objecttothisandTravis Garrison 0808ffae0d fix(sales): escape quote number in email template to prevent XSS (#4625) ...

Wrap $quote_number output with esc() in quote_email.php. Raw
interpolation allowed injected HTML/JS via quote number field.

Signed-off-by: Travis Garrison <travis@chiraqbookstore.com>
Co-authored-by: Travis Garrison <travis@chiraqbookstore.com>

2026-08-07 02:21:19 +04:00

..

form.php

refactor: Replace var with let/const in JavaScript files (#4503)

2026-08-06 12:15:45 +04:00

help.php

Assignable Keyboard Shortcuts Updates (#4532)

2026-05-07 22:53:25 +04:00

invoice_email.php

Update to CodeIgniter 4.7.2 (#4485)

2026-04-14 01:05:10 +04:00

invoice.php

refactor: Replace var with let/const in JavaScript files (#4503)

2026-08-06 12:15:45 +04:00

manage.php

Update to CodeIgniter 4.7.2 (#4485)

2026-04-14 01:05:10 +04:00

quote_email.php

fix(sales): escape quote number in email template to prevent XSS (#4625)

2026-08-07 02:21:19 +04:00

quote.php

refactor: Replace var with let/const in JavaScript files (#4503)

2026-08-06 12:15:45 +04:00

receipt_default.php

Fix XSS vulnerabilities in invoices + receipts (#3965) (#4363)

2026-02-23 20:14:55 +01:00

receipt_email.php

Use Content-Type application/json for AJAX responses (#4357)

2026-03-04 21:42:35 +01:00

receipt_short.php

Fix XSS vulnerabilities in invoices + receipts (#3965) (#4363)

2026-02-23 20:14:55 +01:00

receipt.php

refactor: Replace var with let/const in JavaScript files (#4503)

2026-08-06 12:15:45 +04:00

register.php

Feature: Payment reference code (#4587)

2026-07-10 13:49:05 +04:00

suspended.php

Fix for suspended sales (#4283) (#4303)

2025-08-15 23:12:35 +02:00

tax_invoice.php

refactor: Replace var with let/const in JavaScript files (#4503)

2026-08-06 12:15:45 +04:00

work_order_email.php

chore: miscellaneous updates and improvements (#4530)

2026-05-08 09:07:52 +02:00

work_order.php

refactor: Replace var with let/const in JavaScript files (#4503)

2026-08-06 12:15:45 +04:00