mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-03-07 16:47:03 -05:00
Complete Content-Type application/json fix for all AJAX responses - Add missing return statements to all ->response->setJSON() calls - Fix Items.php method calls from JSON() to setJSON() - Convert echo statements to proper JSON responses - Ensure consistent Content-Type headers across all controllers - Fix 46+ instances across 12 controller files - Change Config.php methods to : ResponseInterface (all return setJSON only): - postSaveRewards(), postSaveBarcode(), postSaveReceipt() - postSaveInvoice(), postRemoveLogo() - Update PHPDoc @return tags - Change Receivings.php _reload() to : string (only returns view) - Change Receivings.php methods to : string (all return _reload()): - getIndex(), postSelectSupplier(), postChangeMode(), postAdd() - postEditItem(), getDeleteItem(), getRemoveSupplier() - postComplete(), postRequisitionComplete(), getReceipt(), postCancelReceiving() - Change postSave() to : ResponseInterface (returns setJSON) - Update all PHPDoc @return tags Fix XSS vulnerabilities in sales templates, login, and config pages This commit addresses 5 XSS vulnerabilities by adding proper escaping to all user-controlled configuration values in HTML contexts. Fixed Files: - app/Views/sales/invoice.php: Escaped company_logo (URL context) and company (HTML) - app/Views/sales/work_order.php: Escaped company_logo (URL context) - app/Views/sales/receipt_email.php: Added file path validation and escaping for logo - app/Views/login.php: Escaped all config values in title, logo src, and alt - app/Views/configs/info_config.php: Escaped company_logo (URL context) Security Impact: - Prevents stored XSS attacks if configuration is compromised - Defense-in-depth principle applied to administrative interfaces - Follows OWASP best practices for output encoding Testing: - Verified no script execution with XSS payloads in config values - Confirmed proper escaping in HTML, URL, and file contexts - All templates render correctly with valid configuration Severity: High (4 files), Medium-High (1 file) CVSS Score: ~6.1 CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation) Fix critical password validation bypass and add unit tests This commit addresses a critical security vulnerability where the password minimum length check was performed on the HASHED password (always 60 characters for bcrypt) instead of the actual password before hashing. Vulnerability Details: - Original code: strlen($employee_data['password']) >= 8 - This compared the hash length (always 60) instead of raw password - Impact: Users could set 1-character passwords like "a" - Severity: Critical (enables brute force attacks on weak passwords) - CVE-like issue: CWE-307 (Improper Restriction of Excessive Authentication Attempts) Fix Applied: - Validate password length BEFORE hashing - Clear error message when password is too short - Added unit tests to verify minimum length enforcement - Regression test to prevent future vulnerability re-introduction Test Coverage: - testPasswordMinLength_Rejects7Characters: Verify 7 chars rejected - testPasswordMinLength_Accepts8Characters: Verify 8 chars accepted - testPasswordMinLength_RejectsEmptyString: Verify empty rejected - testPasswordMinLength_RejectsWhitespaceOnly: Verify whitespace rejected - testPasswordMinLength_AcceptsSpecialCharacters: Verify special chars OK - testPasswordMinLength_RejectsPreviousBehavior: Regression test for bug Files Modified: - app/Controllers/Home.php: Fixed password validation logic - tests/Controllers/HomeTest.php: Added comprehensive unit tests Security Impact: - Enforces 8-character minimum password policy - Prevents extremely weak passwords that facilitate brute-force attacks - Critical for credential security and user account protection Breaking Changes: - Users with passwords < 8 characters will need to reset their password - This is the intended security improvement Severity: Critical CVSS Score: ~7.5 CWE: CWE-305 (Authentication Bypass by Primary Weakness), CWE-307 Add GitHub Actions workflow to run PHPUnit tests Move business logic from views to controllers for better separation of concerns - Move logo URL computation from info_config view to Config::getIndex() - Move image base64 encoding from receipt_email view to Sales controller - Improves separation of concerns by keeping business logic in controllers - Simplifies view templates to only handle presentation Fix XSS vulnerabilities in report views - escape user-controllable summary data and labels Fix base64 encoding URL issue in delete payment - properly URL encode base64 string Fix remaining return type declarations for Sales controller Fixed additional methods that call _reload(): - postAdd() - returns _reload($data) - postAddPayment() - returns _reload($data) - postEditItem() - returns _reload($data) - postSuspend() - returns _reload($data) - postSetPaymentType() - returns _reload() All methods now return ResponseInterface|string to match _reload() signature. This resolves PHP TypeError errors.
194 lines
7.9 KiB
PHP
194 lines
7.9 KiB
PHP
<?php
|
|
|
|
namespace App\Controllers;
|
|
|
|
use App\Models\Expense;
|
|
use App\Models\Expense_category;
|
|
use CodeIgniter\HTTP\ResponseInterface;
|
|
use Config\OSPOS;
|
|
use Config\Services;
|
|
|
|
class Expenses extends Secure_Controller
|
|
{
|
|
private Expense $expense;
|
|
private Expense_category $expense_category;
|
|
|
|
public function __construct()
|
|
{
|
|
parent::__construct('expenses');
|
|
|
|
$this->expense = model(Expense::class);
|
|
$this->expense_category = model(Expense_category::class);
|
|
}
|
|
|
|
/**
|
|
* @return void
|
|
*/
|
|
public function getIndex(): string
|
|
{
|
|
$data['table_headers'] = get_expenses_manage_table_headers();
|
|
|
|
// filters that will be loaded in the multiselect dropdown
|
|
$data['filters'] = [
|
|
'only_cash' => lang('Expenses.cash_filter'),
|
|
'only_due' => lang('Expenses.due_filter'),
|
|
'only_check' => lang('Expenses.check_filter'),
|
|
'only_credit' => lang('Expenses.credit_filter'),
|
|
'only_debit' => lang('Expenses.debit_filter'),
|
|
'is_deleted' => lang('Expenses.is_deleted')
|
|
];
|
|
|
|
return view('expenses/manage', $data);
|
|
}
|
|
|
|
/**
|
|
* @return void
|
|
*/
|
|
public function getSearch(): ResponseInterface
|
|
{
|
|
$search = $this->request->getGet('search');
|
|
$limit = $this->request->getGet('limit', FILTER_SANITIZE_NUMBER_INT);
|
|
$offset = $this->request->getGet('offset', FILTER_SANITIZE_NUMBER_INT);
|
|
$sort = $this->sanitizeSortColumn(expense_headers(), $this->request->getGet('sort', FILTER_SANITIZE_FULL_SPECIAL_CHARS), 'expense_id');
|
|
$order = $this->request->getGet('order', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
|
|
$filters = [
|
|
'start_date' => $this->request->getGet('start_date', FILTER_SANITIZE_FULL_SPECIAL_CHARS),
|
|
'end_date' => $this->request->getGet('end_date', FILTER_SANITIZE_FULL_SPECIAL_CHARS),
|
|
'only_cash' => false,
|
|
'only_due' => false,
|
|
'only_check' => false,
|
|
'only_credit' => false,
|
|
'only_debit' => false,
|
|
'is_deleted' => false
|
|
];
|
|
|
|
// Check if any filter is set in the multiselect dropdown
|
|
$request_filters = array_fill_keys($this->request->getGet('filters', FILTER_SANITIZE_FULL_SPECIAL_CHARS) ?? [], true);
|
|
$filters = array_merge($filters, $request_filters);
|
|
$expenses = $this->expense->search($search, $filters, $limit, $offset, $sort, $order);
|
|
$total_rows = $this->expense->get_found_rows($search, $filters);
|
|
$payments = $this->expense->get_payments_summary($search, $filters);
|
|
$payment_summary = get_expenses_manage_payments_summary($payments, $expenses);
|
|
$data_rows = [];
|
|
|
|
foreach ($expenses->getResult() as $expense) {
|
|
$data_rows[] = get_expenses_data_row($expense);
|
|
}
|
|
|
|
if ($total_rows > 0) {
|
|
$data_rows[] = get_expenses_data_last_row($expenses);
|
|
}
|
|
|
|
return $this->response->setJSON(['total' => $total_rows, 'rows' => $data_rows, 'payment_summary' => $payment_summary]);
|
|
}
|
|
|
|
/**
|
|
* @param int $expense_id
|
|
* @return void
|
|
*/
|
|
public function getView(int $expense_id = NEW_ENTRY): string
|
|
{
|
|
$data = []; // TODO: Duplicated code
|
|
|
|
$data['employees'] = [];
|
|
foreach ($this->employee->get_all()->getResult() as $employee) {
|
|
foreach (get_object_vars($employee) as $property => $value) {
|
|
$employee->$property = $value;
|
|
}
|
|
|
|
$data['employees'][$employee->person_id] = $employee->first_name . ' ' . $employee->last_name;
|
|
}
|
|
|
|
$data['expenses_info'] = $this->expense->get_info($expense_id);
|
|
|
|
$expense_categories = [];
|
|
foreach ($this->expense_category->get_all(0, 0, true)->getResultArray() as $row) {
|
|
$expense_categories[$row['expense_category_id']] = $row['category_name'];
|
|
}
|
|
$data['expense_categories'] = $expense_categories;
|
|
|
|
$expense_id = $data['expenses_info']->expense_id;
|
|
|
|
if ($expense_id == NEW_ENTRY) {
|
|
$data['expenses_info']->date = date('Y-m-d H:i:s');
|
|
$data['expenses_info']->employee_id = $this->employee->get_logged_in_employee_info()->person_id;
|
|
}
|
|
|
|
$data['payments'] = [];
|
|
foreach ($this->expense->get_expense_payment($expense_id)->getResult() as $payment) {
|
|
foreach (get_object_vars($payment) as $property => $value) {
|
|
$payment->$property = $value;
|
|
}
|
|
|
|
$data['payments'][] = $payment;
|
|
}
|
|
|
|
// Don't allow gift card to be a payment option in a sale transaction edit because it's a complex change
|
|
$data['payment_options'] = $this->expense->get_payment_options();
|
|
|
|
return view("expenses/form", $data);
|
|
}
|
|
|
|
/**
|
|
* @param int $row_id
|
|
* @return ResponseInterface
|
|
*/
|
|
public function getRow(int $row_id): ResponseInterface
|
|
{
|
|
$expense_info = $this->expense->get_info($row_id);
|
|
$data_row = get_expenses_data_row($expense_info);
|
|
|
|
return $this->response->setJSON($data_row);
|
|
}
|
|
|
|
/**
|
|
* @param int $expense_id
|
|
* @return ResponseInterface
|
|
*/
|
|
public function postSave(int $expense_id = NEW_ENTRY): ResponseInterface
|
|
{
|
|
$config = config(OSPOS::class)->settings;
|
|
$newdate = $this->request->getPost('date', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
|
|
|
|
$date_formatter = date_create_from_format($config['dateformat'] . ' ' . $config['timeformat'], $newdate);
|
|
|
|
$expense_data = [
|
|
'date' => $date_formatter->format('Y-m-d H:i:s'),
|
|
'supplier_id' => $this->request->getPost('supplier_id') == '' ? null : $this->request->getPost('supplier_id', FILTER_SANITIZE_NUMBER_INT),
|
|
'supplier_tax_code' => $this->request->getPost('supplier_tax_code', FILTER_SANITIZE_FULL_SPECIAL_CHARS),
|
|
'amount' => parse_decimals($this->request->getPost('amount')),
|
|
'tax_amount' => parse_decimals($this->request->getPost('tax_amount')),
|
|
'payment_type' => $this->request->getPost('payment_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS),
|
|
'expense_category_id' => $this->request->getPost('expense_category_id', FILTER_SANITIZE_NUMBER_INT),
|
|
'description' => $this->request->getPost('description', FILTER_SANITIZE_FULL_SPECIAL_CHARS),
|
|
'employee_id' => $this->request->getPost('employee_id', FILTER_SANITIZE_NUMBER_INT),
|
|
'deleted' => $this->request->getPost('deleted') != null
|
|
];
|
|
|
|
if ($this->expense->save_value($expense_data, $expense_id)) {
|
|
// New Expense
|
|
if ($expense_id == NEW_ENTRY) {
|
|
return $this->response->setJSON(['success' => true, 'message' => lang('Expenses.successful_adding'), 'id' => $expense_data['expense_id']]);
|
|
} else { // Existing Expense
|
|
return $this->response->setJSON(['success' => true, 'message' => lang('Expenses.successful_updating'), 'id' => $expense_id]);
|
|
}
|
|
} else { // Failure
|
|
return $this->response->setJSON(['success' => false, 'message' => lang('Expenses.error_adding_updating'), 'id' => NEW_ENTRY]);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return ResponseInterface
|
|
*/
|
|
public function postDelete(): ResponseInterface
|
|
{
|
|
$expenses_to_delete = $this->request->getPost('ids', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
|
|
|
|
if ($this->expense->delete_list($expenses_to_delete)) {
|
|
return $this->response->setJSON(['success' => true, 'message' => lang('Expenses.successful_deleted') . ' ' . count($expenses_to_delete) . ' ' . lang('Expenses.one_or_multiple'), 'ids' => $expenses_to_delete]);
|
|
} else {
|
|
return $this->response->setJSON(['success' => false, 'message' => lang('Expenses.cannot_be_deleted'), 'ids' => $expenses_to_delete]);
|
|
}
|
|
}
|
|
}
|