mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-14 06:19:44 -04:00
jekkosandobjecttothis
839821e2eb
* Validate gift-card payment amounts (GHSA-9847) Close the negative gift-card amount minting vector: when a forged payment_type like 'Gift Card:<number>' reaches the catch-all validation branch, a negative amount_tendered previously passed decimal_locale and was then routed into Giftcard::decrementGiftcardValue, where value - (-N) increased the balance (store credit minted at will). - Add nonNegativeDecimal rule + 'Sales.negative_amount_tendered' message to the catch-all amount_tendered rules in Sales::postAddPayment(); add the language key to all 46 locale files (populated in en, empty elsewhere). - Guard Giftcard::decrementGiftcardValue() against non-positive amounts so the sink itself can no longer add balance from an inverted subtraction. - Regression tests: controller-level rejection of negative amount_tendered and model-level rejection of negative/zero decrements. * Address PR review: align locale keys, drop advisory refs, add decimal_locale message - Align negative_amount_tendered '=> with all other keys (46 locale files) - Remove docblock + inline comment above decrementGiftcardValue() - Remove GHSA ID and attack-detail description from test; scrub redundant comment - Add decimal_locale message override + focused malformed-amount test * Fix formatting and spacing in SalesControllerTest * fix(lang): remove duplicate negative amount tendered key Consolidate 'negative_amount_invalid' and 'negative_amount_tendered' translation keys in Sales.php across all locale files. Both keys held identical messages, causing redundant translation maintenance. - Drop 'negative_amount_invalid' key, keep 'negative_amount_tendered' - Move existing translated text into 'negative_amount_tendered' where it was previously empty - Applied across all app/Language/*/Sales.php locale files Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com> * fix(sales): allow negative amount_tendered in return mode Return transactions legitimately produce negative amount_due and prefilled amount_tendered values, but validation rules previously enforced nonNegativeDecimal unconditionally, blocking valid returns. - Detect return mode via sale_lib->get_mode() in Sales::process - Build amount_tendered rule conditionally: skip nonNegativeDecimal check when in return mode, keep it for sale/giftcard flows - Apply the conditional rule to both giftcard and standard payment branches Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com> * test: update expected error message in negative payment test Sales controller now returns generic numeric-validation message instead of specific negative-amount message for negative tendered amounts. Update test assertion to match new lang key. - tests/Controllers/SalesControllerTest.php: assert Sales.must_enter_numeric instead of Sales.negative_amount_tendered Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com> * test: remove regression tests for GHSA-9847 negative amount fix Drop testDecrementGiftcardValueRejectsNegativeAmount and testDecrementGiftcardValueRejectsZeroAmount from GiftcardTest. - Remove coverage for decrementGiftcardValue() rejecting non-positive amounts (negative/zero) in tests/Models/GiftcardTest.php Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com> --------- Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com> Co-authored-by: objecttothis <17935339+objecttothis@users.noreply.github.com>