application/modules/reports/models/Mdl_reports.php (4)

449-449: Handle null minQuantity value in WHERE clause.

Same issue as lines 326, 336: after fixing the casting at line 214, this needs a null check.

Apply this diff:

-                                    AND ' . $minQuantity . ' <=
+                                    AND ' . ($minQuantity !== null ? $minQuantity : 0) . ' <=

---

214-215: Critical: Casting null to 0 breaks max quantity logic.

Casting $maxQuantity (default null) to 0 transforms an intended unbounded filter into a highly restrictive one (0 >= SUM(...)) that excludes all positive totals. When no max is provided, the upper-bound check should be omitted entirely.

Apply this diff to only cast when values are actually provided:

-        $minQuantity = (int) $minQuantity;
-        $maxQuantity = (int) $maxQuantity;
+        $minQuantity = $minQuantity !== null && $minQuantity !== '' ? (int) $minQuantity : null;
+        $maxQuantity = $maxQuantity !== null && $maxQuantity !== '' ? (int) $maxQuantity : null;

Then check for null before using these values in WHERE clauses (see subsequent comments).

---

564-564: Inconsistent quantity handling: mixing inline cast with escape.

Line 564 uses (int)$minQuantity while line 574 uses $this->db->escape($maxQuantity). Since both are already cast to integers at lines 214-215, this inconsistency is confusing.

Choose one approach and apply consistently:

Option 1: Direct integer concatenation (preferred after fixing null handling):

-                                    AND ' . (int)$minQuantity . ' <=
+                                    AND ' . ($minQuantity !== null ? $minQuantity : 0) . ' <=
                                     (
                                         SELECT SUM(amounts2.invoice_total) FROM ip_invoice_amounts amounts2
                                             WHERE amounts2.invoice_id IN
                                             (
                                                 SELECT inv2.invoice_id FROM ip_invoices inv2
                                                     WHERE inv2.client_id=ip_clients.client_id
                                                         AND ' . $this->db->escape($from_date) . ' <= inv2.invoice_date_created
                                                         AND ' . $this->db->escape($to_date) . ' >= inv2.invoice_date_created
                                             )
-                                    ) AND ' . $this->db->escape($maxQuantity) . ' >=
+                                    )' . ($maxQuantity !== null ? ' AND ' . $maxQuantity . ' >=' : ' AND 1=1 OR 0 >=') . '

Option 2: Use escape consistently (if you prefer belt-and-suspenders):

-                                    AND ' . (int)$minQuantity . ' <=
+                                    AND ' . $this->db->escape($minQuantity !== null ? $minQuantity : 0) . ' <=

Also applies to: 574-574

---

687-687: Inconsistent with line 564 and needs null handling.

Line 564 uses (int)$minQuantity while this line uses $this->db->escape($minQuantity). Pick one approach and apply it consistently across all WHERE clauses.

After fixing the casting at line 214 to allow null values, update this line:

-                                    AND ' . $this->db->escape($minQuantity) . ' <=
+                                    AND ' . ($minQuantity !== null ? $minQuantity : 0) . ' <=

Or use escape consistently:

-                                    AND ' . $this->db->escape($minQuantity) . ' <=
+                                    AND ' . $this->db->escape($minQuantity !== null ? $minQuantity : 0) . ' <=

application/modules/reports/models/Mdl_reports.php (1)

217-218: Validate date conversion results.

date_to_mysql() returns an empty string if the date format is invalid. Using that empty string directly in SQL comparisons could produce unexpected results.

Consider validating the conversion result:

-        $from_date      = $from_date == '' ? date('Y-m-d') : date_to_mysql($from_date);
-        $to_date        = $to_date   == '' ? date('Y-m-d') : date_to_mysql($to_date);
+        $from_date      = $from_date == '' ? date('Y-m-d') : date_to_mysql($from_date);
+        $to_date        = $to_date   == '' ? date('Y-m-d') : date_to_mysql($to_date);
+        
+        // Fallback to today if conversion fails
+        $from_date = $from_date ?: date('Y-m-d');
+        $to_date   = $to_date   ?: date('Y-m-d');

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

application/modules/reports/models/Mdl_reports.php (2)

326-336: Standardize quantity interpolation across all branches.

The code uses three different patterns for inserting integer quantities into SQL:

• Lines 326, 336, 449: direct concatenation (no cast, no escape)
• Line 564: inline (int) cast
• Lines 574, 687: escape() calls

Since quantities are already cast to int at line 214-215, choose one consistent approach—either direct concatenation or inline casting—and apply it uniformly.

-                                    AND ' . $minQuantity . ' <=
+                                    AND ' . (int)$minQuantity . ' <=
 (...)
-                                    ) AND ' . $maxQuantity . ' >=
+                                    ) AND ' . (int)$maxQuantity . ' >=

Then update lines 449, 564, 574, 687 similarly for uniformity.

Based on past review comments.

---

214-215: Critical: Casting null $maxQuantity to 0 breaks unbounded filtering.

Casting $maxQuantity (default null) to (int) yields 0, which changes the filter from "no upper limit" to "exclude rows where SUM(...) > 0"—effectively blocking all valid results when the user does not specify a max.

Solution: Only apply the max-quantity predicate when a non-null, non-zero value is explicitly provided.

Apply this diff to conditionally apply the max filter:

-        $minQuantity = (int) $minQuantity;
-        $maxQuantity = (int) $maxQuantity;
+        $minQuantity = $minQuantity !== null && $minQuantity !== '' ? (int) $minQuantity : 0;
+        $maxQuantity = $maxQuantity !== null && $maxQuantity !== '' ? (int) $maxQuantity : null;

Then, in the WHERE clauses (lines 326-348, 449-461, 555-586, 678-699), wrap the max-quantity comparison in a conditional check:

 AND ' . $minQuantity . ' <=
 (...)
-) AND ' . $maxQuantity . ' >=
+)' . ($maxQuantity !== null ? ' AND ' . $maxQuantity . ' >=' : '') . '
 (...)

Based on learnings and past review comments.

application/modules/reports/models/Mdl_reports.php (1)

217-218: Consider null-safe date handling.

The empty-string check (== '') may not catch all cases where dates are unset. For more robust validation, check for null or empty().

-        $from_date      = $from_date == '' ? date('Y-m-d') : date_to_mysql($from_date);
-        $to_date        = $to_date   == '' ? date('Y-m-d') : date_to_mysql($to_date);
+        $from_date      = empty($from_date) ? date('Y-m-d') : date_to_mysql($from_date);
+        $to_date        = empty($to_date)   ? date('Y-m-d') : date_to_mysql($to_date);

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro