application/modules/mailer/helpers/phpmailer_helper.php (1)

100-123: Harden recipient parsing and confirm PHP version for str_contains.

Common inputs like "a@b.com, b@c.com" or mixed delimiters can produce invalid addresses due to whitespace/semicolon leftovers. Also, str_contains requires PHP 8—please verify the minimum PHP version or use a delimiter-agnostic split.

💡 Suggested parsing (handles commas/semicolons + trims + skips empties)

-    $to = (str_contains($to, ',')) ? explode(',', $to) : explode(';', $to);
+    $to = preg_split('/\s*[;,]\s*/', $to, -1, PREG_SPLIT_NO_EMPTY);

...
-        $cc = (str_contains($cc, ',')) ? explode(',', $cc) : explode(';', $cc);
+        $cc = preg_split('/\s*[;,]\s*/', $cc, -1, PREG_SPLIT_NO_EMPTY);

...
-        $bcc = (str_contains($bcc, ',')) ? explode(',', $bcc) : explode(';', $bcc);
+        $bcc = preg_split('/\s*[;,]\s*/', $bcc, -1, PREG_SPLIT_NO_EMPTY);

resources/docker/php-fpm/Dockerfile (1)

28-28: Remove libonig-dev — it's not needed for the pre-built mbstring in php:8.1-fpm.

The base image php:8.1-fpm includes the mbstring extension pre-compiled and enabled by default. The libonig-dev package is only required when manually compiling mbstring from source, which is not the case here. Removing it will reduce the image size without impact.

application/helpers/pdf_helper.php (1)

129-137: Reduce duplicate XML ID validation calls.
is_valid_xml_config_id() is invoked twice and file_exists() is redundant. Caching the result improves readability and avoids duplicate checks.

♻️ Refactor suggestion

-        $path      = APPPATH . 'helpers/XMLconfigs/';
-        
-        // Security: Validate XML config ID to prevent path traversal
-        if ($xml_id && is_valid_xml_config_id($xml_id) && file_exists($path . $xml_id . '.php') && include $path . $xml_id . '.php') {
+        $path        = APPPATH . 'helpers/XMLconfigs/';
+        $xml_id_valid = $xml_id && is_valid_xml_config_id($xml_id);
+
+        // Security: Validate XML config ID to prevent path traversal
+        if ($xml_id_valid && include $path . $xml_id . '.php') {
             $embed_xml = $xml_setting['embedXML'];
             $XMLname   = $xml_setting['XMLname'];
             $options   = (empty($xml_setting['options']) ? $options : $xml_setting['options']); // Optional
             $generator = (empty($xml_setting['generator']) ? $generator : $xml_setting['generator']); // Optional
-        } elseif ($xml_id && !is_valid_xml_config_id($xml_id)) {
+        } elseif ($xml_id && ! $xml_id_valid) {
             log_message('error', trans('log_invalid_xml_config_id_pdf_helper') . ': ' . $xml_id);
         }

assets/core/css/paypal.css (1)

49-53: Deduplicate #card-spinner styles

There are two #card-spinner blocks; keeping just one avoids confusion and accidental overrides.

♻️ Suggested cleanup

-/* Spinner styling */
-#card-spinner {
-    display: none;
-    margin-left: 10px;
-}

Also applies to: 84-88

application/libraries/gateways/PaypalLib.php (1)

153-165: Avoid mb_str_split dependency unless guaranteed

mb_str_split requires ext‑mbstring. If that extension isn’t guaranteed in your deployment, this can fatal. Consider str_split or explicitly require mbstring.

♻️ Suggested change

-        $uuid = vsprintf('%s%s-%s-%s-%s-%s%s%s', mb_str_split(bin2hex($data), 4));
+        $uuid = vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));

application/modules/clients/controllers/Clients.php (1)

363-399: Avoid per-client version lookups & log spam when schema is unmigrated.

Line 363–399: When fields are missing, this runs for every client in list views. Consider caching the version and logging once per request to reduce DB calls and log noise.

♻️ Possible refactor (log/cache once per request)

-        if (!property_exists($client, 'client_einvoicing_active') || !property_exists($client, 'client_einvoicing_version')) {
-            // Fields don't exist - database hasn't been migrated to 1.6.3+
-            $this->load->model('settings/mdl_versions');
-            $current_version = $this->mdl_versions->get_current_version();
-            $current_version = $current_version ?: 'unknown';
-            $currentVersionForLog = $this->sanitize_for_log($current_version);
-
-            log_message('warning', '[eInvoicing] Database version mismatch detected in check_client_einvoice_active: Running source code 1.6.3+ with database version ' . $currentVersionForLog);
-            log_message('warning', '[eInvoicing] Missing fields: client_einvoicing_active and client_einvoicing_version not found in client object (client_id=' . $clientIdForLog . ')');
-            log_message('warning', '[eInvoicing] Please run database migration 039_1.6.3.sql to add these fields');
+        static $einvoiceSchemaChecked = false;
+        static $cachedVersion = null;
+        if (!property_exists($client, 'client_einvoicing_active') || !property_exists($client, 'client_einvoicing_version')) {
+            if (!$einvoiceSchemaChecked) {
+                $this->load->model('settings/mdl_versions');
+                $cachedVersion = $this->mdl_versions->get_current_version() ?: 'unknown';
+                $currentVersionForLog = $this->sanitize_for_log($cachedVersion);
+                log_message('warning', '[eInvoicing] Database version mismatch detected in check_client_einvoice_active: Running source code 1.6.3+ with database version ' . $currentVersionForLog);
+                log_message('warning', '[eInvoicing] Missing fields: client_einvoicing_active and client_einvoicing_version not found in client object (client_id=' . $clientIdForLog . ')');
+                log_message('warning', '[eInvoicing] Please run database migration 039_1.6.3.sql to add these fields');
+                $einvoiceSchemaChecked = true;
+            }

application/modules/clients/views/view.php (1)

309-313: Consider a fallback if get_xml_full_name() returns null.

Line 309–313: If the XML config is invalid/missing, get_xml_full_name() returns null and the UI shows a blank value. Prefer a clear fallback (e.g., “none”) for consistency.

♻️ Possible tweak

-        echo (($client->client_einvoicing_active ?? 0) && $einvoicing_version) ? get_xml_full_name($einvoicing_version) : trans('none'); 
+        echo (($client->client_einvoicing_active ?? 0) && $einvoicing_version)
+            ? (get_xml_full_name($einvoicing_version) ?: trans('none'))
+            : trans('none');

application/modules/guest/controllers/Payment_information.php (1)

124-128: Normalize venmo flag to boolean for consistency.

Line 124–128: advanced_credit_cards is a boolean but venmo is passed as raw setting value. Casting avoids strict-check surprises in the view/JS.

♻️ Suggested change

-            'venmo'                 => get_setting('gateway_paypal_venmo'),
+            'venmo'                 => (int) get_setting('gateway_paypal_venmo') === 1,

assets/core/js/paypal.js (1)

213-226: Consider adding response validation before parsing JSON.

The fetch calls assume the response is always valid JSON. If the server returns an error page or non-JSON response, response.json() will throw, but the error won't be user-friendly.

Proposed improvement

 createOrder() {
-    return fetch(config.createOrderUrl, { method: "GET" })
-        .then(response => response.json())
-        .then(order => order.id);
+    return fetch(config.createOrderUrl, { method: "GET" })
+        .then(response => {
+            if (!response.ok) {
+                throw new Error('Failed to create order: HTTP ' + response.status);
+            }
+            return response.json();
+        })
+        .then(order => {
+            if (!order || !order.id) {
+                throw new Error('Invalid order response');
+            }
+            return order.id;
+        });
 },

application/modules/upload/controllers/Upload.php (2)

178-184: Redundant checks after basename() and potential log injection.

After basename() on line 175, the filename cannot contain / or \\ by definition. More importantly, line 182 logs the raw $filename after basename(), which could still contain malicious content for log injection (e.g., newlines aren't stripped by basename).

Proposed fix using hash_for_logging

         // Security: Check for path traversal attempts before sanitization
         if (str_contains($filename, '..') || 
             str_contains($filename, '/') || 
             str_contains($filename, '\\') ||
             str_contains($filename, "\0")) {
-            log_message('error', 'Path traversal attempt detected in filename: ' . $filename);
+            log_message('error', 'Path traversal attempt detected in filename (hash: ' . hash_for_logging($filename) . ')');
             return '';
         }

---

54-60: MIME validation silently skipped without fileinfo extension.

When the fileinfo extension isn't loaded, MIME type validation is silently skipped. This could allow bypassing content-type restrictions. Consider logging a warning or requiring the extension.

Proposed improvement

-        if (extension_loaded('fileinfo')) {
-            $this->validate_mime_type(mime_content_type($tempFile));
-        }
+        if (extension_loaded('fileinfo')) {
+            $this->validate_mime_type(mime_content_type($tempFile));
+        } else {
+            log_message('warning', 'fileinfo extension not loaded - MIME validation skipped');
+        }