Ollama 8da4aff262 fix(security): prevent command injection in sendmail path configuration ...

Add validation for the mailpath POST parameter to prevent command injection
attacks. The path is validated to only allow alphanumeric characters,
underscores, dashes, forward slashes, and dots.

- Required mailpath when protocol is "sendmail"
- Validates format for all non-empty mailpath values
- Blocks common injection vectors: ; | & ` $() spaces newlines
- Added mailpath_invalid translation to all 43 language files
- Simplified validation logic to avoid redundant conditions

Files changed:
- app/Controllers/Config.php: Add regex validation with protocol check
- app/Language/*/Config.php: Add mailpath_invalid error message (43 languages)
- tests/Controllers/ConfigTest.php: Unit tests for validation

2026-04-06 18:37:07 +00:00

..

ConfigTest.php

fix(security): prevent command injection in sendmail path configuration

2026-04-06 18:37:07 +00:00

EmployeesControllerTest.php

Fix broken object-level authorization in Employees controller (CVE-worthy) (#4391)

2026-03-05 19:46:39 +01:00

HomeTest.php

Fix IDOR vulnerability in password change (GHSA-mcc2-8rp2-q6ch) (#4427)

2026-03-13 12:13:21 +01:00

ItemsCsvImportTest.php

dd validation for invalid stock locations in CSV import (#4399)

2026-03-06 13:17:52 +01:00

ReportsControllerTest.php

Fix broken object-level authorization in Employees controller (CVE-worthy) (#4391)

2026-03-05 19:46:39 +01:00