opensourcepos

0 Fork 0

mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-09-14 22:37:03 -04:00

Files

T

jekkos bdbc6d9cf1 fix(sales): gate getSearch behind reports_sales grant

Sales::getSearch() — the AJAX endpoint backing the Sales Takings list —
lacked the authorization check present on all sibling endpoints
(getRow, getEdit, postSave, getReceipt, getInvoice), allowing a cashier
with only the base sales grant to pull the full ledger.

- Add reports_sales guard with 403 JSON response on denial
- Add regression tests: cashier without grant → 403; employee with
  grant → search payload returned
- Clarify getSearch() coverage in SalesControllerTest comments
- Remove duplicate test methods introduced during initial commit

2026-09-07 10:54:35 +04:00

ConfigTest.php

fix(config): validate theme param to prevent XSS via invalid theme (#4620 )

2026-08-07 02:18:44 +04:00

CustomersCsvImportTest.php

fix(security): Fix DOMPDF RCE and customer email sanitization (#4568 )

2026-06-09 17:58:52 +02:00

EmployeesControllerTest.php

fix(sales): gate per-record endpoints behind reports_sales grant (#4627 )

2026-08-23 17:40:06 +04:00

HomeTest.php

fix(reports, home): resolve double-URL-decoding bypass for method grants (#4660 ) (#4666 )