mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-03-12 04:02:19 -04:00
690f43578d
Complete Content-Type application/json fix for all AJAX responses - Add missing return statements to all ->response->setJSON() calls - Fix Items.php method calls from JSON() to setJSON() - Convert echo statements to proper JSON responses - Ensure consistent Content-Type headers across all controllers - Fix 46+ instances across 12 controller files - Change Config.php methods to : ResponseInterface (all return setJSON only): - postSaveRewards(), postSaveBarcode(), postSaveReceipt() - postSaveInvoice(), postRemoveLogo() - Update PHPDoc @return tags - Change Receivings.php _reload() to : string (only returns view) - Change Receivings.php methods to : string (all return _reload()): - getIndex(), postSelectSupplier(), postChangeMode(), postAdd() - postEditItem(), getDeleteItem(), getRemoveSupplier() - postComplete(), postRequisitionComplete(), getReceipt(), postCancelReceiving() - Change postSave() to : ResponseInterface (returns setJSON) - Update all PHPDoc @return tags Fix XSS vulnerabilities in sales templates, login, and config pages This commit addresses 5 XSS vulnerabilities by adding proper escaping to all user-controlled configuration values in HTML contexts. Fixed Files: - app/Views/sales/invoice.php: Escaped company_logo (URL context) and company (HTML) - app/Views/sales/work_order.php: Escaped company_logo (URL context) - app/Views/sales/receipt_email.php: Added file path validation and escaping for logo - app/Views/login.php: Escaped all config values in title, logo src, and alt - app/Views/configs/info_config.php: Escaped company_logo (URL context) Security Impact: - Prevents stored XSS attacks if configuration is compromised - Defense-in-depth principle applied to administrative interfaces - Follows OWASP best practices for output encoding Testing: - Verified no script execution with XSS payloads in config values - Confirmed proper escaping in HTML, URL, and file contexts - All templates render correctly with valid configuration Severity: High (4 files), Medium-High (1 file) CVSS Score: ~6.1 CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation) Fix critical password validation bypass and add unit tests This commit addresses a critical security vulnerability where the password minimum length check was performed on the HASHED password (always 60 characters for bcrypt) instead of the actual password before hashing. Vulnerability Details: - Original code: strlen($employee_data['password']) >= 8 - This compared the hash length (always 60) instead of raw password - Impact: Users could set 1-character passwords like "a" - Severity: Critical (enables brute force attacks on weak passwords) - CVE-like issue: CWE-307 (Improper Restriction of Excessive Authentication Attempts) Fix Applied: - Validate password length BEFORE hashing - Clear error message when password is too short - Added unit tests to verify minimum length enforcement - Regression test to prevent future vulnerability re-introduction Test Coverage: - testPasswordMinLength_Rejects7Characters: Verify 7 chars rejected - testPasswordMinLength_Accepts8Characters: Verify 8 chars accepted - testPasswordMinLength_RejectsEmptyString: Verify empty rejected - testPasswordMinLength_RejectsWhitespaceOnly: Verify whitespace rejected - testPasswordMinLength_AcceptsSpecialCharacters: Verify special chars OK - testPasswordMinLength_RejectsPreviousBehavior: Regression test for bug Files Modified: - app/Controllers/Home.php: Fixed password validation logic - tests/Controllers/HomeTest.php: Added comprehensive unit tests Security Impact: - Enforces 8-character minimum password policy - Prevents extremely weak passwords that facilitate brute-force attacks - Critical for credential security and user account protection Breaking Changes: - Users with passwords < 8 characters will need to reset their password - This is the intended security improvement Severity: Critical CVSS Score: ~7.5 CWE: CWE-305 (Authentication Bypass by Primary Weakness), CWE-307 Add GitHub Actions workflow to run PHPUnit tests Move business logic from views to controllers for better separation of concerns - Move logo URL computation from info_config view to Config::getIndex() - Move image base64 encoding from receipt_email view to Sales controller - Improves separation of concerns by keeping business logic in controllers - Simplifies view templates to only handle presentation Fix XSS vulnerabilities in report views - escape user-controllable summary data and labels Fix base64 encoding URL issue in delete payment - properly URL encode base64 string Fix remaining return type declarations for Sales controller Fixed additional methods that call _reload(): - postAdd() - returns _reload($data) - postAddPayment() - returns _reload($data) - postEditItem() - returns _reload($data) - postSuspend() - returns _reload($data) - postSetPaymentType() - returns _reload() All methods now return ResponseInterface|string to match _reload() signature. This resolves PHP TypeError errors.
103 lines
3.8 KiB
PHP
103 lines
3.8 KiB
PHP
<?php
|
|
/**
|
|
* @var string $title
|
|
* @var string $subtitle
|
|
* @var array $overall_summary_data
|
|
* @var array $details_data
|
|
* @var array $headers
|
|
* @var array $summary_data
|
|
* @var array $config
|
|
*/
|
|
?>
|
|
|
|
<?= view('partial/header') ?>
|
|
|
|
<div id="page_title"><?= esc($title) ?></div>
|
|
|
|
<div id="page_subtitle"><?= esc($subtitle) ?></div>
|
|
|
|
<div id="toolbar">
|
|
<div class="pull-left form-inline" role="toolbar">
|
|
<!-- Toggle Button -->
|
|
<button id="toggleCostProfitButton" class="btn btn-default btn-sm print_hide">
|
|
<?php echo lang('Reports.toggle_cost_and_profit'); ?>
|
|
</button>
|
|
</div>
|
|
</div>
|
|
|
|
<div id="table_holder">
|
|
<table id="table"></table>
|
|
</div>
|
|
|
|
<div id="report_summary">
|
|
<?php foreach ($overall_summary_data as $name => $value) { ?>
|
|
<div class="summary_row"><?= lang("Reports.$name") . ': ' . esc(to_currency($value)) ?></div>
|
|
<?php } ?>
|
|
</div>
|
|
|
|
<script type="text/javascript">
|
|
$(document).ready(function () {
|
|
<?= view('partial/bootstrap_tables_locale') ?>
|
|
|
|
var details_data = <?= json_encode(esc($details_data)) ?>;
|
|
<?php if ($config['customer_reward_enable'] && !empty($details_data_rewards)) { ?>
|
|
var details_data_rewards = <?= json_encode(esc($details_data_rewards)) ?>;
|
|
<?php } ?>
|
|
<?= view('partial/visibility_js') ?>
|
|
|
|
var init_dialog = function () {
|
|
<?php if (isset($editable)) { ?>
|
|
table_support.submit_handler('<?= esc(site_url("reports/get_detailed_$editable" . '_row')) ?>');
|
|
dialog_support.init("a.modal-dlg");
|
|
<?php } ?>
|
|
};
|
|
|
|
$('#table')
|
|
.addClass("table-striped")
|
|
.addClass("table-bordered")
|
|
.bootstrapTable({
|
|
columns: applyColumnVisibility(<?= transform_headers(esc($headers['summary']), true) ?>),
|
|
stickyHeader: true,
|
|
stickyHeaderOffsetLeft: $('#table').offset().left + 'px',
|
|
stickyHeaderOffsetRight: $('#table').offset().right + 'px',
|
|
pageSize: <?= $config['lines_per_page'] ?>,
|
|
pagination: true,
|
|
sortable: true,
|
|
showColumns: true,
|
|
uniqueId: 'id',
|
|
showExport: true,
|
|
exportDataType: 'all',
|
|
exportTypes: ['json', 'xml', 'csv', 'txt', 'sql', 'excel', 'pdf'],
|
|
data: <?= json_encode($summary_data) ?>,
|
|
iconSize: 'sm',
|
|
paginationVAlign: 'bottom',
|
|
detailView: true,
|
|
escape: true,
|
|
search: true,
|
|
onPageChange: init_dialog,
|
|
onPostBody: function () {
|
|
dialog_support.init("a.modal-dlg");
|
|
},
|
|
onExpandRow: function (index, row, $detail) {
|
|
$detail.html('<table></table>').find("table").bootstrapTable({
|
|
columns: <?= transform_headers_readonly(esc($headers['details'])) ?>,
|
|
data: details_data[(!isNaN(row.id) && row.id) || $(row[0] || row.id).text().replace(
|
|
/(POS|RECV)\s*/g, '')]
|
|
});
|
|
|
|
<?php if ($config['customer_reward_enable'] && !empty($details_data_rewards)) { ?>
|
|
$detail.append('<table></table>').find("table").bootstrapTable({
|
|
columns: <?= transform_headers_readonly(esc($headers['details_rewards'])) ?>,
|
|
data: details_data_rewards[(!isNaN(row.id) && row.id) || $(row[0] || row.id).text().replace(
|
|
/(POS|RECV)\s*/g, '')]
|
|
});
|
|
<?php } ?>
|
|
}
|
|
});
|
|
|
|
init_dialog();
|
|
});
|
|
</script>
|
|
|
|
<?= view('partial/footer') ?>
|