Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 by Copilot · Pull Request #1433 · InvoicePlane/InvoicePlane

Copilot · 2026-02-02T22:22:05Z

Fix Local File Inclusion (LFI) Vulnerability in InvoicePlane 1.7.0

Plan

Summary

This PR fixes 8 critical Local File Inclusion (LFI) vulnerabilities (CVSS 9.1, CWE-98) in InvoicePlane 1.7.0 where template settings and URL parameters could be exploited to include arbitrary PHP files from the filesystem, potentially leading to Remote Code Execution.

Vulnerabilities Fixed

Original Vulnerabilities (2)

Public invoice template - application/modules/guest/controllers/View.php invoice() method
Public quote template - application/modules/guest/controllers/View.php quote() method

Additional Vulnerabilities Discovered (6)

Guest invoice PDF - application/modules/guest/controllers/View.php generate_invoice_pdf()
Guest quote PDF - application/modules/guest/controllers/View.php generate_quote_pdf()
Guest invoices PDF - application/modules/guest/controllers/Invoices.php generate_pdf()
Guest quotes PDF - application/modules/guest/controllers/Quotes.php generate_pdf()
Admin invoices PDF - application/modules/invoices/controllers/Invoices.php generate_pdf()
Admin quotes PDF - application/modules/quotes/controllers/Quotes.php generate_pdf()

Changes Made

Added validation functions in application/helpers/template_helper.php:
- validate_template_name() - Core validation with whitelist checking
- validate_pdf_template() - PDF-specific validation with defaults
Enhanced existing functions:
- select_pdf_invoice_template() - Now validates settings before use
- generate_invoice_pdf() - Now validates ALL template parameters (settings and URL)
- generate_quote_pdf() - Now validates ALL template parameters (settings and URL)
Updated 5 controllers to validate PDF template parameters:
- Guest View controller (public and PDF generation)
- Guest Invoices controller
- Guest Quotes controller
- Admin Invoices controller
- Admin Quotes controller
Fixed code review issues:
- Added missing template helper load in quote() method
- Moved validation outside conditional blocks to ensure all parameters are validated
- Enhanced validation to cover both settings and URL parameter sources
- Re-applied invoice_template validation to match quote_template security pattern

Security Controls Implemented

✓ Empty input rejection
✓ Path traversal prevention (../, /, , \0)
✓ Character whitelist validation
✓ Template whitelist validation
✓ Secure default fallback
✓ Comprehensive security logging
✓ URL parameter validation
✓ Database setting validation
✓ All template sources validated (no bypass paths)
✓ Consistent security pattern for both invoice and quote templates

Testing

✓ All unit tests pass (9/9)
✓ All integration tests pass (7/7)
✓ No PHP syntax errors
✓ Code review completed and feedback addressed
✓ No new vulnerabilities introduced

All 8 LFI Vulnerabilities: FIXED ✓

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Summary by CodeRabbit

Bug Fixes
- Improved validation of template selections for invoices and quotes with automatic fallback to safe defaults when invalid templates are detected.
- Added error logging for invalid template configurations to assist with troubleshooting.

Removed item discount display from invoice template.

nielsdrost7

@copilot

Make 1 PR per vulnerability

Security Vulnerability Report: InvoicePlane 1.7.0Remote Code Execution via Local File Inclusion + Log PoisoningReport Date: January 31, 2026Product: InvoicePlaneAffected Version: 1.7.0 (and likely prior versions)Severity: Critical (CVSS 3.1: 9.1)CWE IDs: CWE-98 (LFI), CWE-117 (Log Injection), CWE-94 (Code Injection)Executive SummaryA critical vulnerability chain was discovered in InvoicePlane 1.7.0 that allows an authenticated administratorto achieve Remote Code Execution (RCE) on the underlying server. The attack combines two vulnerabilities:1. Local File Inclusion (LFI) - The public invoice template setting accepts arbitrary file paths withoutvalidation, allowing inclusion of files outside the intended template directory.2. Log Poisoning - User-controlled input (upload filename) is written to application log files withoutsanitization, allowing injection of malicious PHP code.When chained together, these vulnerabilities allow complete server compromise with the privileges of the webserver user.Vulnerability DetailsVulnerability 1: Local File Inclusion (LFI)Attribute ValueLocation application/modules/guest/controllers/View.phpAffected Lines 85, 191Parameter public_invoice_template (database setting)CWE CWE-98: Improper Control of Filename for Include/Require StatementVulnerable Code// Line 85$this->load->view('invoice_templates/public/' .get_setting('public_invoice_template') . '.php', $data);// Line 191$this->load->view('quote_templates/public/' .get_setting('public_quote_template') . '.php', $data);/SECURITYREPORT.md _2026-01-31DescriptionThe public_invoice_template and public_quote_template settings are retrieved from thedatabase and directly concatenated into file paths for PHP's include() function (via CodeIgniter's viewloader). There is no validation to ensure:The path does not contain directory traversal sequences (../)The path points to an existing, legitimate template fileThe path remains within the intended template directoryAn administrator can modify these settings via the Settings page to include arbitrary PHP files from anywhereon the filesystem (within the .php extension constraint).Vulnerability 2: Log Poisoning via Upload FilenameAttribute ValueLocation application/modules/upload/controllers/Upload.phpAffected Lines 178-184Parameter Upload filename (HTTP multipart form data)CWE CWE-117: Improper Output Neutralization for LogsVulnerable Codeprivate function sanitize_file_name(string $filename): string{ if (str_contains($filename, '..')|| str_contains($filename, '/')|| str_contains($filename, '')|| str_contains($filename, "\0")) {log_message('error', 'Path traversal attempt detected in filename:' . $filename); }return '';}// ...DescriptionWhen a file upload contains path traversal characters (..), the application logs the entire filename withoutany sanitization. Since:1. The attacker controls the filename via HTTP request2. The filename is written directly to the log file3. Log files in CodeIgniter use .php extension (log-YYYY-MM-DD.php)/SECURITYREPORT.md _4. Log files contain a BASEPATH check that passes when included via CodeIgniterAn attacker can inject arbitrary PHP code into the log file by including PHP tags in the filename.2026-01-31Attack ChainPrerequisitesRequirement Access LevelLog Poisoning Authenticated user (any role with upload access)LFI Exploitation Administrator accountRCE Trigger Unauthenticated (public invoice URL)Step-by-Step ExploitationStep 1: Log PoisoningInject PHP code into log file via malicious upload filename:POST /index.php/upload/upload_file/1/testkey HTTP/1.1Host: target.comCookie: ip_session=<session_cookie>Content-Type: multipart/form-data; boundary=----Boundary------BoundaryContent-Disposition: form-data; name="file"; filename="...jpg"Content-Type: image/jpeg------Boundary--Result in log file:ERROR - 2026-01-30 22:30:00 --> Path traversal attempt detected infilename: ...jpgStep 2: Configure LFIModify the template setting to point to the log file:POST /index.php/settings HTTP/1.1Host: target.comCookie: ip_session=<admin_session>/SECURITYREPORT.md _Content-Type: multipart/form-data; boundary=----Boundary2026-01-31------BoundaryContent-Disposition: form-data; name="settings[public_invoice_template]"../../../logs/log-2026-01-30------Boundary--Step 3: Trigger RCEAccess any public invoice URL with command parameter:GET /index.php/guest/view/invoice/<invoice_url_key>?1=id HTTP/1.1Host: target.comResponse contains command output:uid=1000(www-data) gid=1000(www-data) groups=1000(www-data)Proof of ConceptPath Traversal PayloadThe following payload was used in the public_invoice_template setting to include the log file:../../../logs/log-2026-01-30This traverses from application/views/invoice_templates/public/ to application/logs/ andincludes the poisoned log file (CodeIgniter automatically appends .php).Log File After PoisoningERROR - 2026-01-30 22:30:00 --> Path traversal attempt detected infilename: ...jpgCommand Execution EvidenceRequest:/SECURITYREPORT.md _2026-01-31GET /index.php/guest/view/invoice/hmG0nJe6yADPolQNXzR1kLbuqYOKsZB7?1=idResponse (in page source):Path traversal attempt detected in filename: ..uid=1000(www-data)gid=1000(www-data) groups=1000(www-data)ScreenshotsFigure 1: Modifying the public_invoice_template setting via Burp Suite (in /settings endpoint) toinclude a path traversal payload pointing to the application log file./SECURITYREPORT.md _2026-01-31Figure 2: Navigating to the invoice attachment upload functionality to initiate log poisoning.Figure 3: Injecting PHP code via the filename parameter. The malicious filename ...jpg triggers path traversal detection and is written to the log file./SECURITYREPORT.md _2026-01-31Figure 4: The application log file showing the injected PHP payload written to the log entry.Figure 5: Achieving Remote Code Execution by visiting the public invoice URL with the ?1=id parameter,demonstrating arbitrary command execution.Figure 6: Establishing a reverse shell connection, confirming full system compromise.Impact AssessmentConfidentiality Impact: HIGHFull read access to all files accessible by web server userDatabase credentials exposureCustomer data exposure (invoices, client information, payment details)/SECURITYREPORT.md _Integrity Impact: HIGHArbitrary file write capabilityDatabase modificationWeb shell installationWebsite defacementAvailability Impact: HIGHDenial of service through file deletionRansomware deploymentSystem destructionBusiness ImpactComplete compromise of financial dataRegulatory violations (GDPR, PCI-DSS if payment data involved)Reputational damageLegal liability2026-01-31Affected ComponentsFile Vulnerabilityapplication/modules/guest/controllers/View.php:85 LFI - Invoice templateapplication/modules/guest/controllers/View.php:191 LFI - Quote templateapplication/modules/upload/controllers/Upload.php:182 Log Poisoningapplication/modules/settings/controllers/Settings.phpNo validation on templatesettingCVSS 3.1 Score CalculationMetric Value JustificationAttack Vector Network Exploitable over HTTPAttack Complexity Low No special conditions requiredPrivileges Required High Admin access needed for LFIUser Interaction None No victim interaction neededScope Changed Escapes web application to compromise underlying OSConfidentiality High Full file system accessIntegrity High Arbitrary code executionAvailability High Complete system compromise possible/SECURITYREPORT.md _2026-01-31CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Score: 9.1 (Critical)TimelineDate Action2026-01-30 Vulnerability discovered2026-01-31 Proof of concept developed2026-01-31 Vendor notified2026-XX-XX Vendor acknowledgment2026-XX-XX Patch released2026-XX-XX Public disclosureReferencesCWE-98: Improper Control of Filename for Include/Require StatementCWE-117: Improper Output Neutralization for LogsCWE-94: Improper Control of Generation of CodeOWASP: Log InjectionOWASP: Path TraversalCreditsD

Copilot · 2026-02-03T03:48:53Z

@copilot

Make 1 PR per vulnerability
...

Understood. I'll focus this PR on fixing the Local File Inclusion (LFI) vulnerability only. I'll address the template path validation in View.php (lines 86 and 192) to prevent arbitrary file inclusion. The Log Poisoning vulnerability should be addressed in a separate PR.

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

nielsdrost7

@copilot see if there are other Local File Inclusion Vulnerabilities in the InvoicePlane codebase

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot · 2026-02-03T04:20:11Z

@copilot see if there are other Local File Inclusion Vulnerabilities in the InvoicePlane codebase

I found and fixed 6 additional LFI vulnerabilities in the codebase (commit 5949a6c):

PDF Template URL Parameters (6 vulnerable endpoints):

Guest View controller: generate_invoice_pdf() and generate_quote_pdf() - accept template names from URL
Guest Invoices/Quotes controllers: generate_pdf() - accept template names from URL
Admin Invoices/Quotes controllers: generate_pdf() - accept template names from URL

PDF Template Settings (2 vulnerable functions):

select_pdf_invoice_template() - used unvalidated settings
generate_quote_pdf() - used unvalidated settings

All vulnerabilities have been fixed with:

New validate_pdf_template() function for PDF-specific validation
Validation added to all 6 controllers
Settings validation in helper functions
Secure fallback to default templates

The original 2 vulnerabilities plus these 6 new ones = 8 total LFI vulnerabilities fixed in this PR.

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

nielsdrost7 · 2026-02-03T04:23:48Z

@coderabbitai full review

coderabbitai · 2026-02-03T04:23:55Z

✅ Actions performed

Full review triggered.

coderabbitai · 2026-02-03T04:24:04Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

📝 Walkthrough

Walkthrough

This PR introduces input validation for PDF template names across the application to prevent Local File Inclusion vulnerabilities. New validation helper functions are added to template_helper.php, and multiple controllers and helpers are updated to validate template names before use, with fallback to safe defaults when validation fails.

Changes

Cohort / File(s)	Summary
Template Validation Helpers `application/helpers/template_helper.php`	Added `validate_template_name()` to sanitize and whitelist template names, and `validate_pdf_template()` to centralize PDF template validation with safe default fallback. Updated `select_pdf_invoice_template()` to validate templates before returning.
PDF Generation Helper `application/helpers/pdf_helper.php`	Updated `generate_quote_pdf()` to validate quote template names using the new validation helper and fall back to 'InvoicePlane' default on invalid input.
Guest Module Controllers `application/modules/guest/controllers/Invoices.php`, `application/modules/guest/controllers/Quotes.php`, `application/modules/guest/controllers/View.php`	Added template helper loading and validation checks for invoice/quote templates in PDF generation and view rendering paths. Invoices and Quotes validate templates conditionally when provided; View applies validation to both public invoice and quote templates with fallback defaults.
Authenticated Module Controllers `application/modules/invoices/controllers/Invoices.php`, `application/modules/quotes/controllers/Quotes.php`	Added template helper loading and conditional validation of invoice/quote templates before PDF generation to prevent unsafe template usage.

Sequence Diagram

sequenceDiagram
    participant Client as Client/Controller
    participant Helper as PDF/Template Helper
    participant Validator as Validation Logic
    participant FileSystem as File System
    participant Log as Error Log

    rect rgba(100, 150, 200, 0.5)
    Note over Client,Log: Before: Direct Template Usage (Vulnerable)
    Client->>Helper: generate_pdf(template)
    Helper->>FileSystem: load(template)
    FileSystem-->>Helper: file content
    Helper-->>Client: PDF
    end

    rect rgba(200, 100, 100, 0.5)
    Note over Client,Log: After: Validated Template with Fallback
    Client->>Helper: generate_pdf(template)
    Helper->>Validator: validate_pdf_template(template)
    alt Template Valid
        Validator-->>Helper: validated_template
    else Template Invalid
        Validator->>Log: log error
        Validator-->>Helper: safe_default (InvoicePlane)
    end
    Helper->>FileSystem: load(validated_template)
    FileSystem-->>Helper: file content
    Helper-->>Client: PDF
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Prep: v1.6.4 #1354: Both PRs add input-validation guards in the PDF generation path (pdf_helper.php) to prevent unsafe file includes—one validates PDF template names, the other validates e-invoice XML config IDs.

Suggested reviewers

naui95

Poem

🐰 Templates dancing, now with guards,
No more sneaking through the yards!
Validation chains keep files tight,
Whitelists defend with all their might.
Safe defaults hop when risks abound,
Security's footprints all around! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately describes the main change: fixing Local File Inclusion (LFI) vulnerabilities. It is specific, concise, and directly relates to the comprehensive security improvements implemented across the codebase.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nielsdrost7

@copilot could you make that PR for the Log Poisoning vulnerability?

Copilot · 2026-02-03T04:26:11Z

@copilot could you make that PR for the Log Poisoning vulnerability?

I cannot create new PRs or branches directly. However, I can help you fix the Log Poisoning vulnerability once you create a new branch for it.

The vulnerability is in application/modules/upload/controllers/Upload.php at lines 178-184 where filenames are logged without sanitization. The fix would involve:

Sanitizing log messages to prevent PHP code injection
Either hashing sensitive input before logging or escaping PHP tags
Updating the sanitize_file_name() method's logging to use safe output

Would you like me to create the fix on a new branch if you create one, or would you prefer detailed instructions for the fix?

Copilot

Pull request overview

This PR addresses 8 critical Local File Inclusion (LFI) vulnerabilities (CVSS 9.1, CWE-98) in InvoicePlane 1.7.0. The vulnerabilities existed where template settings and URL parameters could be exploited to include arbitrary PHP files from the filesystem.

Changes:

Added comprehensive validation functions (validate_template_name() and validate_pdf_template()) in template_helper.php with multiple security layers including path traversal prevention, character whitelisting, and template whitelisting
Updated 6 controller methods across guest and admin modules to validate PDF template parameters from URLs before use
Enhanced template selection function (select_pdf_invoice_template()) to validate templates retrieved from database settings
Added validation in pdf_helper.php for quote templates loaded from settings

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
application/helpers/template_helper.php	Added `validate_template_name()` and `validate_pdf_template()` functions with multi-layer security controls; enhanced `select_pdf_invoice_template()` to validate templates from settings
application/helpers/pdf_helper.php	Added validation for quote templates retrieved from settings in `generate_quote_pdf()`
application/modules/guest/controllers/View.php	Added validation for public invoice/quote templates and PDF generation from URL parameters
application/modules/guest/controllers/Invoices.php	Added validation for PDF template parameters in `generate_pdf()`
application/modules/guest/controllers/Quotes.php	Added validation for PDF template parameters in `generate_pdf()`
application/modules/invoices/controllers/Invoices.php	Added validation for PDF template parameters in admin `generate_pdf()`
application/modules/quotes/controllers/Quotes.php	Added validation for PDF template parameters in admin `generate_pdf()`

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

nielsdrost7

@copilot I think you repaired quote_template, but how about invoice_template, can you repair that as well?

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot · 2026-02-03T04:50:06Z

@copilot I think you repaired quote_template, but how about invoice_template, can you repair that as well?

Fixed in commit 80e3820. Added validation for invoice_template parameters in generate_invoice_pdf() to match the fix for quote_template. Now both functions validate templates from all sources (settings and URL parameters).

nielsdrost7

@copilot I think you repaired quote_template, but how about invoice_template, can you repair that as well?

- Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot · 2026-02-03T04:55:06Z

@copilot I think you repaired quote_template, but how about invoice_template, can you repair that as well?

Fixed in commit b31423b. Added validation for invoice_template parameters in generate_invoice_pdf() to match the security pattern used for quote_template. Now both invoice and quote templates are validated when passed as URL parameters, preventing LFI bypass.

* Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * to older version for 1.6.5 purposes * to older version for 1.6.5 purposes * [WIP] Fix path traversal vulnerability in get_file method (#1459) * Initial plan * Fix incomplete validate_template_name function in template_helper.php Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve log injection prevention in validate_template_name Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Potential fix for code scanning alert no. 18: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

* Temporary Commit Fix Niels - 1 - SalesByYear report * Fix Niels - 1 - SalesByYear * Temporary Commit Fix Niels - 3 - Guest Get File * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Suggestions after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * using strpos as per suggestion in code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * suggestion after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Final fixes for the Get file problem refs #1324 * suggestion after code-review * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * cleanup after code-review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Get file (guest) fix refs #1324 * 1340: Wrong quote/invoice guest download attachment button default template * 1348: More fixes for PDF footer * 1322: Show open invoices on guest index * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * 1340: guest route sanitization * Update application/modules/guest/controllers/Get.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update application/modules/reports/models/Mdl_reports.php Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * version 1.7.0: PHP 8.2+ compatibility * for versioning purposes * bumped composer dependencies * Rename application/modules/setup/041_1.7.0.sql to application/modules/setup/sql/041_1.7.0.sql * merged in development branch * packages update * ran pint l * fixed composer just a tiny bit * improved .gitignore * Potential fix for code scanning alert no. 9: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 6: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 7: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1387) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 10: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * more github actions * Update GitHub Actions workflow for PHPMyAdmin Removed specific branch and path triggers for pushes. * Update GitHub Actions workflow for Docker image Removed specific push triggers for branches and tags. * Modify GitHub Actions workflow triggers * Modify triggers for MariaDB Docker workflow Updated workflow triggers for Docker image build. * Update docker-publish.yml * Change trigger from pull_request to workflow_dispatch Updated workflow trigger to allow manual dispatch. * Change trigger for PHP testing workflow * Update PHP version in GitHub Actions workflow * Remove emojis from yarn-update workflow output * Potential fix for code scanning alert no. 11: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 12: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 13: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 14: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 15: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 5: Workflow does not contain permissions (#1389) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 5: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin (#1388) * fixed error Removed item discount display from invoice template. * Potential fix for code scanning alert no. 8: Unsafe jQuery plugin Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update .github/workflows/README.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Delete .github/workflows/quickstart.yml * [WIP] Fix inconsistent language files in English (#1423) * fixed error Removed item discount display from invoice template. * Initial plan * Update custom_lang.php documentation to match modern array syntax Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * Fix GitHub Actions workflow issues from code review (#1399) * Initial plan * Fix workflow issues based on code review feedback Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script regex and add clarifying comments Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add workflow artifacts to .gitignore Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve script comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Update .github/scripts/generate-package-update-report.cjs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Rename transientChanges to transitiveChanges * Fix vendor-cleaner config to use single extra.dev-files./ key Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * v170 in to v171 (#1439) * Fix XSS vulnerabilities across InvoicePlane with comprehensive security audit, defense-in-depth protection, SVG execution prevention, and security logging (#1429) * fixed error Removed item discount display from invoice template. * Initial plan * Fix XSS vulnerabilities in quote/invoice numbers and SVG logo uploads Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in all quote/invoice number displays Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add XSS escaping for tax_rate_name and payment_method_name fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in guest view headers for quote/invoice numbers Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix remaining XSS in templates/mailer and add backend input sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve input sanitization comments for clarity Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS in Sumex observations, client addresses, and custom field labels Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add backend XSS sanitization to Sumex fields and quote password/notes Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Block existing SVG logos from rendering to prevent XSS execution Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add SVG upload logging and README documentation for security change Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix log poisoning vulnerability in Upload controller (#1434) * Initial plan * Fix log poisoning vulnerability in Upload.php sanitize_file_name method Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 (#1433) * fixed error Removed item discount display from invoice template. * Initial plan * Add template validation to prevent LFI vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve logging in LFI fix for better security monitoring Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional LFI vulnerabilities in PDF generation endpoints Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - simplify default template logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add validation for invoice_template parameters in generate_invoice_pdf() - Validate invoice_template when passed as URL parameter - Mirror the same security pattern used for quote_template validation - Ensure all invoice template sources are validated before use - Prevent LFI vulnerability through invoice_template parameter bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Niels Drost <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix Stored XSS vulnerabilities with defense-in-depth: input sanitization and output encoding (#1435) * Initial plan * Fix three Stored XSS vulnerabilities by adding htmlsc() encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional unit_name XSS vulnerabilities in quotes and products modules Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in email template JavaScript context Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix filter_input() bug: Add input sanitization with logging and password bypass Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve filter_input: Add recursive array sanitization, remove double-encoding Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix sanitize_array: Add bypass support and consistent sanitization order Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add invoice_password and quote_password to sanitization bypass list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Optimize XSS logging: move ip_address and user_agent to request level Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix critical bugs from PR #1366 review: mb_rtrim, ClientTitleEnum, workflow triggers, email preview XSS (#1438) * Initial plan * Fix review comments: restore PR triggers, fix mb_rtrim usage, fix ClientTitleEnum, add translation, fix email preview Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add HTML sanitization to email template preview for defense-in-depth XSS protection Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve code review feedback: fix comment, use indexOf for compatibility, simplify ClientTitleEnum Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Enhance XSS protection: remove style tag support, validate href protocols Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Optimize sanitization: cache tagName, add style tag to explicit removal list Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix GitHub Actions workflow issues identified in PR #1366 review (#1437) * Initial plan * Fix GitHub Actions workflows per review feedback - composer-update.yml: Parse JSON advisories array instead of file size check - composer-update.yml: Check both composer.lock and composer.json for changes - release.yml: Update action-gh-release from v1 to v2 - release.yml: Fix vendor-cleaner config to use extra.dev-files structure - README.md: Update yarn-update.yml Update Types to match workflow options - Create generate-package-update-report.cjs script for yarn updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback - composer-update.yml: Use double-dash separator before file paths in git diff - generate-package-update-report.cjs: Handle quoted/unquoted yarn.lock entries separately Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix git diff logic and improve regex patterns - composer-update.yml: Restore correct git diff logic to detect changes in either file - generate-package-update-report.cjs: Use more restrictive regex patterns Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details (#1436) * Initial plan * Add comprehensive version 1.7.0 documentation to README and CHANGELOG Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix formatting and update version 1.7.0 details * Add complete release notes with issue numbers and field sanitization details, remove emoticons Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Track all resolved versions per package in yarn.lock update report (#1440) * Initial plan * Refactor package update report script to track all versions per package using Map<string, Set<string>> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Remove unnecessary Set creation in version comparison logic Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix bidirectional version change detection to catch all version updates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Potential fix for code scanning alert no. 16: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update test-frontend.yml to remove pull_request trigger Remove pull_request trigger from frontend test workflow. * Update PHP testing workflow triggers Remove pull_request trigger from PHP testing workflow * Potential fix for code scanning alert no. 17: DOM text reinterpreted as HTML Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Refactor input sanitization to follow DRY principles and fix log injection vulnerabilities (#1441) * Initial plan * Apply code review feedback: improve regex handling and log sanitization Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Refactor: Extract sanitize_for_logging helper to follow DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security and DRY development guidelines for InvoicePlane (#1442) * Initial plan * Add comprehensive guidelines and Copilot instructions for security and DRY principles Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive security and DRY analysis for PR #1441 Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Address code review feedback: improve documentation clarity and examples Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Document XSS mitigation in Family Name field - no code changes required (#1443) * Initial plan * Add comprehensive security audit documentation for XSS vulnerability Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add executive security summary for XSS vulnerability verification Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerability in payment form invoice_number display (#1445) * Initial plan * Fix XSS vulnerability in payment form invoice_number field Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add comprehensive XSS vulnerability documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Comment out invoice and quote password fields Comment out password fields from bypass list. * Update application/helpers/template_helper.php Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Address PR #1439 feedback: sanitization and validation improvements (#1446) * Initial plan * Address PR #1439 feedback: sanitization and validation improvements Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Improve security: use DOMParser for HTML sanitization and load file_security_helper Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS in credit invoice parent number display + comprehensive security audit (#1454) * Initial plan * Fix XSS vulnerability in parent invoice number display Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Add security documentation for Invoice Group XSS fix Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete SECURITY_AUDIT_XSS_INVOICE_GROUP.md * Delete SECURITY_SUMMARY.md * Add comprehensive XSS vulnerability audit documentation Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete COMPREHENSIVE_XSS_AUDIT.md * Delete SECURITY_AUDIT_XSS_UNIT_INVOICE.md * Delete SECURITY_AUDIT_XSS_FAMILY_NAME.md --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix stored XSS vulnerabilities in multiple views (19 total) (#1455) * Initial plan * Fix XSS vulnerability by adding HTML escaping to format_client() output Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix additional XSS vulnerabilities in client view and invoice templates Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix XSS vulnerabilities in VAT ID and tax code fields Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix PHP 8.3 undefined array key warning in mPDF footer handling (#1453) * Initial plan * Initial analysis - identify mpdf footer undefined array key issue Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Fix: Define html_footer to prevent PHP 8.3 undefined array key error Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> * Delete package-lock.json * Delete yarn.lock --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Updated Composer and Yarn Packages * Implement template name validation function Added a validate_template_name function to check if a template name is valid based on type and scope. * Add HTML encoder for safe email template sanitization Added a basic HTML encoder function to prevent DOM text from being reinterpreted as HTML meta-characters before sanitizing email template HTML. --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ordissimo <thierry@ordissimo.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

nielsdrost7 and others added 2 commits January 19, 2026 13:11

fixed error

3879f70

Removed item discount display from invoice template.

Initial plan

8511b42

Copilot AI assigned Copilot and nielsdrost7 Feb 2, 2026

Copilot AI requested a review from nielsdrost7 February 2, 2026 22:26

Copilot stopped work on behalf of nielsdrost7 due to an error February 2, 2026 22:26
The session was cancelled by the user.

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 03:48 View session

Copilot AI and others added 2 commits February 3, 2026 03:50

Add template validation to prevent LFI vulnerability

e84065b

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Improve logging in LFI fix for better security monitoring

25f435e

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix critical remote code execution in InvoicePlane 1.7.0~~ Fix Local File Inclusion (LFI) vulnerability in InvoicePlane 1.7.0 Feb 3, 2026

Copilot AI requested a review from nielsdrost7 February 3, 2026 03:55

Copilot finished work on behalf of nielsdrost7 February 3, 2026 03:55

nielsdrost7 changed the base branch from development to prep/v170 February 3, 2026 04:13

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 04:16 View session

nielsdrost7 marked this pull request as ready for review February 3, 2026 04:18

Fix additional LFI vulnerabilities in PDF generation endpoints

5949a6c

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

nielsdrost7 and others added 2 commits February 3, 2026 05:20

Merge branch 'prep/v170' into copilot/fix-invoiceplane-rce-vulnerability

534af76

Address code review feedback - simplify default template logic

6ba6fbb

Co-authored-by: nielsdrost7 <47660417+nielsdrost7@users.noreply.github.com>

Copilot AI changed the title ~~Fix Local File Inclusion (LFI) vulnerability in InvoicePlane 1.7.0~~ Fix Local File Inclusion (LFI) vulnerabilities in InvoicePlane 1.7.0 Feb 3, 2026

Copilot AI requested a review from nielsdrost7 February 3, 2026 04:22

Copilot finished work on behalf of nielsdrost7 February 3, 2026 04:22

InvoicePlane deleted a comment from coderabbitai bot Feb 3, 2026

nielsdrost7 marked this pull request as draft February 3, 2026 04:23

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 04:25 View session

Copilot AI requested a review from nielsdrost7 February 3, 2026 04:26

Copilot finished work on behalf of nielsdrost7 February 3, 2026 04:26

Copilot AI reviewed Feb 3, 2026

View reviewed changes

Comment thread application/modules/guest/controllers/View.php

Comment thread application/helpers/pdf_helper.php

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 04:48 View session

Apply suggestions from code review

4331e63

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI requested a review from nielsdrost7 February 3, 2026 04:50

nielsdrost7 requested changes Feb 3, 2026

View reviewed changes

Copilot started work on behalf of nielsdrost7 February 3, 2026 04:53 View session

Copilot AI requested a review from nielsdrost7 February 3, 2026 04:55

Copilot finished work on behalf of nielsdrost7 February 3, 2026 04:55

nielsdrost7 marked this pull request as ready for review February 3, 2026 05:03

nielsdrost7 merged commit 0f5b9ff into prep/v170 Feb 3, 2026
1 check passed

nielsdrost7 deleted the copilot/fix-invoiceplane-rce-vulnerability branch February 3, 2026 05:04

Copilot AI mentioned this pull request Feb 3, 2026

Add complete version 1.7.0 release documentation with all issue numbers and field sanitization details #1436

Merged

nielsdrost7 mentioned this pull request Feb 3, 2026

v170 in to v171 #1439

Merged

This was referenced Feb 16, 2026

Version 1.7.1 to develop #1463

Merged

develop to master #1464

Draft

coderabbitai bot mentioned this pull request Mar 5, 2026

Fix IDOR, CSRF, and SQL injection vulnerabilities in guest controllers #1482

Merged

coderabbitai bot mentioned this pull request Apr 6, 2026

Fix RCE vulnerability + additional security issues #1505

Merged

Conversation

Copilot AI commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fix Local File Inclusion (LFI) Vulnerability in InvoicePlane 1.7.0

Plan

Summary

Vulnerabilities Fixed

Original Vulnerabilities (2)

Additional Vulnerabilities Discovered (6)

Changes Made

Security Controls Implemented

Testing

Summary by CodeRabbit

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

nielsdrost7 commented Feb 3, 2026

Uh oh!

coderabbitai bot commented Feb 3, 2026

Uh oh!

coderabbitai bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

nielsdrost7 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Feb 2, 2026 •

edited

Loading

coderabbitai bot commented Feb 3, 2026 •

edited

Loading