mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-03-13 12:43:52 -04:00
Complete Content-Type application/json fix for all AJAX responses - Add missing return statements to all ->response->setJSON() calls - Fix Items.php method calls from JSON() to setJSON() - Convert echo statements to proper JSON responses - Ensure consistent Content-Type headers across all controllers - Fix 46+ instances across 12 controller files - Change Config.php methods to : ResponseInterface (all return setJSON only): - postSaveRewards(), postSaveBarcode(), postSaveReceipt() - postSaveInvoice(), postRemoveLogo() - Update PHPDoc @return tags - Change Receivings.php _reload() to : string (only returns view) - Change Receivings.php methods to : string (all return _reload()): - getIndex(), postSelectSupplier(), postChangeMode(), postAdd() - postEditItem(), getDeleteItem(), getRemoveSupplier() - postComplete(), postRequisitionComplete(), getReceipt(), postCancelReceiving() - Change postSave() to : ResponseInterface (returns setJSON) - Update all PHPDoc @return tags Fix XSS vulnerabilities in sales templates, login, and config pages This commit addresses 5 XSS vulnerabilities by adding proper escaping to all user-controlled configuration values in HTML contexts. Fixed Files: - app/Views/sales/invoice.php: Escaped company_logo (URL context) and company (HTML) - app/Views/sales/work_order.php: Escaped company_logo (URL context) - app/Views/sales/receipt_email.php: Added file path validation and escaping for logo - app/Views/login.php: Escaped all config values in title, logo src, and alt - app/Views/configs/info_config.php: Escaped company_logo (URL context) Security Impact: - Prevents stored XSS attacks if configuration is compromised - Defense-in-depth principle applied to administrative interfaces - Follows OWASP best practices for output encoding Testing: - Verified no script execution with XSS payloads in config values - Confirmed proper escaping in HTML, URL, and file contexts - All templates render correctly with valid configuration Severity: High (4 files), Medium-High (1 file) CVSS Score: ~6.1 CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation) Fix critical password validation bypass and add unit tests This commit addresses a critical security vulnerability where the password minimum length check was performed on the HASHED password (always 60 characters for bcrypt) instead of the actual password before hashing. Vulnerability Details: - Original code: strlen($employee_data['password']) >= 8 - This compared the hash length (always 60) instead of raw password - Impact: Users could set 1-character passwords like "a" - Severity: Critical (enables brute force attacks on weak passwords) - CVE-like issue: CWE-307 (Improper Restriction of Excessive Authentication Attempts) Fix Applied: - Validate password length BEFORE hashing - Clear error message when password is too short - Added unit tests to verify minimum length enforcement - Regression test to prevent future vulnerability re-introduction Test Coverage: - testPasswordMinLength_Rejects7Characters: Verify 7 chars rejected - testPasswordMinLength_Accepts8Characters: Verify 8 chars accepted - testPasswordMinLength_RejectsEmptyString: Verify empty rejected - testPasswordMinLength_RejectsWhitespaceOnly: Verify whitespace rejected - testPasswordMinLength_AcceptsSpecialCharacters: Verify special chars OK - testPasswordMinLength_RejectsPreviousBehavior: Regression test for bug Files Modified: - app/Controllers/Home.php: Fixed password validation logic - tests/Controllers/HomeTest.php: Added comprehensive unit tests Security Impact: - Enforces 8-character minimum password policy - Prevents extremely weak passwords that facilitate brute-force attacks - Critical for credential security and user account protection Breaking Changes: - Users with passwords < 8 characters will need to reset their password - This is the intended security improvement Severity: Critical CVSS Score: ~7.5 CWE: CWE-305 (Authentication Bypass by Primary Weakness), CWE-307 Add GitHub Actions workflow to run PHPUnit tests Move business logic from views to controllers for better separation of concerns - Move logo URL computation from info_config view to Config::getIndex() - Move image base64 encoding from receipt_email view to Sales controller - Improves separation of concerns by keeping business logic in controllers - Simplifies view templates to only handle presentation Fix XSS vulnerabilities in report views - escape user-controllable summary data and labels Fix base64 encoding URL issue in delete payment - properly URL encode base64 string Fix remaining return type declarations for Sales controller Fixed additional methods that call _reload(): - postAdd() - returns _reload($data) - postAddPayment() - returns _reload($data) - postEditItem() - returns _reload($data) - postSuspend() - returns _reload($data) - postSetPaymentType() - returns _reload() All methods now return ResponseInterface|string to match _reload() signature. This resolves PHP TypeError errors.
190 lines
8.2 KiB
PHP
190 lines
8.2 KiB
PHP
<?php
|
|
/**
|
|
* @var bool $logo_exists
|
|
* @var string $controller_name
|
|
* @var array $config
|
|
*/
|
|
?>
|
|
|
|
<?= form_open('config/saveInfo/', ['id' => 'info_config_form', 'enctype' => 'multipart/form-data', 'class' => 'form-horizontal']) ?>
|
|
<div id="config_wrapper">
|
|
<fieldset id="config_info">
|
|
|
|
<div id="required_fields_message"><?= lang('Common.fields_required_message') ?></div>
|
|
<ul id="info_error_message_box" class="error_message_box"></ul>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Config.company'), 'company', ['class' => 'control-label col-xs-2 required']) ?>
|
|
<div class="col-xs-6">
|
|
<div class="input-group">
|
|
<span class="input-group-addon input-sm">
|
|
<span class="glyphicon glyphicon-home"></span>
|
|
</span>
|
|
<?= form_input([
|
|
'name' => 'company',
|
|
'id' => 'company',
|
|
'class' => 'form-control input-sm required',
|
|
'value' => $config['company']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Config.company_logo'), 'company_logo', ['class' => 'control-label col-xs-2']) ?>
|
|
<div class="col-xs-6">
|
|
<div class="fileinput <?= $logo_exists ? 'fileinput-exists' : 'fileinput-new' ?>" data-provides="fileinput">
|
|
<div class="fileinput-new thumbnail" style="width: 200px; height: 200px;"></div>
|
|
<div class="fileinput-preview fileinput-exists thumbnail" style="max-width: 200px; max-height: 200px;">
|
|
<img data-src="holder.js/100%x100%" alt="<?= esc(lang('Config.company_logo')) ?>" src="<?= $logo_src ?>" style="max-height: 100%; max-width: 100%;">
|
|
</div>
|
|
<div>
|
|
<span class="btn btn-default btn-sm btn-file">
|
|
<span class="fileinput-new"><?= lang('Config.company_select_image') ?></span>
|
|
<span class="fileinput-exists"><?= lang('Config.company_change_image') ?></span>
|
|
<input type="file" name="company_logo">
|
|
</span>
|
|
<a href="#" class="btn btn-default btn-sm fileinput-exists" data-dismiss="fileinput"><?= lang('Config.company_remove_image') ?></a>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Config.address'), 'address', ['class' => 'control-label col-xs-2 required']) ?>
|
|
<div class="col-xs-6">
|
|
<?= form_textarea([
|
|
'name' => 'address',
|
|
'id' => 'address',
|
|
'class' => 'form-control input-sm required',
|
|
'value' => $config['address']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Config.website'), 'website', ['class' => 'control-label col-xs-2']) ?>
|
|
<div class="col-xs-6">
|
|
<div class="input-group">
|
|
<span class="input-group-addon input-sm">
|
|
<span class="glyphicon glyphicon-globe"></span>
|
|
</span>
|
|
<?= form_input([
|
|
'name' => 'website',
|
|
'id' => 'website',
|
|
'class' => 'form-control input-sm',
|
|
'value' => $config['website']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Common.email'), 'email', ['class' => 'control-label col-xs-2']) ?>
|
|
<div class="col-xs-6">
|
|
<div class="input-group">
|
|
<span class="input-group-addon input-sm">
|
|
<span class="glyphicon glyphicon-envelope"></span>
|
|
</span>
|
|
<?= form_input([
|
|
'name' => 'email',
|
|
'id' => 'email',
|
|
'type' => 'email',
|
|
'class' => 'form-control input-sm',
|
|
'value' => $config['email']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Config.phone'), 'phone', ['class' => 'control-label col-xs-2 required']) ?>
|
|
<div class="col-xs-6">
|
|
<div class="input-group">
|
|
<span class="input-group-addon input-sm">
|
|
<span class="glyphicon glyphicon-phone-alt"></span>
|
|
</span>
|
|
<?= form_input([
|
|
'name' => 'phone',
|
|
'id' => 'phone',
|
|
'class' => 'form-control input-sm required',
|
|
'value' => $config['phone']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Config.fax'), 'fax', ['class' => 'control-label col-xs-2']) ?>
|
|
<div class="col-xs-6">
|
|
<div class="input-group">
|
|
<span class="input-group-addon input-sm">
|
|
<span class="glyphicon glyphicon-phone-alt"></span>
|
|
</span>
|
|
<?= form_input([
|
|
'name' => 'fax',
|
|
'id' => 'fax',
|
|
'class' => 'form-control input-sm',
|
|
'value' => $config['fax']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group form-group-sm">
|
|
<?= form_label(lang('Common.return_policy'), 'return_policy', ['class' => 'control-label col-xs-2 required']) ?>
|
|
<div class="col-xs-6">
|
|
<?= form_textarea([
|
|
'name' => 'return_policy',
|
|
'id' => 'return_policy',
|
|
'class' => 'form-control input-sm required',
|
|
'value' => $config['return_policy']
|
|
]) ?>
|
|
</div>
|
|
</div>
|
|
|
|
<?= form_submit([
|
|
'name' => 'submit_info',
|
|
'id' => 'submit_info',
|
|
'value' => lang('Common.submit'),
|
|
'class' => 'btn btn-primary btn-sm pull-right'
|
|
]) ?>
|
|
|
|
</fieldset>
|
|
</div>
|
|
<?= form_close() ?>
|
|
|
|
<script type="text/javascript">
|
|
// Validation and submit handling
|
|
$(document).ready(function() {
|
|
$("a.fileinput-exists").click(function() {
|
|
$.ajax({
|
|
type: 'POST',
|
|
url: '<?= "$controller_name/removeLogo"; ?>',
|
|
dataType: 'json'
|
|
})
|
|
});
|
|
|
|
$('#info_config_form').validate($.extend(form_support.handler, {
|
|
|
|
errorLabelContainer: "#info_error_message_box",
|
|
|
|
rules: {
|
|
company: "required",
|
|
address: "required",
|
|
phone: "required",
|
|
email: "email",
|
|
return_policy: "required"
|
|
},
|
|
|
|
messages: {
|
|
company: "<?= lang('Config.company_required') ?>",
|
|
address: "<?= lang('Config.address_required') ?>",
|
|
phone: "<?= lang('Config.phone_required') ?>",
|
|
email: "<?= lang('Common.email_invalid_format') ?>",
|
|
return_policy: "<?= lang('Config.return_policy_required') ?>"
|
|
}
|
|
}));
|
|
});
|
|
</script>
|