jekkos 3108fda0a2 fix(items): enforce stock location authorization in postSaveInventory ...

Add is_allowed_location() check before processing inventory adjustments
to prevent employees from modifying stock at unauthorized locations.

Adds not_authorized language key and two regression tests:
- testPostSaveInventoryRejectsUnauthorizedStockLocation (403)
- testPostSaveInventoryAllowsAuthorizedStockLocation (200)

2026-11-08 07:50:12 +01:00

..

Attributes.php

feat(items): optimize search, attribute filtering, and sort for items view (#4652)

2026-10-02 14:56:20 +04:00

BaseController.php

chore: sync project files to match upstream templates (#4537)

2026-05-12 15:55:36 +02:00

Cashups.php

refactor(cashups): extract value object and focused methods in Cashups controller (#4786)

2026-11-02 03:59:07 +04:00

Config.php

feat(stock-locations): add default location and sort order support (#4643)

2026-10-27 14:36:34 +04:00

Customers.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Employees.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Expenses_categories.php

refactor(cashups): extract value object and focused methods in Cashups controller (#4786)

2026-11-02 03:59:07 +04:00

Expenses.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Giftcards.php

fix(giftcard): correct return type and rename getGiftcardId method (#4600)

2026-07-24 01:46:52 +04:00

Home.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

index.html

Replace tabs with spaces (#4196)

2025-03-28 21:24:21 +04:00

Item_kits.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Items.php

fix(items): enforce stock location authorization in postSaveInventory

2026-11-08 07:50:12 +01:00

Login.php

fix(migrations): prevent concurrent runs with pessimistic DB lock (#4769)

2026-11-02 15:21:02 +01:00

Messages.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

No_access.php

Feature admin account safeguards (#4657)

2026-08-27 11:29:32 +04:00

Office.php

Use Content-Type application/json for AJAX responses (#4357)

2026-03-04 21:42:35 +01:00

Persons.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Receivings.php

fix(receivings): gate per-record endpoints behind reports_receivings grant (#4798)

2026-11-03 00:00:43 +01:00

Reports.php

fix(receivings): gate per-record endpoints behind reports_receivings grant (#4798)

2026-11-03 00:00:43 +01:00

Sales.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Secure_Controller.php

feat(items): optimize search, attribute filtering, and sort for items view (#4652)

2026-10-02 14:56:20 +04:00

Suppliers.php

refactor: extract PSR-12 renames and independent bugfixes from plugin system PR (#4784)

2026-10-28 13:00:30 +04:00

Tax_categories.php

fix(security): prevent SQL injection in tax controller sort columns

2026-04-06 18:37:07 +00:00

Tax_codes.php

fix(security): prevent SQL injection in tax controller sort columns

2026-04-06 18:37:07 +00:00

Tax_jurisdictions.php

fix(security): prevent SQL injection in tax controller sort columns

2026-04-06 18:37:07 +00:00

Taxes.php

fix(taxes): reject negative tax rates and percentages (#4730)

2026-10-09 08:58:00 +02:00