mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-07-26 06:37:02 -04:00
2f51c4ef52
Security fixes for two vulnerabilities:
1. SQL Injection in Summary Sales Taxes Report (GHSA-5j9m-2f98-cjqw)
- Fixed unsanitized user input concatenation in getData() method
- Applied proper escaping using $this->db->escape() for start_date/end_date
- Consistent with existing _where() method implementation
2. Path Traversal in Receipt Template (GHSA-h6wm-fhw2-m3q3)
- Added ALLOWED_RECEIPT_TEMPLATES whitelist constant
- Added isValidReceiptTemplate() validation method
- Validate receipt_template before saving in Config controller
- Validate receipt_template before rendering in receipt view
- Default to 'receipt_default' for invalid values
- Consistent with invoice_type fix pattern (commit 31d25e06d)
Affected files:
- app/Models/Reports/Summary_sales_taxes.php
- app/Libraries/Sale_lib.php
- app/Controllers/Config.php
- app/Views/sales/receipt.php
Co-authored-by: Ollama <ollama@steganos.dev>
76 lines
2.5 KiB
PHP
76 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Models\Reports;
|
|
|
|
use Config\OSPOS;
|
|
|
|
class Summary_sales_taxes extends Summary_report
|
|
{
|
|
private array $config;
|
|
|
|
public function __construct()
|
|
{
|
|
parent::__construct();
|
|
$this->config = config(OSPOS::class)->settings;
|
|
}
|
|
|
|
/**
|
|
* @return array[]
|
|
*/
|
|
protected function _get_data_columns(): array // TODO: hungarian notation
|
|
{
|
|
return [
|
|
['reporting_authority' => lang('Reports.authority')],
|
|
['jurisdiction_name' => lang('Reports.jurisdiction')],
|
|
['tax_category' => lang('Reports.tax_category')],
|
|
['tax_rate' => lang('Reports.tax_rate'), 'sorter' => 'number_sorter'],
|
|
['tax' => lang('Reports.tax'), 'sorter' => 'number_sorter']
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @param array $inputs
|
|
* @param object $builder
|
|
* @return void
|
|
*/
|
|
protected function _where(array $inputs, object &$builder): void
|
|
{
|
|
$builder->where('sales.sale_status', COMPLETED);
|
|
|
|
if (empty($this->config['date_or_time_format'])) {
|
|
$builder->where('DATE(sales.sale_time) >=', $inputs['start_date']);
|
|
$builder->where('DATE(sales.sale_time) <=', $inputs['end_date']);
|
|
} else {
|
|
$builder->where('sales.sale_time >=', $inputs['start_date']);
|
|
$builder->where('sales.sale_time <=', $inputs['end_date']);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @param array $inputs
|
|
* @return array
|
|
*/
|
|
public function getData(array $inputs): array
|
|
{
|
|
$builder = $this->db->table('sales_taxes');
|
|
|
|
if (empty($this->config['date_or_time_format'])) {
|
|
$builder->where('DATE(sale_time) >=', $inputs['start_date']);
|
|
$builder->where('DATE(sale_time) <=', $inputs['end_date']);
|
|
} else {
|
|
$builder->where('sale_time >=', $inputs['start_date']);
|
|
$builder->where('sale_time <=', $inputs['end_date']);
|
|
}
|
|
|
|
$builder->select('reporting_authority, jurisdiction_name, tax_category, tax_rate, SUM(sale_tax_amount) AS tax');
|
|
$builder->join('sales', 'sales_taxes.sale_id = sales.sale_id', 'left');
|
|
$builder->join('tax_categories', 'sales_taxes.tax_category_id = tax_categories.tax_category_id', 'left');
|
|
$builder->join('tax_jurisdictions', 'sales_taxes.jurisdiction_id = tax_jurisdictions.jurisdiction_id', 'left');
|
|
$builder->groupBy('reporting_authority, jurisdiction_name, tax_category, tax_rate');
|
|
|
|
$query = $builder->get();
|
|
|
|
return $query->getResultArray();
|
|
}
|
|
}
|