mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-03-07 16:47:03 -05:00
Complete Content-Type application/json fix for all AJAX responses - Add missing return statements to all ->response->setJSON() calls - Fix Items.php method calls from JSON() to setJSON() - Convert echo statements to proper JSON responses - Ensure consistent Content-Type headers across all controllers - Fix 46+ instances across 12 controller files - Change Config.php methods to : ResponseInterface (all return setJSON only): - postSaveRewards(), postSaveBarcode(), postSaveReceipt() - postSaveInvoice(), postRemoveLogo() - Update PHPDoc @return tags - Change Receivings.php _reload() to : string (only returns view) - Change Receivings.php methods to : string (all return _reload()): - getIndex(), postSelectSupplier(), postChangeMode(), postAdd() - postEditItem(), getDeleteItem(), getRemoveSupplier() - postComplete(), postRequisitionComplete(), getReceipt(), postCancelReceiving() - Change postSave() to : ResponseInterface (returns setJSON) - Update all PHPDoc @return tags Fix XSS vulnerabilities in sales templates, login, and config pages This commit addresses 5 XSS vulnerabilities by adding proper escaping to all user-controlled configuration values in HTML contexts. Fixed Files: - app/Views/sales/invoice.php: Escaped company_logo (URL context) and company (HTML) - app/Views/sales/work_order.php: Escaped company_logo (URL context) - app/Views/sales/receipt_email.php: Added file path validation and escaping for logo - app/Views/login.php: Escaped all config values in title, logo src, and alt - app/Views/configs/info_config.php: Escaped company_logo (URL context) Security Impact: - Prevents stored XSS attacks if configuration is compromised - Defense-in-depth principle applied to administrative interfaces - Follows OWASP best practices for output encoding Testing: - Verified no script execution with XSS payloads in config values - Confirmed proper escaping in HTML, URL, and file contexts - All templates render correctly with valid configuration Severity: High (4 files), Medium-High (1 file) CVSS Score: ~6.1 CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation) Fix critical password validation bypass and add unit tests This commit addresses a critical security vulnerability where the password minimum length check was performed on the HASHED password (always 60 characters for bcrypt) instead of the actual password before hashing. Vulnerability Details: - Original code: strlen($employee_data['password']) >= 8 - This compared the hash length (always 60) instead of raw password - Impact: Users could set 1-character passwords like "a" - Severity: Critical (enables brute force attacks on weak passwords) - CVE-like issue: CWE-307 (Improper Restriction of Excessive Authentication Attempts) Fix Applied: - Validate password length BEFORE hashing - Clear error message when password is too short - Added unit tests to verify minimum length enforcement - Regression test to prevent future vulnerability re-introduction Test Coverage: - testPasswordMinLength_Rejects7Characters: Verify 7 chars rejected - testPasswordMinLength_Accepts8Characters: Verify 8 chars accepted - testPasswordMinLength_RejectsEmptyString: Verify empty rejected - testPasswordMinLength_RejectsWhitespaceOnly: Verify whitespace rejected - testPasswordMinLength_AcceptsSpecialCharacters: Verify special chars OK - testPasswordMinLength_RejectsPreviousBehavior: Regression test for bug Files Modified: - app/Controllers/Home.php: Fixed password validation logic - tests/Controllers/HomeTest.php: Added comprehensive unit tests Security Impact: - Enforces 8-character minimum password policy - Prevents extremely weak passwords that facilitate brute-force attacks - Critical for credential security and user account protection Breaking Changes: - Users with passwords < 8 characters will need to reset their password - This is the intended security improvement Severity: Critical CVSS Score: ~7.5 CWE: CWE-305 (Authentication Bypass by Primary Weakness), CWE-307 Add GitHub Actions workflow to run PHPUnit tests Move business logic from views to controllers for better separation of concerns - Move logo URL computation from info_config view to Config::getIndex() - Move image base64 encoding from receipt_email view to Sales controller - Improves separation of concerns by keeping business logic in controllers - Simplifies view templates to only handle presentation Fix XSS vulnerabilities in report views - escape user-controllable summary data and labels Fix base64 encoding URL issue in delete payment - properly URL encode base64 string Fix remaining return type declarations for Sales controller Fixed additional methods that call _reload(): - postAdd() - returns _reload($data) - postAddPayment() - returns _reload($data) - postEditItem() - returns _reload($data) - postSuspend() - returns _reload($data) - postSetPaymentType() - returns _reload() All methods now return ResponseInterface|string to match _reload() signature. This resolves PHP TypeError errors.
118 lines
3.0 KiB
YAML
118 lines
3.0 KiB
YAML
name: PHPUnit Tests
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- '**.php'
|
|
- 'spark'
|
|
- 'tests/**'
|
|
- '.github/workflows/phpunit.yml'
|
|
- 'gulpfile.js'
|
|
- 'app/Database/**'
|
|
pull_request:
|
|
paths:
|
|
- '**.php'
|
|
- 'spark'
|
|
- 'tests/**'
|
|
- '.github/workflows/phpunit.yml'
|
|
- 'gulpfile.js'
|
|
- 'app/Database/**'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
name: PHP ${{ matrix.php-version }} Tests
|
|
runs-on: ubuntu-22.04
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
php-version:
|
|
- '8.1'
|
|
- '8.2'
|
|
- '8.3'
|
|
- '8.4'
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup PHP
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ matrix.php-version }}
|
|
extensions: intl, mbstring, mysqli
|
|
coverage: none
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Get npm cache directory
|
|
run: echo "NPM_CACHE_DIR=$(npm config get cache)" >> $GITHUB_ENV
|
|
|
|
- name: Cache npm dependencies
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ${{ env.NPM_CACHE_DIR }}
|
|
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-
|
|
|
|
- name: Install npm dependencies
|
|
run: npm install
|
|
|
|
- name: Build database.sql
|
|
run: npm run gulp build-database
|
|
|
|
- name: Start MariaDB
|
|
run: |
|
|
docker run -d --name mysql \
|
|
-e MYSQL_ROOT_PASSWORD=root \
|
|
-e MYSQL_DATABASE=ospos \
|
|
-e MYSQL_USER=admin \
|
|
-e MYSQL_PASSWORD=pointofsale \
|
|
-v $PWD/app/Database/database.sql:/docker-entrypoint-initdb.d/database.sql \
|
|
-p 3306:3306 \
|
|
mariadb:10.5
|
|
# Wait for MariaDB to be ready
|
|
until docker exec mysql mysqladmin ping -h 127.0.0.1 -u root -proot --silent; do
|
|
echo "Waiting for MariaDB..."
|
|
sleep 2
|
|
done
|
|
echo "MariaDB is ready!"
|
|
|
|
- name: Get composer cache directory
|
|
run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
|
|
|
|
- name: Cache dependencies
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ${{ env.COMPOSER_CACHE_FILES_DIR }}
|
|
key: ${{ runner.os }}-${{ matrix.php-version }}-${{ hashFiles('**/composer.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-${{ matrix.php-version }}-
|
|
${{ runner.os }}-
|
|
|
|
- name: Install dependencies
|
|
run: composer update --ansi --no-interaction
|
|
|
|
- name: Create .env file
|
|
run: cp .env.example .env
|
|
|
|
- name: Run PHPUnit tests
|
|
env:
|
|
CI_ENVIRONMENT: testing
|
|
MYSQL_HOST_NAME: 127.0.0.1
|
|
run: composer test
|
|
|
|
- name: Stop MariaDB
|
|
if: always()
|
|
run: docker stop mysql && docker rm mysql |