mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-13 13:57:34 -04:00
objecttothisandTravis Garrison
f5ba1709eb
* fix(security): sanitize filenames and escape logo path in config - Sanitize uploaded filename in Config.php via preg_replace, strip chars outside [a-zA-Z0-9_-] before storing raw_name - Escape $logo_src with esc(..., 'attr') in info_config.php view to prevent XSS via crafted logo path/filename Prevents stored XSS and path traversal from unsanitized filenames used in config uploads. Signed-off-by: Travis Garrison <travis@chiraqbookstore.com> * fix(config): sanitize uploaded config filenames Replace inline regex filename sanitization with sanitize_filename() helper to prevent path traversal via crafted upload filenames. Signed-off-by: Travis Garrison <travis@chiraqbookstore.com> --------- Signed-off-by: Travis Garrison <travis@chiraqbookstore.com> Co-authored-by: Travis Garrison <travis@chiraqbookstore.com>