Ollama b2fadea44a Fix broken SQL injection fix - use havingLike() instead of having() with named params ...

The previous SQL injection fix (GHSA-hmjv-wm3j-pfhw) used named parameter
syntax :search: with having(), but CodeIgniter 4's having() method does
not support named parameters. This caused the query to fail.

The fix uses havingLike() which properly:
- Escapes the search value to prevent SQL injection
- Handles the LIKE clause construction internally (wraps value with %)
- Works correctly with HAVING clauses for aggregated columns

This maintains the security fix while actually working on CI4.

2026-03-08 22:48:43 +01:00

..

Config

Refactor: Move ADMIN_MODULES to constants, rename methods to camelCase

2026-03-06 17:25:25 +01:00

Controllers

Fix stored XSS vulnerability in item descriptions

2026-03-07 20:51:48 +01:00

Database

Add migration to fix existing image filenames with spaces (#4372)

2026-03-06 17:09:52 +01:00

Events

Improve code style and PSR-12 compliance (#4204)

2025-05-02 19:37:06 +02:00

Filters

Upgrade to CodeIgniter 4.1.3

2024-06-15 17:19:15 +02:00

Helpers

Fix stored XSS vulnerabilities in employee permissions and customer data

2026-03-08 18:42:30 +01:00

Language

dd validation for invalid stock locations in CSV import (#4399)

2026-03-06 13:17:52 +01:00

Libraries

fix(security): whitelist and validate invoice template types (#4393)

2026-03-06 13:18:47 +01:00

Models

Fix broken SQL injection fix - use havingLike() instead of having() with named params

2026-03-08 22:48:43 +01:00

ThirdParty

Improve code style and PSR-12 compliance (#4204)

2025-05-02 19:37:06 +02:00

Views

Fix payment type becoming null when editing sales

2026-03-08 22:34:47 +01:00

.htaccess

Improve code style and PSR-12 compliance (#4204)

2025-05-02 19:37:06 +02:00

Common.php

Upgrade CI to 4.4.3

2024-06-15 17:19:15 +02:00

index.html

Corrected link in README.md

2024-06-15 17:19:15 +02:00