Update application/modules/clients/controllers/Clients.php

nielsdrost7 · Copilot · web-flow · commit 5f4c8fdc8d9a · 2026-01-03T20:19:51.000+01:00
Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
diff --git a/application/modules/clients/controllers/Clients.php b/application/modules/clients/controllers/Clients.php
@@ -344,41 +344,59 @@ private function get_client_title_choices(): array
         );
     }
 
+    /**
+     * Sanitize a value for safe inclusion in log messages.
+     *
+     * Removes newline and carriage-return characters and casts to string
+     * to prevent log injection.
+     */
+    private function sanitize_for_log($value): string
+    {
+        $sanitized = (string) $value;
+        $sanitized = str_replace(array("\r", "\n"), ' ', $sanitized);
+
+        return $sanitized;
+    }
+
     private function check_client_einvoice_active($client, $req_einvoicing) {
         // Update active eInvoicing client
         // Check if database has been migrated to 1.6.3+ (where einvoicing fields were added)
-        
+
+        $clientIdForLog = $this->sanitize_for_log($client->client_id);
+
         if (!property_exists($client, 'client_einvoicing_active') || !property_exists($client, 'client_einvoicing_version')) {
             // Fields don't exist - database hasn't been migrated to 1.6.3+
             $this->load->model('settings/mdl_versions');
             $current_version = $this->mdl_versions->get_current_version();
             $current_version = $current_version ?: 'unknown';
-            
-            log_message('warning', '[eInvoicing] Database version mismatch detected in check_client_einvoice_active: Running source code 1.6.3+ with database version ' . $current_version);
-            log_message('warning', '[eInvoicing] Missing fields: client_einvoicing_active and client_einvoicing_version not found in client object (client_id=' . $client->client_id . ')');
+            $currentVersionForLog = $this->sanitize_for_log($current_version);
+
+            log_message('warning', '[eInvoicing] Database version mismatch detected in check_client_einvoice_active: Running source code 1.6.3+ with database version ' . $currentVersionForLog);
+            log_message('warning', '[eInvoicing] Missing fields: client_einvoicing_active and client_einvoicing_version not found in client object (client_id=' . $clientIdForLog . ')');
             log_message('warning', '[eInvoicing] Please run database migration 039_1.6.3.sql to add these fields');
-            
+
             // Set default values on the client object to prevent further errors
             $client->client_einvoicing_active = 0;
             $client->client_einvoicing_version = '';
-            
+
             return $client;
         }
-        
+
         $o = $client->client_einvoicing_active;
-        log_message('debug', '[eInvoicing] check_client_einvoice_active: client_id=' . $client->client_id . ', current_active=' . $o . ', version=' . $client->client_einvoicing_version);
-        
+        $clientEinvoicingVersionForLog = $this->sanitize_for_log($client->client_einvoicing_version);
+        log_message('debug', '[eInvoicing] check_client_einvoice_active: client_id=' . $clientIdForLog . ', current_active=' . $o . ', version=' . $clientEinvoicingVersionForLog);
+
         if ( ! empty($client->client_einvoicing_version) && $req_einvoicing->clients[$client->client_id]->einvoicing_empty_fields == 0) {
             $client->client_einvoicing_active = 1; // update view
-            log_message('debug', '[eInvoicing] Setting client_einvoicing_active=1 for client_id=' . $client->client_id);
+            log_message('debug', '[eInvoicing] Setting client_einvoicing_active=1 for client_id=' . $clientIdForLog);
         } else {
             $client->client_einvoicing_active = 0; // update view
-            log_message('debug', '[eInvoicing] Setting client_einvoicing_active=0 for client_id=' . $client->client_id);
+            log_message('debug', '[eInvoicing] Setting client_einvoicing_active=0 for client_id=' . $clientIdForLog);
         }
 
         // Update db if need
         if ($o != $client->client_einvoicing_active) {
-            log_message('info', '[eInvoicing] Updating database: client_id=' . $client->client_id . ', client_einvoicing_active changed from ' . $o . ' to ' . $client->client_einvoicing_active);
+            log_message('info', '[eInvoicing] Updating database: client_id=' . $clientIdForLog . ', client_einvoicing_active changed from ' . $o . ' to ' . $client->client_einvoicing_active);
             $this->db->where('client_id', $client->client_id);
             $this->db->set('client_einvoicing_active', $client->client_einvoicing_active);
             $this->db->update('ip_clients');
