Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: InvoicePlane/InvoicePlane
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.7.0
Choose a base ref
...
head repository: InvoicePlane/InvoicePlane
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.7.1
Choose a head ref
  • 9 commits
  • 73 files changed
  • 6 contributors

Commits on Jan 19, 2026

  1. Apply suggestions from code review 

    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    @nielsdrost7 @coderabbitai
    nielsdrost7 and coderabbitai[bot] authored Jan 19, 2026
    Configuration menu
    Copy the full SHA
    c027d2f View commit details
    Browse the repository at this point in the history

  2. Update .github/workflows/README.md 

    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    @nielsdrost7 @coderabbitai
    nielsdrost7 and coderabbitai[bot] authored Jan 19, 2026
    Configuration menu
    Copy the full SHA
    19068cb View commit details
    Browse the repository at this point in the history

  3. Delete .github/workflows/quickstart.yml

    @nielsdrost7
    nielsdrost7 authored Jan 19, 2026
    Configuration menu
    Copy the full SHA
    1a4147a View commit details
    Browse the repository at this point in the history

Commits on Jan 20, 2026

  1. [WIP] Fix inconsistent language files in English (#1423) 

    * fixed error

Removed item discount display from invoice template.

* Initial plan

* Update custom_lang.php documentation to match modern array syntax

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
    @nielsdrost7
    Copilot and nielsdrost7 authored Jan 20, 2026
    Configuration menu
    Copy the full SHA
    3702a81 View commit details
    Browse the repository at this point in the history

  2. Fix GitHub Actions workflow issues from code review (#1399) 

    * Initial plan

* Fix workflow issues based on code review feedback

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve script regex and add clarifying comments

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add workflow artifacts to .gitignore

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve script comments for clarity

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Update .github/scripts/generate-package-update-report.cjs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Rename transientChanges to transitiveChanges

* Fix vendor-cleaner config to use single extra.dev-files./ key

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
    @nielsdrost7
    3 people authored Jan 20, 2026
    Configuration menu
    Copy the full SHA
    b927de9 View commit details
    Browse the repository at this point in the history

Commits on Feb 16, 2026

  1. v170 in to v171 (#1439) 

    * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429)

* fixed error

Removed item discount display from invoice template.

* Initial plan

* Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix additional XSS vulnerabilities in all quote/invoice number displays

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add XSS escaping for tax_rate_name and payment_method_name fields

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix XSS in guest view headers for quote/invoice numbers

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix remaining XSS in templates/mailer and add backend input sanitization

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve input sanitization comments for clarity

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix XSS in Sumex observations, client addresses, and custom field labels

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add backend XSS sanitization to Sumex fields and quote password/notes

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Block existing SVG logos from rendering to prevent XSS execution

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add SVG upload logging and README documentation for security change

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Fix log poisoning vulnerability in Upload controller (#1434)

* Initial plan

* Fix log poisoning vulnerability in Upload.php sanitize_file_name method

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433)

* fixed error

Removed item discount display from invoice template.

* Initial plan

* Add template validation to prevent LFI vulnerability

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve logging in LFI fix for better security monitoring

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix additional LFI vulnerabilities in PDF generation endpoints

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Address code review feedback - simplify default template logic

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Add validation for invoice_template parameters in generate_invoice_pdf()

- Validate invoice_template when passed as URL parameter
- Mirror the same security pattern used for quote_template validation
- Ensure all invoice template sources are validated before use
- Prevent LFI vulnerability through invoice_template parameter bypass

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435)

* Initial plan

* Fix three Stored XSS vulnerabilities by adding htmlsc() encoding

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix additional unit_name XSS vulnerabilities in quotes and products modules

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix XSS vulnerability in email template JavaScript context

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix filter_input() bug: Add input sanitization with logging and password bypass

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve filter_input: Add recursive array sanitization, remove double-encoding

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix sanitize_array: Add bypass support and consistent sanitization order

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add invoice_password and quote_password to sanitization bypass list

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Optimize XSS logging: move ip_address and user_agent to request level

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438)

* Initial plan

* Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add HTML sanitization to email template preview for defense-in-depth XSS protection

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Enhance XSS protection: remove style tag support, validate href protocols

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Optimize sanitization: cache tagName, add style tag to explicit removal list

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix GitHub Actions workflow issues identified in PR #1366 review (#1437)

* Initial plan

* Fix GitHub Actions workflows per review feedback

- composer-update.yml: Parse JSON advisories array instead of file size check
- composer-update.yml: Check both composer.lock and composer.json for changes
- release.yml: Update action-gh-release from v1 to v2
- release.yml: Fix vendor-cleaner config to use extra.dev-files structure
- README.md: Update yarn-update.yml Update Types to match workflow options
- Create generate-package-update-report.cjs script for yarn updates

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Address code review feedback

- composer-update.yml: Use double-dash separator before file paths in git diff
- generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix git diff logic and improve regex patterns

- composer-update.yml: Restore correct git diff logic to detect changes in either file
- generate-package-update-report.cjs: Use more restrictive regex patterns

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436)

* Initial plan

* Add comprehensive version 1.7.0 documentation to README and CHANGELOG

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix formatting and update version 1.7.0 details

* Add complete release notes with issue numbers and field sanitization details, remove emoticons

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Track all resolved versions per package in yarn.lock update report (#1440)

* Initial plan

* Refactor package update report script to track all versions per package using Map<string, Set<string>>

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Remove unnecessary Set creation in version comparison logic

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix bidirectional version change detection to catch all version updates

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Update test-frontend.yml to remove pull_request trigger

Remove pull_request trigger from frontend test workflow.

* Update PHP testing workflow triggers

Remove pull_request trigger from PHP testing workflow

* Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441)

* Initial plan

* Apply code review feedback: improve regex handling and log sanitization

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Refactor: Extract sanitize_for_logging helper to follow DRY principles

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add security and DRY development guidelines for InvoicePlane (#1442)

* Initial plan

* Add comprehensive guidelines and Copilot instructions for security and DRY principles

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add comprehensive security and DRY analysis for PR #1441

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Address code review feedback: improve documentation clarity and examples

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Document XSS mitigation in Family Name field - no code changes required (#1443)

* Initial plan

* Add comprehensive security audit documentation for XSS vulnerability

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add executive security summary for XSS vulnerability verification

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix XSS vulnerability in payment form invoice_number display (#1445)

* Initial plan

* Fix XSS vulnerability in payment form invoice_number field

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add comprehensive XSS vulnerability documentation

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Comment out invoice and quote password fields

Comment out password fields from bypass list.

* Update application/helpers/template_helper.php

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Address PR #1439 feedback: sanitization and validation improvements (#1446)

* Initial plan

* Address PR #1439 feedback: sanitization and validation improvements

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Improve security: use DOMParser for HTML sanitization and load file_security_helper

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454)

* Initial plan

* Fix XSS vulnerability in parent invoice number display

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Add security documentation for Invoice Group XSS fix

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md

* Delete SECURITY_SUMMARY.md

* Add comprehensive XSS vulnerability audit documentation

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Delete COMPREHENSIVE_XSS_AUDIT.md

* Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md

* Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix stored XSS vulnerabilities in multiple views (19 total) (#1455)

* Initial plan

* Fix XSS vulnerability by adding HTML escaping to format_client() output

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix additional XSS vulnerabilities in client view and invoice templates

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix XSS vulnerabilities in VAT ID and tax code fields

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453)

* Initial plan

* Initial analysis - identify mpdf footer undefined array key issue

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Fix: Define html_footer to prevent PHP 8.3 undefined array key error

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

* Delete package-lock.json

* Delete yarn.lock

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    @nielsdrost7
    @github-advanced-security @coderabbitai
    5 people authored Feb 16, 2026
    Configuration menu
    Copy the full SHA
    2b9241f View commit details
    Browse the repository at this point in the history

  2. Updated Composer and Yarn Packages

    @nielsdrost7
    nielsdrost7 committed Feb 16, 2026
    Configuration menu
    Copy the full SHA
    6f6f6f8 View commit details
    Browse the repository at this point in the history

  3. Implement template name validation function 

    Added a validate_template_name function to check if a template name is valid based on type and scope.
    @nielsdrost7
    nielsdrost7 authored Feb 16, 2026
    Configuration menu
    Copy the full SHA
    f4b81a5 View commit details
    Browse the repository at this point in the history

  4. Add HTML encoder for safe email template sanitization 

    Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML.
    @nielsdrost7
    nielsdrost7 authored Feb 16, 2026
    Configuration menu
    Copy the full SHA
    61b57f0 View commit details
    Browse the repository at this point in the history
Loading