mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-10-28 19:18:58 -04:00
objecttothis
9253cfe836
Add ConfigControllerTest covering validation added to protect config save endpoints from injection and bypass attacks. - Mailpath validation: accept legit sendmail paths (with dots, trailing args), require mailpath when protocol is sendmail, reject command injection via shell metacharacters (e.g. semicolon) for both sendmail and non-sendmail protocols - postSaveLocale: verify payment_reference_code_min/max bounds (reject non-numeric, zero, negative, max < min; accept valid and min==max cases) - postSaveLocale: verify language_code allow-list enforcement against path traversal (forward/backslash variants), unknown languages, and case-mismatched codes (GHSA-related hardening) - postSaveGeneral: begin coverage of theme validation with a reusable base payload builder Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>