  • 19eb43270a Fix broken object-level authorization in Employees controller (CVE-worthy) (#4391) jekkos 2026-03-05 19:46:39 +01:00
  • 8f4055c711 Add one-line Ubuntu installation script jekkos 2026-03-05 15:11:06 +00:00
  • 3c25fd77e2 Add validation for invalid stock locations in CSV import jekkos 2026-03-05 15:06:28 +00:00
  • df4549bb0b Fix Docker image upload by replacing slashes in TAG jekkos 2026-03-05 14:46:38 +00:00
  • 3f7ea18f18 Add unit tests for CSV import functionality jekkos 2026-03-05 12:57:37 +00:00
  • 22e3548fea Fix issues in PR #4305: Add missing toggle buttons, fix colspan bug, cleanup jekkos 2026-03-05 12:50:09 +00:00
  • bdc965be23 Fix: Refresh session language for employee after update. (#4245) jekkos 2026-03-04 22:43:52 +01:00
  • 3c5f4c1465 Add integration test harness with Playwright E2E tests jekkos 2026-03-04 21:37:07 +00:00
  • 5c8905aa1b Language Array Key Typo Fix (#4371) Lucas Lyimo 2026-03-05 00:06:17 +03:00
  • 36bf130bdd Add comprehensive unit tests for PR #4384 jekkos 2026-03-04 20:48:10 +00:00
  • 690f43578d Use Content-Type application/json for AJAX responses (#4357) jekkos 2026-03-04 21:42:35 +01:00
  • 0858a1c23c Fix permission bypass in Reports submodule access control (#4389) jekkos 2026-03-04 21:18:42 +01:00
  • 3c217bbddd Fix XSS vulnerabilities in invoice_email.php view jekkos 2026-03-04 17:53:18 +00:00
  • 87a0606141 Fix XSS vulnerability in register (#3965) jekkos 2026-03-03 22:40:50 +01:00
  • b6a90f7880 Fix XSS vulnerability in register (#3965) jekkos 2026-03-03 22:37:08 +01:00
  • b93359bcaf Fix XSS vulnerability in attributes (#3965) jekkos 2026-03-03 22:28:32 +01:00
  • 088ad47c99 CSV Barcode Update Bug objec 2026-02-27 18:00:30 +04:00
  • 808840b2e9 Implement Magic word deletion in CSV import objec 2026-02-27 16:53:03 +04:00
  • 2ed74c5c0e Resolve review comments objec 2026-02-27 00:31:51 +04:00
  • c935fc7a2a Resolve review comments objec 2026-02-26 23:16:39 +04:00
  • 89012054b4 Resolve review comments objec 2026-02-26 15:16:51 +04:00
  • 89572aa289 Resolve review comments objec 2026-02-26 13:52:14 +04:00
  • 2b56d56072 Resolve business logic bugs objec 2026-02-26 12:28:48 +04:00
  • 2fc9fc09a4 Comment Resolutions objec 2026-02-26 00:19:57 +04:00
  • 932b612c9e Case-sensitive attribute update in Item view objec 2026-02-25 19:22:02 +04:00
  • ab6e8ee083 Case-sensitive attributes in CSV imports objec 2026-02-25 16:30:21 +04:00
  • 79427481b3 Fix XSS vulnerabilities in invoices + receipts (#3965) (#4363) jekkos 2026-02-23 20:14:55 +01:00
  • b23351a45c Bump jspdf and jspdf-autotable (#4373) dependabot[bot] 2026-02-07 11:46:11 +00:00
  • bee0c8e364 Bump lodash from 4.17.21 to 4.17.23 (#4369) dependabot[bot] 2026-01-22 20:51:03 +01:00
  • 849439c71e Fix multiple XSS vulnerabilities (#3965) (#4356) jekkos 2025-12-22 17:21:49 +01:00
  • 25680f05db Add equals as permitted URI character (#4329) Chathura Dilushanka 2025-12-22 03:11:36 +05:30
  • a11fb099e2 Fix travis build after merge (#4130) jekkos 2025-12-21 19:50:35 +01:00
  • aee5f31cf5 Add show/hide cost price & profit feature - in reports #4130 (#4350) BhojKamal 2025-12-21 15:23:39 +05:45
  • 643b0ac499 Fix for detailed suppliers report (#4351) jekkos 2025-12-17 22:46:59 +01:00
  • 3e844f2f89 Escape return_policy in receipt + invoice (#4349) jekkos 2025-12-17 20:39:58 +01:00
  • 2acdec431f Fix wrong migration script location (#4285) jekkos 2025-12-08 23:06:33 +01:00
  • f245f585da Fix creation of date attribute value (#4310) (#4344) jekkos 2025-12-02 07:19:14 +01:00
  • e48ab45094 Fix toast notifications in config (#4341) (#4343) jekkos 2025-11-28 09:01:07 +01:00
  • fe6601b351 Refactor database credentials and enhance image handling in item management Sahand-Jaza 2025-07-24 12:26:25 +03:00
  • 46e31b1c16 Allow anonymous giftcard creation (#4278) jekkos 2025-11-24 22:54:52 +01:00
  • bea69c7aa1 Add DOMPurify to JS includes (#4341) jekkos 2025-11-23 22:19:48 +01:00
  • 30da69a382 Fix attachment cid (#4314) jekkos 2025-11-23 21:37:32 +01:00
  • 6dd5a9162f Add DOMpurify + fix XSS (#4341) jekkos 2025-11-23 21:35:47 +01:00
  • 26a398f7d2 Add recent releases to issue template (#4317) jekkos 2025-11-21 23:55:24 +01:00
  • ce73d9bb31 Add env variable to disallow pwd change (#4325) jekkos 2025-11-21 23:46:48 +01:00
  • 83af580d40 Add server side validation for password (#4335) jekkos 2025-11-21 23:39:48 +01:00
  • ca7adf76c1 Update SECURITY.md contact (#4335) jekkos 2025-11-21 23:22:39 +01:00
  • 832db664e5 Fix tax configuration pages (#4331) jekkos 2025-11-21 21:46:22 +01:00
  • 36e73a84af Clean up docker compose setup (#4308) jekkos 2025-08-29 09:18:38 +02:00
  • bcddf482fe [Feature] Add logging to migrations (#4327) Joe Williams 2025-10-19 22:10:28 -07:00
  • 759356288b Add transactions to missing config keys migration. (#4318) Joe Williams 2025-10-15 22:53:14 -07:00
  • 43ebe2169a Fixed naming issue: feature-add-transactions-to-migrations Joe Williams 2025-10-15 22:22:15 -07:00
  • d1e5575ac1 Translated using Weblate (Portuguese (Brazil)) j2272850861-pixel 2025-10-10 09:54:15 +00:00
  • b3f67a5e0f Translated using Weblate (Portuguese (Brazil)) j2272850861-pixel 2025-10-10 10:00:37 +00:00
  • 41b349134a Translated using Weblate (Portuguese (Brazil)) j2272850861-pixel 2025-10-10 09:55:58 +00:00
  • 3f82ac179a Added transaction to Migration_MissingConfigKeys.up(). Joe Williams 2025-09-16 12:14:05 -07:00
  • 73dab4f347 execute_script() now returns a boolean for error handling. Joe Williams 2025-09-16 12:10:32 -07:00