mirror/opensourcepos
1
0
Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-03-25 18:32:17 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
3c7ece5c33278c5609089f83601791ae1cd6dcb4
opensourcepos/app/Controllers
History
jekkos 3c7ece5c33 Fix permission bypass in Sales.getManage() access control (#4428) 
The redirect() in getManage() returned a RedirectResponse that was never
executed, allowing unauthorized access to reports_sales. Updated method
signature to return ResponseInterface|string and properly return the
redirect response.

Refs: GHSA-94jm-c32g-48r5

Co-authored-by: Ollama <ollama@steganos.dev>
2026-03-13 17:52:07 +00:00
..
Attributes.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
BaseController.php
Feature bump ci to 4.6.0 (#4197)
2025-04-03 14:16:06 +04:00
Cashups.php
Add filter persistence for table views via URL query string (#4400)
2026-03-11 20:11:00 +01:00
Config.php
Fix second-order SQL injection in currency_symbol config (#4390)
2026-03-06 17:01:38 +01:00
Customers.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Employees.php
Refactor: Move ADMIN_MODULES to constants, rename methods to camelCase
2026-03-06 17:25:25 +01:00
Expenses_categories.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Expenses.php
Add filter persistence for table views via URL query string (#4400)
2026-03-11 20:11:00 +01:00
Giftcards.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Home.php
Fix IDOR vulnerability in password change (GHSA-mcc2-8rp2-q6ch) (#4427)
2026-03-13 12:13:21 +01:00
index.html
Replace tabs with spaces (#4196)
2025-03-28 21:24:21 +04:00
Item_kits.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Items.php
Add filter persistence for table views via URL query string (#4400)
2026-03-11 20:11:00 +01:00
Login.php
Improve code style and PSR-12 compliance (#4204)
2025-05-02 19:37:06 +02:00
Messages.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
No_access.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Office.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Persons.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Receivings.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Reports.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Sales.php
Fix permission bypass in Sales.getManage() access control (#4428)
2026-03-13 17:52:07 +00:00
Secure_Controller.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Suppliers.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Tax_categories.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Tax_codes.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Tax_jurisdictions.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00
Taxes.php
Use Content-Type application/json for AJAX responses (#4357)
2026-03-04 21:42:35 +01:00