Version 1.7.0 into develop branch: PHP 8.2+ compatibility#1366
Closed
nielsdrost7 wants to merge 93 commits intodevelopfrom
Closed
Version 1.7.0 into develop branch: PHP 8.2+ compatibility#1366nielsdrost7 wants to merge 93 commits intodevelopfrom
nielsdrost7 wants to merge 93 commits intodevelopfrom
Conversation
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…nvoicePlane into fix/niels-1-sales-by-year
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…utton' into prep/v164
* Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
…rs and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| function sanitize_email_template_html(html) { | ||
| // Create a temporary DOM element to parse the HTML | ||
| var temp = document.createElement('div'); | ||
| temp.innerHTML = html; |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
In general, the problem is that untrusted data is being parsed as HTML via innerHTML in the same browsing context; if any scripts or event handlers run during parsing, or if the sanitizer is incomplete, XSS is possible. To fix this, we should ensure that parsing the untrusted HTML cannot execute script, and that all dangerous nodes/attributes are removed before returning any HTML that will later be rendered. The best way, without changing functionality, is to keep the sanitizer but change how we build the DOM for cleaning: instead of using temp.innerHTML = html directly in the main document, we can parse into an inert container such as an HTML <template> element (whose .content never executes scripts), then sanitize its content and serialize it back.
Concretely in assets/core/js/scripts.js inside sanitize_email_template_html:
- Replace
var temp = document.createElement('div'); temp.innerHTML = html;with a safer setup:- Create a
<template>element. - Set
template.innerHTML = html;. - Work on
template.contentinstead of the live DOM. - Wrap the content into a separate
<div>container used only for sanitization and serialization.
- Create a
- Keep the existing
allowedTags,allowedAttrs, andcleanNodelogic, but make sure we pass the correct root for cleaning (the new container that holds the cloned nodes fromtemplate.content) and only operate on that. - Finally, return
container.innerHTMLinstead oftemp.innerHTML.
This keeps the public API (sanitize_email_template_html(html) returning sanitized HTML) unchanged and continues to support the email template preview, but ensures that tainted HTML is never interpreted in a way that could execute scripts in the main document during parsing.
Suggested changeset
1
assets/core/js/scripts.js
| @@ -76,9 +76,12 @@ | ||
| // Sanitize HTML for email template preview | ||
| // Allows only safe formatting tags and strips scripts, event handlers, and dangerous attributes | ||
| function sanitize_email_template_html(html) { | ||
| // Create a temporary DOM element to parse the HTML | ||
| // Parse HTML in an inert context to avoid executing scripts during parsing | ||
| var template = document.createElement('template'); | ||
| template.innerHTML = html || ''; | ||
| // Use a detached container to run the sanitizer on the parsed nodes | ||
| var temp = document.createElement('div'); | ||
| temp.innerHTML = html; | ||
| temp.appendChild(template.content.cloneNode(true)); | ||
|
|
||
| // List of allowed tags (only safe formatting tags) | ||
| var allowedTags = ['b', 'strong', 'em', 'i', 'p', 'br', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', | ||
| @@ -147,7 +149,7 @@ | ||
| }); | ||
| } | ||
|
|
||
| // Clean all child nodes | ||
| // Clean all child nodes in the detached container | ||
| Array.from(temp.childNodes).forEach(function(child) { | ||
| if (child.nodeType === 1) { | ||
| cleanNode(child); |
Copilot is powered by AI and may make mistakes. Always verify output.
…1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Remove pull_request trigger from frontend test workflow.
Remove pull_request trigger from PHP testing workflow
…as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ction vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
* Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| <!-- In views --> | ||
| <h1><?php echo html_escape($invoice_number); ?></h1> | ||
| <div><?php echo html_escape($client_name); ?></div> | ||
| <textarea><?php echo html_escape($notes); ?></textarea> |
There was a problem hiding this comment.
Looks like this element is missing an accessible name or label. That makes it hard for people using screen readers or voice control to use the control.
| <a href="<?php echo $base_url . '/' . $query_param; ?>">Link</a> | ||
|
|
||
| // HTML attribute context | ||
| <input type="text" value="<?php echo html_escape($value); ?>"> |
There was a problem hiding this comment.
Looks like this element is missing an accessible name or label. That makes it hard for people using screen readers or voice control to use the control.
…ed (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| | Payload | Encoded Output | Result | | ||
| |---------|----------------|--------| | ||
| | `<script>alert("XSS")</script>` | `<script>alert("XSS")</script>` | ✅ Safe | | ||
| | `<img src=x onerror=alert(1)>` | `<img src=x onerror=alert(1)>` | ✅ Safe | |
There was a problem hiding this comment.
This image is missing a text alternative. This is a problem for people using screen readers.
| | Payload | Result | | ||
| |---------|--------| | ||
| | `<script>alert("XSS")</script>` | Encoded to `<script>alert("XSS")</script>` ✅ | | ||
| | `<img src=x onerror=alert("XSS")>` | Encoded to `<img src=x onerror=alert("XSS")>` ✅ | |
There was a problem hiding this comment.
This image is missing a text alternative. This is a problem for people using screen readers.
| <!-- In views --> | ||
| <h1><?php echo html_escape($invoice_number); ?></h1> | ||
| <div><?php echo html_escape($client_name); ?></div> | ||
| <textarea><?php echo html_escape($notes); ?></textarea> |
There was a problem hiding this comment.
Looks like this element is missing an accessible name or label. That makes it hard for people using screen readers or voice control to use the control.
| <a href="<?php echo $base_url . '/' . $query_param; ?>">Link</a> | ||
|
|
||
| // HTML attribute context | ||
| <input type="text" value="<?php echo html_escape($value); ?>"> |
There was a problem hiding this comment.
Looks like this element is missing an accessible name or label. That makes it hard for people using screen readers or voice control to use the control.
* Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| | Payload | Encoded Output | Result | | ||
| |---------|----------------|--------| | ||
| | `<script>alert("XSS")</script>` | `<script>alert("XSS")</script>` | ✅ Safe | | ||
| | `<img src=x onerror=alert(1)>` | `<img src=x onerror=alert(1)>` | ✅ Safe | |
There was a problem hiding this comment.
This image is missing a text alternative. This is a problem for people using screen readers.
| | Payload | Result | | ||
| |---------|--------| | ||
| | `<script>alert("XSS")</script>` | Encoded to `<script>alert("XSS")</script>` ✅ | | ||
| | `<img src=x onerror=alert("XSS")>` | Encoded to `<img src=x onerror=alert("XSS")>` ✅ | |
There was a problem hiding this comment.
This image is missing a text alternative. This is a problem for people using screen readers.
| | Payload | Encoded Output | Result | | ||
| |---------|----------------|--------| | ||
| | `<script>alert("XSS")</script>` | `<script>alert("XSS")</script>` | ✅ Safe | | ||
| | `<img src=x onerror=alert(1)>` | `<img src=x onerror=alert(1)>` | ✅ Safe | |
There was a problem hiding this comment.
This image is missing a text alternative. This is a problem for people using screen readers.
| <!-- In views --> | ||
| <h1><?php echo html_escape($invoice_number); ?></h1> | ||
| <div><?php echo html_escape($client_name); ?></div> | ||
| <textarea><?php echo html_escape($notes); ?></textarea> |
There was a problem hiding this comment.
Looks like this element is missing an accessible name or label. That makes it hard for people using screen readers or voice control to use the control.
| **Result:** ✅ XSS payload is displayed as text, not executed | ||
|
|
||
| ### PoC Attack Scenario 3: Invoice Number (Payment Form) | ||
| 1. Create an invoice with malicious number `<img src=x onerror=alert(1)>` |
There was a problem hiding this comment.
This image is missing a text alternative. This is a problem for people using screen readers.
| <a href="<?php echo $base_url . '/' . $query_param; ?>">Link</a> | ||
|
|
||
| // HTML attribute context | ||
| <input type="text" value="<?php echo html_escape($value); ?>"> |
There was a problem hiding this comment.
Looks like this element is missing an accessible name or label. That makes it hard for people using screen readers or voice control to use the control.
Comment out password fields from bypass list.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
…1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
…e security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| return ''; | ||
| } | ||
|
|
||
| return '<img src="' . base_url() . 'uploads/' . $logo_file . '">'; |
There was a problem hiding this comment.
WCAG 1.1.1: Image element missing alt attribute.
Images must have alternate text. Add an alt attribute to elements. Decorative images may use an empty alt attribute (alt=""), role='none', or role='presentation'.
Also on line 55.
| } | ||
|
|
||
| return '<img src="' . $absolutePath . '/uploads/' . $CI->mdl_settings->setting('invoice_logo') . '" id="invoice-logo">'; | ||
| return '<img src="' . $absolutePath . '/uploads/' . $logo_file . '" id="invoice-logo">'; |
There was a problem hiding this comment.
WCAG 1.1.1: Image element missing alt attribute.
* Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| return ''; | ||
| } | ||
|
|
||
| return '<img src="' . base_url() . 'uploads/' . $logo_file . '">'; |
There was a problem hiding this comment.
WCAG 1.1.1: Image element missing alt attribute.
Images must have alternate text. Add an alt attribute to elements. Decorative images may use an empty alt attribute (alt=""), role='none', or role='presentation'.
Also on line 55.
| } | ||
|
|
||
| return '<img src="' . $absolutePath . '/uploads/' . $CI->mdl_settings->setting('invoice_logo') . '" id="invoice-logo">'; | ||
| return '<img src="' . $absolutePath . '/uploads/' . $logo_file . '" id="invoice-logo">'; |
There was a problem hiding this comment.
WCAG 1.1.1: Image element missing alt attribute.
* Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>
| return ''; | ||
| } | ||
|
|
||
| return '<img src="' . base_url() . 'uploads/' . $logo_file . '">'; |
There was a problem hiding this comment.
WCAG 1.1.1: Image element missing alt attribute.
Images must have alternate text. Add an alt attribute to elements. Decorative images may use an empty alt attribute (alt=""), role='none', or role='presentation'.
Also on line 55.
| } | ||
|
|
||
| return '<img src="' . $absolutePath . '/uploads/' . $CI->mdl_settings->setting('invoice_logo') . '" id="invoice-logo">'; | ||
| return '<img src="' . $absolutePath . '/uploads/' . $logo_file . '" id="invoice-logo">'; |
There was a problem hiding this comment.
WCAG 1.1.1: Image element missing alt attribute.
nielsdrost7
added a commit
that referenced
this pull request
Feb 16, 2026
* Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
nielsdrost7
added a commit
that referenced
this pull request
Feb 16, 2026
* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * to older version for 1.6.5 purposes * to older version for 1.6.5 purposes * [WIP] Fix path traversal vulnerability in get_file method (#1459) * Initial plan * Fix incomplete validate_template_name function in template_helper.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve log injection prevention in validate_template_name Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Potential fix for code scanning alert no. 18: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
nielsdrost7
added a commit
that referenced
this pull request
Feb 16, 2026
* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * Implement template name validation function Added a validate_template_name function to check if a template name is valid based on type and scope. * Add HTML encoder for safe email template sanitization Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
addresses #1242
addresses #1223
addresses #1205
addresses #1180
addresses #1063
addresses #1009
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes
Improvements
✏️ Tip: You can customize this high-level summary in your review settings.