Fix Niels Guest Get File by nielsdrost7 · Pull Request #1324 · InvoicePlane/InvoicePlane

nielsdrost7 · 2025-08-21T17:05:26Z

Fix Niels Guest Get File

Summary by CodeRabbit

Bug Fixes
- Improved reliability of file downloads with more accurate content type and size detection.
- Sanitized filenames in download prompts to avoid unexpected characters.
- Clearer 404 responses that include concise reference details when available.
Refactor
- Strengthened path validation to ensure files are served only from allowed locations.
- Consistent use of validated paths throughout the file-serving flow for added safety.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull Request Overview

This PR fixes a critical security vulnerability in the guest file download functionality by implementing proper path traversal protection and file validation.

Key changes:

Added path traversal protection using basename() and realpath() validation
Implemented proper directory boundary checks to prevent accessing files outside the target directory
Enhanced file existence and safety validation before serving files

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

coderabbitai · 2025-10-05T11:59:37Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Refactors guest file-serving to sanitize filenames, validate base and target paths with realpath, enforce that target resides under the base directory, compute MIME/size from the validated path, use the sanitized name in Content-Disposition, and return 404 for invalid paths.

Changes

Cohort / File(s)	Summary
Secure file-serving validation `application/modules/guest/controllers/Get.php`	Replace direct `file_exists` checks with basename sanitization and realpath validation of base and target paths; ensure target is contained within base; derive extension, MIME type, and size from validated real file path; use sanitized filename in Content-Disposition; read from validated path; update 404 responses and early-return flow.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant C as Client
  participant Ctr as Guest.Get Controller
  participant FS as Filesystem

  C->>Ctr: GET /guest/get?ref=...&file=...
  Ctr->>FS: realpath(baseDir)
  alt baseDir invalid
    Ctr-->>C: 404 Not Found (base invalid)
  else baseDir ok
    Ctr->>Ctr: sanitize filename (basename)
    Ctr->>FS: realpath(fullPath of sanitized name)
    alt target invalid or not under base
      Ctr-->>C: 404 Not Found (target invalid/outside base)
    else target valid
      Ctr->>FS: stat(realFile) -> size, ext
      Ctr-->>C: 200 OK
      Note right of Ctr: Headers set using sanitized name and realFile metadata
      Ctr->>C: file bytes (readfile(realFile))
    end
  end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

I hop along the secure path bright,
Basenames trimmed and realpaths tight,
No hidden tunnels, no sly surprise,
Files served true beneath safe skies. 🐇✨

Pre-merge checks and finishing touches

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title Check	⚠️ Warning	The title “Fix Niels Guest Get File” is vague and includes the author’s name rather than clearly summarizing the primary change, which is replacing a direct file check with a secure file‐serving flow that sanitizes input and validates paths via realpath. It does not convey the adoption of basename sanitization, real directory validation, or updated 404 handling that are central to this PR.	Please rename the pull request to clearly reflect the main changes, for example “Implement secure file serving in guest Get controller with basename sanitization and realpath validation.”
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/niels-3-guest-get-file

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9dff57e and 921225a.

📒 Files selected for processing (1)

application/modules/guest/controllers/Get.php (1 hunks)

🔇 Additional comments (3)

application/modules/guest/controllers/Get.php (3)

48-57: Excellent security improvements implemented.

The implementation now properly addresses the past review feedback:

basename() sanitization prevents directory traversal in the filename

realpath() validation on the base directory ensures it exists before proceeding

Early return statement prevents execution after error response

The security foundation is solid.

59-70: Path traversal protection correctly implemented.

The security check properly validates that the resolved file path resides within the base directory. The implementation addresses previous feedback:

Uses str_starts_with() with DIRECTORY_SEPARATOR to prevent prefix-only matches

Removed redundant file_exists() check since realpath() returns false for non-existent files

Added early return statement after error response

Note: While mb_rtrim() on line 59 is unnecessary for single-byte DIRECTORY_SEPARATOR, the developer indicated this is intentional (auto-formatted by IDE).

82-82: Correct use of validated file path.

Using $realFile for readfile() ensures the actual file being served matches the path that passed all security validations.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-05T12:00:36Z

        header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
        header('Pragma: no-cache');
-        header('Content-Disposition: attachment; filename="' . $filename . '"');
+        header('Content-Disposition: attachment; filename="' . $safeFilename . '"');


The filename in the Content-Disposition header should be properly escaped to prevent header injection attacks. Consider using addcslashes($safeFilename, '"\\') or a similar escaping method to handle filenames containing quotes or backslashes.

Suggested change

header('Content-Disposition: attachment; filename="' . $safeFilename . '"');

header('Content-Disposition: attachment; filename="' . addcslashes($safeFilename, '"\\') . '"');

Copilot · 2025-10-05T12:00:36Z

+        $path_parts = pathinfo($realFile);
+        $file_ext   = mb_strtolower($path_parts['extension'] ?? '');
+        $ctype      = $this->content_types[$file_ext] ?? $this->ctype_default;
+        $file_size  = filesize($realFile);


The filesize() function can return false on failure, but this value is used directly in the Content-Length header without validation. This could result in an incorrect Content-Length header being set.

Suggested change

$file_size = filesize($realFile);

$file_size = filesize($realFile);

if ($file_size === false) {

$this->respond_message(404, 'upload_error_file_not_found', $realFile);

return;

}

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (1)

application/modules/guest/controllers/Get.php (1)
59-70: Path traversal protection correctly implemented.

The code properly prevents directory traversal attacks by:

Normalizing the base path with a trailing separator (line 59)

Resolving the real path of the target file (line 60)

Verifying the file exists and resides within the allowed directory (lines 62-65)

This addresses the past review comments about using DIRECTORY_SEPARATOR in the check and removing the redundant file_exists() condition.

Consider adding an explicit is_file() check to prevent serving directories:
 if (
     $realFile === false ||
+    ! is_file($realFile) ||
     ( ! str_starts_with($realFile, $realBaseWithSep))
 ) {
While readfile() on a directory won't cause security issues (it fails safely), an explicit check improves clarity and prevents unnecessary processing.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9dff57e and 921225a.

📒 Files selected for processing (1)

application/modules/guest/controllers/Get.php (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

application/modules/guest/controllers/Get.php (1)

application/modules/upload/controllers/Upload.php (1)

respond_message (163-173)

🔇 Additional comments (2)

application/modules/guest/controllers/Get.php (2)

49-57: LGTM! Path sanitization and base validation implemented correctly.

The use of basename() prevents directory traversal, and the realpath() validation ensures the base directory exists before proceeding. The early return statement at line 56 addresses the past review comment about missing return after error response.

72-82: LGTM! Validated paths and sanitized filenames used throughout.

The code correctly uses:

$realFile for extracting metadata (lines 72-75) and reading the file (line 82)

$safeFilename in the Content-Disposition header (line 79)

This ensures all file operations and headers use validated, sanitized data rather than raw user input, preventing potential injection or information disclosure issues.

nielsdrost7 · 2025-10-12T06:08:43Z

@coderabbitai full review

coderabbitai · 2025-10-12T06:09:04Z

✅ Actions performed

Full review triggered.

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * critical code review (#1355) * Initial plan * Fix critical path traversal and LFI vulnerabilities Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix SQL injection vulnerability in guest attachments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security audit report Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add quick summary of security scan results Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix password reset rate limiting and email enumeration vulnerabilities Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor password reset to use session-based rate limiting (no DB migration) Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Make password reset rate limiting configurable via ipconfig.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Convert hardcoded log messages to translation strings Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix SQL injection and open redirect vulnerabilities (#1358) * Initial plan * Fix SQL injection and open redirect vulnerabilities Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security summary documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add quick reference security summary Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_SECURITY_SUMMARY.md * Delete PASSWORD_RESET_SECURITY.md * Delete SECURITY_AUDIT_2025-11-09.md * Delete SECURITY_AUDIT_2025-11-09_ADDITIONAL.md * Delete SECURITY_QUICK_REFERENCE.md * Delete SECURITY_SCAN_SUMMARY.md * Address review feedback: Use env() for config, add bot detection, and fix syntax errors (#1359) * Initial plan * Replace config variable checks with env() calls and add bot detection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor password reset rate limiting methods * Add translation for bot detection log and fix syntax errors from refactoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

nielsdrost7 · 2025-11-26T11:19:06Z

closing this one, this one is merged when i merged #1354

@Matthias-Ab

* #991: Only load custom_lang.php if it's present * #991: Only load custom_lang.php if it's present * Show list of themes on Windows * #1034: Fix error where default_language at some point switches to English * fixes #1038 * formatting #1033 * only update invoice_date_due when sending email #1033 invoice_date_created should not be updated and always stay the same * move execution of update_invoice_due_date into mark_sent #1033 * remove unnecessary settings tmp_invoice_date and tmp_due_date settings * remove unnecessary helper function reset_invoice_due_dates * fix indentation #1033 * replace tabs with spaces #1033 * bump composer packages * cleanup extra linebreaks * Revert change to invoice_logo() that was intended only for invoice_logo_pdf() * Remove slash because base_url() already has a trailing slash * refractored payments code * use var to prevent reload problem * included the paypal gateway settings * created paypal payment page * added paypal as an extra gateway to be loaded * setup paypal payment endpoint * created paypal REST consumer * implemented sandbox for paypal * removed omnipay * required guzzle * required stripe php sdk * renamed dir * fixed stripe endpoint * created stripe REST API consumer * changed location of files * adapted stripe page to use embedded checkout * included the money package for currencies (was in omnipay) * fixed success message * created verifier * added some comments for clarity * fixed condition for refusing payment * improved paypal REST consumer * refractored payment information * made paypal gateway controller * changed source url after refractoring * improvement code for readability * removed old form * removed deprecated code * handle better single payment gateway * bug fixes * renamed file to prevent loop * made new selection mode * updaed file * new provider selction method * refractored new paypal lib * fixed output * removed the select2 selector * provider auto-selection * fixed style of paypal buttons * added the select method message * prevent accessing payment page with invoice balance zero * #1046: Fixed some formatting * #1046: Fixed some formatting * Slight improvements to README.md Link to demo on homepage so logindata is provided and adjust some wordings * fixes issue #1070 * Fixed broken customer-link in projects-widget. #1072 * fix: ZUGFeRD Name should not be user name * Add Pint and add some directories * added pint.json to help with formatting the files in a certain standard * pre-select current currentcy for online payment * fixed formatting * added information on theming * Bugfix: Other client can be selected from list Bug: No other client can be selected/looked up from the client list. Only the customer from the source invoice was selected. Fix: Selecting an other client is now possible. The selection is saved in the copied invoice. * Bugfix: Selected quote date is saved Bug: The quote date from the source quote was saved and not the selected or entered date from the datepicker. The original quote date was always saved in the copied quote. Fix: The selected date from the datepicker is saved in the copied quote. * Fix #841 Copy quote (modal) UI feedback Bug: When the data is retrieved from the custom_fields db and put into an array and if there is no data in the db, the array cannot be populated so the result is that there is no "response" at all. Fix: extracted the working snippet from mdl_invoice and modified it in mdl_quotes. Even when there is no data/array there is a response. * Adapt copy custom fields code if null * Revert some accidently changes * implemented alternative solution * formatting improvement * copy all fields available in quotes #998 * styling * Improve pint.json just a tiny bit and then format pint.json correctly * Add filter_input function and filter_input in the Clients module * Add filter_input for all the controllers that have the form() function * feat: Add pagination for tabs in client detail fix #1083 * tab change by url and fixed typos * removed ternary * fix formatting * refactor: rename tab variable to activeTab * fix: model-pager have no bottom space in tab * fixed worng bracket * 1096: remove check for number of rows in ip_payments and subsequent early return * changed behavior of returned ->payments, to be null or an array * code formatting * Add another digit for quantity This serves as an example. Please note, that you still have to alter the database table: ALTER TABLE ip_invoice_items MODIFY COLUMN item_quantity decimal(10, 3); First Rule of Programming: Don't run code from the internet when you don't understand it. It might break things. * altered tables * added db changes * adapted function * created setting * adapted invoice items * made quantity available to all views * made quantity available to all quote views * made quantity available to quote views * code formatting * [IP-1003]: Add extra field title (#1101) * Add selector title & create enum php & add field client_title on table ip_client & translation field client_title * Add client title to format client function & KISS & add select and custom title field when custom choice * Clean & edit select auto client title * Add selector title & create enum php & add field client_title on table ip_client & translation field client_title * 1059: Fixed styling in a PHP array * 1059: Validation: client_title isn't required * 1059: database field: *after* client_surname, made sure migration worked * 1059: No yoda-style if-statements, no void return types (yet), no strict typing in files (yet) * 1059: no void return types (yet) * feat: Add pagination for tabs in client detail fix #1083 * tab change by url and fixed typos * removed ternary * fix formatting * refactor: rename tab variable to activeTab * fix: model-pager have no bottom space in tab * Add selector title & create enum php & add field client_title on table ip_client & translation field client_title * Add selector title & create enum php & add field client_title on table ip_client & translation field client_title * 1059: Fixed styling in a PHP array * 1059: no void return types (yet) * 1059: Removed obsolete migration file * 1059: Moved form for the client_title to the bottom of the page (near gender) * emulate enum * 1096: remove check for number of rows in ip_payments and subsequent early return * changed behavior of returned ->payments, to be null or an array * code formatting * Improve pint.json just a tiny bit and then format pint.json correctly * Add filter_input function and filter_input in the Clients module * Add filter_input for all the controllers that have the form() function * fixed worng bracket * Add another digit for quantity This serves as an example. Please note, that you still have to alter the database table: ALTER TABLE ip_invoice_items MODIFY COLUMN item_quantity decimal(10, 3); First Rule of Programming: Don't run code from the internet when you don't understand it. It might break things. * altered tables * added db changes * adapted function * created setting * adapted invoice items * made quantity available to all views * made quantity available to all quote views * made quantity available to quote views * code formatting * Add selector title & create enum php & add field client_title on table ip_client & translation field client_title * Add selector title & create enum php & add field client_title on table ip_client & translation field client_title * 1059: Fixed styling in a PHP array * 1059: database field: *after* client_surname, made sure migration worked * 1059: no void return types (yet) * feat: Add pagination for tabs in client detail fix #1083 * tab change by url and fixed typos * removed ternary * fix formatting * refactor: rename tab variable to activeTab * tmp * rebased development branch into 1059 clientTitle branch * 1059: quick formatting of arrays --------- Co-authored-by: Kevin Joudrier <kev.joudrier@gmail.com> Co-authored-by: pumpi <sf@pumpi-online.de> Co-authored-by: naui95 <nahuel.guidotti@outlook.com> Co-authored-by: = <=> Co-authored-by: der-peer <post@peeruhlmann.de> Co-authored-by: naui95 <naui95@hotmail.com> Co-authored-by: Nathan Mattes <hallo@bullenscheisse.de> * Making sure all the fields in the templates are escaped by htmlspecialchars * replaced _htmlsc with htmlsc where output was echoed * 1089: Fixes after code-review * 1089: Fixes after code-review * no typehint in ClientTitle enum call * 1063: Allowing for Dynamic Properties (PHP 8.2) * 1063: Set back Cryptor the way it was and then allowed Dynamic Properties again * 1063: Set back MY_Form_validation the way it was and then allowed Dynamic Properties again * 1063: Set back class Sumex the way it was and then allowed Dynamic Properties again * 1063: Set back class Sumex the way it was and then allowed Dynamic Properties again * 1063: Set back class ZugferdXml the way it was and then allowed Dynamic Properties again * 1063: Set back class ZugferdXml the way it was and then allowed Dynamic Properties again * 1063: Set back class PaypalLib the way it was and then allowed Dynamic Properties again * 1063: Set back Clients Controller the way it was and then allowed Dynamic Properties again * 1063: #[AllowDynamicProperties] with the PHP 8.2 (8.0+) compatible annotation * 1063: Put back MX / Base the way it was and then allowed for Dynamic Properties * 1063: Modules.php: Placing of the annotation * helpers without dynamic properties * fixed bug where title for the client wasn't saved * Custom rendering will be empty instead of 'custom' * Custom rendering needs to be 'custom', otherwise it won't be shown in the ClientTitle list * fixed bug where a custom client_title was rendered as "Custom" * better formatting * 1010: Added 2 extensions and improved xdebug.ini. Added special xdebug.ini * yarn upgrade and freeze lock file * Special Chore done * issue 1119: add index.php if REMOVE_INDEXPHP is not true * finished Chore * chore: add more options to destroy sessions earlier * add docker publish workflow * fix package.json and yarn.lock for old sass * Update QrCode.php When an invoice is paid in part. The QR code always displays the total paid, not what remains to be paid. * Improve download function * improved get_file function * property client_title doesn't exist? * array_walk an array if value isn't an array * typecasting the decimal_point in number_helper line 76 * fix upload_file function * Fix Upload class * New Buttons for Delete Client note in view (Ajax) Reload all notes after deleted + (new) click event by add_delete_client_notes_click_event() * Remove has-error after good (unempty.trim) client note Fix after 1 error, alway in error .control-group: is (in reality) .input-group & setted with .has-error * Clients view: reload_client_notes() + loader fades Note: Ajax post client_id is in js constant now * Idea to translate Client Title Enums See Clients/Enums/ClientTitleEnum * Fix #1146 after posting a Payments Form when amount > inv. total #1146 Fix number_format(): Arg #1 ($num) must be of type float, string given modules/payments/views/form.php Function: format_amount * Fix payment Cancel repost onclick: history.back 2 location.href By default cancel has onclick with `window.history.back()` See [header_buttons.php](https://github.com/InvoicePlane/InvoicePlane/blob/development/application/modules/layout/views/header_buttons.php) But if click Save multiple time (like monkey) with bad amount value And click Cancel, do repost. Now Cancel always go to Payments page. * Fix setup sql filenames See : [IP-1003: Add extra field title (#1101)](c64b5df#diff-f97132f81d846a5d14eb35d66fe77c943572d8db71735702e6f018f65671058c) Devs, After need update DB Like this: UPDATE `ip_versions` SET `version_id` = '38', `version_date_applied` = '1734693462', `version_file` = '037_1.6.1.sql', `version_sql_errors` = '0' WHERE `version_id` = '38'; UPDATE `ip_versions` SET `version_id` = '39', `version_date_applied` = '1734693462', `version_file` = '038_1.6.2.sql', `version_sql_errors` = '0' WHERE `version_id` = '39'; * Added required input check on full page loaded to 'fix' #1130 * Removed console.log from bugfix * bug-fix-#1147-error-on-database-migration (#1159) * Added required input check on full page loaded to 'fix' #1130 * Refactored upgrade_tables function in Mdl_setup.php * Refactored execute_contents in Mdl_setup.php to remove nested ifs * Added error ignoring on database upgrade to fix #1147 * Removed comment and changed AND operator to OR in Mdl_setup.php * Refactored upgrade_tables function in Mdl_setup.php * Refactored execute_contents in Mdl_setup.php to remove nested ifs * Added error ignoring on database upgrade to fix #1147 * Removed comment and changed AND operator to OR in Mdl_setup.php * Removed scripts.js from conflicting branche * Removed scripts.js from conflicting branche * Update Mdl_setup.php * Added displaying DB error and moved to negative comparison in Mdl_setup.php * Removed tab and comments in Mdl_setup.php --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> * Fix setup Red Screen Of Death with bad DB query Complete #1147 [Solve Red screen Of Death of bad DB query in CI3](https://stackoverflow.com/questions/7843406/codeigniter-how-to-catch-db-errors#54519533) Fix Call to undefined method CI_DB_mysqli_driver::_error_message() The _error_message() function unexist in CI3.1.13: `vendor/codeigniter/framework/system/database/DB_driver.php` + Indents: tab2spaces * Clear setup comments and return all DB errors * Setup upgrade_tables scroll to bottom page * Setup: db debug same as IP_DEBUG * Fix missing if-check * fix problem * Removed '.pdf' from Invoices.php downloads to fix #1171 * Check invoice balance before rendering QR code * Fix #1169 : Add custom_fields in controllers/Settings Now Custom Fields ip_invoice_custom is present in settings page + Remove hard fix in view template-tags-invoices + Indents of settings view partial_settings general * Fix: Delete Client go to 404 page #1182 Inspired by `module/clients/view/partial_client_table.php` * Little details (Base_controller) + indents + tab2spaces * Fix styling in clients table header #1184 * Style2class for amounts & balances (th & tr) Improve #1185 Scope: + Clients + DashBoard + Invoices + Quotes + Payments + Products + Tasks Note: .amount.last apply padding in last element like Quotes list * Fix fullpage-loader helper never showed `$(document).on('click', '.ajax-loader', function () {` Is duplicated inside same function. * Remove event unused JS var (Fullpage loader) * Fix: Send email show blank page #1196 * Add invoice_status case in template_helper (Fix #1198) Scope: qr_code_settings_remittance_text * Fix SMTP password wrong after saving settings #1200 * Update template_helper.php to fix email template with custom single choice field This update will use written label instead of option number in email template, if the filed is an custom field with single choice * chore: pint * chore: pint * add invoices_per_client report * use client custom field for invoices_per_client report * remove debug * fix: order by client_id * fallback if no client_custom_fieldvalue is available * remove client_custom_fieldvalue * use format_client helper * sort invoices by date instead of id * sort quotes by date instead of id see #1218 * Improve number_helper & standardize_amount (fix european format) Fix #1227 European number format change amount on save when use dot as comma * Remove unattended standardize_amount in payments view form * Make sure invoiceplane.conf works properly * Add pagination to invoice and quote templates * fix: amount of the credit transfer cannot be smaller than 0.01 Euro #1128 * Guest Payment stripe flow & online_payment lang improved Load Invoice Model in `__construct` (used in all (2) func's) Don't need site_url for `redirect()` Improve merchand response db insert Improve invoice privacy: client_reference_id (id TO url_key) And adjust indents for the `callback` (it's a function in `class`) Adjust lang sys for multiple use (why not in paypal?) Big Thanks @Matthias-Ab * [IP-939]: Processing e-invoices flow (and some bugfixes): `development` branch for version 1.6.3 (#1247) Prepare for 1.6.3 and 1.7.0 --------- Co-authored-by: Thomas Ingles <thomas@sudwebdesign.fr> * Development v163rc1 (#1268) * Improve versions in composer & package + up yarn & composer lock * Improve gh templates & workflows & infos (md) Improve & Merge Develop v163rc1 (#1266) Without TRANSLATION.md * Setup: Upgrade default & users languages to lowercase like #1232 * Fix: Save products & tasks. No empty rules in Form_validation Form_validation: set_rules() called with an empty $rules parameter See: #1195 * Improve Uploader: Del old system. No show file \w upload_file() Not used in v1.6.3RC0 * PHP compat: No E_STRICT (error_reporting) & Adjust Rector rule In accordance of doc, is unused & PHP 8.4 deprecate. See: https://www.php.net/manual/errorfunc.constants.php#constant.e-strict --- Scope: production or testing environment How to set? See: https://github.com/orgs/InvoicePlane/discussions/1168 * Rector: More efficient Sets: deadCode, codeQuality & codingStyle Applied rules: * RemoveUselessParamTagRector * StrictArraySearchRector * FuncGetArgsToVariadicParamRector * Refacto \w Rector: Prepared set typeDeclarations:true Applied rules: * ReturnUnionTypeRector * ReturnNullableTypeRector * RemoveUselessParamTagRector * RemoveUselessReturnTagRector * StrictStringParamConcatRector * StrictArrayParamDimFetchRector * SimplifyBoolIdenticalTrueRector * ParamTypeByMethodCallTypeRector * ReturnTypeFromStrictNewArrayRector * SimplifyEmptyCheckOnEmptyArrayRector * ReturnTypeFromReturnDirectArrayRector * NumericReturnTypeFromStrictReturnsRector * TypedPropertyFromStrictConstructorRector * BoolReturnTypeFromBooleanConstReturnsRector * BoolReturnTypeFromBooleanStrictReturnsRector * AddFunctionVoidReturnTypeWhereNoReturnRector * StringReturnTypeFromStrictStringReturnsRector * Add composer scripts: phpcs, rector & check `composer run check` to verify & correct the code (with all) * Refacto: My_Form_validation::run() (Ready for Next-1.7) Ok with CodeIgniter 3.1.13 (& 3.3 by pocketarc for PHP 8.2+) See: e95b95f * ipconfig: Add CI_ENV=production to hide minor PHP errors by default Improve gitignore & remove todo (oups) * [wip] JSON.parse to json_parse to show error in front end * [script.js] json_parse for all & console.trace(data) to debug Need `yarn build` if `ENABLE_DEBUG=false` in ipconfig * [script.js] Finish json_parse: Add console.error & div.alert * README header: Restore badges & show favicon at float right --------- Co-authored-by: Niels Drost <nielsdrost7+github@gmail.com> * Replace node-sass with sass (#1277) * Development v163rc2 (#1272) * composer upgrade: Lock file operations: 5 updates Updating dependencies - Upgrading filp/whoops (2.18.0 => 2.18.1) - Upgrading laravel/pint (v1.20.0 => v1.22.1) - Upgrading phpstan/phpstan (2.1.16 => 2.1.17) - Upgrading rector/rector (2.0.16 => 2.0.17) - Upgrading symfony/deprecation-contracts (v3.5.1 => v3.6.0) * Composer\\Config::disableProcessTimeout (scripts) To fix The process "pint" exceeded the timeout of 300 seconds. * lint by composer run check (1 file rectified) Applied rules: * ParamTypeByMethodCallTypeRector * [einvoice] Fix bad wrap in users-check-lists (client view) * [eInvoice] Shift legacy_calculation to false When client use e-Invoice and if XMLconfigs file haven't `'legacy_calculation' => true` * [eInvoice] Add Automatic calculation mode in Cron & adjustments * Fix #1271 : Add payment_method on Cron Payment Method not copied from recurring invoice to generated invoice * [eInvoice] DRY: Use legacy_calculation constant in modal scripts The const legacy_calculation defined in script (get meta content) The data-legacy-calculation in btn isn't necessary (removed) * Fix: Quote header col classes to do the same as Invoice (view) * Fix: Styling issues (#1278) * fix: panel in panel should be inside panel-body * fix: cancel button is not centered * fix: Sidebar is not full height on sites with low content * fix: Client overview shows wrong e-Invoicing state (#1281) * feat: Add a setup step to ensure the user uses the right config value for LEGACY_CALCULATION (#1282) * fix: Client detail view exception after #1281 changes (#1283) * Update number_helper.php to avoid empty string warning (#1302) In `standardize_amount`, `$thousands_separator` is read from the settings, and if it is empty, the error occurs. If I understand correctly, the settings value is not changed directly via UI, but depends on the chosen `number_format`. It is set in `settings.php`, line 78, just below `// Set thousands_separator and decimal_point according to number_format`. So `standardize_amount ` produces the error if a compact `number_format` is used, which resets the thousands separator settings value to an empty string. So the solution would be to simply not use the `thousands_separator` setting, if it is empty * implement new templates with named footers (#1313) * implement new templates with named footers * use named footers to avoid overwriting footers * Feature/1288 - PayPal Advanced Credit Cards and Venmo (#1289) * Adds PayPal advanced credit card fields, #1288 * Adds advanced CC option and conditional logic, #1288 * Adds Venmo option and conditional logic, #1288 * Adds a header builder and additional recommended header params, #1288 * Ignores /.temp, #1288 * Adds proper error handling at transaction level, #1288 * Improves client and server side error handling, #1288 * Moves CSS to core assets structure, #1288 * Moves JS to core assets structure, #1288 * Updates dependencies * Adds payment-forms assets to Grunt clean exclusions, #1288 * Improves payment section display, #1288 * Adjusts processing spinner to align with button, #1288 * Renames PayPal assets, #1288 * ran pint * [1307]: Sending emails to multiple email addresses gives error message (#1308) * using filter_var in mailer_helper caused issues when multiple email addresses were allowed refs #1307 * also fixed it for sending quotes refs #1307 * added custom e-mail validator * fixed bug with array on string * removed comments and corrected return type --------- Co-authored-by: naui95 <nahuel.guidotti@outlook.com> * Solves problem where Alpine Docker containers don't know the \GLOB_BRACE constant refs #1304 (#1305) * ran pint * [IP-1340]: wrong quoteinvoice guest download attachment button default template (#1343) * use get_file method (#1342) * use get_file method (#1341) * Revert "[IP-1340]: wrong quoteinvoice guest download attachment button defaul…" (#1344) This reverts commit cc2762f. * Add default_order_by method for recurring invoices (#1334) * Make $show_item_discounts available in InvoicePlane_Web.php (#1310) * Hide discounts column when show_item_discounts is false refs #1298 * determine discouted items * fixed display for no discounts * hide discounts also with legacy calculation * applied discount hiding also to quotes * fixed item totals * fixed discount display * enforced standard --------- Co-authored-by: naui95 <naui95@hotmail.com> * 1322: Show open invoices on guest index (#1350) * composer.json omit version string (#1306) * Fix Niels: Uploads (#1338) * Made uploading files more secure refs #1326 * Update application/modules/upload/controllers/Upload.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * improved security: - sanitize filename - prevent corss-path navigation --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: naui95 <nahuel.guidotti@outlook.com> * Put back the InvoicePlane version in the package.json * Prep: v1.6.4 (#1354) * Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * critical code review (#1355) * Initial plan * Fix critical path traversal and LFI vulnerabilities Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix SQL injection vulnerability in guest attachments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security audit report Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add quick summary of security scan results Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix password reset rate limiting and email enumeration vulnerabilities Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor password reset to use session-based rate limiting (no DB migration) Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Make password reset rate limiting configurable via ipconfig.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Convert hardcoded log messages to translation strings Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix SQL injection and open redirect vulnerabilities (#1358) * Initial plan * Fix SQL injection and open redirect vulnerabilities Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security summary documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add quick reference security summary Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_SECURITY_SUMMARY.md * Delete PASSWORD_RESET_SECURITY.md * Delete SECURITY_AUDIT_2025-11-09.md * Delete SECURITY_AUDIT_2025-11-09_ADDITIONAL.md * Delete SECURITY_QUICK_REFERENCE.md * Delete SECURITY_SCAN_SUMMARY.md * Address review feedback: Use env() for config, add bot detection, and fix syntax errors (#1359) * Initial plan * Replace config variable checks with env() calls and add bot detection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor password reset rate limiting methods * Add translation for bot detection log and fix syntax errors from refactoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> * for versioning purposes * for versioning purposes * Create 040_1.6.4.sql * for versioning purposes * fix: remove libs that are deprecated (#1373) * fix: remove libs that are deprecated * Update resources/docker/php-fpm/Dockerfile Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Patrick Subang <patrick.subang@lightningfibre.co.uk> Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix email address verification to allow both comma and semicolon separators (#1375) * Allow both comma and semicolon to be valid seperators for $emails to be in sync with phpmail_send() function * fix condition check As mb_strpos could possibly return 0 (not false), replaced both mailer_helper.php and phpmailer_helper.php to use str_contains instead * fixes #1367 (#1368) * Bump qs from 6.14.0 to 6.14.1 (#1380) Bumps [qs](https://github.com/ljharb/qs) from 6.14.0 to 6.14.1. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Reduce QR code image width to 100px (#1377) * Add version checking, logging, and log sanitization for client_einvoicing fields to handle unmigrated databases (#1381) * Initial plan * Add defensive checks for client_einvoicing fields to handle unmigrated databases Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add version checking and extensive logging for einvoicing field access Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add null checks for version retrieval to prevent null concatenation in logs Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/clients/controllers/Clients.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Simplify redundant null coalescing in view.php by extracting to variable Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comment explaining defensive null coalescing pattern in view.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix potential null dereference in Mdl_versions::get_current_version() Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix incorrect property access in Mdl_versions::get_current_version() Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Security: Fix file access vulnerabilities across all controllers with reusable helper (#1383) * Initial plan * Fix critical security vulnerabilities in guest/Get.php file access Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix log injection vulnerabilities in security logging Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize hash calculation and strengthen path validation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix HTTP header injection vulnerability in Content-Disposition Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Strengthen header injection protection with comprehensive control character filtering Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Create reusable file security helper and apply to all file access points Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - improve string formatting and null handling Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - improve path traversal detection and header sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix code review issues - remove redundant checks and security bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Potential fix for code scanning alert no. 3: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 4: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 1: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 2: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Róbert Kelčák <kelcakrobo@gmail.com> Co-authored-by: naui95 <nahuel.guidotti@outlook.com> Co-authored-by: Marc Heiduk <marc@heiduk.me> Co-authored-by: John Mclaren <john@johnscs.com> Co-authored-by: Janek <github@melonion.me> Co-authored-by: Niklas <niklas.schmitt@mailbox.org> Co-authored-by: stephan4p <stephan@vierpunkt.de> Co-authored-by: VeRony <30659226+Verony-makesIT@users.noreply.github.com> Co-authored-by: pumpi <sf@pumpi-online.de> Co-authored-by: = <=> Co-authored-by: der-peer <post@peeruhlmann.de> Co-authored-by: naui95 <naui95@hotmail.com> Co-authored-by: Nathan Mattes <hallo@bullenscheisse.de> Co-authored-by: Kevin Joudrier <kev.joudrier@gmail.com> Co-authored-by: Gabe Dunn <gabe@gabedunn.dev> Co-authored-by: VizardAlpha <43859764+VizardAlpha@users.noreply.github.com> Co-authored-by: Thomas Ingles <thomas@sudwebdesign.fr> Co-authored-by: AutiCodes <prive@auticodes.nl> Co-authored-by: AeroBytes <31496522+AeroBytesNL@users.noreply.github.com> Co-authored-by: Ioannis Dressos <96877388+idressos@users.noreply.github.com> Co-authored-by: Torsten Stöter <torsten.stoeter@lin-magdeburg.de> Co-authored-by: Lars-Olof Kreim <mail@lok-soft.de> Co-authored-by: Kristian Stöckel <git@k118.de> Co-authored-by: Jonas Heinrich <onny@project-insanity.org> Co-authored-by: Niels Drost <nielsdrost7+github@gmail.com> Co-authored-by: ErikKrause <erik.krause@gmx.de> Co-authored-by: naui95 <naui95@users.noreply.github.com> Co-authored-by: Drew Angell <64537522+drewangell@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: PatrickGTR <patricksubang@live.com> Co-authored-by: Patrick Subang <patrick.subang@lightningfibre.co.uk> Co-authored-by: LaoDC <github@laodc.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * to older version for 1.6.5 purposes * to older version for 1.6.5 purposes * [WIP] Fix path traversal vulnerability in get_file method (#1459) * Initial plan * Fix incomplete validate_template_name function in template_helper.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve log injection prevention in validate_template_name Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Potential fix for code scanning alert no. 18: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * Implement template name validation function Added a validate_template_name function to check if a template name is valid based on type and scope. * Add HTML encoder for safe email template sanitization Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

Temporary Commit Fix Niels - 3 - Guest Get File

d80ae52

nielsdrost7 requested a review from Copilot September 5, 2025 05:32

This comment was marked as outdated.

Sign in to view

Apply suggestions from code review

1dbdbc3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

nielsdrost7 requested a review from Copilot September 5, 2025 05:40

This comment was marked as outdated.

Sign in to view

Suggestions after code-review

1212a2b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

nielsdrost7 requested a review from Copilot September 5, 2025 09:01

This comment was marked as outdated.

Sign in to view

using strpos as per suggestion in code-review

5924d8f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

nielsdrost7 commented Sep 7, 2025

View reviewed changes

Comment thread application/modules/guest/controllers/Get.php

Final fixes for the Get file problem refs #1324

1b5d7a7

nielsdrost7 requested a review from naui95 September 7, 2025 05:34

Get file (guest) fix refs #1324

7094e50

nielsdrost7 requested a review from Copilot September 7, 2025 06:15

Copilot AI reviewed Sep 7, 2025

View reviewed changes

Comment thread application/modules/guest/controllers/Get.php Outdated

Comment thread application/modules/guest/controllers/Get.php

naui95 added this to the 1.6.4 milestone Sep 7, 2025

nielsdrost7 requested a review from Copilot October 5, 2025 11:57

Copilot AI reviewed Oct 5, 2025

View reviewed changes

Comment thread application/modules/guest/controllers/Get.php Outdated

Update application/modules/guest/controllers/Get.php

921225a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

nielsdrost7 requested a review from Copilot October 5, 2025 12:00

Copilot AI reviewed Oct 5, 2025

View reviewed changes

coderabbitai bot reviewed Oct 5, 2025

View reviewed changes

nielsdrost7 closed this Nov 26, 2025

nielsdrost7 deleted the fix/niels-3-guest-get-file branch January 20, 2026 08:47

	header('Content-Disposition: attachment; filename="' . $safeFilename . '"');
	header('Content-Disposition: attachment; filename="' . addcslashes($safeFilename, '"\\') . '"');

Conversation

nielsdrost7 commented Aug 21, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

coderabbitai bot commented Oct 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 5, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 5, 2025

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

nielsdrost7 commented Oct 12, 2025

Uh oh!

coderabbitai bot commented Oct 12, 2025

Uh oh!

nielsdrost7 commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nielsdrost7 commented Aug 21, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Oct 5, 2025 •

edited

Loading