mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-07-29 08:07:05 -04:00
6bdeb4f3e1
* feat(plugins): add sale document view hooks and a webhook CSRF exemption Plugins can already inject buttons into the receipt via view:sales_receipt_buttons, but the invoice, quote and work order views have no hook point, so a plugin that delivers sale documents can only reach one of the four. Add the matching hooks, keeping the same name/data shape: view:sales_invoice_buttons view:sales_quote_buttons view:sales_work_order_buttons Each passes ['saleId' => $sale_id_num] and sits in the same position as the existing receipt hook, so one plugin callback can serve all four and branch on the document type. Also allow a plugin to expose an inbound provider webhook. A server-to-server delivery carries no CSRF token and no session, so the global csrf filter now excludes the pattern plugins/*/webhook. Plugins are responsible for authenticating such requests themselves (typically by verifying the provider's signature header against a shared secret) — this is documented alongside the change. While editing that line, the except list becomes an array. CodeIgniter matches every entry as \A<pattern>\z, so the previous 'login|migrate' string produced a single pattern whose inner alternatives were unanchored: 'login/anything' was CSRF-exempt. Listing the entries separately anchors each one, which closes that and keeps the new plugin pattern tight — plugins/whatsapp/webhook is exempt while plugins/whatsapp/send is not. * refactor(plugins): drop explanatory comments from csrf filter exceptions --------- Co-authored-by: Joshua Fernandes <“joshua.1234511@yahoo.in”>